Current Issues In Electronic Discovery

Every attorney dreams of uncovering one critical piece of evidence, commonly called the "smoking gun," that would both (1) persuade the jury and (2) disable the opposing counsel's case. In the last decade, the hope of locating the "smoking gun" has fallen heavily on (1) the apparent promise of discoverable electronic data and (2) the realization that this type of information exists in abundance.

Many recent cases illustrate the use of just this kind of important electronic evidence. The most prominent example, of course, is the electronic mail messages (e-mail) in which Bill Gates discussed his plans to undercut competition. In 2000, an e-mail written by Henry Blodget, a Merrill Lynch stock analyst, was discovered. In that e-mail, Blodget made derogatory references to the tech stocks he had touted to investors. The Blodget e-mail was discovered in a lawsuit that Merrill Lynch settled for over $100 million.²

In May of 2004, a federal jury convicted former investment banker Frank Quattrone of obstructing justice and witness tampering. That case hinged on an e-mail in which the jury concluded that Quattrone encouraged colleagues to destroy files.³

As early as 1970, Rule 34 of the Federal Rules of Civil Procedure was amended to make it clear that Rule 34 applies to the discovery of electronic documents:

The proliferation and advancement of technology has greatly impacted commercial litigation. With 70 percent of all business data now stored in some electronic medium,⁵ a large portion of commercial litigation today contains some element of electronic discovery. Some of the information available in electronic form may have been previously unavailable in hard copy form.

There have been at least three practical problems in the discovery of electronic information: (1) some or all of the information may become effectively inaccessible due to changes in computer hardware and software, (2) it may not be possible to effectively search and locate information that is responsive to discovery requests or otherwise relevant to the claims or defenses asserted, and (3) the cost of locating responsive or relevant information may be very high.

Prior to the proliferation of electronic information storage, some litigants who incurred substantial expense outside the ordinary course of business in responding to discovery requests sought to shift some of the cost of such compliance to the party requesting discovery. Recently, a number of Courts have addressed the issue of the circumstances under which the cost of responding to discovery requests directed to electronic information may be shifted to the requesting party, either in whole or in part.

This article will review the different kinds of data that fall into the broader category of electronic information. This article will highlight (1) the nature of the data, (2) the process necessary to retrieve the data, (3) the problems specific to this process, and (4) the associated factors driving cost.

This article will also provide an overview of the judiciary position relative to cost-shifting by outlining factors used to determine cost allocations.

To date, e-mail communication has been the most prevalent and highly publicized type of electronic document utilized in legal proceedings.⁶ E-mail tends to be an informal mode of communication, and it is often used without any caution.

E-mail messages may be widely distributed. And, it is almost impossible to control copies that are electronically forwarded. Hence, potentially damaging communications can proliferate throughout the organization and beyond. This distribution increases the possibility of these communications becoming discovered.

Frequently, employees retain messages of a personal nature as well as business messages. Often, there is no easy way to discern the difference between personal and business e-mails.

The most significant problem with e-mail is the volume. For even e-mails between employees of one company, there are at least two copies: (1) one copy at the originator's computer and (2) one copy at the computer of the recipient. The number of copies can increase significantly with multiple recipients and forwarding, or if the e-mail is transmitted over the Internet through an internet service provider.

One important task in discovery may be to eliminate duplicate copies of the same e-mail.⁷ Manually inspecting tens of thousands of e-mails to determine whether they are duplicates, as well as for their substance or significance to the issues of a case (1) requires a heavy investment of time and (2) may raise issues of privilege, depending upon how the review is performed and by whom.

A number of software packages are available that (1) may eliminate duplicate e-mails, (2) simplify the strings of e-mails commonly seen when a e-mail is forwarded multiple times, and (3) search for keywords and phrases. The use of outside consultants and experts may make this process more cost effective.

The fact that information is often disclosed capriciously in e-mail messages makes its content difficult to ignore. E-mail messages can provide valuable leads during the commercial litigation process.

Beyond e-mail, many other forms of electronic information are available including: internally produced word processing documents, spreadsheets, databases, pictures, graphics, electronic calendars, contact managers, internal and external communications, internet access, instant messages, and system activity logs.

In litigation, discovery of information in the form of electronic media has become commonplace. Storch v. IPCO Safety Products Company is only one case in which the Court found that "…it is not unreasonable for the defendant to produce the information on computer disk…."⁸

A number of courts have addressed the issues of whether a respondent may be required to produce information in electronic form, and whether it may be required to produce information in both electronic and hard copy formats.

There are significant advantages to having documents in electronic format. Discovery in electronic format provides the ability to perform (1) key word searches and (2) document indexing. These procedures can save an enormous amount of time and money. Further, electronic files regularly store additional information within a document that is not apparent in the printed copy.

These data are called "metadata." Metadata are defined as information about a document stored electronically within the document. Each file contains a date and time stamp that records: (1) when the document was created, (2) who created it, (3) when it was last accessed, and (4) (possibly) a trail of editorial changes.

Also, both e-mail and programs generating computer faxes keep logs of dates of transmission and receipt, trails of recipients, as well as when each e-mail was opened. With this information, it is relatively simple to establish a chronology of computer activity. Cases may be made—or discredited—with basic evidence related to who, what, where, and when.

Electronic documents exist simultaneously at several different levels, one of which may be described as "active." In the paper environment, documents are either maintained in the office or are archived. Active data are similar to paper documents maintained "in the office," where information is readily available for use by the computer.

As active data are readily available, the cost to actually obtain the data is frequently viewed to be relatively small. However, in many instances it may be very expensive and time consuming to determine what information in this category is responsive to specific discovery requests. In addition, screening responsive information for privilege may be very expensive and time consuming.

Companies typically make archival backup copies of data on a regular basis in the form of removable media, typically on tape or optical disk. This process assists in the preservation of information so that computer operations or individual pieces of data may be recovered when necessary.

Such recovery "events" typically include: system failure, inadvertent erasure, computer malfunction, database corruption, or catastrophes such as fires, floods, or earthquakes. In the past, archiving was also conducted (1) to preserve space and (2) to improve computer processing capacity.

Information may also be placed in a backup, or archive, status simply because there is too great a volume of information to keep it all in an active status. Most organizations have formalized procedures to ensure that such backups are made of critical systems and networks. However, many organizations do not focus on the backup of personal computers, laptops, or personal data assistants (PDAs). Backup data are somewhat more difficult, and, accordingly, more costly to obtain.

In Kaufman v. Kinko's Inc., the Court granted the plaintiff's motion to compel the defendant's production of certain e-mail messages retrievable from the defendant's backup system.⁹

Due to the high cost of recovery, some recent cases have used statistical "sampling" of the population of backup data in order determine the cost-benefit of more comprehensive electronic discovery. Therefore, developing a statistically valid sampling plan may become a crucial component in the electronic discovery process.

The cost of accessing backup data may increase significantly if it becomes necessary to search older data. Some data may have been created using a software package that is no longer in use by the party responding to discovery requests, or that is no longer available or supported by the original software vendor. In addition, some backup data may have been placed on storage media that are no longer accessible using hardware in use by the party.

Such circumstances may substantially increase the cost of accessing such data. And, such circumstances may require the hiring of consultants and renting third party data facilities.

Although e-mails are stored as active data, it is also usually available as backup. Retrieval of e-mail from backup media present specific issues. E-mails are stored in a proprietary database format, such as Microsoft Exchange/Outlook or Novell Groupwise. These e-mail databases may be costly to restore from backup media.

Typically, e-mail systems must be restored into the exact operating system environment in use at the time of the backup. It may be very time consuming to recreate these environments. For this reason, most cases involve some form of sampling to determine if further recovery is warranted.

Residual data are information that appear to be gone, but are still recoverable from the computer. When a file is "deleted," it typically is not removed from the computer. Computers maintain a file allocation table (FAT) that tracks the name and exact location of every piece of data stored on its hard disk.

Unless specific steps are taken to truly "delete" a file, deleting a file merely alters its name in the in the FAT. The actual file remains on the disk until the space is over written.

There are several utility programs available to recover lost or deleted files. Networks also track the user that deleted the file. Finding and recovering deleted files can provide valuable information in a litigation or investigation.

Further, files that are over written may not be completely destroyed. Files are stored in "sectors." A sector is the smallest unit of space for data that can be accessed on a disk. Sectors are arranged on the disk in concentric circles called tracks.

A single file may span several sectors. Further, a single file may be scattered over the disk in order to maximize space efficiency. FAT tracks the location and contents of all these sectors on the disk.

Moreover, when files are written to sectors, any unused space in the sector is not over written. Therefore, old data may reside in this space. This is referred to as "slack space" or "file slack." This slack space can provide sources of useful evidence.

Operating systems and applications regularly create copies of files in order to (1) facilitate recovery, (2) improve performance, or (3) perform a routine operation. These files are sometimes described as "file clones," or "temporary files," and are created for a specific purpose. Later, they are deleted by the operating system or application.

Data left over from this process are referred to as "replicant data." When a word processing file is opened, the application creates a working copy of the file to maintain the edits. When the file is saved, it overwrites the original file with the working copy and deletes the working copy.

When you visit an Internet site, images are downloaded onto the hard drive to optimize performance, which are called "cache files." A history of internet sites visited is also maintained on the computer. When a document is printed, software creates a copy of the file to send to the printer so it will not tie up the application.

Since these files are generated automatically, most users are not aware that these files exist. All of these files remain on the computer until overwritten and may provide a valuable source of evidence.

A number of courts have addressed issues relating to the discovery of residual data. For example, in Dodge, Warren & Peters Insurance Services v. Riley, the court entered an Order "to allow a court-appointed expert to copy all of it, including computer hard drives and discs, recover lost or deleted files, and perform automated searches of that evidence...."¹⁰

Retrieval of replicant data has also been addressed by courts in criminal cases. In United States v. Sanchez, investigators used software to "…find 'remnants' of files that were overwritten or deleted from the hard drive..."¹¹

In State v. Voorheis, "…the computer forensic examination recovered text from 'instant messaging' conversations..."¹²

Instant messages (IM) are text messages sent and received over the Internet between two users logged on the service supplier. There are two main suppliers of this service: Yahoo and America Online.

Recently, the National Association of Security Dealers (NASD) and the New York Stock Exchange (NYSE) have required that these messages be retained as business records. These messages may or may not leave residual data on a computer.

The cost to retrieve replicant data can be very significant. It almost certainly requires the use of computer forensics experts. Further, forensic experts are required to follow extensive and careful protocol’s to maintain the "chain of custody" in order to prove that evidence was not spoiled or altered.

Typically, a forensic computer expert will make an exact copy of the subject computer disk, commonly called an "image." This image will be used as the basis for the forensic investigation. This forensic investigation process can be extremely disruptive to the normal operation of the litigant. Therefore, the courts may evaluate whether such an intrusive process is warranted on a case-by-case basis. In many cases, this type of discovery may not be appropriate or necessary.

Typically, the cost of responding to discovery, including discovery of electronic information, is borne by the producing party. However, recent decisions have articulated an analysis which may result in the shifting of some of that cost to the requesting party.

In what commentators are already calling an important case, a federal District Court issued two detailed opinions. The opinions contain extensive analysis of the circumstances under which the expense of responding to discovery requests directed to e-mail systems and other electronic records may be shifted to the party seeking the discovery.

In Zubulake v. UBS Warburg LLC, the District Court held that cost-shifting should be considered only when electronic data are relatively inaccessible, such as on backup tapes. This court used a sampling process to assist it in evaluating whether the cost of responding to discovery should be shifted.

The process outlined by the District Court would be relatively expensive for parties responding to such discovery requests. This is because it requires potentially extensive and costly activity before the Court even considers shifting any of the costs to the requesting party.

The District Court outlined seven factors to be considered in the evaluation of whether to shift the cost. These seven factors are not entitled to equal weight; and, the factors are listed in order of importance:¹³

1. the extent to which the request is specifically tailored to discovery relevant information,
2. the availability of the information from other sources,
3. the total cost of producing the requested information versus the amount in controversy,
4. the total cost of producing the requested information versus each party's resources,
5. the relative availability and motivation of each party to control costs,
6. the importance of issues at stake in the litigation, and
7. the relative benefits of the information to each of the parties.

In Zubulake, UBS maintained e-mails in three ways: (1) on active e-mail servers, (2) on optical disks (optical disks are read-only storage devices that are available to and searchable by users on-line), and (3) on off-line backup tapes (archived).

The District Court ordered UBS to produce all responsive e-mails on its active e-mail servers and optical disks at its own expense.

The District Court ruled that cost shifting was not appropriate for e-mails that were searchable and "accessible" on-line. UBS contended that it had 94 backup tapes with potentially responsive e-mails, and that it would take five days to restore each backup tape on its system at an estimated cost of approximately $300,000.

The District Court ordered UBS to (1) produce responsive e-mails from any five backup tapes selected by Zubulake and (2) file an affidavit detailing the results of the search.¹⁴

The restoration of five tapes yielded 8,344 e-mails, 6,203 of which were unique after eliminating duplicates. UBS also determined that approximately 600 were responsive to Zublulake's request, and produced them. Approximately four percent of the responsive e-mails were withheld on the basis of privilege.

The consultant's fees for this process were $11,524.63, and the total cost, including attorney and paralegal time, was $19,003.43. UBS estimated to costs of restoring the remaining backup tapes to be an additional $165,954.67 for consultants and $107,694.72 for attorney and paralegal time.

On July 24, 2003, based on a highly factual review of the content of the e-mails produced from the five restored backup tapes, the court determined that the tapes contained plainly relevant but not indispensable evidence. Factors one through four tipped against cost-shifting (although factor two only slightly so), while factors five and six were neutral, and factor seven favored cost shifting.

Finding that the amount of cost to be shifted is a matter of "judgment and firmness rather than a mathematical consequence of the seven factors," the District Court shifted 25 percent of the consultants' fees to Zubulake, with UBS to bear 100 percent of the attorney and paralegal cost.

It is important to note that the analytical framework used by the Zubulake court is inherently subjective. This is not an area in which clear, objective guidance is possible.

Indeed, some courts use a different framework for evaluating the shifting of costs. And, even courts which use the same framework might reach different results based on the same facts.

Clearly, the electronic age has expanded counsel's ability to discover critical information not previously available. This will require coordination between counsel and computer forensic professionals so as to target and obtain the required evidence in a cost-effective manner.

It is important that all professional parties involved in commercial litigation obtain a base, core level of knowledge related to electronic discovery.

1. This article is not intended to provide legal advice, and should not be construed to be the opinion of Jorden Burt, LLP or any of its clients.

2. L. Stuart Ditzen, "You’ve Got Evidence." Philadelphia Inquirer, January 11, 2004.

3. Erin McClam, "Web Investment Banker Quattrone Convicted." Associated Press, May 3, 2004.

4. Rule 34 of the Federal Rules of Civil Procedure.

5. Kristin M. Nimsger, "Same Game, New Rules." Legal Times, March 11, 2002.

6. Many companies maintain other types of information in electronic format as well, and such information may also be subject to discovery requests. There is no reason that the principles discussed in this article should apply differently to different types of electronically maintained information.

7. In some instances, whether a specific individual received a copy of an e-mail may have critical significance, in which case the elimination of all duplicate e-mails would not be desirable.

8. Storch v. IPCO Prod. Co. of Pa., 134 Lab. Cas. (CCH) ¶33,560 (E.D. Pa. July 16, 1997).

9. Kaufman v. Kinko's Inc., No. CIV.A.18894-NC, 2002 WL 55402 (Del. Ch. Apr. 16, 2002).

10. Dodge, Warren, & Peters Ins. Servs., Inc. v. Riley, 130 Cal. Rptr. 2d 385, (Ca. Ct. App. 2003).

11. United States v. Sanchez, 59 M.J. 566 (A.F. Ct. Crim. App. 2003).

12. State v. Voorheis, 844 A.2d 794 (Vt. 2004).

13. Zubulake v. UBS Warburg LLC, 216 F.R.D. 280 (S.D.N.Y. 2003); Zubulake v. UBS Warburg LLC, 91 Fair Empl. Prac. Cas. (BNA) 150,2003 WL 21087136 (S.D.N.Y. May 13, 2003).

This is by no means the only court that has considered shifting the cost of responding to electronic discovery. An earlier opinion, with a slightly different analysis, is found at Rowe Entertainment, Inc. v. William Morris Agency, Inc., 205 F.R.D. 421 (S.D.N.Y. 2002).

14. Ibid.

This publication may be cited as "Willamette Management Associates Insights, Summer 2004 issue."