Thoughts on CEIC 2010

The CEIC Welcome Event

Guidance Software hosted another amazing Computer and Enterprise Investigations Conference (CEIC).  This was my fifth CEIC and I believe the best I have attended.

My personal favorite conferences are CEIC and the Paraben Forensic Innovation Conferencec.  For those interested in the interaction between data collection to e-Discovery, both are must attend events. 

Larry Gill from Guidance recognizing Andrew Drake, Esq., for excellence in e-Discovery.

CEIC had an active e-discovery track, adding sessions with electronic evidence statesmen such as Magistrate Judge Andrew Peck and Browning Marean, Esq.  Both were first time attendees and offered excellent content. 

I enjoyed the e-Discovery Caselaw Update and Best Practices seminar.  The message highlighted the lessons learned from major litigation hold cases from this year.  I was particularly interested in the discussion over cloud computing.  There is a collision with IT and Records Managers who want to push storage of data up to a cloud.  This short term cost savings can be ripped apart with complex preservation and collection costs.  Any such decisions for storing data in the “Cloud” should not be made in a vacuum without considering litigation costs. 

e-Discovery Caselaw Update & Best Practices Panel

D4 and kCura hosted a social hour where kCura Relativity 6.0 was showcased.  The event was well attended and the newest version of Relativity has impressive analytical tools.  Thanks to Paraben, D4 & kCura built a Relativity database with text messages.  Relativity 6.0 demonstrated how electronically stored information is beyond simple email messages or Excel files with text messages telling a story attorneys would need to weave together in review. 

The Show Floor and the D4 Booth

I presented on “Textual Relations,” a seminar on text message litigation.  I enjoyed being able to discuss some of the newest caselaw on texting with attendees in law enforcement, IT and legal. 

I congratulate Guidance Software on another great conference.  I look forward to CEIC 2011 in Orlando. 

Disclosures

I am a D4 employee.  Guidance, kCura and Paraben are partners with D4.

Search Term Fashionista: Meet & Confers Never Go Out of Style

One thing never goes out of fashion in e-Discovery: The Meet & Confer over search terms. 

In Ross v. Abercrombie & Fitch Co., the Plaintiff brought a motion to compel missing electronically stored information.  Ross v. Abercrombie & Fitch Co., 2010 U.S. Dist. LEXIS 47620 (S.D. Ohio May 14, 2010). 

The Plaintiff claimed the missing ESI should have been produced in response to the Plaintiff’s first request for production.  Ross , at *4. 

The Plaintiff engaged in a letter campaign and conferences with the Defendant, alerting them to the list of missing electronically stored information over a period of months between August 2009 to January 2010.  Ross , at *4-5.  The Defendant made an additional production that the Plaintiffs viewed as “woefully inadequate.”  Ross , at *4. 

Plaintiff’s Motion to Compel Arguments

The Plaintiff argued that all the categories of missing documents were relevant because of their content and relation in time to the litigation.  Ross , at *5.  There had been a partial production of this information; however there were gaps in the production.  Id.

In theory, the responsive information should have been preserved when the Defendant enacted a litigation hold, because the information would have been saved according to the Defendant’s document retention policy.  Ross , at *5-6. 

The Plaintiff’s request focused on categories of information.  The Defendants used a search protocol based on keywords, which they claimed produced more “hits” than the Plaintiffs categorical search.  Ross , at *6.   

Defendant’s Opposition to the Motion to Compel Arguments

The Defendant argued that once its keyword search was completed, they had no further obligation to search for potentially responsive electronically stored information.  Ross , at *6.  

Moreover, the Defendant claimed that the “missing” ESI was only marginally of value and was no basis in requiring them to search for it.  Id.

A Cavalier View of Litigation Holds

The Defendant took a unique view of the duty to preserve: they told the Plaintiffs that a litigation hold was not placed on the mainframe computer. So, if there was missing responsive information, that’s why it no longer existed.  Ross , at *6-7.

Defendant’s Search & Burden Argument

Whining is not attractive.  That was essentially the Defendant’s burden argument.

The Defendant claimed they endured a “massive” burden in performing the first agreed upon key-word search and winnowing out the responsive ESI, conducting their privilege review and ultimately producing the non-privileged responsive electronically stored information.  Ross , at *9-10. 

The Defendants also performed a second review of the ESI from their search term “Hit List” when the issue of the missing ESI was raised by the Plaintiffs.  Ross , at *10. 

“We’ve been burdened enough” was the spirit of the Defendant’s arguments from performing their key word search and corresponding review.  Ross , at *10. 

The “enough is enough” argument did not carry the day.  Ross , at *11. 

Burden Arguments Must be Specific

The Defendant claimed that any additional searches would be unduly burdensome pursuant to the cost-benefit analysis under Federal Rule of Civil Procedure Rule 26(b)(2)(C)(iii).  Ross , at *10. 

There is a key element to making an undue burden argument: You must explain why there is burden with specific facts and not speculative declarations it is “hard” or “expensive.”  Ross , at *10-11.

The Court found ruling on the Defendant’s burden argument was difficult, because the Defendant did not state how it would search for the missing ESI.  Ross , at *10.  There was nothing indicating how long it would take to perform any searches or how long such a search world take.  Federal Courts cannot limit discovery on claimed “undue burden” without proof supporting good cause. Ross , at *11. 

No Prêt-a-Porter Discovery

The Court was not able to issue a “ready to wear” discovery order. 

The Court found that the Plaintiffs justified the need for additional searching of data for the specifically requested missing electronically stored information.  Ross , at *12. 

However, this came with a big “assumption”: that a search protocol could be devised with a “reasonable likelihood” of finding “some or all of the missing” electronically stored information.  Ross , at *12.

The legal burdens and search complexities were summarized by the Court below: 

There is nothing in the history of this case to suggest that plaintiff can never make a showing that there are relevant documents contained in data sets other than the ones subjected to the keyword search or in the documents produced to the SEC. True, the plaintiff does face a hurdle in doing so; the initial search and refinements were deemed to be the best way to identify responsive documents, and the data sets they were applied to was created with input from plaintiff (see the Court’s Order of October 27, 2008), so that if the Court were to order other types of searches, there would have to be some reasonable probability that the documents being sought would be found by those searches and that they would not add significantly to the burden which discovery has already imposed on Abercrombie. As already noted, however, Abercrombie, not plaintiff, must quantify that burden, especially where, as here, plaintiff’s request for additional documents is specific rather than general, and the documents at issue are important.

Ross , at *11-12. 

What to Wear?  Lack of a Search Protocol to Order

The Court had a giant problem in ordering the Defendant to perform additional searches: Did the ESI still exist and what was the best way to find it?  Ross , at *12. 

The Defendant did themselves a major disservice with their burdensome arguments, reducing the Court to digging through a closet for an answer. 

The Defendant’s arguments suggested that any other responsive ESI was only on their mainframe computer, which was not subject to a litigation hold, thus the ESI was lost.  Ross , at *12. 

Conversely, the Defendant could have also meant the only possible sources for the responsive ESI were on the hard drives that had been searched with their initial keyword search.  Since nothing was found, there were simply no other data sources to search.  Ross , at *12-13. 

The Court also noted that since the Defendant claimed any additional searches would be unduly burdensome, there could be other means to locate the missing electronically stored information.  Ross , at *13.

Simply put, the Court did not know the answer, which would be the legal equivalent of searching for a missing dress sock. 

Parties Ordered to Meet & Confer

There was only one thing the Court could do: The parties were to meet and confer about the search for missing ESI.  Ross , at *13.

The Defendant was directed to tell the Plaintiff if it believed the ESI still existed, how to search it and the cost in both time and money.  Ross , at *13.

The Court did take a small warning shot at the Defendant: they already had one chance to explain how additional searches would have been burdensome and they did not explain how it would be “particularly burdensome.”   Ross , at *13-14.

The encouraged the litigations to work out a search methodology and report back to the Court if they could not reach an agreement.  Ross , at *13-14. 

Bow Tie Thoughts

Attorneys naturally want to throw out every argument they can in a motion.  When dealing with electronically stored information, you might end up confusing the court instead of helping yourself. 

If electronically stored information is not reasonably accessible, explain in detail why that is the case.  The court wants facts, not wild accusations that a search is costly.

Finally, like a bow tie, the meet and confer never goes out of style.  Parties need to be specific in discussing their production challenges.  Attorneys are well served to have an expert with them who can translate the geek-speak into terms the lawyers can understand, resolve issues with the opposing party and correctly educate the court on e-discovery issues.

Harmless Error in Bank Robbery Conviction with Inadmissible Character Evidence from MySpace Profile

A Defendant in Georgia was convicted of multiple armed bank robberies and possession of a firearm by a convicted felon.  The Defendant was sentenced to 2,005 months in prison for his crimes.

On appeal, the Defendant claimed the District Court abused its discretion in admitting the “bad character evidence” of the Defendant’s MySpace profile, subscriber report and photographs to prove he committed the bank robberies “like a gangster.”  United States v. Souksakhone Phaknikone, 2010 U.S. App. LEXIS 9475 (11th Cir. Ga. May 10, 2010). 

The Court of Appeals found that the MySpace evidence was improperly admitted, but since there was overwhelming evidence of the Defendant’s guilt, it was harmless error. 

Government’s Attempted Use of MySpace Evidence

The Defendant was arrested after a string of bank robberies that culminated with a high-speed car chase that ended with the Defendant getting caught in barbed wire after attempting to flee on foot.  Phaknikone, at *2-4.  The Defendant confessed to several robberies after his arrest.  Phaknikone, at *4-5. 

The Government tried several times to admit the Defendant’s MySpace profile during the trial.  The MySpace profile was a prosecutor’s dream come true, complete with the profile name “Trigga FullyLoaded,” photographs of him with a gun, $ 100 bills that floated down the screen and rap music playing. Phaknikone, at *8-9. 

One theory the Government offered to use the MySpace profile photos was that the photos were “inextricably intertwined with [the Defendant’s] charged offense of possession of a firearm by a convicted felon.”  Phaknikone, at *6-7. 

After the jury was empanelled, the Government tried again to bring in MySpace photos to show the Defendant was “an individual who has access to having a gun, as shown and as evidenced by the brazen nature with which he publishes it to every single person on the internet through a MySpace account. . . . [I]t shows knowledge, it shows familiarity with guns.” Phaknikone, at *9.

The Government ultimately sought the admission of the Defendant’s MySpace profile, two photos and the subscriber report, which listed the ”user’s unique identification number, registered first and last name, location, email address, date of registration, and IP address at registration.” Phaknikone, at *7-8. 

There is a complicated trial history with the various attempts to bring in the MySpace evidence.  One witness during the trial had robbed a bank with the Defendant.  The witness testified he knew the Defendant as “Trigga” and knew the Defendant also had a MySpace profile.  Phaknikone, at *11-12.  The witness further identified the Defendant from a MySpace photo after being shown the photo on direct examination, thus allowing the Government to lay the foundation for the MySpace evidence.  Phaknikone, at *12.

The District Court allowed the photos from the MySpace page to be admitted into evidence.  Phaknikone, at *12. However, the District Court viewed the profile itself and subscriber report as character evidence and inadmissible.  Phaknikone, at *12-13.

Not one to give up, the Government tried again to admit redacted portions of the MySpace profile and subscriber report.  Phaknikone, at *13. This redacted portion was ultimately admitted after testimony from a MySpace employee.  Phaknikone, at *15.

The Government in closing argument referred to the Defendant as “Trigga” and used a MySpace photo of the Defendant holding a gun in a car.  Phaknikone, at *15.  The jury was issued a limiting instruction that the evidence “could be considered to prove only intent or absence of mistake or accident.”  Phaknikone, at *15.

Character Evidence Recap

Evidence hornbooks go into great detail discussing character evidence.  The intersection of character evidence and social networking will fill a solid chapter in future publications, if not a book of its own. 

The Defendant argued on appeal that his MySpace profile was offered for no other reason other than “to show action in conformity therewith.” Phaknikone, at *18-19, citing Fed. R. Evid. 404(b).

The Court of Appeals agreed that the MySpace profile was inadmissible character evidence, but that the error was harmless.  Phaknikone, at *19.

The test for determining whether a trial court abused its discretion in admitting character evidence under Federal Rule of Evidence Rule 404(b) is as follows:

1) The evidence must be relevant to an issue other than the defendant’s character.

2) As part of the relevance analysis, there must be sufficient proof so that a jury could find that the defendant committed the extrinsic act.” United States v. Miller, 959 F.2d 1535, 1538 (11th Cir. 1992) (en banc) (footnote omitted).

3) The probative value of the evidence must not be “substantially outweighed by its undue prejudice and the evidence must meet the other requirements of Rule 403.”

Phaknikone, at *19.

Courts apply this test “whenever the extrinsic activity reflects adversely on the character of the defendant, regardless whether that activity might give rise to criminal liability.” Phaknikone, at *19-20, citations omitted.

As the Court noted prior bad acts can be admissible to prove, “‘motive, opportunity, intent, preparation, plan, knowledge, identity, or absence of mistake or accident.’” Phaknikone, at *20, citing Fed. R. Evid. 404(b).

Moreover, the character evidence rule under Rule 404(b) “’is a rule of inclusion . . . [and] 404(b) evidence, like other relevant evidence, should not lightly be excluded when it is central to the prosecution’s case.’” Phaknikone, at *20, citations omitted.

Proving Identity with the MySpace Profile

The Government’s use of the MySpace profile had to pass the “particularly stringent” analysis that the extrinsic evidence showed a “signature” crime.  Phaknikone, at *20-21.  As the Court summarized:

“When extrinsic offense evidence is introduced to prove identity, ‘the likeness of the offenses is the crucial consideration. The physical similarity must be such that it marks the offenses as the handiwork of the accused. In other words, the evidence must demonstrate a modus operandi.’” Phaknikone, at *21, citations omitted. 

Courts require that the extrinsic acts are uniquely the defendant’s “signature” crime to “insure that the government is not relying on an inference based on mere character–that a defendant has a propensity for criminal behavior.” Phaknikone, at *21, citations omitted. 

MySpace Evidence Inadmissible Character Evidence

The Court of Appeals wasted no time holding the MySpace profile failed the first part of the Miller test: The profile was not evidence of identity.  Phaknikone, at *22.

The Court found the subscriber report only contained the Defendant’s nickname, which the Government’s witness stated he knew on direct examination.  Phaknikone, at *22.

The photos from the MySpace profile offered nothing showing a “signature” crime or “a modus operandi about the bank robberies.”  Phaknikone, at *22.

Since the MySpace photos and subscriber report failed to show any evidence of modus operandi to prove identity, the evidence was inadmissible. Phaknikone, at *23.

The Court held:

The MySpace evidence is classic evidence of bad character, which was offered by the government to prove only “action in conformity therewith.” Fed. R. Evid. 404(b). The government wanted the jury to infer that, because Phaknikone is willing to publish these kinds of photographs online, under an incendiary alias, he is a gangster who is likely to rob banks. The district court abused its discretion by admitting the MySpace evidence. Phaknikone, at *23.

A Harmless Abuse of Discretion in Admitting the MySpace Evidence

The Court of Appeals held the admission of the MySpace evidence was harmless, because there was “overwhelming evidence” of the Defendant’s guilt.  Phaknikone, at *24.  The Government’s evidence included confessions to four of the bank robberies, in addition to other evidence of the Defendant’s guilt.  Id. 

Bow Tie Thoughts

The Court’s reasoning and review of Federal Rule of Evidence 404(b) is commendable.  Given the volume of information on social networking sites, prosecutors would be foolish not to search MySpace, Facebook or Twitter about a specific defendant. 

However, just because a prosecutor can find out about a defendant’s bad character on Google does not mean it is admissible.  One possible reason the Court spent so much time on the analysis of the MySpace evidence (besides exercising their Constitutional duties), was a warning shot to prosecutors: Don’t drag in evidence unless it is truly relevant and not to convict a defendant with “bad character” evidence.  While the Court found it was a harmless error, the amount of time spent on the issue shows it is not a harmless issue.

Floppy Disk Wars: Form of Production & Computer Battles from the 1980s

The personal computer is an eternal icon of the 1980s.  However, few might suspect there is litigation currently pending dating back to the era of Reagan, Yuppies and Apple’s 1984 Orwellian  Super Bowl commercial.

[Youtube=http://www.youtube.com/v/OYecfV3ubP8&hl=en_US&fs=1&rel=0]

Floppy Disks: e-Discovery Echoes

Phillip M. Adams & Assocs. v. V., is the continuing story of litigation spinning out of defects in the NEC 765A floppy disk controller (FDC), which was in most personal computers in the 1980s. 

Dr. Phillip M. Adams developed solutions to the FDC defect, which generated several patent lawsuits.  One case had a $2.1 billion class-action settlement.  See, Phillip M. Adams & Assocs. v. V., 2010 U.S. Dist. LEXIS 45576 (D. Utah May 8, 2010).

One Defendant, Winbond, brought a motion to compel Adams to:

(1)     produce all documents and things that disclose or embody Adams’ asserted patents and alleged trade secrets . . . in native format, organized as they are kept on [Dr. Adams'] computer, and maintaining the metadata and file trees found on his computer;

Adams, at *16.

The two specific requests for production stated:

No. 37:

All documents constituting or containing source code, executable code, code portions, description of code, plans, designs, or architecture of hardware or software that Dr. Adams has either created or has in his possession, custody, or control relating to any of the ADAMS patents, ADAMS technology, or ADAMS trade secrets. All such documents, including code, must be produced in their original, native format.

No. 40:

Documents sufficient to show all of the directories and files related to such requests, the relationship of the directories and files within the directories, and the names and hierarchies of the directories and files, for each of Dr. Adams’ or Plaintiff’s computers containing, storing, or with information related to documents requested in Requests for Production Nos. 13 through 39 above.

Adams, at *17.

Requesting Native Files

The discovery battle included dueling emails and representations by the Defendant on what they thought the Plaintiff agreed to produce.  Adams, at *19-20. 

The Defendant sought the source code from the Plaintiff in native file format.  The Plaintiff did not object to the discovery request and offer an alternate form of production.  Adams, at *21. 

Pursuant to the Federal Rules of Civil Procedure Rule 34(b)(1)(C), a party “may specify the form or forms in which electronically stored information is to be produced.” Adams, at *21. 

Moreover, case law has established that where a requesting party states a form of production and there is no evidence the producing party objected to the stated form of production, the producing party must produced the ESI in the form stated.  Adams, at *21, citing Lawson v. Sun Microsystems, Inc. No. 1:00-cv-0196-RLY-TAB, 2007 WL 2572170, at *5 (S.D. Ind. Sept. 4, 2007).

The Defendant specified the electronically stored information in Request 37 be produced in native file format.  As such, the Plaintiff was required to produce the ESI in native file format.  Adams, at *21.

Form of Production Not Specified

The Defendant’s Request for Production #40 did not state the form of production.  The Court stated that if the Plaintiff had already produced the responsive discovery to Request #40, they were not required to supplement the production.  Moreover, the Plaintiff could select the form of production.  Adams, at *22. 

However, while the Court did not state it, the Rules do not permit a producing party to degrade searchable features of ESI, such as producing native files as TIFFs or PDFs without also producing associated metadata or OCR if there were redactions on the TIFF.  See generally, The Form of Production Battle of the Bulge: Scanned PDF’s Not a Reasonably Useable Form, New Bad Idea: Claiming You Can Produce ESI as PDF’s because “Native File” is “Ambiguous”, or Don’t Argue Imaginary ESI Production Problems. 

Searching Computers Dating Back to the 1980s

The Defendant argued that the Plaintiff’s old computers dating back to the 1980s potentially had relevant files that had not been produced.  As such, the Defendant wanted these “vintage” computers from the 1980s searched (along with everything in between).  Adams, at *22.

The Plaintiff countered that searching (let alone finding) all of the computers that had been used since the late 1980s would take hundreds of hours.  Adams, at *22.  Moreover, the Plaintiff claimed it “used each of those computers to produce archives (backups) from which Adams made its production.” Adams, at *22. 

Limiting Factors on Discovery

The Courts have the power to limit discovery if the “the burden or expense of the proposed discovery outweighs its likely benefit” under Federal Rule of Civil Procedure Rule 26(b)(2)(C)(iii).  Adams, at *22. 

A party does not have to produce electronically stored information that is “not reasonably accessible because of undue burden or cost,” pursuant to Federal Rule of Civil Procedure Rule 26(b)(2)(B).  Adams, at *23. 

Burden & Benefit: Can’t Tell

The Court was not able to determine whether the burden of searching the all of the older computers outweighed its likely benefit.  Adams, at *23.

The parties, not surprisingly, each reached opposite conclusions whether the producing party had sufficiently searched, archived and produced the responsive electronically stored information on the old to vintage computers.  Adams, at *23-24. 

The Defendant, along with some other defendants, believed the Plaintiff had not produced everything.  Supporting this belief was a spreadsheet with tests results that had not been produced until another defendant brought a motion to compel. Adams, at *24.  Understandably, the Defendant wanted to know if there was responsive ESI on the older computers. 

Going Back in Time: Old Computer Data to be Produced

The Court required the producing party to produce an inventory of the Plaintiff’s previous computers.  The purpose of the inventory was to determine if the Plaintiff’s computer archives were adequate.  Moreover, the inventory would test the Defendant’s claims that the there was more responsive electronically stored information to Request for Production #37.  Adams, at *24.

The Court weighed its decision against Federal Rule of Civil Procedure Rule 34(a), which allows for testing and sampling of electronically stored information.  Adams, at *24.  However, the Rule does not create an expressway to an opposing party’s electronic information system.  Adams, at *24.  This balance of producing just an inventory was likely the Court’s way of controlling costs before ordering the producing party to travel in time back to the 1980s.

The Court was specific of what was to be included in the inventory:

 Computer make and model;

Serial number;

Storage devices and capacity of the storage devices associated with the computer;

Dates the computer was in service;

By whom it was used;

A general description of the uses of the computer;

Any archive or backup related to the computer;

A summary of the type of data on the computer; and

The current location and custodian of the computer.  

Adams, at *24.

The Court also added a condition:  The Defendant could select one computer if the inventory contained 10 computers, or two computers if there was more then 10 computers, and the Plaintiff would then produce the “directories and file structure contained on the selected computer(s).”  Adams, at *25.  If there was significant discoveries on the directors, the Defendant could then bring a motion for additional discovery.  Adams, at *25. 

Bow Tie Thoughts

A requesting party has significant authority to state the form of production in their request.  However, the requesting party must be vigilant and make sure each request states a form of production, especially when requesting different forms of electronically stored information (ie, source code vs. emails vs. spreadsheets). 

A producing party must be a production sentinel and object specifically to each request if there is an issue with producing in a specified format.  A failure to object can lock the producing party into the requesting party’s form of production.

Uncovering ESI: 20 Search Term Tips

Special Guest Article by Peter Coons & Tom Groom – D4 LLC

Over the years we have keyword searched thousands of hard drives, e-mail stores, thumb drives, CD’s and servers.  Using keywords to identify potentially relevant documents is a well established practice in the eDiscovery world.  When combined with other methods search terms can be a powerful means for culling down a large dataset.  When implemented improperly they can cause major headaches.  To help on the path the keyword nirvana we have outlined 20 helpful (we hope) tips below.

False positive defined: A search term “hits” within a document but not for the meaning that was intended.  For example, the term “comput*” would return “computer” (the intended term) but would also return “computational” (not intended).  Computational would be the “false positive” term.

Below is a list of tips and tricks

1. Any term less than four (4) characters may result in a lot of false positives.  Clients have asked to search for “IT” (information technology) and then wonder why they are getting thousands of false positives.   
2. Be aware of “noise word” lists that are being used during the searches.  Some software applications don’t index the word “it” or “up” for example, so your attempt to find the key phrase “pick up” may fall down.   Most noise word lists can be customized.
3. Be aware that searching numbers can sometimes return unwanted results.  Often we are asked to search for patent numbers such as 1,234,567.  If this term is not quoted properly the result may be way off.  Try using the word “patent” in conjunction with the number.  Be aware that searching for 1,000 will also return 1,000,000 or it could return 2.10,1.000,85697..021.  Make sense?  Exactly.
4. Don’t use wildcards unless it’s absolutely necessary.  If you want to find DOG or DOGS then don’t use DOG* as a search term.   Simply provide both variations of the word.   If you must use a wildcard then please refrain from leading with a wildcard character.  You may get the result you are looking for but you will bring a lot of unwanted garbage with it. 
5. Searching for names of custodians will return a lot of hits if that custodian is part of collection.  Usually, all of the documents for that custodian.  Same thing with company names or subsidiaries.
6. Before deciding on search terms with the opposing party please try to actually sample documents with the proposed terms.  This may seem obvious but this advice is followed about 5% of the time.
7. Searching dates – There are lots of dates associated with ESI.  There are created, modified, accessed, sent, received, etc.  If the ESI was not forensically collected and instead was collected by the custodians and “dropped on a server” don’t be surprised when you find ZERO documents prior to 1/1/2009.  The metadata has been obliterated. 
8. What are the expectations?  Do you expect a 10% return rate and you are getting 90% or vice versa?  If so, there may be an issue. 
9. Don’t request “fuzzy” searching unless you understand what exactly is being requested.
10. DeNISTing does not get rid of all EXE, DLL, and system files.   Not exactly related to searching but we had to throw it in here.
11. Not all logic is the same for all search engines.  For example, some may use the “w/” proximity operator and others use “near”.  Ask the provider or operator to explain the logic and syntax that is required for the software being used.
12. Many characters are traditionally indexed as spaces (e.g. !@”#$&’()*+,./:;<=>?[\5c]^`{|}~).  This means that “pcoons@d4discovery.com” is indexed as three separate terms: “pcoons” “d4discovery” and “com”.  The “@” and the “ .” are considered spaces.  If the characters listed above are all indexed as spaces then my e-mail address would be the same as searching for”pcoons!d4discovery=com”.  Searching for “D4-Discovery” or “D4 Discovery” will yield the same results if the “-“ is indexed as a space. 
13. “1,000″ is same as search “1 000″ and the “word” 1,000,000 is three separate items in the index (1) (000) and (000) so two words and three entries/items.  If we indexed “,” as a comma and not a space then we could search for numbers like 5,195,508 but that would cause even greater issues with searching for other words.
14. When searching personal names, use the “w/2” proximity search between the first and last names.  (Tom w/2 Groom) will pull back Tom Groom; Groom, Tom; Tom S Groom; Groom, Tom S.
15. Suggest expanding first names with known nicknames.  “Bill Johnson” could be searched with ((Bill OR William OR Will) w/2 Johnson).  You will obviously need to gather any special nicknames from the customer (only people in our office would know “Mr. Squeeze” would be David Lapresi).
16. It is a good idea to use all caps for connectors like OR and AND.  It makes it easier to read and some engines require the connectors to be in all caps.
17. Many search applications like the use of parenthesis to separate unique terms or sets of terms.  It also makes it easier to read and correct.  Use quotes when you need to search a literal or a phrase.  Sometimes the quotes will override the stop or noise words but not always.  Here is an example of the use of parenthesis and quotes.((Pete OR Peter) w/2 Coons) OR ((Dave OR David w/2 Lapresi) OR (terminator) OR (“our leaders”)
18. Suggest domain names for potentially privileged queries.  The term (“lawfirm.com”) for example would pick up all email addresses from that domain.  This works well to identify communication with outside counsel.  (Note the @ is treated like a space so you don’t need an * at the beginning of the domain name.)
19. Avoid redundancy. The search ((Dog) OR (Dog w/2 Collar)) is redundant…the second term would already be picked up by the first term.  However, the second term would be more limiting than the first term.
20. As shown in the previous example, you can use proximity searches to limit the returns if one of the words is common and returning too many false positives.

Convicted by Text Message: Overcoming Authentication & Hearsay Objections

A wife was convicted of simple assault on her husband.  Text messages were used in her conviction to show her state of mind.  The Defendant appealed her conviction, claiming the text messages from her phone, the victim’s phone and a photo exhibit of a text message were improperly admitted on foundational and hearsay grounds.  State v. Thompson, 2010 ND 10, P1 (N.D. 2010).

The Supreme Court of North Dakota did not agree with her. 

The Facts: An SMS State of Mind of Assault

Halloween 2008: the Defendant “texted” her husband for money to buy their children Halloween costumes. Thompson, at *P3.  One text message sent at 8:20 am contained threatening and profane language. Id.

After the husband and wife drove the children to school, the Defendant demanded money and refused to get out of the victim’s car.  The victim had to drive to the police department for the Defendant to be removed from the car.  Thompson, at *P3.

Police were called to the Defendant’s house after 11:00 pm that night, finding the victim nursing an injured eye and several blows to the face and back.  The husband was hit several times by the wife in a fight over money.  Thompson, at *P3.

The wife was arrested and convicted for assault. 

Motion in Limine to Exclude Text Messages

The Defendant brought a motion in limine to exclude any testimony or evidence of the text messages.  Thompson, at *P6.  The Defendant claimed the texts were not relevant and inadmissible. Thompson, at *P9.  

Text Messages at Trial

The victim testified at trial about a threatening and profane text message sent the morning of the day he was attacked by the Defendant.  Thompson, at *P7.   The State offered a photo of the text message as a trial exhibit.  Id. 

The Defendant claimed the victim could have sent himself the threatening text from the Defendant’s phone.  Thompson, at *P7.  

Text Messages State of Mind

The trial court allowed the text messages at trial to show the Defendant’s state of mind the day of the attack.  Thompson, at *P11. 

Defendant’s Arguments

The Defendant claimed the State failed to authenticate the text messages. 

The Defendant argued that “text messages are inherently unreliable because of their relative anonymity and can rarely be connected, to a certainty, with a specific author.” Thompson, at *P12. 

Direct Examination of Victim

The husband stated on direct examination that the text messages were from the Defendant.  The victim explained that he stored his wife’s phone number as “Fr: Jen.”  Each text message began with the Defendant’s stored phone number in the victim’s phone.  The text messages were all “signed” with the Defendant’s signature “cuzImJenIcan.”  Thompson, at *P16. 

The Defendant challenged the admission of the text messages at trial as hearsay.  Thompson, at *P16.  The trial court ruled the text messages were “a declaration against interest and therefore not subject to [the] hearsay rule.” Thompson, at *P16.

Rules of Authentication

Authentication is a “condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.”  Thompson, at *P21. 

Pursuant to the Federal Rules of Evidence (which in this case mirrored the state rules), the party offering the evidence “must provide proof sufficient for a reasonable juror to find the evidence is what it purports to be. Thompson, at *P21, citing United States v. Hyles, 479 F.3d 958, 968-69 (8th Cir. 2007).

 

Authentication of Electronically Stored Information

The Supreme Court of North Dakota had not addressed text message authentication before and examined other case law where electronically stored information had been authenticated. Thompson, at *P24.  In all of the cases the Supreme Court of North Dakota discussed, circumstantial evidence was used to authenticate electronically stored information.  Thompson, at *P24.

Authentication examples summarized by the Supreme Court of North Dakota  included:

E-mails properly authenticated when they included defendant’s e-mail address, the reply function automatically dialed defendant’s e-mail address as sender, messages contained factual details known to defendant, messages included defendant’s nickname, and messages were followed with phone conversations on same topic. 

United States v. Siddiqui, 235 F.3d 1318, 1322-23 (11th Cir. 2000)

Foundational requirement for chat room conversation established when defendant admitted he used screen name “Cessna” when he participated in recorded conversations, several co-conspirators testified he used that name, and defendant showed up at meeting arranged with person using screen name “Cessna.”

United States v. Tank, 200 F.3d 627, 630-31 (9th Cir. 2000)

Threatening text messages received by victim on cell phone were properly authenticated when circumstantial evidence provided adequate proof message was sent by defendant.

Dickens v. State, 927 A.2d 32, 36-38 (Md. Ct. Spec. App. 2007)

Text messages properly authenticated when telephone employees testified about logistics for text messages and about how particular text messages were stored and received and messages contained sufficient circumstantial evidence the victim was the person who sent and received the messages.

State v. Taylor, 632 S.E.2d 218, 230-31 (N.C. Ct. App. 2006)

Instant messages properly authenticated through circumstantial evidence including screen names and context of messages and surrounding circumstances.

In re F.P., 878 A.2d 91, 93-95 (Pa. Super. Ct. 2005)

 All cases quoted from Thompson, at *P24.

Text Message Authentication

The Supreme Court of North Dakota held that the authentication of the text messages were proper.  The trial court was presented evidence from the victim of his knowledge of the Defendant’s cell phone number and her signature on text messages.  This evidence was sufficient under the Evidence Code to authenticate the text messages.  Thompson, at *P26.

Hearsay Challenge

The Supreme Court of North Dakota curtly dealt with the hearsay challenge: A party’s own statements are not hearsay.  Thompson, at *P31.

The Unreliable Text Message Argument

The Supreme Court of North Dakota quickly shot down the arguments that a text message was “unreliable” and could have been sent by the victim.  Thompson, at *P25-26. 

The Court, echoing a Pennsylvania Superior Court that addressed the authentication of instant messages, rejected the “argument that electronic messages are inherently  unreliable because of the messages’ relative anonymity.”  Thompson, at *P25. 

As noted in by the Pennsylvania court in In re F.P., 878 A.2d 91 (Pa. Super. Ct. 2005), paper documents can also be subject to forgery or signature letterhead stolen and used by another.  Id.  As the F.P. court stated:

We believe that e-mail messages and similar forms of electronic communication can be properly authenticated within the existing framework of Pa. R.E. 901 and Pennsylvania case law. We see no justification for constructing unique rules for admissibility of electronic communications such as instant messages; they are to be evaluated on a case-by-case basis as any other document to determine whether or not there has been an adequate foundational showing of their relevance and authenticity.

Thompson, at *P25, citing In re F.P., 878 A.2d 91, 93-95 (Pa. Super. Ct. 2005).

The Supreme Court found no error in the trial court’s finding of the victim’s authentication of the text messages and rejected the argument the text messages were “unreliable.”  Thompson, at *P26. 

Bow Tie Thoughts

State v. Thompson is a thoughtful opinion on the rules of Evidence and authenticating text messages.  The one area that could have been worth exploring was how the text messages were collected.

One of the trial exhibits was a photo of the text message.  Thompson, at *P7.  This certainly is a powerful trial exhibit to show the Defendant’s phone number, the text message and signature line. 

However, was the photo the sole means of preserving the text message?  It is possible the investigating officers just took photos to preserve the evidence after the incident. 

I encourage parties to defensibly preserve relevant electronically stored information using a product like Paraben when dealing with something as transitory as a text message on a cell phone.  Alternatively, if the phone is no longer physically available, the cell phone text message history can also be requested from some service provider (this would depend on whether the service provider was retaining any of the text message history).  While taking a photo of a text message has been done before, it is good for attorneys to realize the different methods of collection and preservation at their disposal.

Meet Early, Meet Often: Best Practices for Compliance with Federal Rule of Civil Procedure Rule 26(f) Meet & Confer Requirements

The Court finds the parties could have avoided the expenses of this Motion by conferring appropriately early in the case about ESI.

United States Magistrate Judge Michael R. Merz, Wells Fargo Bank, N.A. v. LaSalle Bank Nat’l Ass’n, 2009 U.S. Dist. LEXIS 70514 (S.D. Ohio July 24, 2009).

Case law is riddled with attorneys failing to comply with their statutory requirement to meet with their opposing counsel to discuss electronic discovery.  This failure to meet, most likely from inexperience instead of gamesmanship, can drive up discovery costs.  It can also result in a judicial lashing in open court.

Please join Connie Merriett, Esq., Dechert, LLC and Peter Coons., D4 LLC for a discussion on meet & confer best practices on May 19, 2010 at 12:00 am PST/3:00 pm EST. 

Webinar Registration Link

Meet Early, Meet Often, will address

• Recent case law addressing meet and confers pitfalls
• Best Practices for Meet & Confer Preparation
• The Sedona Cooperation Proclamation
• Strategies for discussing a Discovery Plan addressing preservation protocols, mandatory disclosures and form of production agreements           
• Discuss Meet & Confer Strategy with a mock fact pattern  

About the Presenters:

Connie Merriett, Esq., Dechert, LLP

Connie E. Merriett, Esq., is an Intellectual Property Litigation Association at Dechert, LLP.  Ms. Merriett focuses her practice on patent and trade secret litigation for high technology companies, primarily in the computer, semiconductor, and electronics industries.

Ms. Merriett has served as the lead attorney on the entire range of pre-trial and trial matters and has developed especially strong experience in coordinating all phases of discovery, evaluating patent damages, Markman hearings, and in handling all phases of trial preparation for technically complex cases. Ms. Merriett also has experience with cases involving software copyright issues and trademark issues.

Ms. Merriett is a courtroom veteran who has appeared in federal and state courts throughout the country. She recently argued a successful motion, under 35 U.S.C. section 285, for attorneys fees in a high-profile patent case on behalf of computer-maker Gateway. On behalf of computer-maker Acer, Ms. Merriett played an integral role in a multi-patent litigation in the Western District of Wisconsin. She developed the non-infringement and invalidity analyses for a patent relating to technology for computer touch pads, managed discovery, and briefed and argued the Markman hearing.

Peter Coons, Vice President, D4 LLC

As Vice President of D4, Peter Coons is focused on implementing innovative e-Discovery solutions for D4 and its clients.  Peter has nearly fourteen years of experience in the legal technology field and holds multiple industry certifications related to computer forensics.  He has testified as a computer forensic expert witness and has been appointed by a District Court as a neutral third party examiner.  He has vast experience orchestrating large scale electronic data collections relating to litigation, audits, or regulatory requests.  He has also written articles on computer forensics and e-Discovery that have been published in legal periodicals.

Prior to joining D4, Peter worked at Baker Robbins & Company, Electronic Evidence Discovery, Inc., and New York Life Insurance Company.  At those organizations his roles comprised managing operations to coordinating litigation support services for internal and external clients.