March 22, 2016 · 11:08 AM

Enterprise eDiscovery Collection Remains Costly and Inefficient

2016 marks my sixteenth year as a senior executive in the eDiscovery business. I began my career as a co-founder at Guidance Software (EnCase), serving as General Counsel, CEO and then Vice Chairman and Chief Strategy Officer from 1999 through 2009. After becoming the dominant solution for computer forensics in the early part of the last decade, Guidance set out to define a new field — enterprise discovery collection. Despite a good foundational concept, a truly scalable solution that could search across hundreds, or even thousands, of enterprise endpoints in a short period of time never came to fruition. To date, no other eDiscovery vendor has delivered on the promise of such a “holy grail” solution either. As a result, eDiscovery collection remains dominated by either unsupervised custodian self-collection, or manual services.

tron1

 

Organizations employ limited technical approaches in an effort to get by, and thus enterprise eDiscovery collection remains a significant pain point, subjecting organizations to both significant cost and risks. This post is the first of a two part series on the status of the broken enterprise eDiscovery collection process. Part two will outline a proposed solution.

Currently, enterprises employ four general approaches to eDiscovery collection, with two involving mostly manual methodologies, and the other two predominantly technology-based. Each of the four methods are fraught with inefficiencies and challenges.

The first and likely most common approach, is custodian self-collection, where custodians are sent manual instructions to search, review and upload data that they subjectively determine to be responsive to a matter. This method is plagued with severe defensibility concerns, with several courts disapproving of the practice due to poor compliance, modifying metadata, and inconsistency of results. See Geen v. Blitz, 2011 WL 806011, (E.D. Tex. Mar. 1, 2011), Nat’l Day Laborer Org. v. U.S. Immigration and Customs Enforcement Agency, 2012 WL 2878130 (S.D.N.Y. July 13, 2012).

The second approach is manual services, usually performed by eDiscovery consultants. This method is expensive, disruptive and time-consuming as many times an “overkill” method of forensic image collection process is employed. It also often results in over collection, as the collector typically only gets one bite at the apple, thus driving up eDiscovery costs. While attorney review and processing represent the bulk of eDiscovery costs, much of these expenses stem from over-collection, and thus can be mitigated with a smarter and more efficient process.

When it comes to technical approaches, endpoint forensic crawling methods are employed on a limited basis. While this can be feasible for a small number of custodians, network bandwidth constraints coupled with the requirement to migrate all endpoint data back to the forensic crawling tool renders the approach ineffective. For example, to search a custodian’s laptop with 10 gigabytes of email and documents, all 10 gigabytes must be copied and transmitted over the network, where it is then searched, all of which takes at least several hours per computer. So, most organizations choose to force collect all 10 gigabytes. The case of U.S. ex rel. McBride v. Halliburton Co.  272 F.R.D. 235 (2011), Illustrates this specific pain point well. In McBride, Magistrate Judge John Facciola’s instructive opinion outlines Halliburton’s eDiscovery struggles to collect and process data from remote locations:

“Since the defendants employ persons overseas, this data collection may have to be shipped to the United States, or sent by network connections with finite capacity, which may require several days just to copy and transmit the data from a single custodian . . . (Halliburton) estimates that each custodian averages 15–20 gigabytes of data, and collection can take two to ten days per custodian. The data must then be processed to be rendered searchable by the review tool being used, a process that can overwhelm the computer’s capacity and require that the data be processed by batch, as opposed to all at once.”

Halliburton represented to the court that they spent hundreds of thousands of dollars on eDiscovery for only a few dozen remotely located custodians. The need to force-collect the remote custodians’ entire set of data and then sort it out through the expensive eDiscovery processing phase, instead of culling, filtering and searching the data at the point of collection drove up the costs.

And finally, another tactic attempted by some CIOs to attempt to address this daunting challenge is to periodically migrate disparate data from around the global enterprise into a central location. This Quixotic endeavor is perceived necessary as traditional information management and electronic discovery tools are not architected and not suited to address large and disparate volumes of data located in hundreds of offices and work sites across the globe.  But, boiling the ocean through data migration and centralization is extremely expensive, disruptive and frankly unworkable.

What has always been needed is gaining immediate visibility into unstructured distributed data across the enterprise, through the ability to search and collect across several hundred endpoints and other unstructured data sources such as file shares and SharePoint, and return results within minutes instead of days or weeks. None of the four approaches outlined above come close to meeting this requirement and in fact actually perpetuate eDiscovery pain.

Is there a fifth option? Stay tuned for my next post coming soon.

Leave a comment

Filed under Best Practices, Case Law, eDiscovery, eDiscovery & Compliance, Enterprise eDiscovery, Information Governance, Information Management, Preservation & Collection

February 23, 2016 · 1:45 PM

Leveraging Analytics for Social Media Investigations

Professional digital investigations often involve hundreds of thousands of items of disparate information. Many of our X1 Social Discovery customers report collecting and searching through over a million social media posts and web pages in a single case. With the amount of digital evidence that exists now, analytical tools like IBM i2 Analyst’s Notebook are critical to speeding investigation processes.  These tools provide multiple benefits:

  • Rapidly piece together disparate data into a single cohesive intelligence picture
  • Quickly Identify key people, events, connections and patterns that will likely be otherwise missed
  • Increase understanding of the structure, hierarchy and method of operation of criminal, terrorist and fraudulent networks
  • Simplify the communication of complex data to enable timely and accurate operational decision making

What investigators now realize is that social media data is critical and extremely relevant to nearly every investigation.  In fact, major social media evidence was overlooked in the San Bernardino shooting: one of the shooters, Tashfeen Malik, made several posts to her Facebook account in 2012 and 2014 that strongly suggested that she held radical jihadist views.  Also, there are indications that a comprehensive search of the publicly available information of her social media friends would have also indicated such ties. To date, however, Analyst’s Notebook users have not been able to quickly and efficiently take advantage of this evidence treasure trove.

Using slower, manual “flat file” data ingestion often leads to a highly manual and extremely inefficient process, plagued by broken links and over-importation of irrelevant entities and links.  X1 Social Discovery for i2 provides a simple, automated and highly scalable way to import this information directly into Analyst’s Notebook for immediate analysis and graphing.   As the graphic below shows, very powerful relationships can be revealed by people’s activities on social networks.

 analyst and X1

The X1 and IBM partnership is an exciting one – customers have been clamoring for an efficient mechanism to get social media content into Analyst’s Notebook and now they have it.  Please view the recording of the recent joint IBM and X1 webinar that demonstrates the product integration and how powerful social media analytics can be for investigations.

Leave a comment

Filed under Best Practices, Social Media Investigations, Social Media Metadata

February 9, 2016 · 3:58 PM

SEARCH REVEALS HUNDREDS OF IMPROPER JUROR SOCIAL MEDIA POSTS PER DAY (PART 2)

In response to our post two weeks ago identifying widespread social media abuse by jurors that could quite possibly lead to mistrials, a frightened prosecutor and others have inquired about how exactly juror’s social media data should be collected and what the various techniques are. So this follow-up post discusses the mechanics of proactively monitoring jurors that are both empaneled and potential members of your pool.

First and foremost, it is important to understand what not to do. Do not fire up Twitter.com and start following jurors. They will receive a notice that they’re being followed, which is improper under various legal ethics rules. Also, it is not effective technically, as you cannot access or search past tweets very effectively (which are often just as important as ones in real time), and it is very difficult to monitor up to several dozen jurors in your pool.

The right software will allow you to employ several techniques and methods, which are most effective when used in conjunction to comprehensively and ethically search for all publicly available juror social media.

The first method is to set a geo-fence around the courthouse and immediate area. This will collect tweets and Instagram posts in real time, as well as going back several days if needed, to collect any tweet that is geo-located in that area. Here is an example of such an effort:geo fence

Another advantage of this method is that it will capture any geo-located social media posts by not only jurors at the courthouse but also by opposing counsel or witnesses, which happens more often than you would think. Expert witnesses in particular can be prolific on social media as they promote their services and their personal brand. They also often Tweet and share approvingly links to industry articles and blog articles, which can then be considered to be part of their opinion record.

The second method is to set keywords such as #juryduty or “jury duty” across the public feed of social media sites. This will cast a wider net, returning posts from all over the country if not the world. But with the right tools you can quickly be able to filter out the ones that are within your geographical location. This will also capture posts that are not Geotagged by the user.  If your case has any media attention, even just locally or within industry media verticals, it is a very good idea to set up keywords that can identify any mention of your case in public feeds.

And just for fun, here are the top 5 controversial juror posts from just the past few days:

bad tweets

And finally, once you have identified an impaneled juror or a member of the potential pool, and have their social media profile names,  you can quickly and anonymously collect all their past and ongoing public social media content through special software such as X1 Social Discovery. This also has the advantage of instantaneous and unified search across all available social media streams from multiple jurors. You also can set up email alerts so that if a juror or other person of interest posts anything, you will immediately be alerted to that post. This is also an effective technique when following opposing counsel or key witnesses. And it’s often a good idea to your monitor your own clients as well.

For more information about how to conduct effective social medial investigations, please contact us, or request a free demo version of X1 Social Discovery.

1 Comment

Filed under Best Practices, Case Study, Legal Ethics & Social Media, Social Media Investigations, Uncategorized

Image

Search Reveals Hundreds of Improper Juror Social Media Posts Per Day

The Federal Judicial Center (“FJC”) recently published a report surveying 952 federal district court judges to identify the scope of jurors’ improper use of social media during trial and how the courts are addressing the problem. The FJC’s report, Jurors’ Use of Media During Trials and Deliberations, reflects that despite various prevention efforts, jurors continue to use Facebook, Twitter, Google and other sites in several, and that the courts continue to struggle to detect such usage. According to the survey results, 30 judges identified incidents of improper juror social media usage,

Such misconduct can easily result in a mistrial or even reversal of judgement. In State v. Smith, Sept. 10, 2013, the Tennessee Supreme court vacated a first degree murder conviction on the sole grounds that one of the jurors communicated with a prosecution witness during trial via Facebook. The court lamented that Internet and social media “has exponentially increased the risk….of extra-judicial communications between jurors and third parties.” This decision is but one example of this common occurrence of juror misconduct through social media use, requiring attorneys and jury consultants to engage in on-going passive monitoring of publicly available social media information.

In fact we recently did our own search of the Twittersphere with X1 Social Discovery, and uncovered several hundred improper Juror tweets in a single day (1/13/2016). Here is a small sampling:

juror tweets

 

 

 

 

 

 

 

 

 

 

 

 

 

(click to enlarge)

It is thus no surprise lawyers are increasingly using Twitter to investigate and monitor potential and impaneled jurors. However, this type of monitoring activity can lead to serious attorney ethics violations if direct or even indirect communications are sent to the juror as a result of such monitoring activities. (See e.g. New York County Law Association Formal Opinion No. 743, May 18, 2011). Proxies hired by attorneys, including eDiscovery service providers, investigators and jury consultants are subject to these restrictions, which can also apply to social media communications with witnesses or opposing parties who are represented by counsel.

For this reason, X1 Social Discovery features a specialized “public follow” feature that enables access to all the past Tweets of a specified user (up to 3200 past tweets) and any new Tweets in real-time without generating a formal “follow” request with the resulting problematic communication.. These legal ethics rules concerning indirect social media communications underscores the importance of employing best practices technology to search and collect social media evidence for investigative and eDiscovery purposes.

Collecting evidence in a manner that prevents, or at minimum, does not require that attorneys and their proxies directly or indirectly communicate with the subjects from whom they are collecting social media evidence is a core requirement for solutions that truly address investigative and eDiscovery requirements for social media. In addition to preserving and authenticating social media evidence in a proper manner, X1 Social Discovery provides fast and comprehensive searching of the data in a manner unmatched by any other technology.

It can even potentially prevent a possible mistrial through early detection of a juror’s improper Tweets or Facebook postings.

UPDATED:  Attorney Ignatius Grande, co-chair of the New York State Bar Committee on Social Media, contacted me in response to this post, to point to the Committee’s recently published Social Media Jury Instruction Report. The report describes the scope and challenges from juror social media use during voir dire and trial, as well as proposed amendments to standard jury instructions address such juror misconduct.

 

Leave a comment

January 27, 2016 · 6:12 PM
December 9, 2015 · 9:04 AM

Print Screen for Social Media Evidence: Not Defensible and Also Very Expensive

As we often note on this blog, courts continue to routinely find that the testimony of an individual who merely printed a copy of a social media webpage is insufficient to authenticate social media evidence. Notable recent cases with such rulings include Linscheid v. Natus Medical Inc., 2015 WL 1470122, at *5-6 (N.D. Ga. Mar. 30, 2015) (finding LinkedIn profile page not authenticated by declaration from individual who printed the page from the Internet); Monet v. Bank of America, N.A., 2015 WL 1775219, at *8 (Cal Ct. App. Apr. 16, 2015) (memorandum by an unnamed person about representations others made on Facebook is at least double hearsay” and not authenticated), and Moroccanoil vs. Marc Anthony Cosmetics, 57 F.Supp.3d 1203 (2014) (Facebook screenshots inadmissible in a trademark infringement without supporting circumstantial information).

These rulings underscore why best practice technology is essential for gathering social media and other Internet evidence. But while many practitioners understand this in terms of defensibility, many operate under the mistaken assumption that manual print screen efforts are a cost-saving shortcut. Nothing could be further from the truth. Stallings v. City of Johnston, 2014 WL 2061669 (S.D. Ill. May 19, 2014), is very instructive as it clearly illustrates that printing Facebook pages for production in eDiscovery is a really bad (and expensive) idea.  In this case, plaintiff Jayne Stallings brought suit for wrongful employment termination against the City of Johnston, her former employer. And it seems that Stallings, like millions of others, was an avid and highly opinionated Facebook poster.

So to respond to discovery requests, Plaintiff’s counsel and a paralegal spent a full week printing out the contents of Plaintiff’s Facebook account — which amounted to over 500 printed screen captures — manually rearranging them, and then redacting the pages. Plaintiff counsel also claimed that she could not provide the relevant Facebook information on a disk, and thus resorted to inefficient paper production – an obviously costly exercise. A week of paralegal and lawyer time could easily run $25,000 and no client should pay anywhere near that amount for a task that, with the right technology, requires minutes instead of days to perform.

Print screen as a social media evidence collection method only leads to higher costs for many reasons, namely because the resulting output is a truncated, unsearchable, flat image that fails to retain the all-important metadata. As a result, a substantial amount of secondary processing must be done to upload the social media images into a standard attorney review platform. The images must be run through OCR, the various requisite metadata fields must be manually entered, and the truncated screen shots reassembled into context so they appear and read as they did in their original state. All this will typically cost thousands of dollars in additional processing fees.

Additionally, when an examiner merely relies on print screen, the scope and thoroughness of the collected social media and Internet evidence is severely limited. This often results in key evidence being overlooked as well as impacting its evidentiary integrity. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This comprehensive and thorough collection allows the examiner to collect far more potential evidence, preserving all relevant metadata, and having that evidence be immediately searchable and reviewable in a highly effective integrated review platform.

Further, the examiner can build a much stronger case for authentication by constructing timelines, drawing connections between witnesses and their various posts, collecting more corroborating metadata, and a litany of other information to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

And of course another key benefit of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of collected social media evidence. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data, for verification of the integrity of the evidence.

It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship.

So while it can seem counterintuitive as sometimes there is a tradeoff when it comes to legal technology between best practices and costs, manual print screen efforts for social media are not only very costly, they subject clients to evidentiary challenges that could place an entire case in peril. But you can have the best of all worlds with the scalability, cost-saving and defensibility brought by X1 Social Discovery.

Leave a comment

Filed under Uncategorized