Post Process

Everything to do with E-discovery & ESI

Archive for September 26th, 2007

Case Blurb: Zubulake I, A Hierarchy of Accessibility based on storage media

Posted by rjbiii on September 26, 2007

Many courts have automatically assumed that an undue burden or expense may arise simply because electronic evidence is involved. This makes no sense. Electronic evidence is frequently cheaper and easier to produce than paper evidence because it can be searched automatically, key words can be run for privilege checks, and the production can be made in electronic form obviating the need for mass photocopying. Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 318 (S.D.N.Y. 2003).

In fact, whether production of documents is unduly burdensome or expensive turns primarily on whether it is kept in an accessible or inaccessible format (a distinction that corresponds closely to the expense of production). In the world of paper documents, for example, a document is accessible if it is readily available in a usable format and reasonably indexed. Examples of inaccessible paper documents could include (a) documents in storage in a difficult to reach place; (b) documents converted to microfiche and not easily readable; or (c) documents kept haphazardly, with no indexing system, in quantities that make page-by-page searches impracticable. But in the world of electronic data, thanks to search engines, any data that is retained in a machine readable format is typically accessible. Id. (citations omitted).

Whether electronic data is accessible or inaccessible turns largely on the media on which it is stored. Five categories of data, listed in order from most accessible to least accessible, are described in the literature on electronic data storage:

1. Active, online data: “On-line storage is generally provided by magnetic disk. It is used in the very active stages of an electronic records [sic] life-when it is being created or received and processed, as well as when the access frequency is high and the required speed of access is very fast, i.e., milliseconds.” Id. (citations omitted).

2. Near-line data: “This typically consists of a robotic storage device (robotic library) that houses removable media, uses robotic arms to access the media, and uses multiple read/write devices to store and retrieve records. Access speeds can range from as low as milliseconds if the media is already in a read device, up to 10-30 seconds for optical disk technology, and between 20-120 seconds for sequentially searched media, such as magnetic tape.” Id. at 319 (citations omitted).

3. Offline storage/archives: “This is removable optical disk or magnetic tape media, which can be labeled and stored in a shelf or rack. Off-line storage of electronic records is traditionally used for making disaster copies of records and also for records considered ‘archival’ in that their likelihood of retrieval is minimal. Accessibility to off-line media involves manual intervention and is much slower than on-line or near-line storage. Access speed may be minutes, hours, or even days, depending on the access-effectiveness of the storage facility.” The principled difference between nearline data and offline data is that offline data lacks “the coordinated control of an intelligent disk subsystem,” and is, in the lingo, JBOD (“Just a Bunch Of Disks”). Id. (citations omitted).

4. Backup tapes: “A device, like a tape recorder, that reads data from and writes it onto a tape. Tape drives have data capacities of anywhere from a few hundred kilobytes to several gigabytes. Their transfer speeds also vary considerably … The disadvantage of tape drives is that they are sequential-access devices, which means that to read any particular block of data, you need to read all the preceding blocks.” As a result, “[t]he data on a backup tape are not organized for retrieval of individual documents or files [because] … the organization of the data mirrors the computer’s structure, not the human records management structure.” Backup tapes also typically employ some sort of data compression, permitting more data to be stored on each tape, but also making restoration more time-consuming and expensive, especially given the lack of uniform standard governing data compression. Id. (citations omitted).

5. Erased, fragmented or damaged data: “When a file is first created and saved, it is laid down on the [storage media] in contiguous clusters … As files are erased, their clusters are made available again as free space. Eventually, some newly created files become larger than the remaining contiguous free space. These files are then broken up and randomly placed throughout the disk.” Such broken-up files are said to be “fragmented,” and along with damaged and erased data can only be accessed after significant processing. Id. (citations omitted).

Posted in 2nd Circuit, Case Blurbs, Cost Shifting, Judge Shira A. Scheindlin, S.D.N.Y | Tagged: , , | Leave a Comment »

Case Blurb: Zubulake I; Initial considerations of cost-shifting

Posted by rjbiii on September 26, 2007

Courts must remember that cost-shifting may effectively end discovery, especially when private parties are engaged in litigation with large corporations. As large companies increasingly move to entirely paper-free environments, the frequent use of cost-shifting will have the effect of crippling discovery in discrimination and retaliation cases. This will both undermine the “strong public policy favor[ing] resolving disputes on their merits,” and may ultimately deter the filing of potentially meritorious claims. Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 317-18 (S.D.N.Y. 2003) (quoting Pecarsky v., Inc., 249 F.3d 167, 172 (2d Cir.2001)).

Thus, cost-shifting should be considered only when electronic discovery imposes an “undue burden or expense” on the responding party. The burden or expense of discovery is, in turn, “undue” when it “outweighs its likely benefit, taking into account the needs of the case, the amount in controversy, the parties’ resources, the importance of the issues at stake in the litigation, and the importance of the proposed discovery in resolving the issues.” Id. (citations omitted).

Posted in 2nd Circuit, Case Blurbs, Cost Shifting, Judge Shira A. Scheindlin, S.D.N.Y | Tagged: , | Leave a Comment »

Airline blames executive’s “porn purge” for deletion of evidence

Posted by rjbiii on September 26, 2007

Uh oh. This isn’t good:

Mesa Air Group said yesterday its chief financial officer went to great lengths to permanently delete computer data sought by Hawaiian Airlines to cover up his interest in pornography.

In an evidentiary hearing held yesterday before Hawaiian’s lawsuit against Mesa goes to trial, the operator of the interisland airline go! said it discovered that CFO Peter Murnane had been browsing adult Web sites.

It also said Murnane was solely responsible for deleting data from his three computers and that the company had given to Hawaiian all the deleted data.

How far did Mr. Murnane allegedly go in his cover-up attempts? A computer forensics expert explains:

Jefford Englander, a computer forensics expert from Phoenix-based Lightstone Solutions, spent about 90 minutes on the stand yesterday detailing how he uncovered multiple instances of deleted files that he could not identify. He also uncovered signs the computer clock had been manipulated — including files that appeared to have been modified before they were created.

Now, to be sure, this all must be substantiated. Mr. Murnane has his own side to the story, and as everyone knows, things aren’t always what they seem. But it doesn’t look good.

Posted in Articles, Computer Forensics, Employee Practices, Spoliation | Tagged: , , | Leave a Comment »

Electronic Discovery viewed from a Global Perspective

Posted by rjbiii on September 26, 2007 has posted an article examining the effects wrought by the emergence of electronic discovery processes on global corporate entities.

Both lawyers and their clients have an obligation to adjust their respective practices to respond to the consequences of these legal developments. For a multinational corporation, the challenge of implementing policies to ensure compliance is twofold: First, the corporation must determine whether and to what extent its foreign affiliates should also establish compliance policies in light of the broad scope of U.S. discovery. Second, the corporation must ascertain which forms of electronic information should be considered when developing these policies and how they can be implemented to strike a balance between legal considerations and effective business practices.

One quick note on that second point. Corporations will do well to leave it to courts to “ascertain which forms of ESI should be considered in developing” their policies, rather than relying on their own expertise and judgement. An analysis of recent case law will confirm that company’s decisions are often in contrast to judicial expectations, and that is hardly the position in which an executive wants to find him(her)self. Formulate the policies with an eye to case law and the FRCP, state, and international rules. A complex calculation based on a series often ambiguous templates, I admit.

The article continues by examining the test for “control” of digital evidence with respect to multinationals:

To determine whether information sought from a corporate party’s foreign affiliate is within the party’s control, the decisive factor is the transactional relationship between the parties. A parent-subsidiary relationship between a U.S. corporation and its foreign affiliate is the clearest example of a relationship that would bring information held by the affiliate within the scope of Rule 34. See Middle District of North Carolina’s Uniden American Corp. v. Ericsson Inc., states, “[A] litigating parent corporation has control over the documents in the physical possession of its subsidiary corporation where the subsidiary is wholly owned or controlled by the parent corporation.”

The article also looks at what data is “reasonably accessible,” while discussing the Zubulake I categories of accessibility.

The Southern District of New York set forth a series of landmark rulings addressing this issue in Zubulake v. UBS Warburg LLC. In Zubulake I, the court established a framework for determining the accessibility of electronic information, recognizing that “whether electronic data is accessible or inaccessible turns largely on the media on which it is stored.” The court then set forth five categories of data listed in order from most accessible to least accessible. These categories are as follows:

Active-online data;

Near-line data;

Offline storage/archives;

Backup tapes; and

Erased, fragmented or damaged data.

Of these categories, the court identified the first three categories as accessible and the last two as inaccessible.

We’ve already noted in one post that back-up tapes aren’t always considered inaccessible data. How the tape system is used is a big factor in the determination. Furthermore, if you use tape to preserve data that you know is relevant to an ongoing dispute, and that data is found nowhere else, it is quite possible you will have to produce it at your own cost. Of course, ultimately a company can only show that it is making a reasonable effort. Perfection is not required.

Posted in Articles, Data Management | Tagged: , , , | Leave a Comment »

Case Summary: Benton v. Dlorah, Inc., 2007 WL 2225946 (D. Kan. Aug. 1, 2007); Court denies motion to compel production of hard drive

Posted by rjbiii on September 26, 2007

In this employment discrimination case, Magistrate Judge Gerald Rushfelt denied defendant’s request to compel the plaintiff to “produce the hard drive of her personal computer for inspection and copying.” In response to defendants’ discovery requests, some of which sought correspondence between plaintiff and defendant National American University or her students at the university, plaintiff produced one e-mail. After defendant informed plaintiff that it believed her responses to the discovery requests were deficient, and after agreeing to supplement those responses, Ms. Benton declared that all e-mails from her students had been deleted, and therefore could not produced. She also resisted producing her hard drive, as requested by defendants.

Defendants argued that Ms. Benton failed to “produce[] any e-mail communications that took place after February 2007,” and that they believe she had been deleting those emails relating to her employment since that date. Defendants contended that because Ms. Benton had admitted to deleting some emails, and because she had only produced one e-mail dated after February 2007, she must have destroyed other relevant documents.

The court disagreed. Defendants were speculating as to the whether plaintiff complied with their discovery requests, and have not met their burden to support their contentions of spoliation. The court refused to assume the plaintiff’s failure to comply. Therefore, the court denied the motion, and any calls for sanctions, without prejudice to any future motion should further discovery show that plaintiff did, in fact, fail to produce responsive documents or had spoliated relevant evidence.

Benton v. Dlorah, Inc., 2007 WL 2225946 (D. Kan. Aug. 1, 2007)

K&L Gates has the full text of the opinion here, as well as their own summary here.

Posted in 10th Circuit, Case Summary, D. Kan., Discovery, Discovery Requests, Form of Production, Magistrate Judge Gerald L. Rushfelt, Motion to Compel | Leave a Comment »