United States: Strategies and Tactics: Electronic Data in Litigation
A Case Study

Alex MacDonald, lawyer representing Mary Linnen’s estate. Munday, Alicia. Dispensing With the Truth, St. Martin’s Press, 298 (2001).

Cases are won and lost on the information that lawyers are able to gather from documentary evidence, whether paper or electronic. A good example of a case which demonstrates many issues related to the production of electronic data is Thomas F. Linnen, et als, Plaintiffs v. A.H. Robbins Company, Inc., et als, No. 97-2307 (Mass.Super. June 16, 1999). Mary Linnen, had been taking a combination of the diet drugs fenfluramine and phentermine (aka Redux and Pondimin), or fen/phen, in order to get in shape for her wedding. Her parents, alleging that it was these diet drugs that caused her death, sued, among others, drug maker Wyeth-Ayerst Laboratories, Inc. and American Home Products (AHP). They claimed that the manufacturers sold the drugs knowing that the combination was potentially fatal. The challenge was to demonstrate what the defendants knew and when the defendants knew it.

The focus of this article is to present an improved approach to extracting useful and relevant information from electronic data. While litigation is not the only reason to conduct searches of electronic data (others include corporate due diligence in mergers and acquisitions, detection of corporate espionage, and the protection of trade secrets), it is the most common. In the past, searching electronic data was only done if absolutely necessary because it was technically difficult and expensive. In the context of litigation, poor data retention policies and practices often resulted in costly data production projects forced upon an organization. As a result, if the cost to the defendant of extracting electronic data exceeded the cost of settling, the defendant would settle. Today, improved tools have made searching electronic data more cost effective, resulting in a leveling of the playing field between plaintiffs and defendants. While traditionally wielded by plaintiffs as a sword, defendants who manage their electronic data (including proper data retention practices) now have a shield.

In Linnen, the information that would make or break the case was buried within email backups. Repeatedly and unabashedly, defendants denied the existence of backup tapes, stating to the Court and in correspondence to the plaintiff:

"I have previously advised you that Wyeth has no ‘mass storage devices’ or other backup tapes containing electronic mail messages relating to Redux and Pondimin from Jan. 1, 1994, to Jan. 1, 1997. You asked me to confirm that fact and I do so here again." Munday, Alicia. Dispensing With the Truth, St. Martin’s Press, 199-200 (2001).

Since few, if any, large organizations conduct business without email, and because email has become a business critical application, it stands to reason that backup tapes existed, despite defendant’s protestations to the contrary. Plaintiff’s strategy for locating the backup tapes was to demand the deposition of a man in a Wyeth Business Unit Support group. Shortly before the deposition was to commence, one of Wyeth’s attorneys casually mentioned that Wyeth may have "a few" backup tapes with information relating to the diet drugs. Upon investigation, defendant’s counsel located backup tapes, one of which was particularly damaging as it contained an email written by Wyeth-Ayerst administrator Kay Anderson, stating, "Do I have to look forward to spending my waning years writing checks to fat people worried about a silly lung problem?" Since the "silly" lung problem complained of by injured parties (primary pulmonary hypertension) was 100% fatal, the inflammatory nature of this email and its potential damage to the defendants was catastrophic. In addition, it was ascertained that backup tapes (if any existed) ordered preserved by the Court had been permanently destroyed and could not be retrieved. As a result of this destruction of email evidence, the defendant was facing a spoliation instruction from the judge to the jury: The jury could infer that the destruction of backup tapes was intentional, and the data contained therein was unfavorable to the defense.

Because of the destroyed email, American Home Products agreed to pay approximately $1 million for the "sampling" (versus complete review) of backup tapes (produced by the defendants in a separate litigation, some of which overlapped what the defendant should have produced to Linnen). The method used to review the backup tapes was to "sample" the data on the backups rather than restore and review the backups in their entirety. This was done per the Court’s instructions, but had the parties instead been required to make a more thorough review, it is highly probable that additional damaging evidence would have been discovered.

The approach still used by the majority of companies and consultants behind the scenes is to manually restore and review data. These laborious procedures involve using large numbers of paralegals to manually review and locate what is relevant. Sometimes these vendors produce this data on paper but do not make the actual binary files available for review. This approach is an inadequate representation of the data as data files themselves contain much richer information than a simple printout exposes. To Summarize, the manual restorative approach is expensive, time consuming and inefficient. Moreover, manual review processes are not foolproof and oversight (missing a critical document) is commonplace. Fortunately, new and efficient tools and processes improve upon past practices.

Assuming that a "complete review" of the evidence was necessary in the fen-phen case (versus the actual "sampling" that took place), the approach is to first gather all the hard drives, personal digital assistants and other sources of discoverable evidence and create a database which contains all of this data regardless of its source. The two types of data we are concerned with are primary data sources such as hard disks, and secondary data sources such as backups and deleted data. Data that is irrelevant such as operating system files and program files are identified but not included in what becomes the evidentiary database. Finally, bibliographic information is coded for responsive data. The key to making the database useful is the organization and coding of bibliographic data. Much of this coding can be automated to find what are likely to be most important documents. These new technologies are a huge improvement over traditional manual reviews.

These new technologies allow us to process data regardless of what application created it. We can mine that data for what is most important, and ensure the integrity of that data by proving it is unaltered from the original. Utilizing these tools, a plaintiff has control over all the evidence (paper based and electronic) in one centralized location. Centralization of data is a key advantage for defendants as well. Defendants can locate and prepare explanations for potentially damaging materials. Additionally, defendants are now armed with the tools to fight cases where they may have previously settled in order to avoid the expense and complication of protracted discovery.

It is normally difficult to examine the contents of a binary file without accessing that file via the program and operating system that created it. Utilizing a product such as DocuMatrix (an automated electronic evidentiary database product from NMatrix, Inc., New York, NY), all data is centralized into a searchable database. Attorneys can then search that entire body of data for key words and phrases, code and catalog that data with their impressions, and if necessary review the original unaltered files. They can also utilize the automated coding facilities (Auto-coding) to automate large portions of bibliographic coding as well locate documents likely to be of the highest importance to the case.

When processing electronic data, there are additional precautions to take to prove chain of custody and that files are unaltered. The ability to prove that a file is what it purports to be is made possible by digital signature technology (specifically, one way hashing functions such as MD5 or SHA). The issue is that files that have identical names (and even identical sizes) can exist in different directories and may or may not have the same contents. Automating the determination of what is and what is not a duplicate file eliminates having to manually review the contents of duplicate files. It may be relevant who saw a particular file (what electronic mailbox contains it), but an attorney reviewing the data in the case need not read the file multiple times. Information about what that file contains is already coded in the database based upon the first occurrence of that file.

Digital signatures provide us with the means to quickly identify and eliminate operating system and program files. Because every binary file has a unique signature, these files are safely ignored. As we process data, information about where the data was originally located is recorded, such as where a file was stored on the file system (or to what message it was attached).

Documents with identical digital signatures are coded as being the exact same thing (except for their location which is different). If a document is coded and another document has the same digital signature, the database automatically associates the bibliographic information of the first file with its duplicate(s). EDataMatrix automatically records this "metadata" (data about data). By searching on this unique hash value it is easy to create a report of every location where a particular piece of evidence exists and infer from its location what individual(s) had access. This is an extremely powerful tool for deposition and trial preparation. Taking this one step further, deposition transcript text is simply another electronic data type for the system to catalog. Within that catalog it is possible to determine quickly what every deposition witness has said about a particular piece of evidence (electronic or paper) by coding the deposition exhibits as attachments to deposition pages. In short, EDataMatrix eliminates the drudgery of manual document review and reduces the possibility of missing a critical document or accidentally producing a privileged document.

Since the vast majority of all information created is in electronic format, it makes sense that there must be a way to electronically search data (regardless of the application that created that data). What we want to accomplish is to quickly locate the relevant documents that warrant further review. Once this data is located, it is useful to categorize that data in a way that permits easy analysis and retrieval. Parts of this process can be automated through the utilization of programs that automatically locate and code data based upon case-specific search criteria.

Another source of potentially useful data is raw data as it exists on physical devices (hard disks, floppy disks, removable devices etc.). Forensic examination (an examination of media to locate deleted data can reveal all sorts of information that a party may believe no longer exists. The reason for this is that when a computer operating system deletes data the data is not actually removed. Rather, the operating system marks space in use as available. The actual data is still on the device until new data takes its place. The expense (who pays) associated with forensic recovery of data varies and may differ at a Court’s discretion. As always, it is necessary to determine whether the value of the data to be retrieved is likely to exceed the cost of recovery.

EDataMatrix allows attorneys to locate immediately what is likely to be the most important documents in a case. By eliminating manual review of large amounts of "junk" data such as operating system files, programs and file duplicates, an attorney is able to more quickly focus on (and find) what is most important. Data is organized and can be produced to a party properly redacted, bates numbered (individual unique page numbering) and indexed. Production to a party can be either on paper or electronic, hosted on-site or safely via the Internet by utilizing a VPN (Virtual Private Network). The processes that eliminate "junk" always maintain the immediate availability of the original data files for examination.

Automated coding (Auto-coding) provides is a huge boost to productivity. For example, the auto-coding processes allow us (without manual review) to locate the vast majority of documents authored by "Jones", between "11/01/00 and 12/01/02" containing the text "FDA approval" and "Smith" that mention the pharmaceutical "Zyclor". Files satisfying the search criteria can be saved into a folder for later review (all the aforementioned bibliographic data is automatically coded to associate that data with the documents). Additional searches utilizing different criteria allow for the cataloguing and identification of all case issues. These programs include a thesaurus function so that a search can automatically return documents that contain all synonyms for the word "valuation" such as "assessment", "estimation", "appraisal", "survey" etc. Attorneys are able to quickly and cost effectively find the needles in their evidentiary haystack.

The ability of attorneys to manage electronic data is increasingly important. Cases are won and lost based upon counsel’s ability handle new data types efficiently. Absent proper management, electronic data works against the unprepared. Documents are produced that should never have been produced (because of privilege or attorney work product), or a party receives data but overlooks it. Tools such as EDataMatrix (for electronic discovery) combined with DocuMatrix (the database component where all electronic, paper and transcript evidence resides) provide lawyers with a centralized data repository for all evidentiary materials. Paper Chase Technologies, Inc. looks forward to assisting counsel with their most complex evidentiary challenges.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.