Tag Archives: technology

May 21, 2024 · 12:12 PM

Microsoft 365 eDiscovery Throttling is Structural and Won’t Be Going Away

By Chas Meier

Users of Microsoft 365 for eDiscovery and Information Governance continue to encounter significant problems with low throughput and defensibility. Many customers report to us that Purview eDiscovery Premium’s documented limitations, including a 2GB per hour indexing limit, prevent them from using the platform to handle anything other than small matters. A routine eDiscovery matter involving one hundred custodians each with about 10GB of M365 data typically requires several weeks to complete with MS Purview Premium. This is a non-starter for legal teams who are up against pressing litigation timelines.

It is important to understand that because M365 is built on a large-scale multi-tenancy SaaS architecture, such challenges are a feature, not a bug of the system. Multi-tenancy is an architecture where shared computing resources are apportioned across large numbers of users. This architecture enables Microsoft to provide the service at a lower cost since computing services are shared.

However, multi-tenant architecture enables scale (in terms of multitudes of users) and efficiency through uniformity. These architectures are not designed for outlier workloads like eDiscovery that routinely require intensive surges in computing resources to collect, process and search terabytes of data. In fact, multi-tenancy cloud architects would identify eDiscovery workloads as a “noisy neighbor” that threatens the overall performance and user experience of the system, and thus must be managed through quality-of-service mechanisms like throttling and time-outs.

I think of multi-tenant architectures like the business model utilized by a gym. The gym has more and better equipment than I have at home, which is attractive so many will join through a membership. The gym has a fixed amount of square footage and equipment which is more than any individual needs and is sufficient to support those that show up, occasionally having to coordinate access to the equipment but manageable. However, what if a small group showed up at the gym every day for most of the day and hogged the equipment? What if more people showed up, became frustrated, and dissatisfied? Gym management would be forced to act to ensure fair access to the equipment.

Throughout my career as an eDiscovery service provider, we made large investments in infrastructure and capacity to the point of overkill to equip ourselves to service a client’s need to address high volumes of data in short timelines without impacting their business-as-usual activities. We were like the fire department for big unstructured data needs.

A huge differentiator in X1’s approach is to divide and conquer large scale projects by leveraging the cumulative power of a decentralized computing orchestrated through a unified management, search, and collection console. Think of this like deploying a fire suppression system proactively before the fire.

Last year, X1 introduced M365 data connectors into our X1 Enterprise platform to satisfy a critical need for enterprises to conduct cost-efficient yet highly scalable eDiscovery search and collection of M365 data. The response has been tremendous, with X1 seeing record demand in large part, due to the architectural limitations and deficiencies noted above.

X1 Enterprise Collect provides users the unique ability to index and search M365 data in-place and then collect in a targeted and iterative manner. This at speeds and throughput far exceeding other tools, including Microsoft Purview Premium. X1 achieves such scalability through a decentralized custodian-based approach that does not rely on the M365 or Purview search Index, which has known issues with the number of file types supported, consistency of search results, and throughput. X1’s approach enables a very scalable, defensible, and robust data collection at speeds far exceeding that of M365 Purview and other approaches.

For a demonstration of the X1 Enterprise Collect Platform, contact us at sales@x1.com. For more details on this innovative solution, please visit www.x1.com/solutions/x1-enterprise-platform.

Leave a comment

Filed under Best Practices, Cloud Data, Corporations, eDiscovery, eDiscovery & Compliance, Enterprise eDiscovery, ESI, Information Governance, Preservation & Collection

Tagged as , , , , , , ,

September 11, 2019 · 10:02 AM

Overcoming Evidentiary Challenges to Social Media Evidence

By John Patzakis

As succinctly noted by The Florida Bar Association in its publication, Florida Law Journal: “Social media is everywhere. Nearly everyone uses it. Litigants who understand social media–and its benefits and limitations–can immeasurably help their clients resolve disputes…it is inevitable that the social media accounts of at least one person involved in a dispute will have potentially relevant and discoverable information.“ However, the FLJ warns that “If not properly researched, preserved, and authenticated, the best social media evidence is worthless.” “Social Media Evidence: What You Can’t Use Won’t Help You” (2014) Florida Law Journal, Volume 88, No. 1. social-media-cases3

In fact, many courts have rendered “smoking gun” and other key web-based evidence worthless because the proponent offered a simple printed a copy of a social media webpage, and thus failed to meet evidentiary authentication requirements. Notable recent cases with such rulings include Linscheid v. Natus Medical Inc. 2015 WL 1470122, at *5-6 (N.D. Ga. Mar. 30, 2015), (finding LinkedIn profile page not authenticated by declaration from individual who printed the page from the Internet); Monet v. Bank of America, N.A., 2015 WL 1775219, at *8 (Cal Ct. App. Apr. 16, 2015), (memorandum by an unnamed person about representations others made on Facebook is at least double hearsay” and not authenticated), Moroccanoil vs. Marc Anthony Cosmetics, 57 F.Supp.3d 1203 (2014), (Facebook screenshots inadmissible in a trademark infringement without supporting circumstantial information).

Commonwealth v. Mangel 181 A.3d 1154 (2018), is a must-read case that provides an instructive and detailed case study on the perils of improperly collecting social media evidence for court.  In that case, the Superior Court of Pennsylvania addressed the standard for admissibility of social media posts and ultimately disallowed into evidence a social media post presented by the prosecution as a simple screen shot. In Mangel, the State charged the defendant with aggravated assault and harassment and sought, in a pre-trial hearing, to introduce evidence of an image of bloody hands posted to Facebook, as well as messages allegedly authored by the defendant. The Facebook account at issue bore the defendant’s name, hometown and high school, which the prosecution argued was sufficient to authenticate the proffered evidence.

Both the trial court and the appellate court found that merely presenting evidence that the posts and messages came from a social media account bearing the Defendant’s name was not enough to allow the evidence in. Instead, the court noted that “authentication of electronic communications, like documents, requires more than mere confirmation that the number or address belonged to a particular person. Circumstantial evidence, which tends to corroborate the identity of the sender, is required.” Metadata is a key form of circumstantial evidence, and the Mangel court noted the conspicuous omission of two key metadata items: the date the post was created, and account ID:

“A thorough review of the Facebook posts and messages themselves raises specific issues. First, the evidence presented by the Commonwealth does not indicate the exact time the posts and messages were made. The incident which brought about the instant criminal charges occurred allegedly on June 26th, 2016, according to the Criminal Information. The lack of a date and timestamps raises a significant question regarding the connection of the posts and messages to the alleged incident on June 26th, 2016. Furthermore, the ‘Tyler Mangel’ who allegedly authored the Facebook posts and messages does not specifically reference himself in the incident on June 26th, 2016; rather, other individuals, many of them who are not directly involved in the instant criminal case, reference a ‘Tyler Mangel’ in response to a post made and in subsequent conversations about an alleged assault.”

By using best practices instead of print screen, practitioners can avoid the falling victim to outcomes like in Mangel. A party can authenticate electronically stored information (“ESI”) per Rule 901(b)(4) and Rule 902(14) with circumstantial evidence that reflects the “contents, substance, internal patterns, or other distinctive characteristics” of the evidence.  Many courts have applied Rule 901(b)(4) by ruling that metadata and file level hash values associated with ESI can be sufficient circumstantial evidence to establish its authenticity, including Lorraine v. Markel American Insurance Company, 241 F.R.D. 534 (D.Md. May 4, 2007.

For further analysis on additional case law, applicable rules of evidence and practice tools, X1 has prepared a detailed white paper on evidentiary authentication of social media and other web-based evidence. You can access this valuable resource here.

Leave a comment

Filed under Authentication, Best Practices, Case Law, eDiscovery, Preservation & Collection, Social Media Investigations, Social Media Metadata

Tagged as

November 17, 2014 · 12:01 PM

Amazon Re:Invent – With the Cloud, Avoid Mistakes of the Past

Last week, I had the opportunity to attend the Amazon Re:Invent conference in Las Vegas. Over 13,000 people took over the Palazzo for deep dive technical sessions to learn how to harness the power of Amazon Web Services (AWS). reinventThis show had a much different energy than other enterprise software conferences, such as VMworld.  Whereas most conferences feature a great deal of selling and marketing by the host, Amazon Re:Invent was truly more of a training show. Cloud architects spent a lot of time in technical bootcamps learning how AWS works and getting certified as administrators.

That is not to say that there was no selling or marketing going on; the exhibition hall featured myriad vendors that augment or assist with AWS deployments and solutions. The focus on the deep technical details, though, does point out the fact that we are still in the very early days of the cloud. Most of the focus of the keynotes was about getting compute workloads to the cloud – there was not a lot of mention of moving actual data to the cloud, even though that is certainly beginning to happen.  But, that is how the evolution goes. IT departments need to be comfortable moving workloads to the cloud as they begin to leverage the cloud. Building this foundation is also important to Amazon – the goal would be for many companies to completely outsource the IT data center.

It is important, however, to proactive plan for information management as more workloads and, importantly, data move to the cloud.  As the internet first emerged, companies dove into new technologies like email and network file shares only to create eDiscovery nightmares and make it virtually impossible to find information within digital landfills. It is key to learn from those mistakes rather than to repeat them when leveraging cloud-based technologies. In order to ensure both that end-users are happy with search experiences on data in the cloud and that Legal can do what they need to do from an eDiscovery standpoint. This means providing business workers with unified access to email, files, and SharePoint information regardless of where the data lives. It also means giving Legal teams fast search queries and collections. But, Cloud search is slow, as indexes live far from the information. This results in frustrated workers and Legal teams afraid that eDiscovery cannot be completed in time.

If a customer wanted to speed up search, it would have to essentially attach an appliance to a hot-air balloon and send it up to the Cloud provider so that the customer’s index could live on that appliance (or farm of appliances) in the Cloud providers data center, physically near the data. There are many reasons, however, that a Cloud provider would not allow a customer to do that:

  • Long install process
  • Challenging Pre-requisites
  • 3rd party installation concerns
  • Physical access
  • Specific hardware requirements
  • They only scale vertically

The solution to a faster search is a cloud-deployable search application, such as X1 Rapid Discovery. This creates a win-win for Cloud providers and customers alike. As enterprises move more and more information to the Cloud, it will be important to think about workers’ experiences with Cloud systems – and search is one of those user experiences that, if it is a bad one, can really negatively affect a project and cause user revolt. eDiscovery is also a major concern – I’ve worked with organizations that moved data to the cloud before planning how they would handle eDiscovery. That left Legal teams to clean up messes, or more realistically, just deal with the messes. By thinking about these issues before moving data to the cloud, it is possible to avoid these painful occurrences and leverage the cloud without headaches. At X1, we look forward to working closely with Amazon to help customers have the search and eDiscovery solutions they need as more and more data goes to AWS.

Leave a comment

Filed under Cloud Data, eDiscovery & Compliance, Enterprise eDiscovery, Enterprise Search, Hybrid Search, Information Access, Information Governance, Information Management

Tagged as , , , , , , , , , , , , , , , , ,

November 4, 2014 · 8:59 AM

Botched Social Media Evidence Collection Results in Overturned Conviction

by John Patzakis

Law Journal for webA US Federal Appellate Court, Second Circuit, recently overturned a criminal conviction upon finding that the lower court erroneously admitted a screenshot of the defendant’s alleged profile on “the Russian equivalent of Facebook,” (“VK.com”) due to improper authentication.

In United States vs. Vayner, 2014 WL 4942227 (C.A. 2 (N.Y.)), a jury convicted Aliaksandr Zhyltsou on a single count of the unlawful transfer of a false identification document. The government’s key evidence included a screen shot purporting to be Zhyltsou’s VK.com profile page. The lower court admitted the printout over Zhyltsou’s objection on insufficient authentication grounds. However, the appellate court determined that the government presented insufficient evidence that the page was what the government claimed it to be—that is, Zhyltsou’s profile page, as opposed to a profile page on the Internet that Zhyltsou did not create or control. The prosecution used the alleged profile page to establish a key connection between Zhyltsou and Vladyslav Timku, another perpetrator who reached a plea bargain and became the Government’s star witness.

Ultimately, the Court concluded that because the page was intended to corroborate testimony regarding the defendant’s alleged online identity, it was  “required that there be some basis beyond Timku’s own testimony on which a reasonable juror could conclude that the page in question was not just any Internet page, but in fact Zhyltsou’s profile. No such showing was made and the evidence should therefore have been excluded.”

This is a clear cut case of a conviction being thrown out over a social media evidence collection that failed to follow best practices. The federal second circuit, which covers all of New York, Connecticut and Vermont, is a very influential court and this decision will impact standards for and the scrutiny of all social media evidence collection in criminal and civil matters nationwide.

United States vs. Vayner is yet another case illustrating that social media provides torrential amounts of evidence potentially relevant to litigation matters, with courts routinely facing proffers of data preserved from various social media websites. This evidence must be authenticated in all cases, and the authentication standard is no different for website data or chat room evidence than for any other. Under Federal Rule of Evidence 901(a), “The requirement of authentication . . . is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” United States v. Simpson, 152 F.3d 1241, 1249 (10th Cir. 1998).

Ideally, a proponent of the evidence can rely on uncontroverted direct testimony from the creator of the web page in question. In many cases, such as in the Vayner case where incriminating social media evidence is at issue, that option is not available. In such situations, the testimony of the examiner who preserved the social media or other Internet evidence “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a finding” that the website documents are what the proponent asserts. Perfect 10, Inc. v. Cybernet Ventures, Inc. (C.D.Cal.2002) 213 F.Supp.2d 1146, 1154. (emphasis added) (See also, Lorraine v. Markel American Insurance Company, 241 F.R.D. 534, 546 (D.Md. May 4, 2007) (citing Perfect 10, and referencing MD5 hash values as an additional element of potential “circumstantial indicia” for authentication of electronic evidence).

One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our white paper available here).

Additionally, when an examiner merely relies on print screen, they also severely limit the scope and thoroughness of the social media and internet collection. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This allows the examiner to build a much stronger case for authentication by building timelines, drawing more connections between witnesses and their various posts, collecting more collaborating metadata, and a litany of other means to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court. The federal prosecutors in Vayner just learned this lesson the hard way.

1 Comment

Filed under Best Practices, Case Law, Social Media Investigations, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , ,

October 27, 2014 · 11:10 AM

The Time Has Come to Approach Search Differently

Anyone in the search / eDiscovery business lives and breathes search – we think about all day, every day because it is our livelihood.  At X1, we have many customers making real progress with enterprise search, so there can be the perception that organizations have learned to address the very real challenge of helping employees find information.  Thus, it can be surprising to run into research that shows just how bad the traditional approach to enterprise search is.

I came across the “Enterprise Search and Findability Survey 2014” on the Findwise website.  It is very interesting reading and really confirms that a new approach to enterprise search is needed.  Some of the key points, from my perspective, are;

  • Almost half of the survey respondents in large organizations (1,000 employees or more) find it difficult or very difficult to find information.
  • Almost two-thirds of respondents are either dissatisfied or very dissatisfied with their existing search applications.
  • Almost two-thirds of respondents believe it is very important to improve the ability to find the right information.

Simply put, traditional enterprise search did not work.  Too many employees complain about not being able to find what they are looking for.  The search solutions deployed over the last 15 years focused on IT requirements rather than end-user requirements.  These tools required end-users to tag and rate their search results, something end-users have neither the time nor the emotional investment to do.  This very point is something that Marcus Stimler, CTO of Capgemini UI, points out on the webinar we did earlier this month – the reliance of traditional search tools on end-users to tag information leads to a lack of findability.  This survey just confirms that fact.

It is not all doom and gloom, however, as many X1 customers know.  There is a better way to approach enterprise search and it begins with the end-user.  In today’s business world, end-users know what they want.  They demand good experiences with technology.   A web page with links to search results will not cut it in the enterprise.  Users need a single-pane-of-glass view to all of their information – email, files, SharePoint, archives like Symantec Enterprise Vault, and other enterprise repositories that users might access.   X1 Search 8 provides just that – a user-friendly interface to all information that lets workers use their brains to find what they are looking for.

Beyond the desktop, X1 Rapid Discovery indexes other sources of content – either on-premise or in the Cloud – and makes the information available alongside a user’s local content.  Perhaps the beauty of this approach lies mostly with its simplicity.  Workers are happy because they can find information.  IT is surprisingly happy because they have a search tool that is easily deployable, as opposed to the traditional complex science project.  This overall happiness is a result of a new approach to enterprise search starting with end-user requirements and extending outward.  It is a subtle difference, but a meaningful one that will drive the results of future findability surveys to a new level.

For more on our perspectives on why enterprise search initiatives often fail, while X1 is invariably successful, please download this short treatise. This was inspired by direct feedback from many successful X1 install sites.  In a nutshell, X1 addresses users’ personalized requirements for business productivity search.

3_forms_table

Click image to enlarge

A key mistake is to take big data or web search solutions and apply them to the very different use case of business productivity search. The matrix displayed here illustrates the key differences between these use cases.

Leave a comment

Filed under Business Productivity Search, Enterprise Search

Tagged as , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,