Category Archives: eDiscovery

November 12, 2019 · 9:07 AM

How Case Teams Can Streamline Collections with X1 in RelativityOne

Editor’s’ Note: This article originally appeared on The Relativity Blog. It is reprinted here in full with permission. 

by Sam Bock on November 07, 2019

Our September 2019 release for RelativityOne debuted some game-changing functionality in the platform. Collect for RelativityOne enables fast, secure, and defensible collections right within the cloud, allowing RelativityOne users to pull data directly from Microsoft Office 365 without ever leaving the platform or Azure.

One of our developer partners—X1—joined up with us on building this functionality, bringing their patented technology into Collect to help simplify traditionally complex workflows.

To get a better picture of just what Collect and X1 Distributed Discovery are capable of now that they’ve teamed up, we sat down with X1 Executive Chairman and Chief Legal Officer John Patzakis. Check out the most impactful takeaways from our conversation, and sign up for X1’s upcoming webinar to learn more.

Sam: What makes collection challenging for today’s legal teams?

John: Traditional e-discovery collection methods consist of either unsupervised custodian self-collection or manual services, driving up costs while increasing risk and disruption to business operations. On the other end of the spectrum, endpoint forensic imaging is burdensome, expensive, and not legally required for civil litigation discovery. Additionally, these manual and disjointed efforts are not technically integrated with Relativity, thus requiring multiple hand-offs, which increases risk, expense, and cumbersome project management efforts.

How does your team think creatively to tackle those challenges in the interest of conducting faster, more defensible collections for your customers?

We tackle collection from the enterprise and also enable significant scalability. X1 Distributed Discovery enables enterprises and their service providers to search, assess, and analyze electronically stored information (ESI) across hundreds or even thousands of custodians, enterprise-wide, where the data resides and before collection, with direct upload into Relativity. Instead of the expensive and disruptive “image then stage then process then load into review workspace” process, X1 Distributed Discovery allows for access to ESI where it sits within hours.

What sorts of variables exist in today’s collection workflows, and how does your team accommodate for those differences?

One of the biggest challenges with modern enterprise ESI collection comes from remote employees who only log into the network intermittently. Most network-enabled collection tools require custodians to be on the domain in order to work. However, X1 is architected to feature SSL security certificates—creating secure tunnels that enable collection from custodians wherever they are, including on WiFi in a Starbucks or on a plane.

Another key challenge is email collection. Traditional workflows often require collecting an entire PST email container or Exchange email account back to a central location for processing, identification, and preservation of potentially responsive email messages. This approach involves the transferring and processing of large files, which takes a lot of time, before even beginning to identify individually responsive email messages. Our solution eliminates the need to transfer entire email containers by allowing the identification and collection of individual messages in place on a custodian’s computer.

How is Collect for RelativityOne built to manage modern collections more effectively?

Collect integrates the X1 Distributed Discovery architecture to leverage patented search technology that indexes Microsoft Office 365 data directly on the laptop, desktop, or file server, allowing e-discovery, investigatory, or forensic professionals to globally query thousands of individual endpoints simultaneously. Individual emails and files can be identified by keyword, dates, and other metadata content without having to first retrieve the entire PST or ZIP across the network.

Collecting enterprise ESI can be one of the most daunting parts of the e-discovery process, and X1’s technical integration with RelativityOne seeks to make it less intimidating. The software helps streamline the e-discovery workflow by eliminating expensive and cumbersome processing steps and dramatically increasing speed to review. Collect for RelativityOne provides legal teams with a solution that compresses project timeframes; reduces risk by integrating collection with the rest of Relativity’s suite of features for review and analysis; and creating a repeatable process that helps reduce overall efforts and costs that might otherwise be spent outside of the platform. Additionally, the tight integration between X1’s technology and Relativity provides a unified chain of custody for optimal defensibility.

In short, we’re excited to see how this functionality, built into Relativity’s collection tool, can help revolutionize the current e-discovery process by collapsing the many hand-offs involved in the EDRM into a few short steps manageable by one or two people.

What tips and best practices would you share with a team conducting complex collections? How can they set themselves up for success from the start?

When collecting data, plan your collection criteria carefully. Focus on granular search criteria including file types, data ranges, and other key metadata in addition to detailed Boolean search terms to help your team strategically reduce collection volumes.

Sam Bock is a member of the marketing team at Relativity, and serves as editor of The Relativity Blog.

Leave a comment

Filed under collection, Corporations, eDiscovery, Enterprise eDiscovery, Uncategorized

September 11, 2019 · 10:02 AM

Overcoming Evidentiary Challenges to Social Media Evidence

By John Patzakis

As succinctly noted by The Florida Bar Association in its publication, Florida Law Journal: “Social media is everywhere. Nearly everyone uses it. Litigants who understand social media–and its benefits and limitations–can immeasurably help their clients resolve disputes…it is inevitable that the social media accounts of at least one person involved in a dispute will have potentially relevant and discoverable information.“ However, the FLJ warns that “If not properly researched, preserved, and authenticated, the best social media evidence is worthless.” “Social Media Evidence: What You Can’t Use Won’t Help You” (2014) Florida Law Journal, Volume 88, No. 1. social-media-cases3

In fact, many courts have rendered “smoking gun” and other key web-based evidence worthless because the proponent offered a simple printed a copy of a social media webpage, and thus failed to meet evidentiary authentication requirements. Notable recent cases with such rulings include Linscheid v. Natus Medical Inc. 2015 WL 1470122, at *5-6 (N.D. Ga. Mar. 30, 2015), (finding LinkedIn profile page not authenticated by declaration from individual who printed the page from the Internet); Monet v. Bank of America, N.A., 2015 WL 1775219, at *8 (Cal Ct. App. Apr. 16, 2015), (memorandum by an unnamed person about representations others made on Facebook is at least double hearsay” and not authenticated), Moroccanoil vs. Marc Anthony Cosmetics, 57 F.Supp.3d 1203 (2014), (Facebook screenshots inadmissible in a trademark infringement without supporting circumstantial information).

Commonwealth v. Mangel 181 A.3d 1154 (2018), is a must-read case that provides an instructive and detailed case study on the perils of improperly collecting social media evidence for court.  In that case, the Superior Court of Pennsylvania addressed the standard for admissibility of social media posts and ultimately disallowed into evidence a social media post presented by the prosecution as a simple screen shot. In Mangel, the State charged the defendant with aggravated assault and harassment and sought, in a pre-trial hearing, to introduce evidence of an image of bloody hands posted to Facebook, as well as messages allegedly authored by the defendant. The Facebook account at issue bore the defendant’s name, hometown and high school, which the prosecution argued was sufficient to authenticate the proffered evidence.

Both the trial court and the appellate court found that merely presenting evidence that the posts and messages came from a social media account bearing the Defendant’s name was not enough to allow the evidence in. Instead, the court noted that “authentication of electronic communications, like documents, requires more than mere confirmation that the number or address belonged to a particular person. Circumstantial evidence, which tends to corroborate the identity of the sender, is required.” Metadata is a key form of circumstantial evidence, and the Mangel court noted the conspicuous omission of two key metadata items: the date the post was created, and account ID:

“A thorough review of the Facebook posts and messages themselves raises specific issues. First, the evidence presented by the Commonwealth does not indicate the exact time the posts and messages were made. The incident which brought about the instant criminal charges occurred allegedly on June 26th, 2016, according to the Criminal Information. The lack of a date and timestamps raises a significant question regarding the connection of the posts and messages to the alleged incident on June 26th, 2016. Furthermore, the ‘Tyler Mangel’ who allegedly authored the Facebook posts and messages does not specifically reference himself in the incident on June 26th, 2016; rather, other individuals, many of them who are not directly involved in the instant criminal case, reference a ‘Tyler Mangel’ in response to a post made and in subsequent conversations about an alleged assault.”

By using best practices instead of print screen, practitioners can avoid the falling victim to outcomes like in Mangel. A party can authenticate electronically stored information (“ESI”) per Rule 901(b)(4) and Rule 902(14) with circumstantial evidence that reflects the “contents, substance, internal patterns, or other distinctive characteristics” of the evidence.  Many courts have applied Rule 901(b)(4) by ruling that metadata and file level hash values associated with ESI can be sufficient circumstantial evidence to establish its authenticity, including Lorraine v. Markel American Insurance Company, 241 F.R.D. 534 (D.Md. May 4, 2007.

For further analysis on additional case law, applicable rules of evidence and practice tools, X1 has prepared a detailed white paper on evidentiary authentication of social media and other web-based evidence. You can access this valuable resource here.

Leave a comment

Filed under Authentication, Best Practices, Case Law, eDiscovery, Preservation & Collection, Social Media Investigations, Social Media Metadata

Tagged as

August 15, 2019 · 9:20 AM

Web Collection With Legitimate Public Policy Purpose Deemed Legal and Proper by Federal Courts

By John Patzakis and Craig Carpenter

Social Media evidence collection for judicial and compliance purposes can involve web collection techniques using artificial or “examiner” accounts in order to access and collect public information. This process involves a degree of automation and results in the collection and preservation of the evidence for analysis, authentication, and potential disclosure to other parties and presentation in court as evidence. According to multiple US Federal Courts, notably, Sandvig v. Sessions, 315 F. Supp. 3d 1 (D.D.C. 2018), such activities are not only legally permissible, but protected under the First and Fifth Amendments of the US Constitution.  icons_social_media2

A Federal District Court in Northern California reached a similar result regarding routine web scraping in hiQ Labs, Inc. v. LinkedIn Corp., 273 F. Supp. 3d 1099, (N.D. Cal.  2017), although the Sandvig court also specifically addressed the use of automated bots in conjunction with artificial user accounts.

In Sandvig, the Plaintiffs are academic researchers who assess online housing, finance, and employment transactions to identify any discriminatory effects of algorithms.  To accomplish this, they create fake profiles, including profiles for minorities, write automated collection bots, and use those profiles and bots to engage and test the profiles and collect resulting data. The Plaintiffs freely admitted that their activities violated various terms of service provisions of third party Internet sites, and thus sought a preemptive declaratory judgment ruling from the federal court to allow their activities.

In ruling in the academics’ favor, the court found that web scraping “falls under the ambit of the First Amendment.” And that “simply placing contractual conditions on accounts that anyone can create, as social media and many other sites do, does not remove a website from the First Amendment protections of the public Internet.” The Sandvig Court noted that the US Supreme Court has made a number of recent statements that give full First Amendment application to the gathering of public information, most notably, Packingham v. North Carolina, 137 S. Ct. 1730 (2017). The Packingham Court struck down a state prohibition on registered sex offenders accessing social media websites, without concern for whether any given website might itself act to bar users who are registered sex offenders. As Packingham recognized, given the nature of the Internet as a locus of communication and expressive activity, state-imposed restrictions on accessing the Internet are subject to First Amendment scrutiny regardless of whether an individual is seeking “access to particular websites, run by private companies.”

Regarding the issue of automated collection techniques, the Sandvig Court determined “that plaintiffs wish to scrape data from websites rather than manually record information does not change the analysis. Scraping is merely a technological advance that makes information collection easier; it is not meaningfully different from using a tape recorder instead of taking written notes, or using the panorama function on a smartphone instead of taking a series of photos from different positions. And, as already discussed, the information plaintiffs seek is located in a public forum.”

And regarding the artificial or “fake” accounts needed to collect data and interact with the public information on the subject sites, the court ruled “plaintiffs have a First Amendment interest in harmlessly misrepresenting their identities to target websites.” The Court noted that plaintiffs’ research requires them to create false employer and job-seeker profiles on employment websites and to use automated bots “to make it appear to a number of housing and employment sites that multiple people are accessing the information they have made available.” The court again cited the Supreme Court, this time in United States v. Alvarez, 567 U.S. 709 (2012), which provides that because “some false statements are inevitable if there is to be an open and vigorous expression of views in public and private conversation,” and because “[t]he Government has not demonstrated that false statements generally should constitute a new category of unprotected speech”  false claims that are not “made to effect a fraud or secure moneys or other valuable considerations fall within First Amendment protection.”

The Sandvig ruling is directly relevant to the user base of X1 Social Discovery, who use X1 to gather evidence for judicial purposes, including civil litigation, regulatory and corporate compliance matters, and for their criminal defense. This is constitutionally protected activity under the free speech and right to petition (access the courts) clauses of the First Amendment, and the Fifth Amendment right to due process. In the international arena, there similarly is a recognized common law right to gather evidence.

In fact, the public policy and Constitutional justifications are arguably particularly stronger for those who use web collection to gather evidence for judicial and compliance purposes. Social media evidence collection of third party public data is a standard and widespread practice mandated by the courts, legal ethics, and the rules of evidence. Copious volumes of case law, legal treatises, and state bar ethics opinions provide that the legal duties of competency and diligent representation necessitate that attorneys search, collect and preserve social media evidence, and that the failure to do so can constitute ineffective assistance of counsel. (see, Cannedy v Adams, 706 F.3d 1148 (9th Cir. 2013)).

It is also critical that the right software be used for social media evidence collection. When lawyers and their representatives resort to print screen or simple flat file images, they are failing to collect key metadata and cannot effectively authenticate the evidence, thus rendering it worthlessly inadmissible for trial purposes. Simple screen captures are not defensible, with several courts disallowing or otherwise calling into question social media evidence presented in the form of a screen shot image. Additionally, flat file images dramatically increase eDiscovery processing costs, while the right software can readily import data straight into attorney review platforms for efficient search, review, tagging, redaction and production.

There are of course limitations to be aware of in this arena. Engaging in mass surveillance or engaging in large-scale data collection and brokering that data for marketing or other improper purposes would arguably fall outside of these protections. However, these recent legal rulings, including relevant Constitutional analysis and precedent from the US Supreme Court, provide that important guidance to legal and compliance professionals who necessarily utilize examiner accounts to engage in web collection of social media data for judicial and compliance purposes.

Leave a comment

Filed under Best Practices, Case Law, eDiscovery, Preservation & Collection, Social Media Investigations, Social Media Metadata, Uncategorized

July 9, 2019 · 9:36 AM

Social Media Statements: Key Evidence and Often Exceptions to the Hearsay Rule

By John Patzakis

Here is a quick legal evidence quiz: Identify the three distinct hearsay exceptions in the following Tweet:

Accident 5

 

The first exception would be under Federal Rule of Evidence 803(2):

“Rule 803. Exceptions to the Rule Against Hearsay: . . . (2) Excited Utterance. A statement relating to a startling event or condition, made while the declarant was under the stress of excitement that it caused.”

Pretty clear here. The four OMGs are a good indication. So no one can argue that the phrase “OMG” never has any legal consequence.

The second exception would be under FRE 803(1): “Present Sense Impression. A statement describing or explaining an event or condition, made while or immediately after the declarant perceived it.”

And if the witness some time later did not recall details of the incident (two words: Vegas, hangover), the statement could be introduced as a recorded recollection under 803(5).

Another key hearsay exception are statements offered as evidence of the then state of mind of the declarant. While YouTube is known for cat videos, Twitter and Facebook are in large part a platform for statements like this:

Happy Tweet

 

In other words, to quote FRE 803(3): “Then-Existing Mental, Emotional, or Physical Condition. A statement of the declarant’s then-existing state of mind (such as motive, intent, or plan) or emotional, sensory, or physical condition (such as mental feeling, pain, or bodily health)”

While social media is a great place to find out what Kim Kardashian and Justin Bieber are thinking or feeling on a given day, the state of mind of a party or witness is a common issue in many legal matters. (See Gordon v. T.G.R. Logistics, Inc. (D. Wy. May 10, 2017) (Court orders production of entire Facebook Account history as relevant to mental and emotional state of Plaintiff)).

And finally, arguably the most compelling social media evidence stems from the propensity to self-incriminate oneself on Twitter, otherwise known as a Statement Against Interest under FRE 804(b)(3).  This takes multiple forms, including flat out admissions of liability, or previous statements that contradict or otherwise impugn the integrity of a declarant. For instance:

Trump tweet

 

The bottom line is that social media provides a treasure trove of evidence that also tends to fall under evidentiary hearsay exceptions, unlike other forms of out of court statements.

But if you are offering social media evidence under a hearsay exception in court, that would likely mean you have an uncooperative or otherwise unavailable party who authored the social media statement in question. In such cases, the authenticity of the post must be established through circumstantial evidence since direct testimony is not available, and you will need the right software to both identify such evidence and properly collect it utilizing best practices to ensure its admissibility in court.

1 Comment

Filed under Authentication, Best Practices, Case Law, Case Study, eDiscovery, Social Media Investigations

May 20, 2019 · 9:30 AM

Want Legal to Add A LOT More Value? Stop Over-Collecting Data

blog-cassting-net

The 2019 CLOC (Corporate Legal Operations Consortium) Conference ended last week, and by all accounts it was another great event for an organization that continues to gain relevance and momentum.  A story in Thursday’s Legaltech News entitled “Why E-discovery Savings Is About Department Value for Corporate Legal” summarized a CLOC session focused on “streamlining e-discovery and information governance inside corporate legal departments.”  At the risk of sounding biased, that seems like a perfect topic to me.

The article’s conclusions from the panel session, namely adding value by wresting control of eDiscovery from outside counsel, consolidating hosting vendors and creating a “living data map”, were all spot on and certainly useful.  One way for legal to add enormous value, however, was NOT discussed: collecting far less data as part of the eDiscovery, investigatory and compliance processes.

As we highlighted on an insightful webinar with our partner Compliance Discovery Solutions last Tuesday (which can be viewed here), the way most eDiscovery practitioners conduct ESI collection is remarkably unchanged from a decade ago, an example of which is shown in the infographic below: consult a data map, image entire drives from each and every custodian (e.g. with EnCase), load these many images into a processing application (e.g. Nuix), process these huge amounts of data (most of which is entirely irrelevant), then move this now-processed data into a review application (e.g. Relativity).

blog-legacy-collection-infographic

This legacy collection process for GRC (Governance, Risk & Compliance) and eDiscovery is wildly inefficient, disruptive to the business and costly, yet many if not most practitioners still use it, most likely because it’s the status quo and change is always hard in the legal technology world.  But change here is a must, as this “image everything à then process it all à and only then begin reviewing” workflow causes myriad issues not just for legal but for the company as well:

  • Increases eDiscovery costs exponentially. The still-seminal Rand study on eDiscovery pegged an overall cost-per-GB for identification through production of $1,800/GB.  While some elements of this price have come down in the intervening 6-7 years, especially processing and hosting rates, data volumes and variety have grown by at least as much thereby negating these reductions.  Imaging entire drives by definition collects far more data than could ever be relevant in any given matter – and the costs of this overcollection multiply every step thereafter, forcing clients to pay hundreds of thousands if not millions of dollars more than they should.
  • Is extremely disruptive to employees. Forensically imaging a drive usually requires gaining physical access to the laptop or desktop for some period of time, often for a day or two.  Put yourself in each of those employee’s shoes: even if you are given a “loaner” machine, you still don’t have all of your local information, settings, bookmarks, etc. – which is a major disruption to your work day and therefore a significant drag on productivity.
  • Takes far too long. With forensic imaging of drives requiring physical access to a device, each custodian’s machine must be dealt with.  In many collections, custodians are spread across multiple offices, or on vacation, or remote employees, which often extends the process to many weeks if not months.  All of this time lawyers are unable to access this critical data (e.g. to begin formulating case strategy, negotiating with opposing counsel or a regulator, etc).
  • Creates unnecessary copies of data that could otherwise be remediated. An often-overlooked byproduct of over-collection is that it creates another copy of data that is outside of most (if not all) data remediation programs.  For companies that are regulated and/or encounter litigation regularly, this becomes a major headache and undermines data governance and remediation programs.
  • Forces counsel to “fly blind” for months. Every day the IT and legal teams are spending forensically imaging each custodian’s drives, then processing it, and only then loading it into a review or analysis application is a day in-house and outside counsel are flying blind, unable to look at key data to begin constructing case strategy, conduct informed interviews, negotiate with opposing counsel (e.g. on the scope of a matter, including discovery) or interact with regulators.  This is incredibly valuable time lost for no value received in return.
  • Using forensic tools for non-forensic processes is unnecessary overkill. The irony of this “image everything” approach is that it is extreme overkill: it would be like a doctor whose only procedure to get rid of a mole was to cut off the arm.  Forensic images can always be utilized on a one-off basis in narrow circumstances where there are concerns about possible spoliation of evidence, but for the vast majority of circumstances, a forensic image is completely unnecessary.

As was a focus at the recent CLOC conference in Las Vegas, corporate legal operations are quite correctly focused on showing the value legal is bringing to the business.  However, there is still a fundamental change they need to make to how they handle the collection of ESI for eDiscovery, GRC and privacy purposes that would be an enormous value-add to all parts of the company, including legal: ending the systematic over-collection of data.  How this can be done quickly and cost-effectively has been the subject of previous blog posts, but will be addressed in detail in the next few weeks as well.

Leave a comment

Filed under Best Practices, collection, compliance, Data Audit, eDiscovery, Enterprise eDiscovery, Uncategorized