Electronic Records

Human Challenges

Some challenges, common to both electronic and paper records, involve practical difficulties in the application of settled law. Meeting them may be especially difficult where litigation is merely anticipated rather than pending, such as in the case of a grand jury investigation. These include:

• Pinpointing the specific time when litigation becomes reasonably anticipated. This may be an easy call when a grand jury subpoena is received. Other cases may require difficult decisions, such as whether a mere threat of litigation creates a company-wide duty to preserve records. Particular employees may anticipate litigation long before relevant information reaches appropriate corporate officials. This raises the question, 'anticipated by whom?'
• Determining what records should be preserved. Because a grand jury investigation is shrouded in secrecy, it may be virtually impossible to determine the required scope of a litigation hold, especially when complex facts and law are involved. Companies may have to consider suspending all routine records purges. In civil disputes, they must try to predict causes of action, cross-claims, defenses, counterclaims, etc.
• Determining how to preserve records. An instant freeze of all electronically stored information would require blocking user access and disabling core software. The potential for business disruption is obvious. A more viable option may be to act quickly (even if not instantly) to impose a broad litigation hold, liberally preserving all records suggested by the subpoena or other event creating the prospect of litigation, and gradually relax it as more information becomes available.

Technical Challenges

In implementing a litigation hold, special challenges arise from five characteristics of electronic records: volume, duplicability, dynamic content, metadata and dispersion. See The Sedona Principles: Best Practices Recommendations & Principles for Addressing Electronic Document Production (July 2005 version) (available at www.sedonaconference.com) (discussing these and other differences).

Volume

The rate at which electronic records are created has accelerated rapidly in recent years. Now, there are vastly more electronic than paper records. The Sedona Conference, a research and educational institute, estimates that:

• At least 93% of information is first generated in digital format;
• 70% of corporate records may be stored in electronic format; and
• 30% of electronic information is never printed to paper.

E-mail makes a substantial contribution to this profusion. The Digital Evidence Project of the American Bar Association's Information Security Committee estimates that over 11 trillion e-mail messages will be sent during 2007. Their volume magnifies the importance of electronic records in imposing a litigation hold, while their duplicability magnifies the difficulty.

Duplicability

Electronic records can be replicated rapidly, with or without human intervention. The countless examples include automatic backup of file data for disaster recovery. Duplication also occurs when, for example, an e-mail message is sent to many recipients, some of whom forward it to several others, etc. Simultaneously, computer systems that transmit the messages automatically create multiple copies as the messages are sent and re-sent.

Duplication increases the difficulty of purging records under the circumstances permitted by Arthur Andersen, supra. This, along with sheer numbers and the multiplicity of locations in which electronic records may reside, increases the difficulty of capturing all relevant versions of e-mail, metadata and other records.

Existence of Metadata

Metadata is descriptive information about documents, files and e-mail that assists users and facilitates the storage and retrieval of electronic records. According to the Sedona Conference, understanding 'when metadata needs to be specifically preserved and produced represents one of the biggest challenges in electronic document production.'

Metadata includes such information as dates of file creation and modification, authorship, comments, editing history and file designation. For e-mail, it includes such information as the dates that mail was sent, received, replied to and forwarded. Some metadata is visible to the ordinary user while other metadata is not. Metadata may be important because it assists in determining the origin and distribution of electronic records, often helping answer the question, 'What did she know and when did she know it?'

Metadata may, however, sometimes be misleading. A simple example from the Sedona Principles is that 'when a new employee uses a word processing program to create a memorandum by using a memorandum template created by a former employee, the metadata for the new memorandum may incorrectly identify the former employee as the author.'

Because the origin and distribution of electronic records may be independently relevant, it may be important to use forensic tools that capture all metadata fields. 'Mirror images' of storage media may not be enough because they only have active file data and are not forensic images.

Dispersion

Though freezing paper records may be difficult, they may be collected in discrete filing cabinets, while electronic records can reside in many places simultaneously: PCs, laptops, floppy disks, CDs, flash drives, servers, PDAs, and even iPods, which may be used to back up hard drives. This magnifies the difficulty of freezing all records necessary to avoid allegations of spoliation, etc.

Dynamic Content

Electronic records often have dynamic content that can change over time. The simple act of booting up a computer can alter data. Human intervention can change electronic records in other ways, such as moving a word processing file from one location to another, which may alter the creation and modification dates associated with the file. Thus, promptness is essential.

Authentication

A bankruptcy case, In re Vinhnee, 2005 WL 3609376 (B.A.P. 9^th Cir. Dec. 16, 2005), imposed new foundational requirements for the admission of electronic records, essentially requiring a prima facie showing of measures to safeguard data integrity, reflecting the courts' growing recognition of key differences between paper and electronic records. See Axelrod: New Rules for Electronic Records? Business Crimes Bulletin (June 2006). The Sedona Principles explain:

[I]t may be more difficult to determine the provenance of electronic documents than paper documents. The ease of transmitting electronic data and the routine modification and multi user editing process may obscure the origin of a document. Electronic files are often stored in shared network folders that may have departmental or functional designations rather than author information. In addition, there is growing use of collaborative software that allows for group editing of electronic data, rendering the determination of authorship far more difficult. Finally, while electronic documents may be stored on a single drive, it is likely that such documents may also be found on high-capacity, undifferentiated backup tapes, or on network servers not under the custodianship of an individual who may have 'created' the document.

Even if courts don't raise these issues, adversaries may. Consequently, a litigation hold should include forensic measures to memorialize the creation, modification and reliability of electronic data, lest records important for the defense be found inadmissible.

Proactive Measures

Proactive measures may help mitigate risk and reduce the expense of retention and production. Funda-mental elements of a litigation hold strategy include:

• Identifying elements of the information technology system that are important for litigation holds and e-discovery;
• Allocating responsibility for implementing holds and producing records; and
• Establishing procedures for disseminating information and regular reminders regarding what and how information must be preserved. Case law imposes this obligation on outside counsel as well as the company.

An important part of disseminating information and reminders is developing a shared language that facilitates communication among individuals with disparate levels of technical knowledge, such as IT staff, in-house and outside counsel, and employees who possess relevant data.

Effective records management isn't easy under the best of circumstances, but is exponentially more difficult if neglected until forced by impending litigation. Apply the Boy Scout motto ' Be Prepared.

David F. Axelrod ([email protected]), a former Assistant U.S. Attorney, is a director in the Forensic & Dispute Services practice of Deloitte Financial Advisory Services LLP. John A. ('Jack') Walker ([email protected]) leads Deloitte's Midwest Analytic & Forensic Technology practice, which provides technical infrastructure for forensic investigations and disputes.

In Arthur Andersen LLP v. United States , 125 S. Ct. 2129, 235 (2005), the Supreme Court acknowledged the importance of records management policies that provide for the routine destruction of unneeded records under ordinary circumstances. It is, however, common knowledge that such policies should ordinarily be suspended once an investigation or litigation is reasonably anticipated. This is normally accomplished through the imposition of a 'litigation hold,' the process of notifying employees of their obligations to preserve all potentially relevant records while continuing the routine destruction of non-relevant active and archived data. This may be a company's first line of defense against claims of spoliation or obstruction. See Brady and Cohen: Achieving a Useful Litigation Hold, National Law Journal (July 26, 2005).

The failure to suspend routine purges of records in the face of litigation has contributed to the imposition of sanctions as high as $1.45 billion on companies, Coleman (Parent) Holdings, Inc. v. Morgan Stanley & Co., Inc., Case No. 502003CA005045XXOCAI (Fl. Cir. Ct. 2005), as well as substantial fines on individual, non-compliant employees , U.S. v. Phillip Morris USA, Inc. , 327 F. Supp.2d 21 (D.D.C. 2004) ($250,000 apiece). It may also result in prosecution and imprisonment. See United States v. Quattrone , 441 F.3d 153 (2d Cir. 2006) (reversing conviction).

Implementing a 'litigation hold' is not the simple matter it might seem. The challenges are both human and technical. Understanding them may help oppose the admission of harmful records, avoid claims of spoliation and obstruction of justice, and exploit the carelessness of adversaries.

Human Challenges

Some challenges, common to both electronic and paper records, involve practical difficulties in the application of settled law. Meeting them may be especially difficult where litigation is merely anticipated rather than pending, such as in the case of a grand jury investigation. These include:

• Pinpointing the specific time when litigation becomes reasonably anticipated. This may be an easy call when a grand jury subpoena is received. Other cases may require difficult decisions, such as whether a mere threat of litigation creates a company-wide duty to preserve records. Particular employees may anticipate litigation long before relevant information reaches appropriate corporate officials. This raises the question, 'anticipated by whom?'
• Determining what records should be preserved. Because a grand jury investigation is shrouded in secrecy, it may be virtually impossible to determine the required scope of a litigation hold, especially when complex facts and law are involved. Companies may have to consider suspending all routine records purges. In civil disputes, they must try to predict causes of action, cross-claims, defenses, counterclaims, etc.
• Determining how to preserve records. An instant freeze of all electronically stored information would require blocking user access and disabling core software. The potential for business disruption is obvious. A more viable option may be to act quickly (even if not instantly) to impose a broad litigation hold, liberally preserving all records suggested by the subpoena or other event creating the prospect of litigation, and gradually relax it as more information becomes available.

Technical Challenges

In implementing a litigation hold, special challenges arise from five characteristics of electronic records: volume, duplicability, dynamic content, metadata and dispersion. See The Sedona Principles: Best Practices Recommendations & Principles for Addressing Electronic Document Production (July 2005 version) (available at www.sedonaconference.com) (discussing these and other differences).

Volume

The rate at which electronic records are created has accelerated rapidly in recent years. Now, there are vastly more electronic than paper records. The Sedona Conference, a research and educational institute, estimates that:

• At least 93% of information is first generated in digital format;
• 70% of corporate records may be stored in electronic format; and
• 30% of electronic information is never printed to paper.

E-mail makes a substantial contribution to this profusion. The Digital Evidence Project of the American Bar Association's Information Security Committee estimates that over 11 trillion e-mail messages will be sent during 2007. Their volume magnifies the importance of electronic records in imposing a litigation hold, while their duplicability magnifies the difficulty.

Duplicability

Electronic records can be replicated rapidly, with or without human intervention. The countless examples include automatic backup of file data for disaster recovery. Duplication also occurs when, for example, an e-mail message is sent to many recipients, some of whom forward it to several others, etc. Simultaneously, computer systems that transmit the messages automatically create multiple copies as the messages are sent and re-sent.

Duplication increases the difficulty of purging records under the circumstances permitted by Arthur Andersen, supra. This, along with sheer numbers and the multiplicity of locations in which electronic records may reside, increases the difficulty of capturing all relevant versions of e-mail, metadata and other records.

Existence of Metadata

Metadata is descriptive information about documents, files and e-mail that assists users and facilitates the storage and retrieval of electronic records. According to the Sedona Conference, understanding 'when metadata needs to be specifically preserved and produced represents one of the biggest challenges in electronic document production.'

Metadata includes such information as dates of file creation and modification, authorship, comments, editing history and file designation. For e-mail, it includes such information as the dates that mail was sent, received, replied to and forwarded. Some metadata is visible to the ordinary user while other metadata is not. Metadata may be important because it assists in determining the origin and distribution of electronic records, often helping answer the question, 'What did she know and when did she know it?'

Metadata may, however, sometimes be misleading. A simple example from the Sedona Principles is that 'when a new employee uses a word processing program to create a memorandum by using a memorandum template created by a former employee, the metadata for the new memorandum may incorrectly identify the former employee as the author.'

Because the origin and distribution of electronic records may be independently relevant, it may be important to use forensic tools that capture all metadata fields. 'Mirror images' of storage media may not be enough because they only have active file data and are not forensic images.

Dispersion

Though freezing paper records may be difficult, they may be collected in discrete filing cabinets, while electronic records can reside in many places simultaneously: PCs, laptops, floppy disks, CDs, flash drives, servers, PDAs, and even iPods, which may be used to back up hard drives. This magnifies the difficulty of freezing all records necessary to avoid allegations of spoliation, etc.

Dynamic Content

Electronic records often have dynamic content that can change over time. The simple act of booting up a computer can alter data. Human intervention can change electronic records in other ways, such as moving a word processing file from one location to another, which may alter the creation and modification dates associated with the file. Thus, promptness is essential.

Authentication

A bankruptcy case, In re Vinhnee, 2005 WL 3609376 (B.A.P. 9^th Cir. Dec. 16, 2005), imposed new foundational requirements for the admission of electronic records, essentially requiring a prima facie showing of measures to safeguard data integrity, reflecting the courts' growing recognition of key differences between paper and electronic records. See Axelrod: New Rules for Electronic Records? Business Crimes Bulletin (June 2006). The Sedona Principles explain:

[I]t may be more difficult to determine the provenance of electronic documents than paper documents. The ease of transmitting electronic data and the routine modification and multi user editing process may obscure the origin of a document. Electronic files are often stored in shared network folders that may have departmental or functional designations rather than author information. In addition, there is growing use of collaborative software that allows for group editing of electronic data, rendering the determination of authorship far more difficult. Finally, while electronic documents may be stored on a single drive, it is likely that such documents may also be found on high-capacity, undifferentiated backup tapes, or on network servers not under the custodianship of an individual who may have 'created' the document.

Even if courts don't raise these issues, adversaries may. Consequently, a litigation hold should include forensic measures to memorialize the creation, modification and reliability of electronic data, lest records important for the defense be found inadmissible.

Proactive Measures

Proactive measures may help mitigate risk and reduce the expense of retention and production. Funda-mental elements of a litigation hold strategy include:

• Identifying elements of the information technology system that are important for litigation holds and e-discovery;
• Allocating responsibility for implementing holds and producing records; and
• Establishing procedures for disseminating information and regular reminders regarding what and how information must be preserved. Case law imposes this obligation on outside counsel as well as the company.

An important part of disseminating information and reminders is developing a shared language that facilitates communication among individuals with disparate levels of technical knowledge, such as IT staff, in-house and outside counsel, and employees who possess relevant data.

Effective records management isn't easy under the best of circumstances, but is exponentially more difficult if neglected until forced by impending litigation. Apply the Boy Scout motto ' Be Prepared.

David F. Axelrod ([email protected]), a former Assistant U.S. Attorney, is a director in the Forensic & Dispute Services practice of Deloitte Financial Advisory Services LLP. John A. ('Jack') Walker ([email protected]) leads Deloitte's Midwest Analytic & Forensic Technology practice, which provides technical infrastructure for forensic investigations and disputes.