Los Angeles E-Discovery Lawyer & Attorney : McBride Law Firm : Electronic Evidence: Santa Monica, California

The core software components your discovery team will need to do computer-based e-discovery management are the following:

• Windows SharePoint Services, a free download to Windows 2003 or 2008.  

• Microsoft Search Server Express, also a free download to Windows 2003 or 2008.   

• Indexing connectors (and "iFilters") for indexing different types of non-Microsoft data on your client's network.  Connectors and iFilters are available as free downloads for most data types.  In an exceptional case of an unusual document type, your IT professional will need to write a connector script for you.

 How it Works:

Windows SharePoint Services provides the Windows infrastructure for collaborative review of documents, version control, collection-related metadata entry (without disturbing original data or metadata) and other features. 

Search Server Express provides a management console from which network crawling, document indexing, text downloads and text searching are managed.  

The connectors and iFilters allow your Windows-based software to see other data types (such as Lotus notes, WordPerfect and UNIX/Linux-based documents) and to copy data and metadata from each indexed document, while maintaining integrity of the original document itself. 

More Detail:

The version of SharePoint to install is Windows SharePoint Services 3.0.

Microsoft Search Server Express is a single-machine version of the more robust Microsoft Search Server software that Microsoft charges for.  The more robust version is needed if searching is done from a clustered environment--not typically necessary in e-discovery. 

In other words, a single server (with adequate power) can supervise the crawl, indexing and downloads of virtually any small to medium sized business.  This means that attorneys for most clients can almost always get by using Microsoft Search Server Express--the free version.

A server with "adequate power" means any current-model server with 2 to 4 processors and 8 GB of RAM.  The configuration we use consumes about 1 GB of RAM in idle state.  Crawling and indexing will use another 3 GB of RAM.  So to make this system work, your client will need one relatively modern server with at least 4 GB of RAM that can be allocated to crawling and indexing--a task that can often be done after-hours so as to not interfere with daily workloads.

The search query tool is based on the Microsoft Windows Search technology, and works similarly.  Indexed files are sorted by relevance and are listed along with a snippets from the file, with search terms highlighted.  Duplicates are identified and collapsed.  Alerts can be set for specific queries, which allows document preservation policies and ongoing document collections to be automated.

The specific indexing connectors you need will depend on the type of documents your client has.   As mentioned above, most connectors can be downloaded for free, but your IT professional may need to write a new connector script for document types that are unusual or proprietary.  Microsoft provides a software developer kit (again, free) for this purpose. 

Before your IT team begins the collection process, you need to be cognizant of the need for passwords, access permissions and, in unusual cases, possibly additional licenses for certain software programs running on your client's system.  It is a good idea to identify early in the process all applications on the system and the licensing requirements and access permissions needed for each.  Sometimes it is easier for a lawyer to smooth the way for securing these additional permissions than for technical staff or paralegals.

 Other ideas:

We have created in-house a 32-bit "image" of the SharePoint Services and Search Search Express downloads for installation in a Microsoft Virtual Server environment.  This allows us to install the e-discovery software on a client's server in a virtual environment to make efficient use of an existing server, if available, instead of buying an entirely new computer just for e-discovery.  This is a cost-savings that any small to medium sized business will appreciate.  

When the case is over, the entire SharePoint image can be easily removed (assuring ongoing data confidentiality) and the server can be used for other functions without any remaining trace of the SharePoint e-discovery software.

The cost of a Windows server license to run Microsoft's virtual server is $600.  Resource demands on the host server are approximately 16 GB of fixed hard drive space for the system files and 16 additional GB of flexible hard drive space for index files and documents.  (If large documents are downloaded, additional hard drive space will be required.)

In addition, a company in Reston VA, Surety, LLC, has just brought to market a plug-in for SharePoint Services that certifies chain of custody of document collections.  The Surety website says its product, AbsoluteProof, "automatically and seamlessly affixes a Surety Integrity Seal™ to each native or imaged record as it enters the SharePoint system providing users with long-lasting, objective proof of the time and content integrity of their electronic records."

The cost of a Surety license is $25 per seat.  Considering the extra benefit of proving chain of custody for e-discovery documents collected through the Microsoft SharePoint solution, it seems well worth the money. 

 What Does this Mean for Lawyers?

 Lawyers will never download software or implement e-discovery searches--this is work for technical people.  But litigation attorneys now need to understand technology at about the level of this article for two reasons: (1) to meet your obligations to oversee the discovery process and (2) to help your client save money.

There are dozens of software products and vendors selling e-discovery software.  It is all quite expensive.  The benefit of the Microsoft solution is its very low (virtually free) cost and its very high functionality.  Almost all clients will already have a Microsoft-based server on which the software can be installed and run in a virtualized environment.  Downloads and most connectors are free. 

And the functionality of this product is very high--it should significantly help you manage and supervise discovery, confidently identify document maps, identify and search custodian documents, preserve documents without changing metadata, automatically set policies for ongoing preservation so that important documents are not lost or destroyed, and provide a clear audit trail for all electronic discovery activity. 

To date, most firms are conducting electronic discovery manually--i.e., sitting down with a pencil and paper, with the client, and drawing a network map.  This is still a necessary step, but probably not sufficient in and of itself. 

Automated collection through a cost-effective solution like SharePoint provides much greater control over document preservation policies and collections than manual auditing could ever do alone.  It seems safer for counsel and clients to minimize potential mistakes in collection and preservation by automating these policies and functions. 

  Where can I go for More Information?

Of course, you can contact me on the blog contact link, or at km@mcbride-law.com, for more information.  We are happy to help you build Microsoft download images and run in a virtual server environment.    

If you represent a large client client who can afford extensive enterprise consulting services, you may want to  contact Christ Kallas at Hitachi Consulting: ckallas@hitachiconsulting.com   (located in Orange County).   Hitachi Consulting is an authorized Microsoft partner for electronic discovery and has considerable experience using SharePoint in electronic discovery.

Otherwise, if you have a trusted IT adviser who is highly knowledgeable about networking and Microsoft products, he or she can probably help you learn more, in conjunction with your client's IT people.

Use of these Microsoft products should greatly increase your effectiveness in supervising electronic discovery collections and document preservation--and save your clients money.  In all, a pretty good bargain!

1.  The magistrate judge's non-recognition of the "self-defense" exception to the attorney-client privilege was originally supported because Qualcomm had not presented any evidence, such as declarations against its attorneys.  Thus, no adversity between Qualcomm and its attorneys was present.

2.  Qualcomm filed four declarations of employees, exonerative of Qualcomm and critical of the services and advise of their retained counsel.  None were filed under seal.  Notwithstanding, Qualcomm still involved the attorney-client privilege.

3.  This introduction of accusatory adversity between Qualcomm and its retained counsel assessing responsibility for the failure of discovery changes the factual basis which supported the earlier denial of the self-defense exception to Qualcomm's attorney-client privilege.

4.  The attorneys have a due process right to defend themselves under the totality of circumstances presented in this sanctions hearing where their alleged conduct regarding discovery is in conflict with that alleged by Qualcomm concerning performance of discovery responsibilities.

Discussion:

Judge Brewster relied on two Ninth Circuit cases in recognizing the "self-defense" exception to the attorney-client privilege: Miranda v. So. Pac. Transp. Co., 710 F.2d 516 (9th Cir. 1983) and Weil v. Investment/Indicators, Research & Mgmt., Inc., 647 F.2d 18 (9th Cir. 1981).

The Miranda case recognized the due process rights of attorneys where their alleged conduct regarding discovery is in conflict with that alleged by a client.  710 F.2d at 522-23.

The Weil case held that communications and conduct relevant to the topic areas of records discovery in conflict were not privileged.  647 F.2d at 24.

Although Judge Hillman had ordered production of electronic documents, one document custodian testified in deposition that he “was not aware of any search for electronic documents on New Line’s servers, on any individual’s desktop or laptop computer, or otherwise.”

Another custodian testified that he had undertaken a search specifically related to merchandising agreements, but his search “consisted of little more than clicking through various folders on the only two server drives he could personally access.” He did not conduct or arrange for a server-wide search for documents containing the phrase “Lord of the Rings” or any other keywords; indeed, he did not even search for documents with “Lord of the Rings” in the title. 

Newline likewise “failed to conduct any search of the company’s email servers for email correspondence containing the phrase “Lord of the Rings” or any other keywords.

While some individual employees were asked to collect their emails, others were not; and even those employees who did collect emails were given little or no guidance on where to search (e.g., inbox, sent items, deleted items, archived folders) or how to conduct their search (e.g., keyword searching).”

As a result, Judge Hillman found that “New Line still has not performed any meaningful search for emails and other electronic documents. [one custodian] has performed no more than a haphazard search for electronic documents…and only on the servers to which he happened to have access. And no witness can say with any degree of certainty what individuals searched their own email files or how any of those searches were conducted. The most New Line’s custodians can say is that any emails or electronic documents that happened to have been printed in the ordinary course of business and placed in the paper files would have been captured in the document collection. However, a search for printouts is not a search for electronic documents; it is a search for paper documents.”

Judge Hillman continued, “[a]t the very least, New Line should have charged its in-house information technology professionals with responsibility to ensure that all of the company’s servers and individual computers were searched, and that they were searched in a manner that was reasonably calculated to capture all responsive documents (e.g., keyword searches of electronic documents and emails).

New Line’s discovery issues did not stop with its failure to diligently search and respond to electronic discovery request.  Magistrate Judge Hillman also found that New Line failed to suspend the automatic deletion of electronic documents after the dispute arose.

Apparently it was New Line’s practice at the time the case arose to purge every employee’s email in-box every 30 days, and to wipe clean email backup tapes on a weekly basis. Backup tapes for other electronic documents such as word processing files were recycled after one year. Judge Hillman found that “New Line did not suspend the automatic deletion of emails and other electronic documents as part of a litigation hold; instead, to this day, emails continue to be purged from every employee’s email in-box every thirty days, and backup tapes continue to be recycled every week (for emails) or year (for other electronic documents).

As a result of New Line’s failure to suspend its automatic document destruction procedures, the only email correspondence that has possibly been preserved is that which an individual employee moved from his or her in-box into a saved folder.

As a result of finding these discovery violations, Judge Hillman ordered New Line to retain an outside vendor (jointly selected by the parties) to collect electronic documents and email correspondence that were within the scope of the Court’s discovery orders.

The vendor was granted access to New Line’s servers, including email servers, for the purpose of conducting keyword searches for responsive documents; and access to hard drives from the desktop and laptop computers of specified employees connected with the dispute for the purpose of conducting keyword searches.

New Line was ordered to bear all costs and expenses of the outside vendor. In addition, the court awarded $125,000 of Wingnut’s $191,000 fee request.

Judge Hillman’s minute entry granting sanctions was entered October 4, 2007. The case was settled promptly thereafter on undisclosed terms and a stipulated dismissal was entered on December 20, 2007.

Judge Hillman's detailed opinion provides guidance on what not to do in electronic discovery.

Defendants did not keep records of the identity of users who searched and downloaded music files from its Netherlands-based servers. In addition, defendants disabled the server logging functions that would have recorded the IP address of persons accessing its servers. Finally, the job of managing the servers facilitating music downloads was outsourced to a third party.

 It would seem that these management decisions were designed, at least in part, to protect the identity of users who were downloading music without paying for it.

The plaintiff music companies sought to discover the IP addresses of persons who had used the BitTorrent software and website to show the number of downloads that originated within the United States, and therefore were illegally downloaded. Defendants claimed that it had no such information since no login files were maintained; and that discovery was beyond the reach of US law since the servers were located in the Netherlands.

 The music companies countered, explaining in an evidentiary hearing that identity of users could be determined by activating the server log function in the website servers and recording login activity available from the servers’ random access memory (RAM). (RAM is temporary computer memory that remains active for about 6 hours—long enough to be logged.) 

After evaluating the interests for and against activation of server log data to record the information sought in production, Judge Chooljian agreed with the music companies and ordered defendants to activate server log functions to record data stored in RAM.

 Judge Chooljian’s order in this case has been criticized by technology companies and their counsel who fear that RAM will now become an ordinary part of discovery in all cases and that routine preservation RAM will be mandatory. I don’t read the order that broadly. In fact, Judge Chooljian went out of her way to comment in footnote 31 that:

The court emphasizes that its ruling should not be read to require litigants in all cases to preserve and produce electronically stored information that is temporarily stored only in RAM. The court’s decision in this case to require the retention and production of data which otherwise would be temporarily stored only in RAM is based in significant part on the nature of this case, the key and potentially dispositive nature of the Server Log Data which would otherwise be unavailable, and defendants’ failure to provide what this court views as credible evidence of undue burden and cost.

Thus, Judge Chooljian’s order was because the Server Log Data was potentially dispositive to the case, it was the key evidence in the case, the evidence would otherwise be unavailable, and defendants could not show undue burden or cost of requiring the data to be logged and produced.

 There was really no other way of getting at this critical information. Server activation logs had been disabled. Servers were located outside the United States. A third party company was retained to manage server accounts. This was seemingly done to prevent any kind of discovery into the identity of the BitTorrent file sharing users. Judge Chooljian would not reward these efforts to avoid potential legal responsibility through a front of anonymity.

First, the judge addressed a threshold issue of whether RAM data could even be categorized as “ESI” under FRCP Rule 34(a).  Judge Chooljian cited the Advisory Committee Notes that explain Rule 34(a)(1) “is expansive and includes any type of information that is stored electronically,” and that it “is intended to be broad enough to cover all current types of computer-based information, and flexible enough to encompass future changes and development.”

 She then cited a Ninth Circuit case, MAI Systems Corp. v. Peak Computer, Inc., 991 F.2d 511, 518-19 (9th Cir. 1993) which determined that RAM was “fixed” in a tangible medium and “was sufficiently permanent or stable to permit it to be perceived, reproduced, or otherwise communicated for a period of more than a transient duration.”

 With these two steps, she concluded that RAM can be defined as ESI for the purposes of FRCP Rule 34(a).

Second, she ruled that defendants maintained “possession, custody and control” over the information, even though it was technically in the hands of third parties, reasoning that “[f]ederal courts have consistently held that documents are deemed to be within a party’s possession, custody and control for purposes of Rule 34 if the party…has the legal right to obtain the documents on demand.” In re Bankers Trust Co., 61 F.3d 465, 469 (6th Cir. 1995).

 Because the defendants retained the right to modify server routing information, Judge Chooljian concluded that defendants factually and contractually had possession custody and control over the servers.

Third, Judge Chooljian dealt with the unusual circumstance of requiring defendants to activate server log functions in order to preserve server log data for production. Defendants had correctly argued that a party “cannot be compelled to create, or cause to be created, new documents solely for their production.” Paramount Pictures Corp. v. Replay TV, 2002 WL 32151632, *2 (C.D.Cal. 2002)(Judge Florence-Marie Cooper), citing Alexander v. FBI, 194 F.R.D. 305, 310 (D.D.C. 2000).  

 But in rejecting defendants argument, Judge Chooljian reasoned that because the server log data already exists, is temporarily stored in RAM, and is controlled by defendants, an order requiring defendants to preserve and produce such data is not tantamount to ordering the creation of new data.

 Judge Chooljian explained that in determining whether to issue a preservation order in these circumstances, courts balance at least three factors: (1) the level of concern the court has for the continuing existence and maintenance of the integrity of the evidence in the absence of an order directing preservation; (2) any irreparable harm likely to result to the party seeking the preservation of the evidence absent an order directing preservation; and (3) the capability of the party to maintain the evidence sought to be preserved, not only as to the evidence’s original form, condition or contents, but also the physical, spatial and financial burdens created by ordering evidence preservation. Capricorn Power Co. v. Siemens Westinghouse Power Corp., 220 F.R.D. 429, 432-33 (W.D.Pa. 2004).

 In undertaking this balancing test, Judge Chooljian noted that defendants had conceded that the activation of a logging function to enable the retention of server log data in RAM would not be difficult. Thus, she found there was no undue burden. She expressed a high degree of concern for continuing existence of the evidence since, in fact, there would be no evidence of the identity of users absent activation of the logging function. On balance, Judge Chooljian found the test weighed to ordering this specific preservation order.

 Fourth, Judge Chooljian rejected the conflicts of laws arguments raised by defendants arising from the fact that physical location of most of the servers was in the Netherlands. She pointed out that defendants had retained the ability to manipulate the routing of the server log data from the US and also that the party resisting discovery has the burden of proving a foreign statute should be read to bar discovery in an issue, United states v. Vetco, 691 F.2d 1281, 1289 (9th Cir. 1981)—a burden not met in this case. She also relied on case law holding that foreign blocking statues do not deprive an American court of the power to order a party subject to its jurisdiction to produce (let alone produce) evidence even though the act of production may violate that statute. Richmark Corp. v. Timber Falling Consultants, 959 F.2d 1468 (9th Cir. 1992).

Defendants objected to the magistrate judge’s order and moved for review, but District Judge Florence-Marie Cooper denied the motion. Judge Cooper noted that amici briefs had been filed in opposition to the finding that RAM could constitute electronically stored information for the purposes of FRCP 34(a). Defendants (and the amici briefs) argued that information in RAM was temporary and therefore not “stored” information.  Judge Cooper rejected this argument, pointing out, inter alia, that Merriam-Webster’s Collegiate Dictionary (Frederick C. Mish et al eds., 10th ed. 1993) defined the word “store” to mean “to lay away, to accumulate or to place or leave in a location (as a warehouse, library, or computer memory) for preservation or later use or disposal.” (Emphasis by the court.)

 Judge Cooper also turned to the definition of “RAM” itself for support: RAM is defined as a storage unit and, due to its speed relative to hard disk drives, is typically used as the computer’s primary storage.” Judge Cooper then reasoned that “Rule 34 requires no greater degree of permanency from a medium than that which makes obtaining the data possible.

 As information can be obtained from RAM, it is within the scope of Rule 34 and subject to discovery under the appropriate circumstances.” In response to the amici’s concerns over the “potentially devastating impact of this decision on the record-keeping obligations of businesses and individuals,”

 Judge Cooper noted (as did Magistrate Judge Chooljian before her) that “this decision does not impose an additional burden on any website operator or party outside of this case.”