…because even the smartest, coolest IT experts will have to deal with it sooner or later.
R BY BILLF7=;' TOLSON R F7=;( 9EDJ;DJI h
Introduction: Which know-IT-all are you? ...... 5
Chapter One: Sorry, no – eDiscovery is not online speed dating ...... 7
Chapter Two: It’s all geek to me (Reviewing the new FRCP amendments) ...... 10
Chapter Three: “I have to stop all ESI deletions when?” (When or what is considered notice of possible litigation?) ...... 16
Chapter Four: Searching for ESI is like looking through the office fridge: There’s more in there than you’d expect ...... 20
Chapter Five: A CEO, a marketing manager, and an email admin walk into a bar… (eDiscovery involves many departments, not just IT) ...... 23
Chapter Six: A litigation hold is like being hungover at work – you just can’t focus on anything else ...... 27 R F7=;) 9EDJ;DJI h
Chapter Seven: Spoliation is not what happens to last week’s Chinese food ...... 31
Chapter Eight: Safe Harbor is the truest form of CYA: Understanding FRCP Rule 37(e) .....34
Chapter Nine: Proactive planning for eDiscovery ensures you won’t miss the Stargate SG1 weekend marathon ...... 37
Chapter Ten: Form ID-10T Summary ...... 47
©2009 Mimosa Systems, Inc. All rights reserved worldwide. Mimosa, Mimosa Systems, and Mimosa NearPoint are trademarks of Mimosa Systems, Inc. in the United States and other countries. Other product names mentioned herein may be trademarks or registered trademarks of their respective owners. R F7=;* ?DJHE:K9J?ED h
Which Know-IT-All are you?
CHECK ALL THAT APPLY.
fig. : JOE COOL fig. : MR. FIX IT fig. : TH E ALL NIGHTER
The resident wunder- Hero of the helpdesk—your No 9-to-5’er, and it shows—it kind—you can close most techie obsession has paid looks like you slept in your trouble tickets with 10 simple off. Look who needs your clothes because you did, at your keystrokes and a smug smile. geeky know-how now. It’s the desk. Whatever it takes, man. Chicks really dig that. revenge of the nerds.
fig. : THE CONNOISSEUR fig. : THE SMARTY PANTS fig. : THE RENEGADE
No school like the old school- A promising new recruit—you Standard procedures are for -you know what ports and know the coolest trends, the chumps—you’ve learned some protocols all systems use to latest tech, and the big buzz problems are fixed with paperclips talk AND you can synch the words. No one understands a and chewing gum. Giddyup, who’s berry. You are Morpheus to word you say. next? their Neo. R F7=;+ sumrluv09 sxyminx078
The Know-IT-All Quiz Question 1:
eDiscovery is defined as: A) Online speed dating. B) Getting to know that hot chick on Second Life.® C) Touring the world on Google Earth.™ D) A panicked last-minute request from your corporate legal department requiring you to wade through endless terabytes of ESI, on top of your already-full workload.
freddiefab_2
R prettymary F7=;, 9>7FJ;HED; h
Sorry, no – eDiscovery is not online speed dating
lectronic discovery (also called e-Discovery or eDiscovery) refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case. eDiscovery can be carried out offline on a particular computer E 1 or it can be done on the network.
Recent amendments to the Federal Rules of Civil Procedure (FRCP) highlighted duh! that electronically stored information (ESI) is a discoverable record type and factoid should be treated as any other type of evidence (see Chapter Two). In civil eDis- covery, all ESI that could pertain to a case must be found, It is usually the party protected, and turned over to opposing counsel when requested. being discovered that pays the cost of the M^WjZe[ij^_ic[Wd\eh?J5 discovery. ?jc[WdioekcWoX[Z_h[Yj[ZjeÓdZif[Y_ÓYÓb[i _dYbkZ_d] I^Wh[Fe_djh[YehZi"[cW_biWdZc[jWZWjW YedjW_d_d]if[Y_ÓYYedj[dj" \hecehjeif[Y_ÓY[cfbeo[[i"i[djX[jm[[dif[Y_ÓYZWj[i$?jYWdX[fh[jjoif[Y_ÓY?\oekhYecfWdo _ib_a[ceijYecfWd_[i"oekm_bb^Wl[jei[WhY^j^hek]^j[hWXoj[ie\;I?jeÓdZj^_i_d\ehcWj_ed$Je cWa[cWjj[himehi["oekÊbbb_a[bo^Wl[c[h[ZWoiehÆWjX[ijÆWYekfb[e\m[[aijeZeie$?\oekYWddej \kbboYecfbom_j^effei_d]Yekdi[bÊih[gk[ij"oekhYecfWdoYekbZbei[j^[YWi[X[\eh[_j[l[h][jije jh_Wb$7dZbei_d]m_bbYeijoekÆ^k][Ód[i"fkd_j_l[ZWcW][i"WdZeffei_d]Yekdi[bÊi\[[i$
Corporate management often doesn’t appreciate what’s required to adequately respond to discovery requests—especially if they have not been through the process before. Many IT administrators know this pain— the Friday afternoon phone call from corporate legal or the CIO asking for a “round-up” of all ESI detailed in a new discovery request. “Have it on my desk by Monday morning!”
R F7=;- 7D[:?I9EL;HOH;GK;IJKIK7BBO;D9ECF7II;IJ>H;;C7?DJEF?9I0 JWh][j[Z[cfbeo[[i YkijeZ_Wdi 7if[Y_ÓYZWj[hWd][ If[Y_ÓYYedj[dj
These three topics are the tip of the ice- duh! Opposing counsel berg. The availability of new technology has factoid can ask for any- empowered opposing counsel to be increas- thing in discovery, ingly specific in their requests. So nowadays and if a judge agrees with the a discovery could also include things like request, you have to comply. Boolean logic instructions. For example: find all correspondence between Employee 1 and So, are you equipped to search though terabytes Employee 8 that relates to the ABC Corpo- of electronic files, emails, attachments, data- ration (but not including ABC Corporate) base systems, and employee storage (including and XYZ Corporation between January 27, removable media) to locate specific content be- 2005 and July 13, 2008. To complicate mat- tween certain dates? And can you do it within, ters, this request may be further narrowed to say, two weeks? include only those emails that were opened!
Gone are the days of burying opposing coun- If not, how would you explain the sel under a mountain of storage boxes con- impossibility of this request to your taining millions of printed records for them management team? to search themselves. The amendments to the FRCP direct parties responding to a discovery IEM>7JÊIJ>;7DIM;H5 request to find and turn over only relevant Plan for eDiscovery before it happens. That records. This puts the onus back on you—it’s means putting archiving systems in place now the discoveree’s job to sort through the enabling you to centrally manage ESI, mountain of material. apply retention policies, secure data for litigation holds, and search the entire data store.
R F7=;. 88
My CIO wants me to come up to speed and follow the new federal rules of civil procedure. 8
I8 told him to quit telling me how to treat my wife.
The Know-IT-All Quiz Question 2:
What are the Federal Rules of Civil Procedure? A) Lie. Deny. Then Jerry Springer. B) Why I divorced my third wife. C) Do not talk about the Federal Rules of Civil Procedure. There are no Federal Rules of Civil Procedure. D) The legal playbook governing court procedures for civil suits in the United States district courts—recently amended to make life a whole lot easier for lawyers and a whole lot harder for the IT crew. R F7=;/ 9>7FJ;HJME h
It’s all geek to me (Reviewing the new FRCP amendments)
ll employees—and especially IT folk—need to understand their responsibilities under both their state’s rules of civil procedure and the new Federal Rules of Civil Procedure (FRCP). AThat’s because, under certain circumstances, any employee can be held personally responsible for the destruction of evidence by deleting electronically stored information (ESI). Knowing how to manage ESI substantially lowers everyone’s risk.
M>7J7H;J>;<;:;H7BHKB;IE<9?L?BFHE9;:KH;5 The FRCP, established in 1938, govern federal court procedures for civil suits in the United States district courts. Put forth by the United States Supreme Court pursuant to the Rules Enabling Act, they were then approved by the United States Congress. The Court’s modifications to the rules are usually based on recommendations from the Judicial Conference of the United States, the federal judiciary’s internal policy-making body. Although federal courts are required to apply the substantive law of the states as rules of decision in cases where state law is in question, the federal courts almost always use the FRCP as their rules of procedure. States make their own rules that apply in their own courts, but most states have adopted rules based on the FRCP.
The most recent revision to the FRCP, which took effect in December 2006, included practical chang- es to discovery rules to make it easier for courts and litigating parties to manage electronic records. These new amendments continue to have a major effect on how companies retain, store, and produce ESI for litigation—especially email, SharePoint, and file system data.
The FRCP does not specify or even suggest any technologies be used for record archiving or eDiscovery processes, but rather makes clear the obligation to quickly secure, hold, and produce all pertinent data for litigation when directed.
In many companies, the IT staff is in charge of duh! collecting ESI and applying litigation holds. So, to factoid reduce your personal risk, you’d better understand your company’s legal responsibilites. R F7=;'& 4%!- %3) 4(% .%7 !-%.$-%.43
The new amendments define what ESI is, what ESI must be disclosed, and when. They also place new requirements on the parties’ knowledge of The fact that your their own electronic infrastructure—what company has never had ESI they have, where it’s kept, how it’s re- duh! a civil lawsuit against it tained, and how it’s deleted. The FRCP also factoid does not mean it never reiterates the parties’ obligations for preserv- will. Chances are your ing potential electronic evidence. The new company will either be a direct target amendments to FRCP rules 16, 26, 33, 34, of litigation or a third-party to and 37 are aimed directly at ESI. discovery sooner or later. The changes reflect the reality that discov- ery of email and other ESI is now a rou- tine—yet critical—aspect of every litigated case. First, the amendments treat ESI differently. Second, they require early discussion of and attention to electronic discovery. Third, they address inadvertent production of privileged or protected materials. Fourth, they encourage a two-tiered approach to dis- covery—deal with reasonably accessible information and then later with inaccessible data. Finally, they provide a safe harbor from sanctions by imposing a good faith requirement.2
Any organization that can be sued in federal court is affected by these amendments. So all organiza- tions need to proactively manage all aspects of their electronic infrastructure, including litigation hold capability and ESI retention policies. R F7=;'' 2ULE This rule clarifies a responding party’s duty to include ESI in its initial disclosures. It also requires the party to describe where, in what form, and the accessibility of all ESI they have in their possession. It reads, in part: “A copy of, or a description by category and location of, all documents, electronically stored information, and tangible things that are in the possession, custody, or control of the party and that the disclosing party may use to support its claims or defenses, unless solely for impeachment.” 3
2ULE A 2 L Rule 26(a)(1) specifies that the organization must have a location and high-level inventory of all electronic data ready at the pre-trial conference. This rule removes any maneuvering room around producing instant messages, SMS messages, voicemail, or other forms of electronic data stored in less accessible locations, such as removable storage devices, USB thumb drives, digital camera memory, etc.
M^WjZe[ij^_ic[Wd\eh?J5?Jm_bbX[YWbb[Zkfedjegk_YabofheZkY[j^_iZ[jW_b[ZZWjW cWff_d]eh_dl[djeho$8[fheWYj_l[9h[Wj[j^[ZWjWcWfeh_dl[djehoW^[WZe\j_c[WdZ a[[f_jkfjeZWj[$Ej^[hm_i["oekhm[[a[dZYekbZX[Wffhefh_Wj[Z\ehj^_ibWijEj^[hm_i["oekhm[[a[dZYekbZ c_dkj[[n[hY_i[$
2ULE B This rule alerts the court and litigants to the possible need to address the handling of discovery of ESI early in the litigation process. Rule 16(b) is amended to invite the court to address disclosure or discovery of ESI in the Rule 16 scheduling order and gives the court discretion to enter an order adopting any agreements the parties reach for asserting claims of privilege or protection after inadvertent production in discovery. R F7=;'( 2ULE A # is not reasonably accessible. If the responding party makes this showing, a court may order dis- Rule 26(a)(1)(C) removes the long periods of covery for good cause and may impose conditions. time to respond that were commonplace before the new amendments were issued. Now, a party Any organization should first obtain and examine must make the initial disclosures at or within information that can be provided 14 days after the parties’ Ruleule 26(f ) fromfrf om eaeasilys accessible sources conference unless andaand thenthen determine whether a different time is it is necessarynec to search less set by stipulation or accessibleaaccessib sources (a court can court order, or unless orderoorder a sampling technique to a party objects during determineddeterm the usefulness of the conference that searchingssearch the less accessible initial disclosures are sources).ssourc not appropriate in this action and states the A partypa might be obligated objection in the pro- tot preservep information posed discovery plan. In storedsstor on sources it has ruling on the objection, identifiediide as not reason- the court must determine ablyaab accessible. what disclosures, if any, are to be made and must RuleR 26(b)(2)(B) requires set the time for disclosure. companiesc to know early ono what ESI discovery M^WjZe[ij^_ic[Wd\ehh maymay bbee ddifficultifficult to produce, or expensive ?J5Oekckij^Wl[oekh to produce, why, and identify it to other parties, ZWjWcWfehZWjW_dl[djehoh[WZokf\hedj$?\ with reasonable specificity. oekmW_jkdj_boekWh[Wia[Z\eh_j"oekhY^WdY[i e\ÓdZ_d]Wbbh[ifedi_l[ZWjWWh[l[hobem$ Company representatives, including the corpo- rate legal team, must now be knowledgeable of 2ULE B " their corporate data infrastructure at the pre-trial Rule 26(b)(2)(B) clarifies the obligations of a meeting to discuss the eDiscovery plan. responding party to provide discovery of ESI that is not reasonably accessible (deleted information, M^WjZe[ij^_ic[Wd\eh?J5 information kept on some backup tape systems, Jej^[YekhjÇ_dWYY[ii_Xb[ÈZe[idejc[Wd and legacy data from systems no longer in use). Çd[l[hc_dZÈJ^[j[hch[\[hi_dij[WZjej^[ The amendment requires the responding party fh_eh_joe\ZWjWZ_iYel[ho$:WjWijeh[ij^WjWh[ to identify the sources of potentially responsive Yedi_Z[h[ZÇWYY[ii_Xb[ÈWh[i[WhY^[ZÓhij$ information it has not searched or produced >em[l[h"j^ei[Z[[c[ZÇ_dWYY[ii_Xb[ÈYekbZ because of the costs and burdens of accessing the X[Z_iYel[h[ZbWj[h$?\j^Wj^Wff[diWdZoekh information. If the requesting party moves for [n[Ykj_l[i_di_ijj^WjÇ_dWYY[ii_Xb[Èc[WdiYWdÊj production of such information, the responding X[WYY[ii[Z"][jj^[cjefkj_j_dmh_j_d]$ party has the burden of showing the information R See CYA, page 34 F7=;') 2ULE employee awareness campaigns, etc. In essence, Rule 37(e) obligates businesses to have a compli- Rule 34 explicitly recognizes ESI as a category ant records management program and litigation of discoverable data. It also allows the requesting hold procedures, among other things, to show party to specify the form or format of data “good faith” and intent to be responsive to any production—hard copy, native format, PDF, etc. discovery order. A key provision of Rule 34 is to produce data in “a form or forms in which it is ordinarily main- M^WjZe[ij^_ic[Wd\eh?J5 tained or in a form or forms that are reasonably Kfedb[Whd_d]e\feii_Xb[b_j_]Wj_ed"?J^Wije usable.” X[WXb[jeijefWbbZ[b[j_edie\h[ifedi_l[ZWjW _cc[Z_Wj[bo$J^_ic[Wdifh[l[dj_d]Wbb[c# Rule 34 allows for an agreement at the initial fbeo[[Z[b[j_ediWim[bbWiWkjecWj[Zioij[c meet-and-confer between the parties regarding Z[b[j_edie\Wbbfej[dj_Wbboh[ifedi_l[h[YehZi what form or format the responsive data will m_j^_dc_dkj[i"_\deji[YedZi$ be produced. This agreement replaces the past practice providing requested ESI in formats dif- ficult to use, such as hundreds of boxes of printed email.
M^WjZe[ij^_ic[Wd\eh?J5 I_cfbofkj"i[Ykh[WdZjkhdel[hWbb[cW_b" I^Wh[Fe_dj"WdZÓb[ioij[cWdZYkijeZ_WdZWjWjW _dj^[\ehcWjoekÓdZ_j"m^[h[l[hoekÓdZ_j_d_d oekh_d\hWijhkYjkh["_dYbkZ_d]Wbbc[jWZWjW$
2ULE E Rule 37(e) creates a “safe harbor” which protectsts the discovered party from adverse sanctions forr failing to provide ESI because of inadvertent loss due to “good faith” operation of the com- pany’s electronic infrastructure. For example, if the company initiates a litigation hold and takes other measures to preserve all potential- ly responsive ESI after it’s been made aware of possible litigation, then it could claim safe harbor if responsive data is inadvertently lost or deleted. The key to claiming safe harbor is being able to show the court the company took several steps to ensure respon- sive data was not deleted or lost. This proof can take the form of existing data retention policies, formal litigation hold and discovery procedures, R F7=;'* G G99B 'F89F CB ,. &'/ !J>WB VLRO COFBKAP @LIIB>DRBP
Sally got fired on Friday? Simply turn on the ALL-NEW LITIGATION DETECTOR and find out if she plans to sue your company… great fun at parties and corporate events! Adjustable volume control Minimally invasive Available in black, silver, or red
The Know-IT-All Quiz Question 3:
Which of the following constitutes notice of possible litigation? A) The execs all suddenly move to Switzerland. B) The janitor urinating on the copier. C) The guy who got fired last week sues the company. D) All of the above—and much, much more. R F7=;'+ 9>7FJ;HJ>H;; h
“I have to stop all ESI deletions when?” (When or what is considered notice of possible litigation?)
mendment 37(e) is much debated in Many lawyers and judges would say yes. This the legal community as a whole and conversation should trigger the company’s ob- Adangerously misunderstood in the cor- ligation to start protecting data for the possible porate legal community in particular. The FRCP discovery request. Advisory Committee’s comments to amended Rule 37(e) make it clear that duh! FCRP Rule 26(b) states: Every orga- any automatic deletion feature factoid nization has “a duty to disclose should be turned off and a litiga- all potentially relevant sources of tion hold imposed once litigation Written documents information” to the courts as soon can be reasonably anticipated. are not the only as they “reasonably anticipate” This begs the question: when can notice of potential litigation, unless these sources are litigation be reasonably anticipated? litigation. Notice can “not reasonably accessible because be verbal or even of undue burden or cost.” This The answer is important. based on requirement puts the legal depart- Recognizing possible impending circumstances. ment between a server rack and a litigation triggers your respon- hard place. While not necessarily sibility to secure and protect all a problem for the IT organiza- potentially responsive records, both electronic tion, it is a good idea to at least be aware of the and hard copy. The inadvertent destruction of company’s legal responsibilities. such evidence would not be not be looked upon kindly by the court. The Testa v. Wal-Mart case provides another example of an unconventional form of notice. So, when is notice of a possible lawsuit given to a While delivering a shipment of live tropical fish business entity? Say several employees are stand- to a Wal-Mart store, Louis Testa slipped on ing around the department coffee machine. Bob some ice on the loading dock and hurt himself. says to Jim; “Did you hear they fired Sally?” Jim As he picked himself up, he spied a young “asso- responds; “Yeah, I spoke to her on Saturday, and ciate” near the loading dock door and yelled “I’m she said she is thinking of hiring a lawyer.” Is going to sue you guys!” this notice of possible litigation for the company? R F7=;', Case Study: Testa v. Wal-Mart
In the winter of 1993, Louis Testa, a truck driver defended against the suit by claiming Mr. Testa for a tropical fish wholesaler, Heavenly Fish, ignored Wal-Mart’s explicit direction not to make drove his van up to a loading dock in the rear deliveries that day. of a newly opened Wal-Mart store in Hinsdale, During discovery, Wal-Mart was unable to pro- New Hampshire. Mr. Testa alerted Wal-Mart duce either the purchase order to Heavenly Fish to his arrival, unloaded his shipment of tropi- or the telephone records for the day Wal-Mart cal fish, and proceeded up Wal-Mart’s delivery claimed it had cancelled the delivery. Wal-Mart ramp. The ramp was coated with snow and testified that it had destroyed the records a few ice, causing Mr. Testa to fall and hurt himself. months before the lawsuit was filed but more As Mr. Testa was leaving, he threatened to sue than two years after the incident in accordance Wal-Mart for his injuries. A Wal-Mart employee, with a standard record retention policy. presumably present on the loading dock, heard Mr. Testa’s threat and made note of it in an inter- During the trial of the matter, the court provided nal report of the incident. In addition, Wal-Mart the following instruction to the jury regarding the noted that an invoice clerk had put a hold on documents Wal-Mart could not produce: the order placed with Heavenly Fish for that day, A reasonable inference is a deduction which which was the day of the store’s grand open- common sense and reason lead you to draw ing. Wal-Mart had informed all vendors that it from the evidence. An example is one infer- would not accept deliveries on that day, which ence that the plaintiff seeks to have you draw is why Wal-Mart did not bother to clear the ramp here is to the effect that the defendant, having of snow and ice that day. The invoice clerk also known that a lawsuit was pending, destroyed followed up with a phone call to Heavenly Fish certain records and did so because defendant confirming that deliveries were cancelled for knew the records to be harmful to its own case. that day. But the law holds that such an inference can be Wal-Mart had a written record of the purchase drawn only if the plaintiff proves by a preponder- order and phone call to Heavenly Fish. Wal- ance of the evidence that [the defendant] not Mart had a two-year document retention policy, only knew of the potential claim of the plaintiff, which it faithfully followed. Accordingly, two but also knew of the potential relevance of the years after the incident involving Mr. Testa, Wal- destroyed documents. And even where plaintiff Mart destroyed all its records relating to the in- satisfies this burden of proof, any inference that cident, including the purchase order and phone may be drawn is permissive and may or may record. Unfortunately for Wal-Mart, the statute of not be drawn by the jury. limitations in New Hampshire for personal injury After the jury awarded a verdict for the plaintiff, exceeded two years. Shortly after Wal-Mart Wal-Mart appealed challenging the trial court’s had destroyed its records consistent with its adverse inference instruction as improper. The destruction policy, Mr. Testa filed suit. Wal-Mart Court of Appeals concluded that a rational jury R F7=;'- could have concluded that Wal-Mart was on notice of the plaintiff’s claim because it had conduct- ed an investigation and generated an internal accident report, which noted Testa’s threat to sue, immediately after the accident occurred. The court also concluded that a rational jury could con- clude that Wal-Mart was on notice of the relevance of the destroyed documents. In response to Wal-Mart’s argument that there was no evidence that the Wal-Mart employee who discarded the records had any notice of Testa’s claim or the relevance of the records to it, the court explained that only institutional notice – “the aggregate knowledge possessed by the party and its agents, servants, and employees”— was required for purposes of the adverse inference instruction Testa v. Wal-Mart Stores, Inc., 144 F.3d 173 (1st Cir. 1998). The Testa case spotlights the perils of relying on a broad-based, general retention policy. Consis- tent application of Wal-Mart’s two-year document retention policy was of no avail to Wal-Mart in the face of Testa’s threat to sue and the three-year statute of limitations. Testa also underscores the need for companies to devise and implement early detection measures for potential lawsuits. A properly implemented record retention policy, which considers extended retention requirements due to potential lawsuits, will provide protection against sanctions for a business accused of destroying documents in the face of litigation. However, the policy must be consistently and uni- versally implemented and may not be used merely as an excuse for the destruction of pertinent records.
(Excerpted from the paper: E-mail Retention: How Much Risk Can You Afford? by William F. Savarino, Esq. of Cohen Mohr LLP, 2003.)
Is that threat notice to the Wal-Mart corporate assume and plan for potential litigation from entity? The judge in New Hampshire thought these layoffs? Absolutely. Generally speaking, so. It should have triggered Wal-Mart’s duty to litigation should be anticipated in the wake of apply a litigation hold (which they didn’t do) on employee layoffs. all records, including emails, video surveillance, employee access card records, etc. that could M^WjZe[i_jc[Wd\eh?J5 become evidence in the upcoming litigation. EdY[oekhYehfehWj[b[]WbZ[fWhjc[djWY# Other examples of “reasonable anticipation” ademb[Z][if[dZ_d]b_j_]Wj_ed"_jm_bbZ_h[Yj?J include situations where a reasonable person jeijWhjYebb[Yj_d]WdZi[Ykh_d]ZWjW$J^[]Wf would conclude litigation is a possibility some- X[jm[[dm^[dWYecfWdoi^ekbZ^Wl[h[Wied# time in the future. Take the following situation: WXboWdj_Y_fWj[Zb_j_]Wj_edWdZm^[dj^[oWYjk# Due to the current economic crises, a company WbboZeYWd WdZe\j[d_i ki[ZXoeffei_d] of 98 employees decides it needs to lay off 20 Yekdi[bjeY^Wh][YecfWd_[im_j^Z[ijhkYj_ed percent of its workforce. Should the company e\[l_Z[dY[$ R F7=;'. The Know-IT-All Quiz Question 4:
Locating specific ESI is like trying to find: A) Kickboxing on the Lifetime Channel. B) Meaning at the bottom of the next bottle. C) A girlfriend on craigslist. D) Your lunch in the office fridge—somewhere behind the birthday cake and Jim’s Hot Pocket™ from last week. R F7=;'/ 9>7FJ;H Searching for ESI is like looking through the office fridge: There’s more in there than you’d expect ule 34, in the new Federal Rules of Civil JeX[Yedi_Z[h[ZW\kbbo#h[ifedi_l[i[WhY^ Procedure (FRCP), specifies electronically YedZkYj[Z_d]eeZ\W_j^"oekhb_ijcWo stored information (ESI) is a discoverable _dYbkZ[j^[\ebbem_d]0 R ;cW_bi[hl[hiWdZWjjWY^[ZijehW][ format in the litigation process. Since approxi- mately 95 percent of the information generated I^Wh[Fe_dji[hl[hiWdZWjjWY^[ZijehW][ <_b[WdZfh_dji[hl[hiWdZWjjWY^[ZijehW][ and received in a company’s day-to-day business I^Wh[Zh_l[i is electronic, this amendment created a gigantic I[hl[hbe]Ób[i increase in data sources that must be searched and I[hl[hH7C protected in litigation. 8WYakfjWf[iehXWYakfjWh][ji ;nj[hdWbijehW][\WY_b_j_[i The average 1 GB USB thumb drive can hold If an investment in capital equipment is not feasible, a second strategy is for IT to create and man- age an enterprise-wide data map. A data map is essentially an inventory of all of the company’s ESI records. It should describe the records—by business unit and custodian, if appropriate—and specify the various types of electronic media on which the records are maintained. M^WjZe[ij^_ic[Wd\eh?J5 [:_iYel[hoWdZ%ehWb_j_]Wj_ed^ebZm_bbj^hemWdkdfh[fWh[Z?JZ[fWhjc[dj_djeYecfb[j[Y^Wei$ OekcWo^Wl[jei[WhY^j^hek]^oekh[dj_h[_d\hWijhkYjkh[Æ_dYbkZ_d][cfbeo[[iÊbeYWb^WhZmWh[Æ_d Wl[hoi^ehjj_c[$FbWdd_d]\ehj^_i[l[djkWb_jom_bb]h[Wjboh[ZkY[oekhh_iaWim[bbWih[ZkY[oekh h[ifedi[j_c[$?dijWbbW\kbbo_dZ[n[ZWdZi[WhY^WXb[;I?WhY^_l[ehYh[Wj[WZWjWcWf$ R F7=;(' 4(% 535!, 3530%#43 #&/ )4 !##/5.4).' (2 ,%'!, &).!.#% The Know-IT-All Quiz Question 5: Which employees should be included on the cross-departmental eDiscovery team? A) Tim, for sure. He always brings donuts. B) The accountants, even though I’ve heard they eat paste. C) Anyone with a C_O in their title, because they pay our salaries. D) Legal, IT, Finance, Accounting,R HR, and the CFO. Now it’s a party. F7=;(( 9>7FJ;H A CEO, a marketing manager, and an email admin walk into a bar… (eDiscovery involves many departments, not just IT) orporate civil litigation rarely affects only the legal department. A discovery request can and does affect many, if not all, departments. The most obvious department in the crosshairs is IT, Cmainly because legal assumes that IT controls and has immediate access to all stores of buried information. This, of course, is often not the case. IT usually has a general idea of the data stores they manage within the corporate infrastructure. But a huge amount of potentially discoverable data is con- trolled by employees directly. Asking IT personnel alone to search for and retrieve all responsive data places an undue burden on that department. A team approach to eDiscovery will lower your discovery costs as well as your legal risk. Much of the cost of discovery is directly related to finding all the requested data, wherever it may be. Unprepared companies perform inefficient searches—disrupting employee productivity, searching the same data store many times, and looking at employee data not part of the discovery request. Such inefficiency increases a company’s risk of not finding all data requested or adversely turning over too much data. Proactively creating and training an eDiscovery team will greatly reduce costs and risks as well as help IT when unexpected litigation arises. Let’s start with these: J^[\ebbem_d]heb[iWh[_cf[hWj_l[je^Wl[edj^[j[Wc0 7Ç9Èb[l[bifedieh"ikY^Wij^[=[d[hWb9ekdi[b"9^_[\?d\ehcWj_edE\ÓY[h"eh9^_[\<_dWdY_Wb E\ÓY[h$This key executive has a direct line of communication to the Board of Directors, the execu- tive committee, or the CEO and can therefore secure buy-in from senior management and get budgets approved. 7i[d_ehc[cX[he\j^[b[]WbijW\\ who represents the legal priorities of the team and insures all legal responsibilities are followed. 7i[d_eh?Jh[fh[i[djWj_l[ with in-depth knowledge of the corporate network’s protocol and pro- cedures, a thorough understanding of the corporation’s IT infrastructure, and historical knowledge of how the network was constructed and maintained (or is at least privy to the history and able to access it conveniently and quickly). R F7=;() 7c[cX[he\j^[ÓdWdY[ edgeable about the IT infrastructure, Z[fWhjc[dj who can track duh! and understands legal points. discovery expenses and help best IJ;F*0 Have the legal team mem- build financial business cases practice ber educate the team on the basics of when new technology and eDiscovery, the company’s legal ob- services are required. Create a cross- ligations, and the company’s current Depending on your circum- departmental litigation hold process and discovery stances and the size of your eDiscovery team to procedures. organization, you may chose to take some of the burden off the add team members from the IJ;F+0 Have the IT member edu- IT group. following functions. If you do cate the team on the corporate data not add these members, be sure infrastructure. that these functions are nevertheless covered by the existing team. IJ;F,0 Have the IT team member and the re- • Investor relations cords management team member create a corpo- • Human resources rate infrastructure data map—an inventory of all of • Records management the corporate data-producing hardware, applica- • Accounting tions, storage repositories, files, number of copies, • Risk management applications that automatically delete files, etc. • Purchasing IJ;F-0 Have the records management member • Engineering insure that the existing records retention policies have been updated and are being followed—or, if 9h[Wj_d]j^[[:_iYel[hoJ[Wc the policies don’t already exist, begin the process \hecj^[?Jfe_dje\l_[m of creating them with help from legal. IJ;F'0 Get buy-in for the creation of the team from the CEO or Board of Directors. If needed, IJ;F.0 Have the team develop or update the have the CEO appoint an executive-level sponsor. company’s litigation hold and eDiscovery pro- cedures, including forms, chain of custody, and IJ;F(0 Find a member of the legal department documentation instructions for every step of the who is knowledgeable about the amended Federal process. Train all employees on these procedures. Rules of Civil Procedure (FRCP). This may be more challenging than you might expect. Many IJ;F/0 The legal team member needs to keep up companies employ outside law firms to handle to date on new legal requirements, new case laws actual litigation, so legal staff members may not and so on, and communicate this information to be conversant on the subject. If none are available, the team. consider hiring an eDiscovery consultant. IJ;F)0If you are not the right IT representative, find an IT resource who can and wants to work closely with the legal representative, is knowl- R F7=;(* E$ISCOVERY 4EAM "UILDING IN .).% %!39 34%03 1 Get Buy In 23Find legal Get a from CEO member who smart IT to create team knows FRCP. resource. 5 Group 6 Create 4 Group meeting, corporate meeting! continued! infrastructure data Legal to explain map IT member educates on eDiscovery/litigation data infrastructure process 8 7 Update Train 9 Regular records employees on group meetings, retention litigation hold & with updates on policies eDiscovery new legal procedures requirements M^WjZe[ij^_ic[Wd\eh?J5 8k_bZ_d]WYheii#Z[fWhjc[djWb[:_iYel[hoj[Wcm_bbh[b_[l[ ckY^e\j^[XkhZ[d\hec?J"m^_b[WbieYh[Wj_d]j^[effehjkd_jo \ehWbbW\\[Yj[ZZ[fWhjc[djijei^Wh[_Z[WiWdZWZZh[ii h[gk_h[c[dji$?d\WYj"?JÊiemdh[gk_h[c[djiÆ\ehWkje# cWj[Zioij[cijeX[jj[hh[ifedZjeZ_iYel[hoh[gk[iji"\eh The first step _dijWdY[Æm_bbX[Yec[WffWh[djWYheiij^[XeWhZWdZh[WY^ is to admit you i[d_ehb[l[bij^hek]^j^[i[YedZk_ji$7d[\\[Yj_l[[:_iYel[ho have a problem. j[WcYWdb[WZoekhYecfWdoiceej^boj^hek]^j^[d_]^jcWh[ e\Y_l_bb_j_]Wj_edWdZ^[bfWle_Zi_]d_ÓYWdj^WhZi^_fi_dj^[ \ehce\Ód[i"XWZfh[ii"WdZej^[hf[dWbj_[i$ R F7=;(+ The Know-IT-All Quiz Question 6: Applying a litigation hold is: A) A sure-fire way to win a professional wrestling match. B) Like suffering through your niece’s violin recital. C) A persistent ache, like adolescence with acne. D) A debilitating condition, like a workday hangovers. R F7=;(, 9>7FJ;HI?N h A litigation hold is like being hungover at work– you just can’t focus on anything else ne of the principal rules of the amended Federal Rules of Civil Procedure (FRCP) is whenever litigation is reasonably anticipated, threatened, or pending against an organization, Othat organization has an immediate duty to preserve relevant information. This duty to immediately preserve potentially responsive data includes the obligation to identify, locate, and secure all data potentially relevant to the case. When preservation of electronically stored information (ESI) is required, most of the time this duty to preserve obviously overrides any records management policies that would otherwise result in the deletion of ESI. Always be aware this duty also pertains to any systems automatically deleting data without human intervention. A litigation hold duty triggers immediately when duh! litigation can be reasonably anticipated. factoid Under Rule 37 of the amended (FRCP), a party that violates a litigation hold or otherwise fails to produce requested data will be exposed to a range of sanctions, including a spoliation/destruction of evidence judgment. However, FRCP Rule 37 also provides that a court may not impose sanctions on a party for failing to provide ESI lost as a result of the routine, good-faith operation of an electronic information system. This is known as the “Safe Harbor” rule (see Chapter 9). B_j_]Wj_ed>ebZ=k_Z[b_d[i0 \hecj^[I[ZedW9ed\[h[dY[9ecc[djWhoedB[]Wb>ebZi(&&- '$H[WiedWXb[Wdj_Y_fWj_ede\b_j_]Wj_edWh_i[im^[dWdeh]Wd_pWj_ed_ieddej_Y[e\WYh[Z_Xb[j^h[Wj j^Wj_jm_bbX[Yec[_dlebl[Z_db_j_]Wj_edehWdj_Y_fWj[ijWa_d]WYj_edje_d_j_Wj[b_j_]Wj_ed$>Wl_d]W ZWjWcWfjeh[\[h[dY[m_bb^[bf_dZ[j[hc_d_d]m^Wj_j[ci[n_ij"m^[h[j^[oWh["[jY$\ehWb_j_]Wj_ed ^ebZ$?jWbiei^emiÇ]eeZ\W_j^_dj[djÈ\ehj^[ÇIW\[>WhXehÈZ[\[di[$ R F7=;(- So what qualifies as “reasonable anticipation”? claim by the plaintiff should be dismissed by the Here’s an example: A Chief Financial Officer of a court based on Rule 37. company reads a news story about the Securities Exchange Commission launching an investigation )$7dej^[h\WYjehZ[cedijhWj_d]h[WiedWXb[d[ii into specific industries in regards to the backdat- WdZ]eeZ\W_j^_dc[[j_d]fh[i[hlWj_edeXb_]W# ing of employee options…and your company’s in- j_edi_ij^[ki[e\[ijWXb_i^[Z"j[ij[ZfheY[# dustry is on the list. Under these circumstances, a Zkh[i\ehj^[h[fehj_d]e\_d\ehcWj_edh[bWj_d] government investigation (and possibly litigation) jeWfej[dj_Wbj^h[Wje\b_j_]Wj_edjeWh[ifedi_Xb[ can reasonably be anticipated and a preservation Z[Y_i_edcWa[h$ obligation has arisen. Simply put, your company should train all employees to contact the legal Another example in which reasonable department when they read or anticipation would apply is hear anything that could point to when your company lays anticipated litigation. off a substantial number of employees. Most HR manag- *$J^[Z[j[hc_dWj_ede\m^[j^# ers would foresee potential [hb_j_]Wj_ed_ih[WiedWXboWdj_Y_fWj[Z wrongful termination litigation i^ekbZX[XWi[Zed]eeZ\W_j^"h[WiedWXb[d[ii" on the horizon. Wh[WiedWXb[_dl[ij_]Wj_ed"WdZWd[lWbkWj_ede\ j^[h[b[lWdj\WYjiWdZY_hYkcijWdY[i$ ($Ed[\WYjehZ[cedijhWj_d]h[WiedWXb[d[ii WdZ]eeZ\W_j^_dc[[j_d]fh[i[hlWj_edeXb_]W# +$M^[dWZkjojefh[i[hl[Wh_i[i"h[WiedWXb[ j_edi_ij^[WZefj_edWdZYedi_ij[dj_cfb[c[d# ij[fii^ekbZX[jWa[dje_Z[dj_\oWdZfh[i[hl[ jWj_ede\Wb_j_]Wj_ed^ebZfeb_YoZ[Ód_d]WZeYk# h[b[lWdj_d\ehcWj_edWiieedWi_i\[Wi_Xb[$:[# c[djh[j[dj_edZ[Y_i_ed#cWa_d]fheY[ii$ f[dZ_d]edj^[Y_hYkcijWdY[i [$]$Zeoek^Wl[ j^[WX_b_jojeÓdZWbbh[ifedi_l[ZWjWY[djhWbbo An interesting example of how a litigation hold l_WWh[Wb#j_c[WhY^_l[5 Wmh_jj[db[]Wb^ebZ policy can reduce your risk of spoliation would i^ekbZX[_iik[Z"m^_Y^_dYbkZ[iWfh[i[hlW# be if your Investor Relations VP receives an j_eddej_Y[jef[hiedib_a[boje^Wl[h[b[lWdj anonymous threat to sue with little or no support _d\ehcWj_ed$ accusations. The Investor Relations VP consults your existing and updated litigation hold policy, ,$JeZ[j[hc_d[m^WjZWjWi^ekbZX[fbWY[Zed which has very specific descriptions of issues that b_j_]Wj_ed^ebZ"Yedi_Z[hj^[dWjkh[e\j^[_iik[i would result in a litigation hold. Based on the hW_i[Z"fh[l_eki[nf[h_[dY[_di_c_bWhY_hYkc# policy, the VP concludes that the company should ijWdY[i"WdZj^[Wcekdj_dYedjhel[hio$ not reasonably anticipate litigation. In this ex- ample, the company is able demonstrate it had a -$JeX[[\\[Yj_l["WcWdkWbb_j_]Wj_ed^ebZckij policy which it followed in accessing the potential _Z[dj_\oj^[f[hiedim^eWh[b_a[boje^Wl[ threat. Even if later litigation arises, a spoliation h[b[lWdj_d\ehcWj_ed$ R F7=;(. ?iik[Wmh_jj[d Yecckd_YW# j_edjej^ei[ f[hiediYb[Whbo Z[Ód_d]m^Wj _d\ehcWj_ed_ije X[fh[i[hl[ZWdZ ^emj^[fh[i[hlW# j_ed_ijeX[kdZ[h# jWa[d$ 8[h[l_[m[Zf[h_# eZ_YWbboWdZ"m^[d d[Y[iiWho"h[_iik[Z _d[_j^[h_jieh_]_dWb ehWc[dZ[Z\ehc$ .$J^[b_j_]Wj_ed ^ebZfeb_YoWdZ_ji _cfb[c[djWj_edfheY[ii i^ekbZX[ZeYkc[dj[Z X[YWki[Xej^j^[feb_Yo WdZfheY[iicWoX[ikX`[Yjje iYhkj_doXoj^[effei_d]fWhjo WdZh[l_[mXoj^[Yekhj$ /$J^[_cfb[c[djWj_ede\Wb_j_]Wj_ed ^ebZi^ekbZX[h[]kbWhboced_jeh[Zje [dikh[Yecfb_WdY[$ '&$J^[b_j_]Wj_ed^ebZfheY[iii^ekbZ_dYbkZ[fhel_i_edi\ehj^[h[b[Wi[e\j^[^ebZkfedj^[j[h# c_dWj_ede\j^[cWjj[hWj_iik[$?Z[Wbbo"WcWdW][hi^ekbZX[_Z[dj_Ó[Z\eh[WY^fheY[iim^eYWd Wdim[hWbbfWhj_[iÊgk[ij_ediWdZYecckd_YWj[f[h_eZ_YkfZWj[i"_dYbkZ_d]ÆÓdWbboÆj^[j[hc_dWj_ed WddekdY[c[dj$ R F7=;(/ The Know-IT-All Quiz Question 7: Spoliation is a term used to describe what happens when: A) The moment you realize your prom date is actually a man. No wonder she was taller than you. B) Your recently-rehabbed best friend brings “Near Beer” to the Superbowl party. C) Wednesday’s Chinese food converts to a two-hour trip to the toilet. D) A party in a legal proceeding intentionally or negligently withholds, hides, alters, or destroys relevant evidence. R F7=;)& 9>7FJ;HI;L;D h Spoliation is not what happens to last week’s Chinese food. poliation is the intentional or inadvertent destruc- tion, mutilation, concealment, or alteration of Sevidence. A misplaced record, either electronic or hard copy, can affect the outcome of litigation and redirect liability. That’s because a spoliation decision can result in an “adverse inference” instruction to the jury, who are free to conclude that the missing evidence was detrimental to the party responsible for it. Some consider being found guilty of spoliation to be the last nail in the coffin. If this happens to you, you can stop worrying about whether or not you’ll lose the case and start wondering what it’s going to cost you. Ifeb_Wj_ed_ij^[_dj[dj_edWbehWYY_Z[djWb Z[ijhkYj_ede\h[YehZij^WjcWoh[WiedWXboX[ h[gk[ij[ZXoeffei_d]Yekdi[b$ Here are a few quick examples spoliation charges laid against defendants in actual court cases: 9Wi['07d?dj[bb[YjkWbFhef[hjoJ^[\j9Wi[ Defendant was ordered not to alter any infor- mation on the company’s computers. However, numerous files containing relevant information were subsequently deleted and later recovered from the Windows recycle bin. 9Wi[(07FheZkYjB_WX_b_jo9Wi[ Defendant was ordered to preserve emails related to the product in question. Within a week, however, emails exchanged between product development and senior management discussing the dangers of the product were deleted. R F7=;)' Most common forms of spoliation Abject Laziness Neglect Busy flirting with Intern Oversight Passing the Buck 9Wi[)07d?dikhWdY[ The phrase “Safe Harbor” refers to: A) A movie starring Gregory Harrison about a widowed sheriff and his three sons living with his mother in a motel she owns. B) A financial consulting firm, specializing in the sale of life insurance annuities. C) An exemption, in patent law, to the rights conferred by patents, which is especially relevant to drugs. D) A provision of a statute or regulation that reduces or eliminates a party’s liability under the law, on the condition that the party performed its actions in good faith. E) All of the above, technically, but (A) to (C) are way off topic. R F7=;)) 9>7FJ;H;?=>J h Cover your ass Safe Harbor is the truest form of CYA: Understanding FRCP Rule 37(e) aving a top-notch CYA process is, as example, most corporate computer applications Martha Stewart says, “a good thing.” are not designed to archive data —that is, to store H(Shame this book was not circulating it for extended periods of time. It follows, then, in time to save her some that corporate email systems hard time!) Buried in duh! generally do not control the new Federal Rules of factoid what employees do with the Civil Procedures (FRCP) data in their mailboxes, so amendments is Rule To effectively utilize a CYA employees can move it out 37(e), otherwise known strategy, your organization of the email system or delete as the “Safe Harbor” must be able to document that it at will. This makes data amendment. This new they have taken all reason- preservation difficult, if not rule protects parties in able steps to insure potential impossible. litigation from sanctions if evidence is not lost. This potentially responsive data means that your organization It is important to note the (evidence) is inadvertently needs to put policies, proce- new rules do not necessarily altered or deleted. Rule dures, data maps, training, impose additional obliga- 37(e) states: and automation in place in tions to save that which 7Xi[dj[nY[fj_edWb order to have a prayer of get- cannot reasonably be saved Y_hYkcijWdY[i"WYekhj ting protection under the Safe without disrupting or crip- cWodej_cfei[iWdYj_edi Harbor amendment. pling business operations. edWfWhjo\eh\W_b_d]je That’s where the “routine, fhel_Z[[b[Yjhed_YWbbo good faith” standard comes ijeh[Z_d\ehcWj_edbeijWi in. Many corporate data Wh[ikbje\j^[hekj_d["]eeZ#\W_j^ef[hWj_ede\ systems operate under settings chosen by the Wd[b[Yjhed_Y_d\ehcWj_edioij[c$ user or administrator to govern time periods and volume thresholds—such as mailbox limits that Before considering what qualifies as a “routine, prompt users to delete, overwrite, or store email good faith operation,” you should be aware of the and attachments. This discretionary process is re- discretionary controls (those which are not cen- flected in the language of Rule 37. These settings, trally controlled) within your infrastructure. For and how they are treated, are potentially subject R F7=;)* to hindsight analysis by the pending litigation. When court to determine whether it comes to using the Safe the party allowed deletion Harbor defense, it goes a long to occur in the “good faith way to have a documented operation of an electronic litigation hold procedure that information system” or has been approved by your whether something is amiss legal department. under the circumstances. In most cases, the court will Thirdly, you need to make presume that, as the owner your employees fully aware of and administrator of your your litigation hold procedure applications, you are expert in their operation and train them on their related responsibilities. and should know when data deletions need to be This means more than simply adding a para- suspended. Therefore, to claim Safe Harbor, you graph to the new employee “warm welcome” must demonstrate you have taken all necessary packet. In fact, to meet the Safe Harbour require- steps to insure data loss doesn’t happen. This way, ments, you should offer in-person or web-based if potential evidence is lost or deleted, you are far training sessions and periodic refresher sessions— less likely to be held responsible. all of which should be fully documented. M^WjÊid[[Z[Z\eh)- [ Finally, you need to consider litigation support First of all, to accurately evaluate your risk, you automation—an archive system that captures, in- need to understand how the data in your infra- dexes, single instances, applies retention policies, structure is generated, managed, and expired. and secures all or most discoverable ESI. Auto- Answering the following questions can help the mating these functions will dramatically reduce IT department create and routinely update a your risk of spoliation and the costs associated comprehensive data map: with applying litigation holds and complying with M^Wjioij[ciWh[_dfbWY[5 eDiscovery requests. M^WjWffb_YWj_ediWh[hkdd_d]5 M^Wjjof[ie\ZWjWWh[][d[hWj[Z5 M^WjZe[ij^_ic[Wd\eh?J5 >emcWdoYef_[iWh[fheZkY[Z5 Oekckij^Wl[WZ[[fWdZYecfh[^[di_l[ M^[h[Wh[j^[Yef_[iijeh[Z5 kdZ[hijWdZ_d]e\oekhYehfehWj[_d\hWijhkYjkh[ ?ij^[h[WkjecWj_YZ[b[j_ede\iec[ZWjW5 WdZj^[ZWjW_j][d[hWj[iWdZcWdW][i$J^_i >emWh[WkjecWj_YZ[b[j_edi^Wbj[Z5 _dYbkZ[iZWjWj^Wj[cfbeo[[i^Wl[Z_h[Yj M^WjWffb_YWj_ediWdZZWjWWh[Yedjhebb[ZXo Yedjhebel[h$ [cfbeo[[i5 M^[h[YWd[cfbeo[[iijeh[ZWjW5 Secondly, you need to create a litigation hold procedure that defines what should happen once your legal department alerts you to potential or R F7=;)+ STARGATE Season 1 (1997-1998) The Know-IT-All Quiz Question 9: 101 Children of the Gods (1 & 2) 102 The Enemy Within Which of the following “Stargate” trivia questions is too easy 103 Emancipation 104 The Broca Divide to submit to the fan site? 105 First Commandment A) In the 1994 movie Stargate, who played the role of Dr. 106 Cold Lazarus Daniel Jackson—a brilliant Egyptologist whose farfetched 107 The Nox 108 Brief Candle theories about pyramids led to his participation in the 109 Thor’s Hammer original mission? 110 The Torment of Tantalus 111 Bloodlines B) Who left his home planet of Langara after witnessing Dr. 112 Fire and Water Jackson’s deadly sacrifice and the resulting celebration of 113 Hathor his planet’s leaders? 114 Singularity 115 Cor-Ai C) The season 8 episode “Citizen Joe” features a guest 116 Enigma appearance by which actor? (Hint: he voices a character in 117 Solitudes The Simpsons) 118 Tin Man 119 There but for the Grace of God D) Funny you think you have time for this. Legal’s 120 Politics (1) on the phone. It’s for you. 121 Within the Serpent’s Grasp (2) Season 2 (1998-1999) 201 The Serpent’s Lair 202 In the Line of Duty 203 Prisoners 204 The Gamekeeper 205 Need 206 Thor’s Chariot 207 Message in a Bottle 208 Family 209 Secrets 210 Bane 211 The Tok’ra (1) 212 The Tok’ra (2) 213 Spirits 214 Touchstone 215 (217) A Matter of Time 216 The Fifth Race R F7=;), 9>7FJ;HD?D; h Proactive planning for eDiscovery ensures you won’t miss the Stargate SG1 weekend marathon lanning for personal digital assistants (PDAs), eDiscovery is portable computers, laptop comput- essential. If you are duh! ers, and other electronic devices. P factoid Include contact information such as unprepared, a request can full name, job position, job descrip- certainly ruin your weekend. You or your co-workers tion, and list of duties. And the weekend after that. can and probably will 2. List employees formally or loosely And so on. The most onerous be questioned by assigned to subgroups within the IT task for IT is finding and opposing counsel about and IS departments, such as net- securing all potentially your infrastructure…be work engineering, software develop- ment, emergency response, quality responsive data. You’ll be prepared. guided in this task by an assurance, and troubleshooting. interrogatory. Never heard of it? It’s the stuff nightmares are made of. Jef_Y(0D[jmeha7hY^_j[Yjkh[ Read on. 1. Describe any and all groups of connected computer systems that permit users to share information ?dj[hhe]Wjeh_[i and transfer data, including, but not limited to Interrogatories are written questions asked by local area networks (LANs), wide area networks the opposing counsel to discover key facts about (WANs), client-server networks, virtual private networks (VPNs), and storage area networks your party’s case. IT, in particular, can expect de- (SANs). tailed questions about the corporate infrastruc- 2. List any and all components and network resources ture. The following list includes general topics that establish and maintain the network envi- and related questions IT may have to answer in ronment, including, but not limited to, routers, responding to an interrogatory. switches, hubs, bridges, firewalls, and proxies. 3. Describe any and all third-party connectivity be- Jef_Y'0?d\ehcWj_edJ[Y^debe]o ?J ?d\ehcWj_ed tween the computer systems and network environ- Ioij[c ?I F[hiedd[b ment of [Plaintiff / Defendant], including the type 1. List all IT and IS personnel and technical staff that of information shared, manner in which informa- is or has been responsible for managing and main- tion is transferred, and contact lists of internal taining the technology infrastructure of [Plaintiff / and external individuals who have authorization Defendant] for the period _____ to _____, includ- to transfer information into or out of [Plaintiff / ing, but not limited to desktop computers, servers, Defendant] network environment. R F7=;)- 217 Serpent’s Song Jef_Y)09ecfkj[h>WhZmWh[ 218 Holiday 219 One False Step 1. Identify each computer system that is or has been used by employees for the 220 (221) Show and Tell period _____ to _____, including, but not limited to, desktop computers, 221 (220) 1969 servers, personal digital assistants (PDAs), portable computers, laptop comput- 222 Out of Mind (1) ers, and other electronic devices. Include descriptions of equipment and any peripheral technology attached to the computer system. Season 3 (1999-2000) 2. Describe the Internet and intranet connectivity of each computer system, 301 Into the Fire (2) 302 Seth including, but not limited to, client-server communications and client-client 303 Fair Game communications facilitated through modem, network, or direct connection. 304 Legacy 3. List all hardware or software modifications made to computer systems in use 305 Learning Curve during the period _____ to _____, including, but not limited to, dates of modi- 306 Point of View fications, software and hardware titles, version numbers, contact information of 307 Deadman Switch IT or IS personnel performing the modification, and location of data backups 308 Demons 309 Rules of Engagement taken prior to modification. 310 Forever in a Day 4. Identify any and all specific computer systems that have been used to create, 311 Past and Present modify, or store electronic information relevant to this legal matter. 312 Jolinar’s Memories (1) 313 The Devil You Know (2) 314 Foothold Jef_Y*09ecfkj[hIe\jmWh[ 315 Pretense 316 Urgo 1. List all operating systems installed on all computer systems in use by [Plaintiff 317 A Hundred Days / Defendant], including, but not limited to, Microsoft Windows, Linux, UNIX, 318 Shades of Grey DOS, etc. 319 New Ground 2. List the title and version number of any and all software installed or executed 320 Maternal Instinct 321 Crystal Skull on the computer systems used by [Plaintiff / Defendant] during the period 322 Nemesis (1) ____ to _____. Season 4 (2000-2001) 401 Small Victories Jef_Y+0;b[Yjhed_YCW_b9ecckd_YWj_ed 402 The Other Side 1. Describe all server- and workstation-based software in use or used to facilitate 403 Upgrades the transmission of email during the period ____ to _____. 404 Crossroads 405 Divide and Conquer 2. Identify all hardware in use or used to facilitate the transmission or storage of 406 Window of Opportunity email during the period ____ to _____. 407 Watergate 3. List all email accounts in use during the period ____ to _____. 408 The First Ones 409 Scorched Earth 4. Describe the policies, procedures, and technology employed to backup and 410 Beneath the Surface archive email messages during the period ____ to _____. 411 Point of No Return 5. Describe any email-based encryption algorithms in place. 412 Tangent 413 The Curse 6. List all emails, senders, and recipients of email currently known to be relevant 414 The Serpent’s Venom to this legal matter. 415 Chain Reaction 416 2010 417 Absolute Power R F7=;). Jef_Y,0:WjW8WYakfi"7hY^_l[i"WdZH[celWXb[C[Z_W 418 The Light 419 Prodigy 1. Describe the policies and procedures governing the use of removable media, 420 Entity such as CD-ROMs, zip disks, floppy disks, tape drives, removable hard 421 Double Jeopardy drives, etc., associated with [Plaintiffs / Defendants] computer systems or 422 Exodus (1) network. Season 5 (2001-2002) 2. Describe the policies and procedures for performing data backups on all 501 Enemies (2) computer systems as well as the hardware and software employed during the 502 Threshold (3) period ____ to _____. 503 Ascension 3. List any and all removable media utilized to store data during the period ____ 504 The Fifth Man to _____. 505 Red Sky 506 Rite of Passage 4. List all IT and IS personnel responsible for conducting data backups and the 507 Beast of Burden archiving of electronic information during the period ____ to _____. 508 The Tomb 5. Identify all removable media known to contain information relevant to this 509 Between Two Fires 510 2001 legal matter. 511 Desperate Measures 512 Wormhole X-Treme! 513 Proving Ground Jef_Y-0J[b[f^ed[Ioij[c 514 48 Hours 1. Describe the elements of your telephone and voice messaging system, includ- 515 (516) Summit (1) ing all hardware, software, and third-party service providers. 516 (517) Last Stand (2) 517 (515) Fail Safe 2. Identify any and all voice messaging records for [Name] during the period 518 The Warrior ____ to _____, including, but not limited to, caller message recordings, voice 519 Menace recordings, computer voice mail files, outgoing voice recordings, unified mes- 520 The Sentinel saging files, etc. 521 Meridian 3. Identify any and all telephone use records for [Name] during the period ____ 522 Revelations to _____, including logs of outgoing and incoming calls. Season 6 (2002-2003) 601 Redemption (1) Jef_Y.0C_iY[bbWd[ekiIekhY[i\eh;b[Yjhed_Y;l_Z[dY[ 602 Redemption (2) 603 Descent 1. Describe any and all network, server, and workstation-based log files 604 Frozen generated during the period ____ to _____. 605 Nightwalkers 606 Abyss 2. Describe the policies and procedures governing employee use of Internet 607 Shadow Play newsgroups, chat rooms, or instant messaging on [Plaintiffs /Defendants] 608 The Other Guys computer systems. 609 Allegiance 3. List any and all portable electronic devices owned and operated by [Name] 610 Cure but used in the performance of his/her employment with [Plaintiffs / Defen- 611 Prometheus (1) dants]. 612 Unnatural Selection (2) 613 (615) Sight Unseen 614 Smoke & Mirrors 615 Paradise Lost 616 Metamorphosis 617 Disclosure 618 Forsaken 619 The Changeling 620 Memento 621 Prophecy R 622 Full Circle F7=;)/ Season 7 (2003-2004) Jef_Y/0:[ijhkYj_ede\?d\ehcWj_ed 701 Fallen (1) 702 Homecoming (2) 1. Describe the policies and procedures pertaining to data retention and list all 703 Fragile Balance information scheduled for deletion during the period ____ to _____. 704 Orpheus 2. Describe all hardware or software utilized to facilitate the deletion of data 705 Revisions subject to data retention policies and procedures. 706 Lifeboat 707 Enemy Mine 3. List any and all servers, workstations, or electronic devices that have had 708 Space Race their hard drives reformatted or replaced during the period ____to _____. 709 Avenger 2.0 4. Identify any and all information deleted, physically destroyed, corrupted, 710 Birthright damaged, lost, or overwritten, either pursuant to the data retainer policies 711 Evolution (1) 712 Evolution (2) and procedures or not, relevant to this legal matter. 713 Grace 5. Identify any and all information deleted, physically destroyed, corrupted, 714 Fall-out damaged, lost, or overwritten, either pursuant to the data retainer policies 715 Chimera and procedures or not, that took place since the initiation of this legal 716 Death Knell matter.4 717 Heroes (1) 718 Heroes (2) 719 Resurrection Interrogatories are part of the pre-trial discovery stage of a lawsuit and must 720 Inauguration be answered under penalty of perjury. Court rules tightly regulate how, when 721 The Lost City (1) 722 The Lost City (2) and how many interrogatories can be asked. Lawyers can write their own sets of questions or can use form interrogatories designed to cover typical issues in Season 8 (2004-2005) common lawsuits. 801 New Order (1) [:_iYel[hoh[gk[ijikikWbbojWh][jj^h[[cW_dWh[Wi0 802 New Order (2) 803 Lockdown If[Y_ÓY[cfbeo[[i 804 Zero Hour If[Y_ÓYZWj[hWd][i 805 Icon If[Y_ÓYYedj[dj 806 Avatar 807 Affinity 808 Covenant 809 Sacrifices 810 Endgame 811 Prometheus Unbound 812 Gemini 813 It’s Good To Be King 814 Full Alert 815 Reckoning (1) 816 Reckoning (2) 817 Threads 818 Citizen Joe 819 Moebius (1) 820 Moebius (2) R F7=;*& urgent To: You, our IT guy From: Legal, on behalf of evil litigators Date: Today RE: eDiscovery Request: URGENT. Cancel all social engagements you may have in the near future 1. Produce all documents and electronically stored information that you referred to, relied upon, consulted, or used in any way in answering each interroga- tory set forth in [party name] Interrogatories dated ______. 2. Produce organization charts for all of your Information Technology or Infor- mation Services departments or divisions during the period of [date] to the present time. 3. Produce all written policies, procedures, guidelines, or records developed by or used by you for your computers, computer systems, electronic data, or electronic media, during the period of [date] to the present time. 4. Produce all written policies, procedures, guidelines, or records developed by or used by you for backup or emergency restoration of electronic data, including backup tape rotation schedules, during the period of [date] to the present time. 5. Produce all written policies, procedures, guidelines, or records developed by or used by you for electronic data retention, preservation, and destruction, including any schedules relating to those procedures, during the period of [date] to the present time. 6. Produce all employee-use policies developed by or used by you for company computers, data, and other technology, during the period of [date] to the present time. 7. Produce all written policies, procedures, guidelines, or records developed by or used by you for file naming conventions and standards, during the period of [date] to the present time. 8. Produce all written policies, procedures, guidelines, or records developed by or used by you for password, encryption, or other security protocols, during the period of [date] to the present time. 9. Produce all written policies, procedures, guidelines, or records developed by or used by you for labeling standards for diskette, CD, DVD, or other remov- able media. 10. Produce all written policies, procedures, guidelines, or records developed by or used by you for email storage conventions (e.g., limitations on mailbox sizes/storage locations; schedule and logs for storage) during the period of [date] to the present time. R F7=;*'F7=;*' urgent eDiscovery Request. Page 2/3 11. Produce all written policies, procedures, guidelines, or records developed by or used by you for electronic media deployment, allocation, and maintenance procedures for new employees, current employees, or departed employees, during the period of [date] to the present time. 12. Produce all written policies, procedures, guidelines, or records developed by or used by you for software and hardware upgrades, including patches, during the period of [date] to the present time. 13. Produce all written policies, procedures, guidelines, or records devel- oped by or used by you for personal or home computer usage for work-related activities during the period of [date] to the present time. 14. Produce all backup tapes containing email and other electronically stored information related to this action during the period of [date] to the present time. 15. Produce exact copies (i.e., bit-by-bit copies) of all hard drives on the desktop computers, laptop computers, notebook computers, personal digital assistant computers, servers, and other electronic media related to this action, used by [name], during the period of [date] to the present time. 16. Produce exact copies (i.e., bit-by-bit copies) of all relevant disks, CDs, DVDs, or other removable media containing electronically stored information created, reviewed, or received by [name] related to this action during the period of [date] to the present time. 17. Produce copies of all database files, email, or other files maintained on servers or mainframe or minicomputers, containing electronically stored information created, reviewed, or received by [name] related to this action during the period of [date] to the present time. 18. Produce exact copies (i.e., bit-by-bit copies) of all data that was stored, retrieved, downloaded, restored, reconstructed, removed, deleted, salvaged, regenerated, and/or forensically extracted from the computer devices used by [name] related to this action during the period of [date] to the present time. 19. Produce all documents relating to costs and fees billed to you by any computer forensic examiner or other third-party technology provider with respect to the data that was stored, retrieved, downloaded, restored, reconstructed, removed, deleted, salvaged, regenerated, and/or forensi- cally extracted from the computer devices used by [name] related to this action during the period of [date] to the present time. R F7=;*(F7=;*( urgent eDiscovery Request. Page 3/3 20. Produce all documents relating to the terms of any agreement to provide services by any computer forensic examiner or other third-party tech- nology provider with respect to the data that was stored, retrieved, downloaded, restored, reconstructed, removed, deleted, salvaged, regen- erated, and/or forensically extracted from the computer devices used by [name] related to this action during the period of [date] to the present time. 21. Produce all documents relating to the hash of any drive image created by any computer forensic examiner or other third-party technology provider with respect to the data that was stored, retrieved, downloaded, restored, reconstructed, removed, deleted, salvaged, regenerated, and/or forensically extracted from the computer devices used by [date] related to this action during the period of [date] to the present time. 22. Produce all documents relating to the original drive hash with respect to any drive image created by any computer forensic examiner or other third-party technology provider with respect to the data that was stored, retrieved, downloaded, restored, reconstructed, removed, deleted, salvaged, regenerated, and/or forensically extracted from the computer devices used by [name] related to this action during the period of [date] to the present time. 23. Produce all documents relating to the chain of custody with respect to any computer drive examined or copied by any computer forensic examiner or other third-party technology provider with respect to the data that was stored, retrieved, downloaded, restored, reconstructed, removed, deleted, salvaged, regenerated, and/or forensically extracted from the computer devices used by [name] related to this action during the period of [date] to the present time. 24. Produce all documents, reports, and conclusions relating to the foren- sic analysis of any computer drive examined or copied by any computer forensic examiner or other third-party technology provider with respect to the data that was stored, retrieved, downloaded, restored, recon- structed, removed, deleted, salvaged, regenerated, and/or forensically extracted from the computer devices used by [name] related to this action during the period of [date] to the present time. The above eDiscovery request is an example of a standard form published by the ABA and found in the book: The Electronic Evidence and Discovery Handbook written by Sharon D. Nelson, Bruce A. Olson, and John W. Simek. R F7=;*)F7=;*) Imagine how long and hard opposing counsel will often request your IT department would have duh! data that you can’t or will have a hard to work to respond to a similar factoid time producing. So your best strategy eDiscovery request (to the satis- The only way to is to purchase a solution that captures faction of the courts) within the respond to this type of everything they could ask for. tight timeframes usually allotted. eDiscovery request, as shown previously, M7HD?D=08bWjWdjFheZkYj fheWYj_l[fbWdd_d]\eh is to have proactively Fbk]7^[WZAs you’ve no doubt [:_iYel[ho0 planned for answering seen in the headlines, ESI including To be fully prepared for these types of SharePoint records, work files, and eDiscovery requests, you’ll need a questions. email data are playing an important two-pronged approach. role in high-profile legal proceed- First, create or update the appropriate policies ings. ESG reports that 80 percent of organizations and procedures. These include: in litigation have been asked to produce emails and ;b[Yjhed_YWbboijeh[Z_d\ehcWj_ed ;I? attachments in response to discovery requests. What h[j[dj_edfeb_Y_[i is not as widely publicized is that 60 percent of them 7d[cfbeo[[;I?ki[feb_Yo have also been asked to produce unmanaged general 7b_j_]Wj_ed^ebZfeb_Yo office documents, including SharePoint documents. 7j[ij[Z[:_iYel[hofheY[Zkh[ There is only one ESI archive solution that captures all discoverable data in the SharePoint, Exchange, Second, install an automated, centrally-controlled and Windows file system. archive system that performs the following func- tions: The Mimosa Systems NearPoint™ Content 9Wfjkh[i Wjj^[l[hob[Wij Wbb[cW_b"I^Wh[# archive captures data in near real time. NearPoint Fe_dj"WdZÓb[ioij[cZWjW"j^[j^h[[ceij provides an integrated archive for Microsoft Share- Z_iYel[h[ZZWjWjof[i Point systems, emails, attachments, instant mes- ?dZ[n[iZWjW sages, and file system data. Unlike other archive I_d]b[_dijWdY[iZWjW products that store content in multiple archive 7ffb_[ih[j[dj_edfeb_Y_[i locations, NearPoint is the next generation single 7bbemi\eh_cc[Z_Wj[b_j_]Wj_ed^ebZi repository—all content is stored in one highly- I[WhY^[iWhY^_l[ZZWjWgk_Yabo scalable archive. NearPoint ends reactive eDis- Fhel_Z[ied#]e_d]ZWjW_dl[djeho ZWjWcWf covery fire drills by providing a unified repository e\WbbWhY^_l[ZZ_iYel[hWXb[ZWjW for SharePoint, messaging, and file content with a single search experience for eDiscovery. 8k_bZ_d]WfheWYj_l[;I?WhY^_l[ The key to building an effective ESI archive is to M^WjZe[ij^_ic[Wd\eh?J5 use a solution that preserves the types of data you 8[_d]WXb[jeh[ifedZje[:_iYel[hoh[gk[iji are generating and captures all discoverable data. gk_Yabo m_j^_dc_dkj[ieh^ekhi"hWj^[hj^Wd If you choose a solution that captures only email ZWoiehm[[ai m_bb_cfh[iij^[^[bbekje\oekh messages and attachments but not calendar entries, =[d[hWb9ekdi[bWdZcWoX[[l[doekh9;E$ task lists, contact lists, or object attributes, then you FbWdd_d]\eh[:_iYel[ho_dYbkZ[ifkjj_d]j^[ will still need to restore backup tapes and image h_]^jWkjecWj_ed_dfbWY[Æ_jÊbbWbmWoiiWl[oekh employee’s hard disks 24 hours a day. Unfortunately, YecfWdoj_c["ZebbWhi"WdZh_ia$ R F7=;** R F7=;*+ Cut out, make copies, and distribute to irritating colleagues for your continued amusement, DATE OF REQUEST FORM ID-10T TIME OF REQUEST Request for IT Services NAME DEPARTMENT EMAIL PHONE DESCRIBE, IN DETAIL, THE NATURE OF YOUR PROBLEM # NOW PLEASE EXPLAIN THE FEEBLE ATTEMPTS YOU HAVE MADE TO REMEDY THE SITUATION IT SERVICES USE ONLY: R F7=;*, 9>7FJ;HJ;D h Form ID-10T Summary o wrap up all the thoughts and suggestions laid out in the preceding chapters, it suffices to say that your company’s legal responsibilities related to eDiscovery and electronically stored Tinformation (ESI) are absolute … and they are also an absolute pain in the butt. Still, for the sake of appearances, here is a summary of the salient points. M^Wj_i[:_iYel[ho5 eDiscovery refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case. It can be carried out offline on a particular computer, or it can be done on a network, or both. >emZej^[d[m J^[h[_iWbejjeYedi_Z[h$ B_j_]Wj_ed^ebZiÆm^Wj"m^[d"^em5 In civil eDiscovery, all ESI that could pertain to a case must be found and protected—that’s called a litigation hold—and turned over to opposing counsel when requested. The FRCP’s amended Rule 37(e) make it clear that any automatic deletion feature should be turned off and a litigation hold imposed once litigation can be reasonably anticipated. R F7=;*- So what qualifies as “reasonable anticipation”? In sanctions ... on a party for failing to provide short, any situations in which a reasonable person electronically stored information lost as a result of would conclude that litigation is a possibility the routine, good-faith operation of an electronic sometime in the future. Unfortunately, the gap information system.” between when a company should have reasonably anticipated litigation and when they actually do, In most cases, the court will presume you are an can be (and often is) used by opposing counsel to expert in your IT operations and should know charge companies with spoliation. when data deletions need to be suspended. To claim Safe Harbor, an organization must dem- M^Wj_iifeb_Wj_ed5 onstrate it has made all the right moves to insure Simply put, spoliation is the intentional or inad- potential evidence is not lost or deleted. If your vertent destruction, mutilation, concealment, or company mishandles ESI, it’s highly unlikely alteration of evidence. that a judge will consider a defence of “we don’t have the automated processes in place to handle A spoliation of ESI decision against your com- this!” Chances are your company will lose and be pany can result from a number of routine actions subject to sanctions and fines. and automated processes, including the re-use of backup tapes, the continued use of applications >emWXekjWJ[Wc7ffheWY^5 that automatically delete data after a litigation Good idea. Much of the cost of discovery is hold has been applied, the deletion of email by directly related to finding all the requested data, employees, the practice of writing over files on a wherever it may be. Unprepared companies per- USB thumb drive, and the disposal of data CDs form inefficient searches—disrupting employee or DVDs. productivity, searching the same data store many times, and looking at employee data not part of A spoliation decision can prompt the judge to the discovery request. Such inefficiency increases issue an “adverse inference” instruction to the a company’s risk of not finding all data requested jury, who may then conclude that your evidence is or adversely turning over too much data. “missing” because you decided it was incriminat- ing and tried to get rid of it. In short, spoliation To make it through an eDiscovery process suc- will often lose you the case—perhaps even before cessfully, IT will have to cooperate with repre- you get your day in court. Unless you’re lucky sentatives from a number of other departments. enough to find a “safe harbor” in this storm. Proactively creating and training a well-informed and active cross-departmental eDiscovery team M^[h[_ij^[IW\[>WhXeh5 will greatly reduce costs and risks, as well as help Rule 37(e), otherwise known as the Safe Har- IT when unexpected litigation arises. In addition, bor amendment, is a new FRCP rule protecting this measure will also help protect your employees parties in litigation from sanctions if potentially should someone be called into court to explain responsive data (evidence) is inadvertently altered how the discovery was accomplished. (If the court or deleted. The rule states that, “Absent excep- suspects spoliation, you should expect subpoenas.) tional circumstances, a court may not impose R F7=;*. M^Wj:e[iJ^_iC[Wd\ehW9ecfWdo Call team meeting to review the Mimosa brochure...make some calls. R F7=;*/ 9H;:?JI7D:;D:DEJ;I h The Know-IT-All’s Guide to eDiscovery was brought to you by Mimosa Systems provides information immediacy, discovery, and continuity for the new generation of critical enterprise information. It enables fingertip access to vast information by users, powerful and rapid search and retrieval of corporate historical information by auditors, and uninterrupted access to corporate information in the midst of failures and errors. Mimosa is focused on information management of unstructured and semi-structured data, including SharePoint, email and attachments, instant messages, files and documents, and other new data types. Mimosa NearPoint™ Content Archiving Solution provides fine-grained and immediate recovery, with self-service archival access to enterprise information. Mimosa Near- Point is the industry’s only comprehensive information management solution for SharePoint, Exchange, and file system data, unifying archiving, recovery, and storage management. Near- Point assures content continuity and regulatory compliance, while leveraging cost-effective disk technologies to optimize Exchange storage growth. IEKH9;I0 ';b[Yjhed_Y:_iYel[hoZ[Ód_j_ed\hecj^[m[Xi_j[0 ^jjf0%%i[WhY^ÓdWdY_Wbi[Ykh_jo$j[Y^jWh][j$Yec%i:[Ód_j_ed%&""i_Z'.+U]Y_''+&&'-"&&$^jcb ( Disclaimer: This document provides a general overview of some of the legal issues relating eDiscovery and records retention require- ments. It is not intended to be an exhaustive discussion of all the issues nor is it intended to constitute legal advice. The information presented is based on statutes and regulations in effect at the time the book was written and should not be considered complete. If you have specific questions regarding eDiscovery or record retention requirements, please consult your legal advisor. R F7=;+& R F7=;+' ADVANCED PRAISE FOR the know- all’s ITguide toto eDiscoveryeDiscovery In a world of e-Everything, it’s the complexities of eDiscovery that should have us sitting up and taking notice. Thanks for taking this message of hope to the people. — The Wally Street Journal Droll and eloquent, this is the eDiscovery story of the decade. Bill Tolson is at the top of his craft. (Bill, if you’re hiring, call me!) — Marty, ACME Worldwide, Inc. I laughed. I cried. I hurled. — Wayne With this guide in my back pocket, I’m almost hoping we’re sued! We’re ready—bring it on! — Employee 8, ABC Corporation R F7=;+(