Post Process

Everything to do with E-discovery & ESI

Archive for the ‘Data Collection’ Category

Case Blurb: Mirbeau of Geneva Lake; Right of a Party to Conduct its own Search

Posted by rjbiii on December 29, 2009

[T]he federal rules do not give a party the “right to conduct its own search of [another party’s] electronic devices. Instead, in facilitating the production of ESI, the federal rules “allow the responding party to search his [or her] records to produce the required, relevant data.” Only if the moving party can actually prove that the responding party has concealed information or lacks the expertise necessary to search and retrieve all relevant data, including metadata or residual data, is it proper for the moving party to initiate the searches of the other party’s ESI.

Mirbeau of Geneva Lake LLC v. City of Lake Geneva, 2009 U.S. Dist. LEXIS 101104, at *3-4 (E.D. Wis. Oct. 15, 2009)

Posted in 7th Circuit, Case Blurbs, Data Collection, Data Sources, E.D. Wis., Judge J.P. Stadtmueller | Leave a Comment »

Case Blurb: YouTube; Court Grants Motion to Compel Production of 12 TB Database, Dismisses User’s Privacy Concerns

Posted by rjbiii on August 12, 2008

Video-Related Data from the Logging Database

Defendants’ “Logging” database contains, for each instance a video is watched, the unique “login ID” of the user who watched it, the time when the user started to watch the video, the internet protocol address other devices connected to the internet use to identify the user’s computer (“IP address”), and the identifier for the video. That database (which is stored on live computer hard drives) is the only existing record of how often each video has been viewed during various time periods. Its data can “recreate the number of views for any particular day of a video.” Plaintiffs seek all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website.

They need the data to compare the attractiveness of allegedly infringing videos with that of non-infringing videos. A markedly higher proportion of infringing-video watching may bear on plaintiffs’ vicarious liability claim, n3 and defendants’ substantial non-infringing use defense.

Defendants argue generally that plaintiffs’ request is unduly burdensome because producing the enormous amount of information in the Logging database (about 12 terabytes of data) “would be expensive and time-consuming, particularly in light of the need to examine the contents for privileged and work product material.”

But defendants do not specifically refute that “There is no need to engage in a detailed privilege review of the logging database, since it simply records the numbers of views for each video uploaded to the YouTube website, and the videos watched by each user.” While the Logging database is large, all of its contents can be copied onto a few “over-the-shelf” four-terabyte hard drives. Plaintiffs’ need for the data outweighs the unquantified and unsubstantiated cost of producing that information.

Defendants argue that the data should not be disclosed because of the users’ privacy concerns, saying that “Plaintiffs would likely be able to determine the viewing and video uploading habits of YouTube’s users based on the user’s login ID and the user’s IP address.”

But defendants cite no authority barring them from disclosing such information in civil discovery proceedings, FN5 and their privacy concerns are speculative. Defendants do not refute that the “login ID is an anonymous pseudonym that users create for themselves when they sign up with YouTube” which without more “cannot identify specific individuals, and Google has elsewhere stated:

We . . . are strong supporters of the idea that data protection laws should apply to any data that could identify you. The reality is though that in most cases, an IP address without additional information cannot.

FN5: The statute defendants point to, 18 U.S.C. § 2710 (titled “Wrongful disclosure of video tape rental or sale records”), prohibits video tape service providers from disclosing information on the specific video materials subscribers request or obtain, and in the case they cite, In re Grand Jury Subpoena to Amazon.com, 246 F.R.D. 570, 572-73 (W.D.Wis. 2007) (the “subpoena is troubling because it permits the government to peek into the reading habits of specific individuals without their prior knowledge or permission”), the court on First Amendment grounds did not require an internet book retailer to disclose the identities of customers who purchased used books from the grand jury’s target, a used book seller under investigation for tax evasion and wire and mail fraud in connection with his sale of used books through the retailer’s website.

Therefore, the motion to compel production of all data from the Logging database concerning each time a YouTube video has been viewed on the YouTube website or through embedding on a third-party website is granted.

Viacom Int’l Inc. v. YouTube Inc., 2008 U.S. Dist. LEXIS 50614 at *15-19 (S.D.N.Y. July 1, 2008 ).

Posted in 2nd Circuit, Case Blurbs, Data Collection, Data Sources, Databases, Duty to Produce, Judge Louis L. Stanton, Privacy, S.D.N.Y, Scope of Discovery, Undue burden or cost | Tagged: , , | Leave a Comment »

Case Blurb: YouTube; Court Grants Motion to Compel Videos “Removed” from Web Site

Posted by rjbiii on August 12, 2008

Removed Videos

Plaintiffs seek copies of all videos that were once available for public viewing on YouTube.com but later removed for any reason, or such subsets as plaintiffs designate. Plaintiffs claim that their direct access to the removed videos is essential to identify which (if any) infringe their alleged copyrights. Plaintiffs offer to supply the hard drives needed to receive those copies, which defendants store on computer hard drives.

Defendants concede that “Plaintiffs should have some type of access to removed videos in order to identify alleged infringements”, but propose to make plaintiffs identify and specify the videos plaintiffs select as probable infringers by use of data such as their titles and topics and a search program (which defendants have furnished) that gives plaintiffs the capacity both to run searches against that data and to view “snapshots” taken from each removed video. That would relieve defendants of producing all of the millions of removed videos, a process which would require a total of about five person-weeks of labor without unexpected glitches, as well as the dedication of expensive computer equipment and network bandwidth.

However, it appears that the burden of producing a program for production of all of the removed videos should be roughly equivalent to, or at least not significantly greater than, that of producing a program to create and copy a list of specific videos selected by plaintiffs.

While the total number of removed videos is intimidating (millions, according to defendants), the burden of inspection and selection, leading to the ultimate identification of individual “works-in-suit”, is on the plaintiffs who say they can handle it electronically.

Under the circumstances, the motion to compel production of copies of all removed videos is granted.

Viacom Int’l Inc. v. YouTube Inc., 2008 U.S. Dist. LEXIS 50614 at *13-15 (S.D.N.Y. July 1, 2008 ) (internal citations removed).

Posted in 2nd Circuit, Case Blurbs, Data Collection, Data Sources, Discovery Requests, Duty to Produce, Form of Production, Judge Louis L. Stanton, S.D.N.Y, Technology, Video Files | Tagged: , , | Leave a Comment »

PI Licensing Laws in Texas and Michigan Continue to get Press

Posted by rjbiii on July 31, 2008

This time, the CEO (and former litigator) of Catalyst, John Tredennick, writing in Law Technology Today (reg’n may be required) passes comment:

Two states have recently enacted statutes that make it a crime for unlicensed individuals to engage in computer forensics. Texas passed a law that would give regulators the power to impose up to a year in jail and a $14,000 fine on people doing “computer investigations.” Michigan went a bit further. On May 28 th of this year, Governor Jennifer Granholm signed into law a bill that makes unlicensed computer forensics work in Michigan a felony punishable by up to a four-year prison term, damages of up to $25,000 and a criminal fine of up to $5,000.

Read the article for details, but Tredennick summarizes the Texas law thusly:

As I read these [Regulatory Agency] opinions, there is some comfort for people doing routine electronic discovery collection but not if there is a forensic or testimonial aspect to the collection. There is a strong suggestion that experts who are called to testify in Texas courts regarding examinations of electronic files better be licensed in Texas. If you don’t have a license, you might be pulled off the stand and escorted to the hoosegow for an extended visit.

Seriously…not the hoosegow!

With respect to Michigan:

How far does this reach?

Good question. If I were a forensics expert and offering testimonial services, I would be pretty nervous about this law. The Act seems to focus on:

Computer forensics to be used as evidence before a court, board, officer, or investigating committee.

Most electronic discovery is focused on collection rather than forensics and an argument could be made that your eDiscovery efforts are not about forensics but rather the collection of relevant evidence for review. But do you want to make this argument to some Michigan criminal court? I wouldn’t.

Post Process has previously blogged on this issue (here, here, here, here, here, and here).

Posted in Articles, Data Collection, EDD Industry, Forensics, Laws, Michigan, Privacy, Texas, Vendor Liability | Tagged: , | 2 Comments »

Social Sites becoming Databases for Prosecutors

Posted by rjbiii on July 20, 2008

An AP article discusses a case in which photos of a party posted on Facebook ended up haunting the defendant in a drunken-driving case:

PROVIDENCE, R.I. – Two weeks after Joshua Lipton was charged in a drunken driving crash that seriously injured a woman, the 20-year-old college junior attended a Halloween party dressed as a prisoner. Pictures from the party showed him in a black-and-white striped shirt and an orange jumpsuit labeled “Jail Bird.”

In the age of the Internet, it might not be hard to guess what happened to those pictures: Someone posted them on the social networking site Facebook. And that offered remarkable evidence for Jay Sullivan, the prosecutor handling Lipton’s drunken-driving case.

Sullivan used the pictures to paint Lipton as an unrepentant partier who lived it up while his victim recovered in the hospital. A judge agreed, calling the pictures depraved when sentencing Lipton to two years in prison.

The Judge on the case said that the photos did affect his decisions with respect to the sentence he passed down.

Post Process has previously taken notice of the trend in this post. One thing to note, the defendant himself didn’t publish these photos…another party-goer did.

Posted in Articles, Data Collection, Trends | Tagged: , | Leave a Comment »

Case Blurb: Younessi; Court Fashions Protective Order to Allow for Discovery but Protect Trade Secrets

Posted by rjbiii on July 3, 2008

The Court is convinced that this need is strong enough to warrant discovery from [Producing Party] and the Motion to Quash is DENIED. However, some form of protective order is appropriate and the Court now turns to what form that production should take.
[…]
In situations involving information which is appropriately kept private, the Court may fashion restrictions on the form and method of disclosure. See Playboy Enterprises, Inc. v. Welles, 60 F.Supp.2d 1050 (S.D.Cal.1999). In the interest of protecting private information such as trade secrets or privileged documents, the Court can order the responding party’s attorneys to search for all documents consistent with the subpoena and to produce only those which are relevant, responsive, and do not disclose trade secrets. See, e.g., id. The Court finds in Playboy an appropriate model for this case. There, the plaintiff sought to copy the defendant’s hard drives after it learned she may have deleted emails which could potentially prove the knowledge element of plaintiff’s infringement claims. Id. at 1051. Defendant responded with concerns that privileged communications would also be recoverable under such a procedure. Id. at 1054. The court ordered the copying, but directed defense counsel to search the copy for responsive materials instead of turning over the copied drives themselves. Id. at 1055

Here, [Requesting Party] also requests to copy [Producing Party’s] hard drives, a process which might reveal not just privileged, but also trade secret information. Having [Producing Party] search its own computers is an appropriate compromise here because of the unique status of [Requesting Party] as a direct competitor and of [Producing Party] as a nonparty [third party] to the underlying suit. The elaborate copying which took place in Playboy is not necessary because there are no allegations of documents being destroyed and [Producing Party] has shown that it is responsive and willing to cooperate with [Requesting Party’s] reasonable requests.

Daimler Truck N. Am. LLC v. Younessi, 2008 WL 2519845 (W.D. Wash. June 20, 2008 )

Posted in 9th Circuit, Case Blurbs, Data Collection, Data Sources, Duty to Produce, Form of Production, Hard Drive Inspections, Judge Ronald B. Leighton, Objections to Discovery Requests, Overly Broad Request, W.D. Wash. | Tagged: , | Leave a Comment »

Is VoIP the Next Frontier in E-Discovery?

Posted by rjbiii on June 30, 2008

The New York Law Journal On-line has posted an article warning of the dangers companies adopting Voice Over IP might encounter with e-discovery:

Depending on the VoIP system in place, the manner in which such data is retained may be under the direct control of the company and its IT professionals, as opposed to the phone company. Further, VoIP data will likely be subject to a company’s or client’s backup and retention policies. Unlike traditional voicemails, VoIP data may prove difficult to delete. Instead, as is common with e-mails, redundant backup systems will ensure that additional copies may continue to persist at many levels. As an added complication, VoIP messages cannot easily be searched by subject or text. In fact, searches may be limited to such parameters as caller ID information, recipient, and date and time of call.

Without proper planning, a client or company may be faced with hundreds or even thousands of hours of audio data that cannot be easily parsed if production is required. This situation poses a significant problem in light of recent amendments to the Federal Rules of Civil Procedure that expressly define “sound recordings” as “electronically stored information” and impose new requirements for disclosure, case management, planning, and form of production of all electronically stored information.

What is VoIP? you ask. Ah. The article does a nice job of explaining:

VoIP, also known as IP Telephony, is the real-time transmission of voice signals using the Internet Protocol (IP) over the public Internet or a private data network. In simpler terms, VoIP converts the voice signal from a telephone into a digital signal that travels over the Internet, rather than over the traditional phone company-owned PSTN. As the caller speaks, the analog sound signal from his or her voice is rapidly converted into a series of small chunks of digital data commonly referred to as “packets.” Rather than routing the data over a dedicated line (similar to the way the PSTN functions), the data packets flow through a chaotic network along thousands of possible paths in a process called “packet switching.” Compared to the traditional PSTN, packet switching is very efficient because it lets the network route the packets along the least congested and cheapest lines.

The article goes on to advocate incorporating legal considerations of e-discovery into the design of any corporate VoIP system.

This is a specific example for my popular general thesis that data is everywhere, and the world is nothing more than a huge database. Data sources will continue to multiply and become ever more varied, so although experts love to discuss the “commoditization” of the the basic e-discovery process, at the upper levels of the profession, there is just such a maze of problems, and an arsenal of solutions.

Posted in Articles, Data Collection, Data Management, Data Sources, Trends | Tagged: , | Leave a Comment »

Trend in Licensing for Computer Forensics Continues with New Michigan Law

Posted by rjbiii on June 18, 2008

Post Process has already remarked on a Texas law that implies that computer forensics experts must have a private investigator’s license. Now it’s Michigan’s turn.

Joe Howrie has written an article on a new Michigan law that requires people engaging in “computer forensics” to acquire a license as a private investigator:

“According to the state of Michigan Web site, Michigan House Bill 5274, “the professional investigator licensure act,” was signed into law by Gov. Jennifer Granholm on May 28.

According to the terms of the act, it becomes effective immediately (Sec. 29) and it is now a felony punishable by up to a four-year prison term and a $25,000 fine for a person to engage in computer forensics in Michigan unless that person is licensed under the act or falls within one of its exemptions (Sec. 3(3)).”

The exemptions mentions attorneys, but not staff working under a lawyer’s supervision, although Howrie feels that staff would be exempted:

Presumably, the attorney exemption extends to staff employed to assist an attorney as attorneys have historically used support personnel for litigation. If the legislature had intended that lawyers could only use support staff with whom the lawyers had employer-employee relationships, the employer-employee language from 4(e) would also appear in the 4(a) lawyer exemption section.

This particular law, driven evidently from privacy concerns, seems broader and harsher than others we’ve seen recently, including the Texas law. Questions abound: if I am in Houston, and I use an application to pull data from a server in Michigan, for the purposes of preparing some of that data for submission to a court as evidence, am I in violation of the statute? If I merely hold myself out as a computer forensics professional, do no business in Michigan directly, but engage in “forensics” elsewhere, are there any consequences (minimum contacts and the web?).

While protecting the public and privacy is important…is a Private Investigator’s license really the best vehicle for this sort of regulation? Stay tuned…

Posted in Articles, Data Collection, Forensics, Laws, Legislation, Privacy, Trends, Uncategorized | Tagged: , , | 1 Comment »

TX Case Blurb: Honza; Court addresses objection to discovery request based on revealing confidential information, court order

Posted by rjbiii on March 10, 2008

[Producing Party members] seek a writ of mandamus compelling Respondent, the Honorable Greg Wilhelm, Judge of the County Court at Law No. 1 of Ellis County, to set aside a discovery order requiring the Honzas to permit a forensic expert to create a mirror image of each of the computer hard drives in the Honzas’ office in an effort to locate two particular documents or iterations of those documents

The Honzas contend that Respondent abused his discretion because: (2) the order authorizes the disclosure of information protected by the attorney-client privilege; and (3) the order authorizes the disclosure of confidential information pertaining to the Honzas’ other clients who have no connection to the underlying lawsuit.

The present discovery dispute originated with [Requesting Party’s] motion to gain access to the Honzas’ computers, which was filed about one month before trial. By this motion, [Requesting Party] sought “[i]nformation (the ‘Metadata’) contained on the actual computers of the Defendants, such as any time stamps on the Relevant Documents, versions of the Relevant Documents, if any, as well as the deletion of various versions, if any.” [Requesting Party] explained that, although the Honzas responded to a prior request for production of relevant documents in their electronic version, “the Metadata was neither produced nor made available.”

[Ed. Testimony indicated the existence of relevant documents with respect to a another transaction apparently not addressed by earlier discovery requests]

[] [Requesting Party] sought discovery of relevant documents pertaining to the [newly revealed] transaction, and the [Producing Party] complied by providing pertinent written discovery.

[Requesting Party] seeks the metadata from the [Producing Party’s] hard drives because it wants to identify the points in time when the partial assignment draft was modified in relation to the diary entry. This goes to the issue of whether [the Producing Party] altered the partial assignment after the parties concluded their agreement but before the document was presented for execution.

[Ed. The opinion then went on to list various Federal and State sources for persuasive authority in discovery law, especially with respect to ESI]

Privileged or Confidential Information

The [Producing Party] also contend[s] that the discovery order improperly authorizes the disclosure of (1) information protected by the attorney-client privilege and (2) confidential information pertaining to the Honzas’ other clients who have no connection to the underlying lawsuit.

Notwithstanding the “unlimited” access necessarily granted the forensic expert, Respondent’s order preserves any privileged or confidential information in several ways. First, the expert is limited in his search to two specific documents or iterations of those documents. [Members of the Producing Party] are then accorded the right to review the documents and information which the expert believes responsive and produce to [Requesting Party] only those documents and information which [members of the Producing Party] themselves believe are responsive. These provisions effectively preclude [Requesting Party] from having any access to documents or information pertaining to other clients of the Honzas not involved in this litigation.

Second, the order allows the [Producing Party executives] to withhold from discovery any documents or information which they claim to be privileged or confidential and provide instead a privilege log, subject to in camera review by Respondent.

Finally, the order provides that: (1) the observation of information by [Requesting Party] representatives during the imaging process shall not constitute a waiver of privilege or confidentiality; (2) all participants in the imaging process are subject to a protective order prohibiting the unauthorized disclosure of information; and (3) [Requesting Party’s] expert must provide proof of being bonded and of having commercial liability insurance by which the [Producing Party] may be “fully indemnified against any monetary loss.”

For these reasons, we hold that Respondent appropriately tailored the discovery order to prohibit the unauthorized disclosure of privileged or confidential information and no abuse of discretion is shown.

[Ed. Note that a dissenting opinion is also entered by one of the Judges hearing the case. See the order itself for the full text of that dissent, or of the opinion itself.]

In re Honza, 2007 WL 4591917 (Tex. App. Dec. 28, 2007)

Posted in Case Blurbs, Computer Forensics, Data Collection, Data Custodians, Data Sources, Discovery Requests, Duty to Produce, Objections to Discovery Requests, Privacy, Privilege, Privilege Log, Scope of Discovery, Texas, TX Judge Felipe Reyna | Leave a Comment »

TX Case Blurb: Honza; Court outlines process for Forensic Expert’s access to Party’s hard drive and subsequent production

Posted by rjbiii on March 10, 2008

[Producing Party members] seek a writ of mandamus compelling Respondent, the Honorable Greg Wilhelm, Judge of the County Court at Law No. 1 of Ellis County, to set aside a discovery order requiring the Honzas to permit a forensic expert to create a mirror image of each of the computer hard drives in the Honzas’ office in an effort to locate two particular documents or iterations of those documents

The Honzas contend that Respondent abused his discretion because: (1) the discovery order is overbroad and authorizes an improper “fishing expedition”; (2) the order authorizes the disclosure of information protected by the attorney-client privilege; and (3) the order authorizes the disclosure of confidential information pertaining to the Honzas’ other clients who have no connection to the underlying lawsuit.

The present discovery dispute originated with [Requesting Party’s] motion to gain access to the Honzas’ computers, which was filed about one month before trial. By this motion, [Requesting Party] sought “[i]nformation (the ‘Metadata’) contained on the actual computers of the Defendants, such as any time stamps on the Relevant Documents, versions of the Relevant Documents, if any, as well as the deletion of various versions, if any.” [Requesting Party] explained that, although the Honzas responded to a prior request for production of relevant documents in their electronic version, “the Metadata was neither produced nor made available.”

[Ed. Testimony indicated the existence of relevant documents with respect to a another transaction apparently not addressed by earlier discovery requests]

[] [Requesting Party] sought discovery of relevant documents pertaining to the [newly revealed] transaction, and the [Producing Party] complied by providing pertinent written discovery.

[Requesting Party] seeks the metadata from the [Producing Party’s] hard drives because it wants to identify the points in time when the partial assignment draft was modified in relation to the diary entry. This goes to the issue of whether [the Producing Party] altered the partial assignment after the parties concluded their agreement but before the document was presented for execution.

[Ed. The opinion then went on to list various Federal and State sources for persuasive authority in discovery law, especially with respect to ESI]

Under these decisions, the following protocol is generally followed. First, the party seeking discovery selects a forensic expert to make a mirror image of the computer hard drives at issue. This expert is required to perform the analysis subject to the terms of a protective order, generally prohibiting the expert from disclosing confidential or otherwise privileged information other than under the terms of the discovery order.

After creating the mirror images and analyzing them for relevant documents or partial documents, courts typically require the expert to compile the documents or partial documents obtained and provide copies to the party opposing discovery. That party is then to review the documents, produce those responsive to the discovery request, and create a privilege log for those withheld. Finally, the trial court will conduct an in-camera review should any disputes arise regarding the entries in the privilege log.

Because our research has disclosed no Texas decisions regarding this type of electronic discovery, we will apply these fairly uniform procedures to the issues presented in this proceeding.

[Ed. Note that a dissenting opinion is also entered by one of the Judges hearing the case. See the order itself for the full text of that dissent, or of the opinion itself.]

In re Honza, 2007 WL 4591917 (Tex. App. Dec. 28, 2007)

Posted in Case Blurbs, Computer Forensics, Data Collection, Data Custodians, Duty to Produce, Objections to Discovery Requests, Privacy, Privilege, Privilege Log, Scope of Discovery, State Courts, Texas, TX Judge Felipe Reyna | Leave a Comment »