The International Legal Technology Association recently published a very informative and comprehensive law firm eDiscovery practice survey “2018 Litigation and Practice Support Survey.” ILTA received responses from 181 different law firms — small, medium and large — on a variety of subjects, including eDiscovery practice trends and software tool usage. The survey reveals three key takeaways regarding social media and website discovery.
The first clear takeaway is that social media discovery is clearly increasing among law firms and in the field in general. 90 percent of responding law firms reported conducting social media discovery in 2018. Additionally, the responding firms reported a higher average volume of cases involving social media evidence, with a 46 percent increase in firms handling at least 20 matters per year involving social media evidence.
Source: ILTA 2018 Litigation and Practice Support Survey
In terms of identified software solution usage, the survey establishes that X1 Social Discovery is the clear leader in the web and social media capture category among purpose-built tools used by law firms. 63 percent of all surveyed law firms rely on X1 Social Discovery on either an in-sourced or outsourced basis. This is consistent with our own internal data, reflecting the industry’s standardization of social media evidence collection by the sheer volume of customers that have adopted X1 Social Discovery. Nearly 200 law firms and 400 eDiscovery services firms have at least one paid license of X1 Social Discovery.
And in addition to social media evidence collections, X1 Social Discovery registered as the most popular eDiscovery software used for webmail collection (i.e. Gmail, Yahoo, Aol, Office 365) with 32 percent of law firms relying on X1 for this purposes. X1 Social Discovery provides an extremely effective means to collect, search, tag, and export via loadfile or pst web-based email evidence.
The final takeaway is that the practice of using screen captures with general IT tools like Adobe and Snagit is still commonly employed by practitioners at law firms, but is virtually non-existent amongst service providers, who typically are on the forefront of adapting best practices. Screen capturing is neither effective nor defensible. They are ineffective because the results are very narrow and incomplete, and the process is very labor intensive resulting in much higher costs to the client than using best practices. (See Stallings v. City of Johnston, 2014 WL 2061669 (S.D. Ill. May 19, 2014): the law firm spent a full week screen capturing contents of a Facebook account — which amounted to over 500 printed pages — manually rearranging them, and then redacting at a cost of tens of thousands of dollars).
In addition, simple screen captures are not defensible, with several courts disallowing or otherwise calling into question social media evidence presented in the form of a screen shot image. This scrutiny will only increase with Federal Rule of Evidence 902(14) now in effect. I have previously addressed Rule 902(14) at length on this blog, but in a nutshell, screen captures are not Rule 902(14) compliant, while best practices technology like X1 Social Discovery have the critical ability to collect all available metadata and generate an MD5 checksum, or “hash value,” of the preserved data for verification of the integrity of the evidence. The generation of hash values is a key component for meeting the requirements of FRE 902(14).
The ILTA Litigation Practice survey results can be accessed here. For more information about how to conduct effective social medial investigations, please contact us, or request a free demo version of X1 Social Discovery.
The Sedona Conference® (“TSC”) has just published the 2nd edition of their very useful Primer on Social Media. Sedona is a very influential organization so this is an important development further underscoring the importance of social media evidence. According to TSC, the Primer series “provides best practice guidance on the corporate use and management of social media, as well as their preservation, collection, and production in the form of electronically stored information (ESI).”
The 93 page second edition is a valuable resource and a must read for every legal and eDiscovery practitioner who address social media evidence. For purposes here, I have outlined 5 particularly interesting takeaways:
Attorney’s Duty of Competency Requires Focus on Social Media Evidence
TSC’s Primer notes that “ethics rules require lawyers to understand the impact and consequences of social media,” and that “Counsel is responsible for reasonably investigating client social media content to identify relevant information and provide oversight of the search and production of such information. (at pg. 26).” The Primer tracks and cites ABA model ethics Rule 1.1[8], noting that “counsel must be competent (or partner with a competent lawyer) to facilitate appropriate discovery of [social media evidence]. (at pg. 27)”
The Primer also features a good discussion of Lester v. Allied Concrete Company, where the plaintiff’s attorney did not meet his ethical obligations and instead blithely instructed his client to rid his Facebook page of damaging evidence, resulting in what many attorneys believe is the most severe eDiscovery court sanction imposed upon a lawyer. As the Primer reinforces, social media is highly relevant as evidence, and it is thus important that attorneys, paralegals, eDiscovery consultants and investigators proactively seek out such evidence, ensure its preservation, and include the investigation in their standard processes and checklists.
Static “Print Screen” Captures are Problematic
As we have noted many times on this blog, print screen is not best practices for collection social media and other web-based evidence. TSC’s Primer provides important guidance on this point: “Printing out social media data has its evidentiary limitations, as a static image does not capture the metadata of the image, other than whatever information may be viewable as part of the screen shot. As a result, static images may result in an incomplete and inaccurate data capture that is hard to authenticate,” and that “[a]ny such collection will most likely be a visual representation that does not include metadata, logging data, or other information that would allow the content to be easily navigated and used. (at pp 45-46)”
Extensive Discussion of Evidentiary Authentication for Web-based Evidence and Rule 902(14)
Noting that “[a]uthenticity is a key issue that a court must consider in determining the admissibility of social media evidence,” the Primer dedicates an entire section to the subject. This section features a good overview of case law, summarizing that “courts generally seem to agree that the mere testimony of the person who downloaded or printed out social media content, without more, is insufficient to establish its authenticity.” As such, the Primer advises that “parties proffering social media content should make sure they develop and present foundational evidence beyond simply printing or down-loading the content from the internet.” (at pp 85-86).
Among the authentication methods outlined by the Primer is Federal Rule of Evidence 902(14), which provides that electronic data recovered “by a process of digital identification” is to be self-authenticating. The Primer notes that with a proper social media collection process, FRE 902(14) will enable most litigants to utilize written certifications instead of costly trial testimony of a forensic or technical expert. But again, only where best practices are employed. For more resources, this blog has extensively addressed FRE 902(14). (See here).
Negative Peer Review of Facebook’s DIY Function
When considering what constitutes best practices for collection of electronic evidence, courts and counsel generally look to industry peer review and publication under the Daubert Standard, which includes those factors, among others, as a framework for judges to determine whether scientific or other technical evidence is admissible in federal court. Sedona Conference publications are among the most important peer review in the eDiscovery world, so it is notable that the Primer says this about Facebook’s built in “Download Your Information” function:
Although the information from the Facebook download can perhaps be used as evidence in particular situations, it may be it may be preferable to have a vendor obtain the data with the appropriate tools for accessing and then reviewing the information in a manner that includes available metadata.
The Primer goes on to outline how certain data may be omitted by Facebook’s DIY and thus and the use of provider-controlled export tools, “may raise preservation and collection issues,” and that as those tools are often modified or updated without notice or documentation “the frequent changes to the export tools pose some risk that counsel should consider.” (at pp 47-48)
Positive Peer Review Mention of X1 Social Discovery
The Primer does offer positive peer review of technical solutions for social media eDiscovery, noting that “Vendors have developed technology to allow certain content to be collected in a way that preserves the content and captures various metadata fields associated with social media data. Properly captured, these metadata fields can assist with establishing the chain of custody and authentication. They can also help to facilitate more accurate and efficient data processing and review.”
In the same section, The Primer provides this description of X1 Social Discovery affirming industry general acceptance:
“One of the popular social media discovery collection tools is X1 Social Discovery, which has API collection tools for Facebook, Twitter, YouTube, Instagram, and Tumblr, along with the capability to collect webpages and email from other providers.” (at pg. 49).
A full copy of TSC’s Primer on Social Media can be accessed here.
For more information on X1 Social Discovery, please see here.
The New York Appellate Division allowed discovery into the non-public information of the social media accounts of a former professional basketball player relevant to his personal injury claims arising out of an automobile accident. In Vasquez-Santos v. Mathew 2019 NY Slip Op 00541 (January 24, 2019), the court held that the defendant may utilize the services of a “data mining” company for a widespread search of the plaintiff’s devices, email accounts, and social media.
Vasquez-Santos is an extension of a large body of court decisions that allow discovery of a user’s “private” social media messages, posts and photos where that information is reasonably calculated to contain evidence material and necessary to the litigation. Private social media information can be discoverable to the extent it “contradicts or conflicts with [a] plaintiff’s alleged restrictions, disabilities, and losses, and other claims” according the Vasquez-Santos Court.
The Court found that the defendant “is entitled to discovery to….defend against plaintiff’s claims of injury,” and noted that the requested access to plaintiff’s accounts and devices “was appropriately limited in time, i.e., only those items posted or sent after the accident, and in subject matter, i.e., those items discussing or showing defendant engaging in basketball or other similar physical activities.”
Also noteworthy was the Court’s finding that while plaintiff did not take the pictures himself, that was of no import to the decision. He was “tagged,” thus allowing him access to the pictures, and thus populated his social media account.
This decision is consistent with the general rule that while social media is clearly discoverable, there must be a requisite showing of relevance before the court moves to compel full production of a litigant’s “private” social media.
This case illustrates that any solution purporting to support eDiscovery for social media must have robust public search and collection capabilities. This means more than merely one-off screen scrapes but instead an ability to search, identify and capture up to thousands of social media posts on an automated and scalable basis.
X1 Social Discovery has the ability to find an individual’s publicly available content and to collect it in an automated fashion in native format with all available metadata intact to enable systematic and scalable search, review, tagging and analysis. We heard from one major law firm that screen captures of a single public Facebook account took several hours, with the resulting images not searchable or organized into a case-centric workflow. Now with X1 Social Discovery, they are able to accomplish this full capture in seconds. This is critically important to conduct proper due diligence on a case and to better assist legal and investigative professionals to make the requisite showings for the full discovery of social media evidence in civil discovery, as in Vasquez-Santos.
In his recent blog post, X1 CEO Craig Carpenter discussed the inability of any software provider to solve a critical need by delivering a truly scalable eDiscovery preservation and collection solution. As Craig pointed out, in the absence of such a “holy grail” solution, eDiscovery collection remains dominated by either unsupervised custodian self-collection or manual services, driving up costs while increasing risk and disruption to business operations.
Craig outlined how endpoint forensic imaging are still employed on a limited basis. Many companies have also tried network crawling methods with repurposed forensic tools. (A “collection 2.1” method, if you will). While this can be feasible for a small number of custodians, network bandwidth constraints coupled with the requirement to migrate all endpoint data back to the forensic crawling tool renders the approach ineffective. For example, to search a custodian’s laptop with 10 gigabytes of email and documents, all 10 gigabytes must be copied and transmitted over the network, where it is then searched, all of which takes at least several hours per computer. So, most organizations choose to force collect all 10 gigabytes. The case of U.S. ex rel. McBride v. Halliburton Co. 272 F.R.D. 235 (2011), illustrates this specific pain point well. In McBride, Magistrate Judge John Facciola’s instructive opinion outlines Halliburton’s eDiscovery struggles to collect and process data from remote locations:
“Since the defendants employ persons overseas, this data collection may have to be shipped to the United States, or sent by network connections with finite capacity, which may require several days just to copy and transmit the data from a single custodian . . . (Halliburton) estimates that each custodian averages 15–20 gigabytes of data, and collection can take two to ten days per custodian. The data must then be processed to be rendered searchable by the review tool being used, a process that can overwhelm the computer’s capacity and require that the data be processed by batch, as opposed to all at once.”
Halliburton represented to the court that they spent hundreds of thousands of dollars on eDiscovery for only a few dozen remotely located custodians. The need to force-collect the remote custodians’ entire set of data and then sort it out through the expensive eDiscovery processing phase, instead of culling, filtering and searching the data at the point of collection drove up the costs. As such, this network crawling based architecture is fundamentally flawed and cannot scale.
What is needed is the ability to gain immediate visibility into unstructured distributed data across the enterprise, through the ability to search and collect across several hundred endpoints and other unstructured data sources such as file shares, and return results within minutes instead of days or weeks. The approaches outlined above and by Craig Carpenter do not come close to meeting this requirement and in fact actually perpetuate eDiscovery pain.
Solving this collection challenge once and for all is basis for X1 Insight and Collection, which is our eDiscovery collection 3.0 solution. X1 Insight and Collection (XIC) enables enterprises to quickly and easily search across up to thousands of distributed endpoints and data servers from a central location. Legal and compliance teams can easily perform unified complex searches across both unstructured content and metadata, obtaining statistical insight into the data in minutes, and full results with completed collection in hours, instead of days or weeks. Built on our award-winning and patented X1 Search technology, XIC is the first product to offer true and massively scalable distributed data discovery across an organization. XIC replaces expensive, cumbersome and highly disruptive approaches to meet enterprise discovery, preservation, and collection needs.
Targeted and iterative end point search is a quantum leap in early data assessment, which is critical to legal counsel at the outset of any legal matter. However, under today’s industry standard, the legal team is typically kept in the dark for weeks, if not months, as the manual identification and collection process of distributed, unstructured data runs its expensive and inefficient course. To illustrate the power and capabilities of XIC, imagine being able to perform multiple, detailed, Boolean keyword phrase searches with metadata filters across the targeted end points of your global enterprise. The results start returning in minutes, with granular statistical data about the responsive documents and emails associated with specific custodians or groups of custodians.
Once the legal team is satisfied with a specific search string, after sufficient iteration, the data can then be collected by XIC by simply hitting the “collect” button. The responsive data is “containerized” at each end point and automatically transmitted to either a central location, or uploaded directly to Relativity, using Relativity’s import API where all data is seamlessly ready for review. Importantly, all results are tied back to a specific custodian, with full chain of custody and preservation of all file metadata. Here is a recording of a live public demo with Relativity, showing the very fast direct upload from XIC straight into RelativityOne.
This effort described above — from iterative, distributed search through collection and transmittal straight into Relativity from hundreds of endpoints — can be accomplished in a single day. Using manual consulting services, the same project would require several weeks and hundreds of thousands of dollars in collection costs alone, not to mention significant disruption to business operations. Substantial costs associated with over-collection of data would mount as well, and could even dwarf collection costs through unnecessary attorney review time.
XIC operates on-demand where your data currently resides — on desktops, laptops, servers, or even the cloud — without disruption to business operations and without requiring extensive or complex hardware configurations. Beyond enterprise eDiscovery and investigation functionality, organizations can offer employees the award-winning X1 Search, improving productivity while maintaining compliance.
As Relativity Product Manager Barry O’Melia said in the live X1/R1 integration demo, it is something you have to see for yourself to believe. So please check out the demo here, or contact us to arrange for a private demo.
Editor’s Note: The following is a blog post published by eDiscovery expert Chad Jones, Director at D4 Discovery, regarding D4’s extensive testing and validation of the integration of R1 and X1 Insight and Collection. It is republished here with permission.
Discovery is a complicated business. For a typical litigation, there are at least five separate stages, collection, processing, review, analysis, and production, and while the average discovery period lasts eight to ten months, the matters themselves can run for years. During the lifecycle of a common eDiscovery project, these five stages are usually performed by several different parties, which further complicates the process by introducing a variety of hand-offs and delays between organizations and individuals.
The proof of concept that follows was designed to validate Insight and Collection, a product created by X1 Discovery, Inc, and that now features a direct upload to Relativity and RelativityOne. With this product, X1 proposes to streamline the five-stage process by allowing enterprises to search locally, collect those search hits, process the results and push them directly to RelativityOne in a matter of minutes.
To evaluate the viability of the X1 Insight and Collection, D4, LLC. designed and executed the following Proof of Concept (POC). A leader in forensic collection services and a seven-time Relativity Best in Service, Orange Levelhosting partner, D4 staff leveraged its expertise in end to end eDiscovery to implement the workflow and document the results.
Background
Project
eDiscovery is a multi-stage process with a series of hand-offs between disconnected parties. This process can be extremely expensive and error prone. In addition to the costs, the time to review can often span weeks or even months to complete.
Stakeholders
Those who stand to benefit from X1 Insight and Collection are business and organization leaders looking to manage and control the cost and risks of discovery.
Solution Features and Benefits
There are several features of the X1 Insight and Collection: search-in-place, early case assessment visualizations, remote collection, processing on demand, publish to review in RelativityOne. Searching in place on the local machine has several benefits. It prevents needless over collection and saves the end user from the hassle of turning over her machine and losing productivity. It also gives case teams the opportunity to iterative refine search terms and review search hits on the fly.
Finally, searching in place replaces the need to collect data and load to a master repository for indexing and searching. This includes email containers – the ability to index, search and collect all email in place on the custodian’s computer or the corporate Exchange server without the need to migrate the entire container or full account is a strong and unique capability. With X1’s remote collection, once users target the specific files and emails they need, they can immediately collect and process that information. Once collected and processed, enterprise users have the option of creating standard load files or sending text, metadata and native files directly to RelativityOne.
Practical Details of POC
To test and vet the software, D4 built a mini-cloud environment, consisting of five custodian machines; one enterprise server; and one client server meeting the specs listed below:
Server 1
OS: Microsoft Server 2012 R2
CPU: 2.6 GHz minimum 8 processors
Memory: 16 GB RAM
Disk: 180 GB free hard disk space (software)
Disk 2: 1TB for collected data (or available network drive)
Server 2
OS: Microsoft Server 2012 R2
CPU: 2.6 GHz minimum 8 processors
Memory: 32 GB RAM
Disk: 180 GB free hard disk space (software)
Testing Desktop: (QTY 5)
OS: Microsoft Windows 7, 8 or 10
CPU: 1.8 GHz minimum 2 processors
Memory: 8 GB RAM
On each custodian machine we placed a mix of email and non-email data. From these data sets we ran a series of tests from which we collected data.
Although X1 Insight and Collection provides a variety of workflows allowing for a complex collection strategy, for the purposes of this proof-of concept, the collection was limited to a simple Boolean query of common football related terms across Enron data. We made two separate collections of email data: a collection to disc with load files and a collection direct pushed to RelativityOne. The terms used in the POC were: “football OR game OR trade OR QB OR league OR cowboys OR longhorns OR thanksgiving OR player.” Following the collections, the results of the load file export were test loaded to Relativity and the results of the dataset published direct to RelativityOne were evaluated in that workspace.
Test Results
The testing process considered four main areas: documenting search results; documenting upload/download times; metadata validation; and reports and exception handling. To test the search results the loaded data was indexed, and searches run to confirm the results. In both load formats, the search results remained the same as shown below.
It is important to note that in Relativity only the text was searched while in X1 all metadata was also included in the search. This is a common difference between review platforms and collection tools, as collection tools are able to search all components of the file, while review is limited to extracted metadata fields only.
Additional tests were performed to document search and exports speeds. One of the components of X1 Insight and Collection is its collection module which sits on the client server and manages the collection from a central location. In the initial test, we chose to export the files to disc and create a load file, while in the second test we leveraged X1s integration with RelativityOne and upload data to Relativity’s cloud instance via the Relativity API.
In both cases, the results proved that X1 is incredibly powerful. Each time the system executed saved searches on five separate machines, pulled the data to the client server, extracted text and metadata and then either generated a load file or sent the deliverable straight to the cloud and into Relativity – all within minutes. The results, shown below, are amazing. In both cases the system completed all steps in under 13.5 minutes. Additional tests were performed to document search and exports speeds.
One of the components of X1 Insight and Collection is its collection module which sits on the client server and manages the collection from a central location. In the initial test, we chose to export the files to disc and create a load file, while in the second test we leveraged X1s integration with RelativityOne and upload data to Relativity’s cloud instance via the Relativity API. In both cases, the results proved that X1 is incredibly powerful. Each time the system executed saved searches on five separate machines, pulled the data to the client server, extracted text and metadata and then either generated a load file or sent the deliverable straight to the cloud and into Relativity – all within minutes. The results, shown below, are amazing. In both cases the system completed all steps in under 13.5 minutes.
Further testing showed that while X1 gets the essential metadata components extracted from the data, there are some features we are used to seeing in established eDiscovery processing tools that are lacking in this product. We also found the exception reporting to be lacking. In our RelativityOne tests, we found 40 files were excluded from upload, yet when reviewing the available exception reporting we had trouble seeing what caused those file failures. These issues notwithstanding, the POC proved successful. X1 Insight and Collection proved to be a powerful search engine and collection tool, capable of collecting over 6,000 documents from five separate machines and uploading those files to RelativityOne in less than fifteen minutes!
Conclusion
X1 Insight and Collection offers multiple benefits to the enterprise user looking to take control of the eDiscovery life cycle. By simplifying the course of an eDiscovery project, X1 limits the number of touch points in the traditional vendor-driven process. Internal users can search and vet terms in real-time before collection. This not only mitigates the opportunity for error, but it greatly reduces the time to review, which is what this solution really seems to be all about. X1 seems to have been designed with the internal investigation in mind. Offering a light tagging feature, X1 gives users a light ECA option that with a couple mouse clicks becomes a collection and processing tool that connects directly to all the features of RelativityOne. When combined with Relativity ECA, Analytics and Active Learning, this might be all the solution the typical enterprise would need.
