Legal Tech: Crisis Control: Best Practices for Emergency E-Discovery and Incident Response

Another complicating factor is a common desire to collect and review text and social media communications, which can be more prevalent in crisis situations than in other types of cases. When disaster strikes, people today often send a text, chat message or interoffice IM. Investigations may sometimes reveal communication that someone intended to be "off the record," which may provide important insights into the facts of the case.

Best Practices

Through our work with these types of matters, our teams have learned some important lessons. Drawing on these, we have established a set of steps and best practices that legal teams can follow to ensure thorough and efficient handling of e-discovery in crisis situations. These include:

• Don't panic, develop a plan: The legal team will be pulled in many different directions, so it is critical for them to take a step back and breathe. This will create space to think carefully about the matter. At this point, it is important to ask questions to understand what will be most important downstream, the full scope of data sources that need to be considered, how they may need to be shared among multiple team and all potential pitfalls that may arise. Counsel should also build a plan for garnering information from key stakeholders, and begin interviews to determine all areas where data may live and all owners of important data.
• Rally a strong team: A strong team that can support every facet of the crisis, end-to-end, is essential. This should include a strategic communications team that can develop a clear narrative about what happened, and distribute that information across shareholders, employees, board members and the media. Also bring in experts that can investigate the situation from a regulatory perspective, remediate compliance issues and interface with regulators. A cohesive team that works together across all areas will ensure efficiencies as the crisis continues to evolve, and help maintain a smooth path forward. In one recent matter, consultants from across our organization supported a client in a major crisis — the e-discovery team was mobilized, and in parallel the strategic communications and investigations teams collaborated with the law firm to align on the risk exposures and the details that needed to be communicated to stakeholders and regulators.
• Preserve carefully: It is important for relevant data — from computers, mobile devices, hard copies, USB drives, key data systems (such as rig information units for offshore oil, or research data for a product liability case) and other sources — to be preserved for potential use downstream. This doesn't necessarily mean the team must review it, but it needs to be available. Take care to confirm that nothing is "lost," to avoid adverse consequences or inferences made during a proceeding.
• Be strategic about unconventional data types: Consider whether text messages, chat strings, voicemails and other communications may come into scope given the particular context. These files can sometimes be looked at together to develop a timeline for a particular actor or group of people. Teams may need to look for documents (not just text messages) saved on mobile devices, and find back-ups when possible. Individuals will often back up their phones to their computer or the cloud, and data will remain there until removed. Gathering iterative back-ups may in some circumstances help fill in the chain of events. Further, forensic experts can help counsel dig into databases of texts to identify gaps in the messages listed in the database to help fill in blanks that may have been created by deletion.
• Identify important information: Right away — or better yet in advance of a crisis — a plan for identifying critical information should be put in place. This will allow the team to begin processing for analysis and quick fact finding ahead of investigatory inquiries. One piece of this is to have insight into the key stakeholders that pertain to each piece or set of data and a method by which to track who was issued which device. As early in the process as possible, interview the key stakeholders and determine others who may have more "on the ground" knowledge of how something was used, where data was saved, etc., in the course of business.
• Enable agility: Things can change quickly in these matters, and counsel needs to be prepared to endure the changing tides of the investigations and litigation. Working with outside experts that can provide on-the-ground support is key. This provides collaborative support and experienced backing for the teams dealing with the actual crisis. A general best practice is for the in-house team and all outside providers to maintain frequent touchpoints with each other, regulators and opposing counsel to keep things moving forward smoothly.

Lawyers that have experienced these situations, or those that work within industries subject to major accidents, know that emergencies require them to mobilize quickly. Without an effective plan, counsel will find it much more difficult to bear the stress and emotional strain of the ordeal, which can lead to trickle-down implications for the company, its partners and the people impacted by the crisis. But following a playbook of key steps can make a big difference in ensuring everyone stays calm, gathers as much information about the incident as possible and is able to respond in a timely way.

*****

Andrew Johnston is a Senior Managing Director in the Discovery practice within the Technology segment at FTI Consulting. As an expert in e-discovery technology, he helps clients across the lifecycle of the discovery process, including the review and production of electronic data. He is based in Wayne, PA.