What is Ediscovery, and Why Should You Care?

by Joe Moran

This ediscovery guide discusses what you need to know and do if your business receives an electronic evidence preservation letter.

According to Webopedia, electronic discovery—or ediscovery for short—describes the process of compiling, storing, and securing of digital information, such as email, files, and other data for evidence in a legal proceeding. This article looks at why it's important for small business owners to understand ediscovery and what they need to do in the event of a lawsuit.

[Learn more about data backup: Online Data Backup Services for Small Business]

Disagreements are an inevitable part of doing business, and fortunately you can often resolve disputes with customers, suppliers, or employees relatively easily (if not always amicably). But when you can't, your business might receive a demand letter notice of a claim or a lawsuit. Such notification often includes a demand for preservation of information, sometimes known as a "preservation letter," instructing you to take steps to ensure that no one in your company destroys potentially relevant information—including electronically stored information, or ESI.

Let's look at what you need to know about ediscovery in the event that you need to preserve ESI as the result of a lawsuit. Before we go any further, it's important to note that we're not conferring legal advice here; if you receive a preservation letter, your first order of business should be to obtain your own legal counsel.

Ediscovery Checklist

Read the entire article, and use the links below to jump to that specific ediscovery category.

What is ediscovery?

Ediscovery and Preserving Digital Evidence

Keeping paper documents out of a dumpster or a shredder is straightforward enough, but preserving ESI in an environment where you constantly modify data (i.e. overwrite it) can be a considerably more daunting job. Given what's at stake (more on that later), preserving electronic data—which typically involves a series of ongoing tasks—should be performed by, or under the direct supervision of, an IT expert, depending on the amount of data you need to preserve and where it's located.

If you don't have in-house IT resources then bring in outside expertise, and keep in mind that regardless of whether you handle data preservation internally or you outsource it, the people involved must document their activities in detail—who did what, and when, and how. They must also maintain a chain of custody for any physical devices (computers, storage devices, etc.) that contain potentially relevant data. Another big reason to task data preservation chores to IT professionals: whoever does the job may be considered a witness and be called on to testify in hearings or at trial.

So what exactly data do you need to preserve? That, of course, depends on countless variables and the specifics of the particular case. And because the information that may be relevant isn't always clear at the outset of litigation, preservation letters often use very broad—sometimes vague or confusing—language to describe what information should be preserved.

When preservation letters take an "everything-but-the-kitchen-sink" approach, your attorney can contact the opposing counsel to advocate for narrowing the scope to specific types of data, individuals, and/or timeframes.

"It's always a good idea for the parties' attorneys to start a dialogue and attempt to formulate a discovery plan early on, even if there aren't any concerns about the scope or clarity of the preservation demand," says Sonia M. Diaz, Esq., partner with Coleman Hazzard & Taylor, a civil litigation and business law firm in Naples, FL.

Ediscovery Costs and Consequences

Small businesses with limited resources may be justifiably concerned about how much effort and expense it takes to preserve the required electronic data. The costs in terms of hardware, software, and especially person-hours can be considerable. The data you need to preserve may go back long before the legal claim was filed, and finding it might be time and labor intensive. The upshot is that preservation expenses may be a major financial burden.

Unfortunately, no uniform standards govern preservation demands or outline how much effort or expense is appropriate to comply with them. In general you should always make best (i.e. good-faith) efforts to preserve any potentially relevant data. "When in doubt as to whether data is relevant, err on the side of preserving rather than discarding data or allowing it to be overwritten," recommends Diaz.

Courts typically have discretion to limit the scope of discovery and/or require the requestor to bear at least some of the recipient's costs. But exactly how and when courts exercise that discretion varies from jurisdiction to jurisdiction and there's no way to know in advance when, or even if, a court might make such a determination.

In some jurisdictions the court will limit discovery and/or shift cost to the requesting party only where it determines that the cost of preserving and producing the data is disproportionate to its likely benefit. If a preservation demand is especially burdensome, your attorney may be able to convince the other party to share some of the resultant expenses, provided you can show documentation or testimony to justify the expenses.

If the parties cannot agree on a resolution, your attorney may be able to obtain relief in court. While there are no hard-and-fast rules as to what types of preservation costs may be shifted to the other party, "if the expense was a direct result of compliance with a preservation demand, I would be comfortable asking for it," says Diaz. Just don't expect anyone to help pick up the tab for indirect costs, such as lost productivity or downtime associated with taking computing devices out of service.

The hassles and costs of compliance notwithstanding, it's important that you take evidence preservation demands seriously to avoid putting your business at risk of adverse legal consequences. Indeed, while the data you preserve may or may not ultimately be required depending on how the case unfolds, failing to preserve data that's later determined to be relevant or potentially relevant (what the legal profession refers to as spoliation), can result in significant penalties.

Specifics vary by jurisdiction (sometimes even within the same jurisdiction), but they can include "prejudicial jury instructions, monetary fines, and the striking of pleadings, which can result in the party responsible for destroying evidence losing the case," according to Diaz. And it may not matter whether the destruction was unintentional, because some states, such as Florida, consider destruction of evidence a sanctionable discovery violation even if the destruction wasn't deliberate.

Ediscovery: What Information Should You Preserve?

The type of electronic information that might be relevant to a legal proceeding includes documents or spreadsheets, emails, a PC's browsing history, text (SMS) messages, and voice mails. It may also include metadata—data about data—such as when a piece of information was created or modified, and by whom. Preserving different types of data presents different challenges, but here are a few things to keep in mind.

First off, when it comes to data preservation, time is most certainly of the essence. Given the routine electronic data destruction (i.e. old information continually being overwritten with new) that takes place in a typical office environment, data preservation can't generally wait a week or even a day—the time to start is right away. If you can't begin immediately, at the very least you should power down devices, take them out of service, and secure them until they can be examined.

Also, technical measures to lock down data may not always be practical or even possible, so—and this is vital—don't neglect the human element. Formally notify employees about the existence of litigation and instruct them not to delete any potentially relevant data. Given that legal proceedings can go on for months or even years, issue reminders frequently, and don't forget to inform new employees as well.

Ediscovery Checklist

Read the entire article, and use the links below to jump to that specific ediscovery category.

Ediscovery: Preserving Email

Legal disputes frequently have to do with who communicated what to whom and when, which often makes email a fertile source of relevant information. As it happens, it can be among the easiest data to preserve, because almost all email servers have a function called Legal/Litigation Hold (or a similarly-named feature) that prevents messages from being deleted—either indefinitely, or for a specified duration.

[Protect your data: Data Backup Devices for Small Businesses]

You can enable this on a per-user/mailbox basis so it applies only to relevant individuals, and it will override any mail storage quotas those people may have (so watch your free disk space if you're running low). The most recent versions of Microsoft Exchange have an enhanced feature called In-Place Hold that lets you preserve messages based on a search query and pinpoint the specific messages that contain relevant subject matter in lieu of preserving an entire mailbox.

Ediscovery Tools for Preserving PC and Server Content

When you need to preserve the contents of a desktop or laptop PC (or a Mac for that matter), cloning the hard disk seems like a logical way to proceed. However, standard cloning tools (such as Clonezilla) clone only the used disk space. They ignore the free space, which may be chock full of recently-deleted—and potentially relevant—files and configuration data. To clone the entire disk, free space and all, requires a forensic cloning tool such as the free and open-source OSFClone.

Bear in mind that forensic cloning a computer with a large hard drive—it doesn't matter if it's mostly empty—can take many, many hours during which time the system will not be available for use. You can get your systems back in service a bit quicker by using standard cloning tools to clone the original disk to a new replacement disk, then swap in the replacement and preserve the original disk. This obviously adds some hardware cost, and it may not be practical for systems where you can't easily access the hard drive, such as certain laptops.

Ediscovery and small business

Preserving data on a server where lots of people constantly add and update data can be a challenge especially if the server isn't set up to provide some type of file versioning (where it retains earlier iterations of data files whenever anyone makes a change to them). Here's a relatively straightforward, albeit somewhat blunt, way to preserve a server's contents: adjust your backup rotation (you are backing up your data, right?) with additional disks, tapes, or whatever media you use so that you don’t overwrite previous backups. Be sure you physically secure your backup media at all times—and remember to preserve that chain of custody.

If you backup data to the cloud or to a network attached storage (NAS) device, rather than to removable media, alter your configuration to ensure that it doesn't overwrite the backups. Keep in mind that this may eventually require provisioning/adding more space as your backups start to pile up.

Ediscovery: Preserving Smartphone and Tablet Data

Preserving data on these devices can be problematic, because they're not as easily to manipulate as PCs and servers. Plus many of the features (such as text messages and voice mails) may be under the control of the mobile carrier or device/OS manufacturer rather than the device's user or owner.

You can make partial or full backups of mobile devices and store them locally as opposed to in the cloud (with iOS devices you can do it with iTunes or other utilities, but Android devices typically need to be rooted). However—depending on what you need to preserve—you may need to contract a mobile forensics professional to get the job done properly.

And be warned that if your business practices BYOD (bring-your-own-device) and you allow employees to use personal devices for work, it may be legally required to preserve relevant data on those employee-owned devices. "Discovery obligations typically apply to all information within the possession, custody, or control of the party receiving the request," points out attorney Diaz. "A party is deemed to have 'control' of information that they have the right, authority, or practical ability to obtain, even if it's held by third parties."

Speaking of third parties, it's important to note that if your business uses any kind of hosted services, such as Office 365, Google Apps, a hosted database or CRM, etc. you need to get those providers involved early on because you may not always have the direct administrative control necessary to preserve relevant data. In some cases, you may not be able to preserve certain kinds of data in-place on hosted services—for example, you currently can't put a hold on files stored in Google Drive.

Also, in some cases you may need to upgrade your hosting plan in order to gain access to features that allow you to preserve data (providers typically refer to these as ediscovery or compliance features). The same may be true of on-premises software—for example, you're not allowed to use Microsoft Exchange's Litigation/In-Place hold on a mailbox unless the user has an Enterprise (rather than a Standard) license.

[Learn more about data security: 6 Ways to Improve Small Business Data Security]

One last thing—some courts have found that the duty to preserve relevant information doesn't begin when a legal claim is filed, but rather when you can reasonably foresee one on the horizon. Therefore, it behooves you to get your business ducks in a row at the first sign of a dispute that might progress into legal action.

Joseph Moran is a technology writer and IT consultant specializing in services for consumers and small businesses. He's written extensively for numerous print and online publications, and is the author of File Management Made Simple, Windows Edition from Apress.

Do you have a comment or question about this article or other small business topics in general? Speak out in the SmallBusinessComputing.com Forums. Join the discussion today!
This article was originally published on Wednesday Sep 21st 2016
Mobile Site | Full Site