CEDS Certification Exam Preparation Manual 2020 PDF

CEDS CERTIFICATION EXAM PREPARATION MANUAL Fifth Edition PAGE i | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists CEDS CERTIFICATION EXAM PREPARATION MANUAL Fifth Edition PAGE ii | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists CEDS CERTIFICATION EXAM PREPARATION MANUAL Fifth Edition ACEDS 880 Blue Gentian Rd, Suite 140, Eagan, MN 55121, USA Phone: 1-844-992-2337 Email: [email protected] Web: www.ACEDS.org © Copyright 2013-2020 Association of Certified E-Discovery Specialists Certification (ACEDS) Eagan, USA. All rights reserved. No part of this Manual may be reproduced, distributed or made available in printed or electronic format without the express prior written permission of ACEDS. Notice: The Certified E-Discovery Specialist (CEDS) Certification Examination Preparation Manual is designed to help candidates prepare for the examination. No guarantee, warranty, or representation is made that candidates will pass the CEDS examination as a result of using or studying this Manual. It is designed to provide accurate and authoritative information concerning electronic discovery and related subjects. In publishing this Manual, neither ACEDS, the editors nor contributors are engaged in rendering legal or other professional service. The services of a competent professional should be sought if such assistance is required. PAGE iii | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists EDITORS Michael Quartararo and Helen Bergman Moure CONTRIBUTORS TO THE CEDS EXAMINATION PREPARATION MANUAL Samantha Anderson Stephanie Gwozdz Bradley Schaffel Alexander Bates William F. Hamilton Brook Schaub Evan Benjamin Johnette Hassell Susan Schomburg Helen Bergman Moure Robert Hilson Adrian Skinner James Bickley David Kearney R.P. Smith Thomas Breuer Mark Lenetsky Robert Stangler Ricky Brooman Mary Mack Jason Velasco Stephanie Clerkin Eric P. Mandel Kaylee Walstad Jeffrey Close Rachi Messing Jonathan Wiley Clennie David Tom O’Connor Dave York Kenya Dixon Jim Page Fred Zaremby Chris Fernelius Michael Quartararo Matthew Gibson Nancy Regula CONTRIBUTORS WHO HELPED CREATE AND REVIEW ITEMS FOR THE CEDS EXAMINATION John Addington Christopher Dix Wade Peterson Evan Benjamin Courtney Fay Lisa Prowse Helen Bergman Moure Daniel Goldwag Michael Quartararo James Bickley Jeff Goreski Nancy Regula Ben Blain Donnel Grubbs Bradley Schaffel Thomas Breuer William F. Hamilton Susan Schomburg Ricky Brooman Brandon Hollinder Larikus Scott Kimberly Carradine Jeffrey Jacobson Adrian Skinner Susan Casey Trevor Jefferies Richard Smith Jeff Caudill Eric Killough Robyn Thompson Dinna Chesteen Mary Mack Jason Velasco Stephanie Clerkin Eric P. Mandel Kaylee Walstad Jeffrey Close Stephanie Morgan Sandra Ward David Cohen Patrick Murphy Erik Werfel Scott Cohen Tom O’Connor Nisha West John Connell Robin Peterson EXECUTIVE EXECUTIVE PROJECT PSYCHOMETRICIAN COORDINATOR MANAGER Dave Clark Michael Quartararo Peter Bruce PAGE iv | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists CONTENTS INTRODUCTION.............................................................................................................................................................................................................. 1 PREPARING FOR THE CEDS EXAM...................................................................................................................................................... 1 WHAT TO EXPECT....................................................................................................................................................................................... 1 CHAPTER 1—DISCOVERY AND THE U.S. LEGAL FRAMEWORK........................................................................................................... 2 INTRODUCTION............................................................................................................................................................................................. 2 THE FEDERAL RULES OF CIVIL PROCEDURE.............................................................................................................................. 2 RULE 26 AND THE SCOPE AND TIMING OF DISCOVERY.......................................................................................................3 MEET-AND-CONFER CONFERENCE...................................................................................................................................................4 RULE 26 DISCOVERY PLAN....................................................................................................................................................................5 LIMITATIONS ON DISCOVERY OF ESI THAT IS NOT REASONABLY ACCESSIBLE.....................................................8 RULE 34 REQUESTS TO PRODUCE DOCUMENTS......................................................................................................................9 OTHER DISCOVERY TOOLS....................................................................................................................................................................11 RULE 37 AND THE FAILURE TO COOPERATE IN DISCOVERY.............................................................................................11 CERTIFYING DISCOVERY RESPONSES............................................................................................................................................12 COST-SHIFTING AND PROPORTIONALITY: WHO PAYS?...................................................................................................... 13 DISCOVERY ABOUT DISCOVERY....................................................................................................................................................... 13 NON-PARTY DISCOVERY....................................................................................................................................................................... 14 RULE 502: INADVERTENT PRODUCTION AND THE WAIVER OF PRIVILEGE............................................................ 16 CONCLUSION................................................................................................................................................................................................ 18 CHAPTER 2—UNDERSTANDING TECHNOLOGY AND SOURCES OF ESI....................................................................................... 19 SHARED NETWORK RESOURCES - FILE SERVERS................................................................................................................. 19 SHARED NETWORK RESOURCES - EMAIL SERVERS AND CLIENTS..............................................................................21 DATA IN THE CLOUD: WEB-BASED STORAGE AND EMAIL............................................................................................... 23 DATA MANAGEMENT AND RETENTION POLICIES.................................................................................................................. 23 FLASH, TEMPORARY, AND EPHEMERAL DATA STORAGE.................................................................................................. 24 DISCOVERY AND VARIOUS DATA LOCATIONS AND DATA FORMS.............................................................................. 24 CHARACTERISTICS OF DATA IN UNALLOCATED SPACE.................................................................................................... 25 HOW A COMPUTER OVERWRITES AND DESTROYS DATA................................................................................................ 26 SYSTEM AND FILE METADATA............................................................................................................................................................27 COMPUTER MANAGEMENT AND INTERNAL FILE RECORDS STORAGE.....................................................................27 MANAGING DISASTER RECOVERY AND BACKUP MEDIA................................................................................................... 28 THE IMPACT OF SOFTWARE UPGRADES AND INTEGRATION ON ESI........................................................................ 28 HARDWARE MAINTENANCE AND ITS IMPACT ON ESI......................................................................................................... 29 HOW DATABASES STRUCTURE ESI................................................................................................................................................. 29 THE DATA OF SOCIAL NETWORKING SITES..............................................................................................................................30 MESSAGING AND COLLABORATION APPLICATIONS............................................................................................................ 31 SMARTPHONES AND OTHER MOBILE DEVICES....................................................................................................................... 31 IoT AND OTHER NON-TRADITIONAL DATA SOURCES......................................................................................................... 32 CONCLUSION............................................................................................................................................................................................... 32 PAGE v | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists CHAPTER 3—INFORMATION GOVERNANCE AND LITIGATION READINESS............................................................................... 33 INFORMATION GOVERNANCE............................................................................................................................................................ 34 DATA MAPS.................................................................................................................................................................................................... 34 BACKUP MEDIA............................................................................................................................................................................................ 35 LEGAL HOLD..................................................................................................................................................................................................36 INFORMATION GOVERNANCE AND DEPARTING EMPLOYEES..........................................................................................36 CONCLUSION................................................................................................................................................................................................ 37 CHAPTER 4—IDENTIFICATION AND PRESERVATION OF ESI.............................................................................................................. 38 THE DUTY TO PRESERVE DOCUMENTS AND ESI.................................................................................................................... 38 IDENTIFYING SOURCES OF ELECTRONICALLY STORED INFORMATION................................................................... 39 UNDERSTANDING ESI STORAGE LOCATIONS............................................................................................................................40 IMPLEMENTING A Legal Hold: CONTENTS OF THE NOTICE................................................................................................ 41 ADDITIONAL RECOMMENDED PRACTICES................................................................................................................................. 43 POTENTIAL LEGAL CONSEQUENCES OF FAILING TO PRESERVE ESI.........................................................................44 CONCLUSION................................................................................................................................................................................................ 45 CHAPTER 5—COLLECTION OF ESI.....................................................................................................................................................................46 IMPLEMENTING A REASONABLE COLLECTION STRATEGY...............................................................................................46 FORENSIC INSPECTION PROTOCOLS.............................................................................................................................................50 CONCLUSION................................................................................................................................................................................................. 51 CHAPTER 6—PROCESSING OF ESI..................................................................................................................................................................... 52 BUILD A PROCESSING PLAN................................................................................................................................................................ 52 EXTRACTING METADATA AND TEXT............................................................................................................................................... 53 VALIDATING PROCESSED DATA......................................................................................................................................................... 53 ELIMINATING IRRELEVANT ESI THROUGH CULLING.............................................................................................................. 54 DATA DE-DUPLICATION.......................................................................................................................................................................... 54 EMAIL THREADING.................................................................................................................................................................................... 55 DEVELPING SEARCH METHODS TO CREATE DATA SETS................................................................................................... 56 DATA PROCESSING TOOLS AND RESOURCES.......................................................................................................................... 56 CONCLUSION................................................................................................................................................................................................ 56 CHAPTER 7—DOCUMENT REVIEW.................................................................................................................................................................... 57 REVIEW TOOLS AND METHODS........................................................................................................................................................ 57 TRAINING THE REVIEW TEAM............................................................................................................................................................ 58 QUALITY CONTROL OF REVIEW PROCESSES........................................................................................................................... 63 PRIVILEGE LAW, REVIEW FOR PRIVILEGE, AND CREATING PRIVILEGE LOGS.......................................................64 TECHNOLOGY ASSISTED REVIEW....................................................................................................................................................66 THE TAR PROCESS.................................................................................................................................................................................... 67 CONCLUSION................................................................................................................................................................................................ 68 CHAPTER 8—PRODUCTION OF ESI.................................................................................................................................................................. 69 PLANNING A DOCUMENT PRODUCTION...................................................................................................................................... 69 FORM OF PRODUCTION......................................................................................................................................................................... 69 LOAD FILE AND METADATA DELIVERABLES............................................................................................................................. 70 PRODUCTION OF HARD COPY DOCUMENTS.............................................................................................................................. 71 PAGE vi | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists APPLYING QUALITY CONTROLS TO PRODUCTION................................................................................................................ 73 PRODUCTION MEDIA.............................................................................................................................................................................. 74 CONCLUSION................................................................................................................................................................................................ 74 CHAPTER 9—PROJECT MANAGEMENT AND BUDGETING................................................................................................................... 75 FUNDAMENTALS OF PROJECT MANAGEMENT........................................................................................................................ 75 INITIATING AND PLANNING FOR AN E-DISCOVERY PROJECT........................................................................................ 77 IDENTIFICATION AND PRESERVATION........................................................................................................................................... 79 COLLECTION.................................................................................................................................................................................................80 PROCESSING.................................................................................................................................................................................................. 81 DOCUMENT REVIEW................................................................................................................................................................................ 83 PRODUCTION................................................................................................................................................................................................ 85 CREATING AND MANAGING AN E-DISCOVERY BUDGET.................................................................................................... 86 FACTORS AFFECTING THE E-DISCOVERY PROJECT BUDGET......................................................................................... 89 CONCLUSION................................................................................................................................................................................................. 91 CHAPTER 10—INTERNATIONAL AND CROSS-BORDER E-DISCOVERY......................................................................................... 92 CROSS-BORDER DISCOVERY FOR U.S.-BASED LITIGATION.............................................................................................. 92 LEGAL RESTRICTIONS TO INTERNATIONAL CROSS-BORDER DATA TRANSFERS...............................................94 OVERCOMING FOREIGN LEGAL RESTRICTIONS AND ENABLING CROSS-BORDER DATA TRANSFERS...................................................................................................................................................................................... 98 COMPLIANCE WITH DATA PROTECTION LAWS AND REGULATION............................................................................99 CONCLUSION................................................................................................................................................................................................101 CHAPTER 11—ETHICAL CONSIDERATIONS IN E-DISCOVERY............................................................................................................ 102 THE DUTY OF COMPETENCE............................................................................................................................................................. 102 THE DUTY OF CANDOR........................................................................................................................................................................ 102 DUTY OF CONFIDENTIALITY............................................................................................................................................................ 103 CONFLICTS OF INTEREST.................................................................................................................................................................... 104 SUPERVISION OF LAWYERS AND NON-LAWYER PROFESSIONALS.......................................................................... 105 SIGNING AND CERTIFYING DISCOVERY DOCUMENTS....................................................................................................... 106 CONCLUSION.............................................................................................................................................................................................. 106 APPENDIX A...................................................................................................................................................................................................................107 A REAL-WORLD PRODUCTION PROTOCOL...............................................................................................................................107 APPENDIX B..................................................................................................................................................................................................................... 111 METADATA AND OTHER DATA FIELDS............................................................................................................................................ 111 METADATA FIELDS COMMONLY EXTRACTED DURING PROCESSING 111 OTHER COMMON DATA FIELDS 112 APPENDIX C....................................................................................................................................................................................................................113 MEET AND CONFER CHECKLIST........................................................................................................................................................113 APPENDIX D...................................................................................................................................................................................................................114 CEDS EXAM PRACTICE QUESTIONS................................................................................................................................................114 CEDS EXAM PRACTICE QUESTION ANSWERS & RATIONALS..........................................................................................118 PAGE vii | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists INTRODUCTION Congratulations on taking the next step to enhancing and validating your e-discovery knowledge, skill, and experience! This study guide has been created for candidates who are preparing for the Certified E-Discovery Specialist (CEDS) exam. The guide is intended to cover the subjects on the CEDS exam and to provide useful information and insight for readers to prepare for the exam. PREPARING FOR THE CEDS EXAM Reading this study guide alone, however, may not be enough to adequately prepare you for the CEDS exam. That is why we recommend that all CEDS candidates study additional materials, including past and current webinars on the ACEDS website, the ACEDS blog and other industry blogs, websites, and white papers on e-discovery best practices. We also strongly recommend that you attend the live three- session CEDS Prep webinar (or a live in-person presentation if one is available locally) because there is no substitute for live instruction and the ability to ask questions of one of our instructors. Finally, there are several reasons that each candidate is given one year to prepare to take the CEDS exam. First, the exam is designed to be difficult. A certification exam that is easy would not be worth much. With scenario-based questions, the CEDS exam will challenge your ability to meet e-discovery demands in a variety of areas. Second, we recognize that individuals who work in e-discovery and the legal industry in general are busy people and not everyone will have time to study and prepare for the exam. So, we provide a good deal of time to enable candidates to prepare. ACEDS recommends that candidates for the CEDS exam spend between 30 and 40 hours of study time preparing for the exam. WHAT TO EXPECT On the CEDS exam you will encounter 145 scenario-based questions and some shorter questions as well. Each question is multiple choice, and the test is designed for the correct answer to be the best answer based on the facts given in the scenario. You will have four hours to take the exam. Additional time is available in special circumstances. ACEDS recommends that you proceed through the exam as quickly as possible, answering questions for which you are sure of the correct answer. Along the way, you will have an opportunity to mark questions in the comments box after each question to remind yourself to go back and complete those marked questions. Many people who take the exam encounter what is called test anxiety. ACEDS recommends that as you prepare and study for the exam, you also plan to free yourself of work and personal concerns the day before and the day of the exam. This will reduce any potential stress or anxiety and ensure you have the time and required focus to prepare for and take the exam. Good luck on the exam! Don’t forget to reach out to us after the exam and provide ACEDS with feedback about your experience preparing for and taking the CEDS exam. PAGE 1 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists CHAPTER 1 DISCOVERY AND THE US LEGAL FRAMEWORK INTRODUCTION In the course of litigating a legal dispute or lawsuit, the discovery phase is the period of time after the filing of the complaint and answer when the parties exchange information about the facts of their case. Discovery may involve the exchange of paper documents or Electronically Stored Information (“ESI”), the taking of sworn testimony of witnesses through depositions, and the preparation of evidence and arguments for eventual trial. In the past, most discovery was delivered in paper format, even for information that originated in some electronic form. Today, with the dramatic shift to a more paperless environment in both personal and business contexts, and through the recognition by courts and litigants of the necessity and utility of embracing digital formats, discovery today is almost exclusively focused on ESI. This shift has given rise to several significant changes in the legal landscape: The increasing need for lawyers and practitioners to better understand technology and make effective use of it in their practices, the perpetual development of new software tools to assist in performing discovery, the incorporation of more non- lawyers into the discovery process, and the flourishing industry of service providers eager to assist in the more efficient and cost-effective performance of discovery. In many ways, the basic elements of discovery are unchanged, but in other ways there has been a dramatic change in how lawyers, parties, and courts address the critical exchange of information and evidence before reaching trial. This manual, and the companion preparatory course, are intended to highlight those ways in which the landscape has shifted to affect both the law and the mechanics of discovery work and reflect the evolving best practices in discovery. THE FEDERAL RULES OF CIVIL PROCEDURE The Federal Rules of Civil Procedure (“FRCP”) are the “rules of the road” in litigation, promulgated and occasionally amended by a committee of federal judges (the “Rules Advisory Committee”) through a years-long process that includes collecting public comment, numerous proposals and revisions, and ultimately Congressional and Supreme Court approval. The most drastic amendments to the rules ever made were initiated in the early 2000s and took effect in 2006; they were primarily focused on the changes in how discovery is performed, and it is the first time the concept of ESI was introduced. The subsequent and most recent amendments to the rules, which took effect in 2015, were less significant and were primarily focused on streamlining discovery through the application of proportionality and reducing the risk of sanctions for spoliation. The 2006 and 2015 amendments are addressed in greater detail below. PAGE 2 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists RULE 26 AND THE SCOPE AND TIMING OF DISCOVERY Rule 26 of the Federal Rules of Civil Procedure sets forth the scope of discovery in civil litigation. Parties to litigation, including the litigation support and paralegal personnel who work on litigation matters need a general understanding of the FRCP. Under Rule 26(b)(1) of the FRCP, any party may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit. Information within this scope of discovery need not be admissible in evidence to be discoverable. Several important concepts stem from Rule 26. First, discovery may be had of non-privileged material. Second, the documents or ESI sought must be relevant to a claim or defense in the case. And third, the discovery sought must be proportional to the need of the case given the factors outlined in the rule. The scope of discovery may be limited by Rule 26(b)(2)(B), which provides that: A party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost. On motion to compel discovery or for a protective order, the party from whom discovery is sought must show that the information is not reasonably accessible because of undue burden or cost. If that showing is made, the court may nonetheless order discovery from such sources if the requesting party shows good cause, considering the limitations of Rule 26(b)(2)(C). The court may specify conditions for the discovery. Another requirement of Rule 26 is the parties’ obligation to make initial disclosures under FRCP Rule 26(a)(1). This means that before any request or demand for discovery is made, the parties must exchange initial disclosures. The Rule provides that: Except as exempted by Rule 26(a)(1)(B) or as otherwise stipulated or ordered by the court, a party must, without awaiting a discovery request, provide to the other parties: (I) the name and, if known, the address and telephone number of each individual likely to have discoverable information—along with the subjects of that information—that the disclosing party may use to support its claims or defenses, unless the use would be solely for impeachment; (II) a copy—or a description by category and location—of all documents, electronically stored information, and tangible things that the disclosing party has in its possession, custody, or control and may use to support its claims or defenses, unless the use would be solely for impeachment; (III) a computation of each category of damages claimed by the disclosing party—who must also make available for inspection and copying as under Rule 34 the documents or other evidentiary material, unless privileged or protected from disclosure, on which each PAGE 3 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists computation is based, including materials bearing on the nature and extent of injuries suffered; and (IV) for inspection and copying as under Rule 34, any insurance agreement under which an insurance business may be liable to satisfy all or part of a possible judgment in the action or to indemnify or reimburse for payments made to satisfy the judgment. A 2015 amendment to Rule 26 also impacted the timing of discovery requests. Under Rule 26(d), parties may now serve what are called “Early Rule 34 Requests,” which are intended to get the parties talking about e-discovery issues earlier in the case. Early Rule 34 requests may be served as soon as 21 days after service of a summons and complaint that begin a lawsuit. MEET AND CONFER CONFERENCE Recognizing the importance of early and comprehensive discussions between the parties concerning the whole discovery process, the FRCP include several procedures to bring ESI issues to the forefront very early in the development of the case. One of the most significant of these is the FRCP 26(f) conference. The precise timing of the conference will depend on the court’s scheduling orders and local practice, but it gives rise to one of the earliest opportunities for the parties to engage in comprehensive discussions regarding discovery. The stated goal of the rule is for parties to have an open dialogue, exchange information, and strive to reach proactive agreement on many discovery-related topics. It is essential that the attorney who is representing the client in these discussions be knowledgeable about the rule requirements, the discovery process, and the details of the client’s electronic storage systems. Because these discussions necessarily touch on a wide range of topics, many of them not typically within the purview of the lawyers, it is prudent to involve other personnel with the requisite knowledge (IT staff, litigation support technicians, etc.) as needed. Rule 26(f) requires that the parties to litigation meet and discuss the discovery requirements involved in each case. Under Rule 26(f)(2), “the parties must consider the nature and basis of their claims and defenses and the possibilities for promptly settling or resolving the case; make or arrange for the disclosures required by Rule 26(a)(1); discuss any issues about preserving discoverable information; and develop a proposed discovery plan.” The attorneys involved in the case are jointly responsible for arranging the conference, for attempting in good faith to agree on the proposed discovery plan, and for submitting to the court within 14 days after the conference a written report outlining the plan. Under Rule 26(f)(3), a discovery plan developed by both parties will generally involve addressing the following issues: Any changes that should be made in the timing, form, or requirement for initial disclosures under Rule 26(a), including a statement of when initial disclosures were made or will be made. The subjects on which discovery may be needed, when discovery should be completed, and whether discovery should be conducted in phases or be limited to or focused on particular issues. Any issues about disclosure, discovery, or preservation of electronically stored information, including the form or forms in which it should be produced. PAGE 4 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists Any issues about claims of privilege or of protection as trial-preparation materials, including—if the parties agree on a procedure to assert these claims after production— whether to ask the court to include their agreement in an order under Federal Rule of Evidence 502; What changes should be made in the limitations on discovery imposed under these rules or by local rule, and what other limitations should be imposed; and Any other orders that the court should issue under Rule 26(c) (protective orders) or under Rule 16(b) and (c) (scheduling and case management conferences). Regarding ESI, the parties must make or arrange for the disclosures required by Rule 26(a)(1), discuss any issues about preserving discoverable information, and develop a proposed discovery plan. To address preservation issues, counsel must have fully explored with the client the legal hold strategy and its implementation. The attorney must not only be able to articulate exactly what their own client has done but be prepared and sufficiently knowledgeable to ask questions of the opponent regarding its preservation activities. Ideally, the result of the 26(f) conference will be the joint creation of a comprehensive discovery plan, details of which are addressed more fully below. In order to be prepared to address the required topics, it is necessary for the discovery team to have investigated the location of relevant ESI; the logistical challenges that are likely to be encountered in collecting, reviewing, and producing that ESI; the anticipated volume of available ESI; and the client’s preferred approach to issues such as protective order designations, privilege log components, and possible staging or prioritizing of the discovery process to increase efficiency and control costs. The 26(f) conference represents a vital opportunity for parties to proactively address common discovery issues and propose approaches to streamline the process in line with the mutual goal of proportionality. Agreements in the discovery process are typically reciprocal; parties should be cautious of asking for something they would be unwilling to offer. Counsel entering the conference process sufficiently informed and ready to make reasonable proposals and agreements will benefit the most from these early discussions, while counsel entering these discussions unprepared could have significant and costly burdens imposed on their clients that might have been avoided through preparation (a sample meet and confer checklist can be found in Appendix C). RULE 26 DISCOVERY PLAN Rule 26(f)(3) requires that the parties to litigation develop a plan for discovery. The discovery plan—and therefore the conference that precedes the plan—must address the following specific topics: Initial disclosures, including proposed changes to the timing, form, or requirements. The parties may choose to change the timing or detail to be included in the initial disclosures or reach agreements about the specific information that will be included. For example, they may agree to exchange lists of proposed custodians and non-custodial sources of ESI, or they may agree to delay such a detailed exchange until a specific later date. As noted earlier, FRCP 26(a)(1) requires each litigant to disclose to its opponent various types of information before any formal discovery requests are served in the case. The idea behind this “initial disclosure” rule is to require parties to be proactively forthcoming with information relevant to the matter and to streamline the discovery process. PAGE 5 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists In practice—much modified by local rules of the various District Courts and by local practice—initial disclosures have not been as comprehensive as the original drafters of the rule envisioned. They are nevertheless a critical event in the early development of the case and must address ESI since it will likely predominate the overall discovery material. According to Rule 26(a)(1)(A)(ii), each party must provide as part of their initial disclosures “a copy—or a description by category and location—of all documents, electronically stored information, and tangible things that the disclosing party has in its possession, custody, or control and may use to support its claims or defenses, unless the use would be solely for impeachment.” The initial disclosure deadline arises very quickly after the filing of the complaint and answer. As a result, there will be very little time for a party to perform an exhaustive investigation of the type and location of all the likely relevant information. It is therefore necessary to have prompt discussions as soon as the matter is filed concerning these disclosures and to begin to plan exactly what will be disclosed. In practice it is uncommon (though certainly permissible) to provide the actual evidence at initial disclosure; most parties provide a description by category and location of the documents.’ It may be possible and thus advisable to identify specific custodians and non-custodial sources of ESI which are expected to be searched for relevant data. If there are specific database programs, networked departmental share drives, or other non-custodial sources, these certainly should be listed. It is common for parties to negotiate the scope of these initial disclosures, including the extent to which they will update the disclosures with additional detail as the case proceeds. In the end, however, a party who fails to initially disclose the existence of relevant ESI, who later attempts to use that data at trial without having turned it over to opposing counsel, is likely to be precluded from using that information. Under the initial disclosures rule, parties should disclose any ESI in their custody and control that is relevant to the claims or defenses in the case. Subjects on which discovery may be needed, when discovery will be completed, and whether discovery can and should be phased, limited, or focused on particular issues. The parties may list specific topics for discovery and reach agreements on the timing of such discovery. In order to streamline the discovery process, the parties might, for example, agree to begin with a phase of discovery focused on a single facet of the case, the resolution of which could be key to the outcome of the litigation. In such an instance they would typically agree to engage in broader discovery only if the case is not resolved or narrowed upon completion of the first phase. Such agreements should always be considered in cases amenable to such phasing where it would be strategically advantageous. When phasing discovery, however, it is important to consider where efficiencies can be gained and to avoid processes that will merely duplicate effort. For example, it may be most efficient to start with a small list of sources of ESI and fully review that material, adding other sources later only if necessary. It is almost never most efficient to review a set of ESI for only limited topics if it is likely that the same material will have to be reviewed again later for other topics. The parties and their attorneys must have a relatively comprehensive understanding of the likely issues in the case before efficient phasing is possible. PAGE 6 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists Disclosure or discovery of ESI, including the format of production. Format of production is one of the most important issues to address early in the case. Even though production may not occur for many weeks or even months, the parties need to know the format at the outset in order to establish their processing and review plans. Without this agreement, a party may unwisely convert or otherwise manipulate its ESI in a way that is incompatible with the ultimately required production format. Similarly, a party may have a request for the format in which it would like to receive documents that would be simple to provide if the correct processes are in place from the beginning. If the requesting party waits until later to specify the format, it may be too late for the other party to reasonably accommodate the request. Claims of privilege and attorney work product material, including agreements about inadvertent disclosure and issuance of a protective order by the court. It is essential that parties proactively address the near-certainty of the inadvertent production of privileged and/or work-product material. In almost all cases, the parties should agree to a process by which each side would have the right to identify and request the return of such material without the production resulting in a waiver. This agreement—commonly referred to as a clawback agreement—should always be incorporated into a court order, either as part of the protective order or through another type of routine court order. The issuance of such an order should always precede any production in the case. As explained in more detail later, under Federal Rule of Evidence 502, if a court orders this kind of agreement, the order will protect the parties from claims of waiver if, among other things, the disclosure is inadvertent. Potential changes to the limitations on discovery imposed by the Federal Rules or local rules. If the parties anticipate that discovery can be accomplished through fewer depositions or interrogatories, for instance, then as permitted under the rules, they should make that proposal in the Rule 26 conference and incorporate any such agreement into the discovery plan. More commonly, the parties agree to expand on the limits, but such agreements may be resisted by the court. This is also the opportunity to raise limits that are not at all contemplated by the rules but which, through cooperation, might greatly benefit the parties and aid in proportionality. Such agreements might include a limit on the number of custodians and/or limits on search terms and date ranges to include. Asking for or agreeing to such limits is a matter of strategy and will be very case-specific, but the possibility of doing so should at least be discussed internally before the 26(f) conference. Other orders that the court should issue concerning the discovery process. At a minimum, the Rule 26 conference must address all the issues listed above. The discovery plan may, in fact, cover a wide variety of additional topics and may memorialize various agreements between the parties on these subjects. A well-prepared party can leverage the required process to gain advantage by proactively providing a draft of the plan before the conference, including all the subjects on which that party would like to reach agreement and specific proposals. A party may also proactively propose an agenda for the conference and the information that each party will be expected to bring. Most important, the conference and the plan provide the basis for opening the discussion and setting the tone between the parties in terms of cooperation and agreement when possible. PAGE 7 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists LIMITATIONS ON DISCOVERY OF ESI THAT IS NOT REASONABLY ACCESSIBLE Discovery in the US, unlike in many other jurisdictions, is broad in scope. As noted above, a party “may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case.” FRCP Rule 26(b)(1). There are, however, limitations on discovery. Also as noted above, under FRCP Rule 26(b)(2)(B), parties are afforded some protection against collecting and producing ESI that is difficult or expensive to retrieve. The rule states that “[a] party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost.” The Rules also provide an outline of how an objection under the rule may be made and resolved. The objection should be explicitly stated—and the source identified—in response to a discovery request, or in the party’s initial disclosures. On motion to compel discovery or for a protective order, the party from which discovery is sought must show that the information is not reasonably accessible because of undue burden or cost. If that showing is made, the court may nonetheless order discovery from such sources if the requesting party shows good cause, considering the limitations of Fed. R. Civ. P. 26(b)(1). The court may put conditions on the discovery from the source including cost-shifting. The impact of “not reasonably accessible” data has grown over the years. As the volume of data generated has soared, the costs of data storage have declined, and companies retain large amounts of data in disaster-recovery (off-line) or “near-line” forms of storage. These ever-larger stores of data with possibly marginal utility should be evaluated as potentially being “not reasonably accessible” in order to control the costs of collecting and producing data. Also, the pace of technological change has made computer systems and software obsolete more quickly than before, resulting in increasing amounts of “legacy” data which is frequently the subject of “not reasonably accessible” claims. The initial burden of showing that data is “not reasonably accessible” is on the party making the objection. In addition, courts may permit discovery into the contentions of burden and cost. Therefore, it is important for the producing party to understand and appreciate the limits on the protection provided by the rule before asserting it. When dealing with non-civil types of matters, discussions should occur as early as possible in the process to determine the scope. No data sources are presumptively “not reasonably accessible.” The producing party must make an individualized assessment for each source as to which it is claiming protection. Simply asserting that backup media or legacy data systems are not reasonably accessible is likely not to be sufficiently precise if there is more than one type involved. Some courts have treated backup tapes as presumptively inaccessible, but that is generally no longer the case. The producing party must make a detailed and individualized assessment of the burden and cost of providing the discovery requested. The cost or burden may include: (1) the cost of converting data from a format that is difficult or impossible to search or review to another more accessible format (such as the restoration of data from a backup tape); (2) the cost to review the data for responsiveness, privilege; or 3) business disruption and other internal costs. The producing party may need to obtain bids from vendors to collect the information and convert it to a usable form and prepare a good faith estimate of the cost to review the data retrieved for relevance and privilege. Courts are often skeptical of what they perceive to be inadequately substantiated or exaggerated cost estimates. PAGE 8 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists The producing party should be prepared to address additional factors including: (1) the relevance of the data residing on the particular source; (2) the value to the litigation, overall, of the data at issue; and (3) whether the information can be obtained through some other means, such as third-party subpoenas or depositions. It will be more difficult to support a claim that data from a backup medium is not reasonably accessible if the company routinely recovers data from that source. The producing party must also be prepared to discuss compromise measures that would avoid the cost of wholesale restoration of a source of data but can supply responsive data from other sources. If the dispute centers on backup media, the producing party must determine whether the backup media contain any kind of index or log that would allow selective restoration focused on a specific time period, custodian, or type of data. This information will be sought by the requesting party. The Advisory Committee notes to Fed. R. Civ. P. 26(b)(2)(B) suggest that discovery on the issue of accessibility “might take the form of requiring the responding party to conduct a sampling of information contained on the sources identified as not reasonably accessible…” Sampling may involve restoring a few backup tapes selected from different time periods or locations both to determine whether any responsive, non- redundant, or truly useful information is contained on the tapes, and to inform future discussions about cost and burden of including additional similar sources. A compromise may be sought on the universe of documents to be reviewed once the data source is restored. If the review costs are the driver of the effort to designate a source as not reasonably accessible, the parties must be prepared to discuss the use of culling methods, such as search terms and dates ranges, to narrow the universe of data that must be individually reviewed for responsiveness or privilege. RULE 34 REQUESTS TO PRODUCE DOCUMENTS The FRCP provides several discovery tools that parties may use for requesting a party produce information relevant to a litigation or investigation. Rule 34, which relates to requests for documents and ESI, is perhaps the most used discovery tool for requesting ESI. Requests for production of documents under Rule 34 are usually served by the parties following the filing of a complaint and answer. Rule 34 provides as follows: (a) In General. A party may serve on any other party a request within the scope of Rule 26(b): (1) to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party’s possession, custody, or control: (A) any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form; or (B) any designated tangible things; or 1 As noted earlier, however, in federal court and some state courts parties may be required to make initial disclosures without having received a request from an opposing party. PAGE 9 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists (2) to permit entry onto designated land or other property possessed or controlled by the responding party, so that the requesting party may inspect, measure, survey, photograph, test, or sample the property or any designated object or operation on it. (b) Procedure. (1) Contents of the Request. The request: (A) must describe with reasonable particularity each item or category of items to be inspected. (B) must specify a reasonable time, place, and manner for the inspection and for performing the related acts; and (C) may specify the form or forms in which electronically stored information is to be produced. A party that is responding to a request to produce ESI usually has 30 days to produce the information, although extensions of time are typically granted and discovery can last for months. If a party objects to a request to produce documents, under Rule 34(b)(2), it is necessary that the objecting party who is resisting discovery state their objection with particularity. (2) Responses and Objections (A) Time to Respond. The party to whom the request is directed must respond in writing within 30 days after being served or—if the request was delivered under Rule 26(d)(2)—within 30 days after the parties’ first Rule 26(f) conference. A shorter or longer time may be stipulated to under Rule 29 or be ordered by the court. (B) Responding to Each Item. For each item or category, the response must either state that inspection and related activities will be permitted as requested, or state with specificity the grounds for objecting to the request, including the reasons. The responding party may state that it will produce copies of documents or of electronically stored information instead of permitting inspection. The production must then be completed no later than the time for inspection specified in the request or another reasonable time specified in the response. (C) Objections. An objection must state whether any responsive materials are being withheld based on that objection. An objection to part of a request must specify the part and permit inspection of the rest. (D) Responding to a Request for Production of Electronically Stored Information. The response may state an objection to a requested form for producing electronically stored information. If the responding party objects to a requested form—or if no form was specified in the request—the party must state the form or forms it intends to use. (E) Producing the Documents or Electronically Stored Information. Unless otherwise stipulated or ordered by the court, these procedures apply to producing documents or electronically stored information: PAGE 10 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists (i) A party must produce documents as they are kept in the usual course of business or must organize and label them to correspond to the categories in the request. (ii) If a request does not specify a form for producing electronically stored information, a party must produce it in a form or forms in which it is ordinarily maintained or in a reasonably usable form or forms; and (iii) A party need not produce the same electronically stored information in more than one form. It should be noted that there are specific objection requirements when responding to requests for production of documents. And practitioners should also be aware of the form or forms language in Rule 34. In the end, ESI must be produced in a “reasonably useable form.” OTHER DISCOVERY TOOLS Several other provisions of the FRCP outline the discovery tools that parties may use in litigation. Rule 30 permits a party to take the oral deposition of another party; Rule 33 provides for the taking of interrogatories, which are written questions that must be answered under oath; and Rule 36 is used to ask a party to admit that a statement of fact is true or false. Which tools are used in discovery are entirely the strategic choice of the practitioners and parties involved. In the end, each discovery tool is intended to discover information that is relevant to the claims and defenses in the case. RULE 37 AND THE FAILURE TO COOPERATE IN DISCOVERY If party fails to preserve ESI, fails to produce ESI or fails to participate or cooperate with other parties in the discovery process, Rule 37 provides for the possibility of sanctions. A 2015 amendment to FRCP 37(e) resulted in a new provision related specifically to the failure to preserve ESI. That section now reads: (e) Failure to Preserve Electronically Stored Information. If electronically stored information that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it, and it cannot be restored or replaced through additional discovery, the court: (1) Upon finding prejudice to another party from loss of the information, may order measures no greater than necessary to cure the prejudice; or (2) Only upon finding that the party acted with the intent to deprive another party of the information’s use in the litigation may: (A) presume that the lost information was unfavorable to the party. (B) instruct the jury that it may or must presume the information was unfavorable to the party; or (C) dismiss the action or enter a default judgment. PAGE 11 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists Under the Rule, parties to litigation are expected to take “reasonable steps” to preserve ESI. This new rule makes the obligation to preserve information an affirmative duty for practitioners. It should be noted, however, that the new rule introduces the notion of prejudice and only if a court finds that a party intended to deprive another party of relevant information may the court impose sanctions. The 2015 amendment to FRCP 37(e) adds obstacles before the most onerous sanctions can be issued for a failure to preserve ESI. The court will look to whether the ESI should have been preserved in the first place. Next, the court will look to whether the party failed to take reasonable steps to preserve it. Then the party presumably has an opportunity to restore and replace the ESI, or the requesting party can ask for additional discovery. The inquiry will then shift to prejudice due to the loss of information. If a party has been prejudiced by the failure to preserve, curative measures can be ordered. In contrast to punitive sanctions, curative measures are to be no greater than necessary to cure the prejudice. Lastly, to obtain the most serious sanctions of adverse inferences, dismissals or defaults, judges must find that the party acted with intent to deprive another party of the information’s use in the litigation. It is important to note that these limitations on judicial sanctions are focused on ESI and not tangible evidence. There are other rules that allow sanctions, and judges’ inherent power to control the behavior of litigants is left intact. Finally, Rule 37(f) provides that “if a party or its attorney fails to participate in good faith in developing and submitting a proposed discovery plan as required by Rule 26(f), the court may, after giving an opportunity to be heard, require that party or attorney to pay to any other party the reasonable expenses, including attorney’s fees, caused by the failure.” CERTIFYING DISCOVERY RESPONSES One provision of Rule 26 that is often overlooked is the requirement that an attorney or party sign and certify their discovery request and responses. Under Rule 26(g), “every discovery request, response, or objection must be signed by at least one attorney of record in the attorney’s own name—or by the party personally, if unrepresented.” By signing, an attorney or party certifies that to the best of the person’s knowledge, information, and belief, formed after a reasonable inquiry, that any discovery provided is complete at the time it is disclosed and that discovery requests, responses or objections are: consistent with these rules and warranted by existing law or by a non-frivolous argument for extending, modifying, or reversing existing law, or for establishing new law; not interposed for any improper purpose, such as to harass, cause unnecessary delay, or needlessly increase the cost of litigation; and neither unreasonable nor unduly burdensome or expensive, considering the needs of the case, prior discovery in the case, the amount in controversy, and the importance of the issues at stake in the action. If a discovery request is not signed, the responding party has no obligation to respond. And finally, should a party’s discovery responses not comply with Rule 26(g), the court may impose sanctions on the attorney, the party, or both. PAGE 12 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists COST-SHIFTING AND PROPORTIONALITY: WHO PAYS? In United States courts, each party bears all its own litigation expenses, including the expense of discovery. (Because the rules are different in most other countries with similar legal systems, this is sometimes called the “American rule.”) Efforts to change this system in the 2006 revisions to the Federal Rules were largely rejected and, in general, courts disfavor cost-shifting. Moreover, the Federal Rules favor broad discovery, even explicitly including material that is not admissible in court. That is not to say, however, that costs of discovery are irrelevant or never can be shifted to the requesting party. Information is discoverable pursuant to FRCP 26(b)(1), as revised in 2015, if it is relevant to a party’s claim or defense and is proportional to the needs of the case. This provision is the starting point for any party arguing for a departure from the American rule. A party that insists upon production of information that is out of proportion to its likely benefits is more likely to have the costs of production shifted to it. Rule 26(b)(2)(B) also includes a provision related to “not reasonably accessible” electronically stored information, which also anticipates possible cost-shifting under some circumstances. A party need not produce any ESI from sources that it deems to be not reasonably accessible if the party identifies the source with particularity to its opponent. A source can be considered not reasonably accessible based on “undue burden or cost.” Once so identified, the requesting party may nevertheless move to compel production from the identified source but will need to make a showing of “good cause” to require it. If the court determines that good cause has been shown, it may in addition require the requesting party to bear the reasonable costs of production under the proportionality rule. In general, a court will be much more sympathetic to an argument for cost-shifting if the party has already made efforts to provide the requested information and has concrete evidence of the additional expense of providing additional or different material. The better faith demonstrated in prior dealings and the more open the communication between the parties, the more likely a court will favorably consider a cost-shifting argument. The converse also is true: if a party making a cost-shifting request supports it with cost estimates that do not stand up to scrutiny, then not only is the court more likely to reject the cost-shifting request at issue, but the party’s credibility with the court on other issues may be impaired. DISCOVERY ABOUT DISCOVERY Where a requesting party harbors reasonable doubts about the completeness and integrity of a producing party’s responses, it may launch “discovery about discovery.” Topics that may be explored include what was done to institute a legal hold; what was collected, when and how it was collected, and how materials were processed. All the usual discovery methods are available to a party exploring these issues: interrogatories, document requests, and depositions. Recipients of these requests have all the usual procedures available to resist them. Probably the most useful method of “discovery about discovery,” and certainly the most common, is a deposition under FRCP 30(b)(6). This rule permits a party to serve a deposition notice on a corporate entity rather than an individual. The notice specifies the topics to be covered in the deposition, and the party being deposed is responsible for designating the person—sometimes a group of people—qualified to answer questions on the specified topics. The designated person need not necessarily have day-to- day responsibility for the matters about which he or she will testify but must be educated in those issues before the deposition takes place. This approach saves the deposing party from having to identify the right individual to depose and permits a full exploration of the topics in a single deposition, which is important in cases in which the total number of depositions is limited. PAGE 13 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists The topics to be covered in such a deposition will depend on the facts and circumstances of the case. Areas of reasonable inquiry might include: What the party’s legal hold process is in general—for instance, whether the producing party has a generally-applicable legal hold policy and the details of that policy—and what specific steps were taken in this case to effectuate a hold. When the legal hold was issued and to whom. What was the substance of the legal hold communication (if not considered privileged)? How sources were selected for legal hold and who was eliminated from legal hold, as well as the reasoning behind those decisions. Whether there are any automatic deletion processes in place in the company and, if so, what steps were taken to disable them when the preservation duty arose. The method of collecting ESI for review; specifically, whether the method preserved all relevant metadata intact. The method used to cull the ESI prior to review, including the tools used and the criteria for inclusion in review (including search terms, if used). The method used for review of the ESI including the review platform used, whether documents were individually considered or whether there was any automated or bulk decision-making regarding duplicates or near-duplicates. The personnel employed to conduct ESI review, including their qualifications, experience, and training. The volume of material collected, the volume reviewed, and the volume produced. What quality controls were in place at the various stages of the collection, processing, review, and production? Depending on the responses to these questions, there are of course further topics that might need to be explored to ensure that the producing party has met its preservation and discovery obligations. NON-PARTY DISCOVERY Material is discoverable (i.e. required to be produced during litigation) if it is in a party’s “possession, custody, or control.” The word “control” in the rule indicates that in some circumstances it is not necessary that the producing party actually possess the ESI, but merely that it have some legal right to direct the treatment of it, including its preservation, collection, review, and production. Therefore, in some instances, potentially relevant ESI may be held and maintained by a person or entity not a party to the matter. As an example, the producing party may contract with a separate company to provide customer service and/or technical support in a matter in which the customer support records are relevant. In such a case, it is important to assess how the same identification, preservation, and collection issues that arise when the producing party is in direct control of the ESI will be handled regarding the non-party. Fortunately, Rule 45 of the Federal Rules of Civil Procedure provides for the issuance of a subpoena to demand that non-parties produce relevant ESI. The first consideration is the relationship between the producing party and the non-party. There are two general variations, each with potential specific issues. The first variation—using our example above—is that PAGE 14 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists the ESI belongs to or directly involves the producing party but is held by a non-party. This situation has become more common as companies store more of their data in the cloud. We can refer to this situation as “hosted information.” The second variation involves information that belongs and relates solely to the non- party, but which is nevertheless potentially relevant to the matter. We can refer to this situation as “third party information.” Hosted information: In most instances, hosted information will be in the hands of the non-party due to a business relationship between the producing party and the non-party. If the relationship is contractual, the written agreement may contain specific terms addressing each party’s rights and obligations in the event of litigation and discovery. For this reason, the contract should always be reviewed as a first step. As soon as practical after the duty to preserve arises, a legal hold must be issued to the non-party hosting the information. This legal hold will notify the non-party of the producing party’s legal obligations to preserve hosted information, inform the non-party that this duty extends to ESI that it is holding, and ask that steps be taken to preserve the potentially relevant ESI in its possession. We recommend that the initial legal hold contact be made in writing in order to create a record that the request was made on a date and if spoliation issues arise. After the legal hold notice has been sent, it will almost always be necessary to follow up with more direct contact in the form of telephone conferences and/or face- to-face meetings. These conferences or meetings are typically used to understand how the data is structured, stored, and whether any auto-delete or data purging policies exist. It is also important to determine how the data can be collected from the system. The producing party should request specific confirmation of the preservation activities from the non-party host, including the suspension of any auto-delete or data purging cycles. The producing party may properly insist on interviewing appropriate personnel at the non-party hosting location. How the non-party hosted ESI will be produced is subject to the same issues that the producing party faces during collection, review, and production. However, in addition to the usual issues, there may be additional concerns related to costs incurred by the non-party hosting entity and protection of proprietary information that belongs to the non-party. Regarding cost, the issue may be addressed under the contract between the producing party and the non-party. If there is no prior agreement, it will be necessary for the producing party to negotiate with the non-party regarding reasonable compensation for what may be a substantial burden, depending on the circumstances. Courts are sympathetic to the rights of non-parties and will expect the parties to a matter to minimize the burdens imposed on non-parties. On the other hand, courts will expect entities that are hosting a party’s information as part of their business model to have anticipated the requirement to produce party-related information. One approach is for the hosting entity to turn over relevant ESI to the producing party in what is known as a “raw” state – that is without processing or review -- and permit the producing party to process, review, and produce the ESI at its own expense. This approach may not always be practicable. For example, the non-party hosting entity may need to protect its own proprietary information from production if it is intermixed with ESI that belongs to the producing party. When this occurs, the non- party hosting entity may incur significant expense and burden in reviewing and producing only the producing party’s material. PAGE 15 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists Third-party information: When a third party has no contractual or ongoing relationship with the responding party, the situation is more complicated. Federal Rule of Civil Procedure 45 (and state corollary rules that largely mirror Rule 45) governs this situation by empowering attorneys to obtain information through subpoena. There may be significant differences between federal and state rules and among various states. An attorney who is knowledgeable about the law of the jurisdiction in question should be consulted to ensure that no error is made in issuing, serving, and responding to the subpoena. As such, an attorney must be involved in obtaining third party information from a non-party. The non-party recipient of a subpoena must assess the subpoena’s validity and decide how to respond. It is possible to serve objections to the subpoena and/or seek court relief. As discussed in the Hosted Information section above, courts are known to be sympathetic to claims by non-parties that they are being asked to do more than is reasonable for an entity not actually involved in the lawsuit. Although a Rule 45 subpoena is issued at the direction of an attorney, it carries the same weight as a court order and requires the served non-party to prudently and timely respond to the subpoena and address ESI issues that arise exactly as it would if it were a party to the case. As with party related discovery issues, the process of obtaining third-party information is usually a matter of negotiation. Both sides need to be mindful of Federal or State rule requirements for the issuance of and response or objection to subpoenas. Once the formalities are out of the way, we find that the most effective approach is to discuss the issues and try to reach a reasonable agreement. Those discussions should include the precise scope of the requested ESI, the manner and format in which the requested data will be produced or provided, and who will bear the costs of the work necessary to produce or provide the requested data. Courts are likely to shift the costs of burdensome e-discovery requests from non-parties to the parties in the matter. This dynamic should cause the party issuing the subpoena to be focused and specific regarding the data sought. Frequently, however, the party issuing the subpoena knows little about the non-party company’s computer and data systems, and risks drafting a broad subpoena. The scope of subpoenas is often greatly reduced once informed attorneys begin a dialogue that includes representatives from the responding non-party IT team or specialists familiar with the systems that store the discovery in question. As a last resort, either the party or the non-party may seek court intervention and relief if it believes the demands of the other side are unreasonable. RULE 502: INADVERTENT PRODUCTION AND THE WAIVER OF PRIVILEGE It has been well-recognized by courts and practitioners in recent years that the increasing volume of ESI, as well as the less formal methods of communicating with lawyers (i.e., through email rather than formal memos) make it virtually impossible to successfully screen from production every item that is protected by the attorney-client privilege, work product doctrine, or other type of privilege. As a result, whether through inaccurate identification in review or by virtue of cost-saving steps to produce materials without a comprehensive privilege review, parties routinely produce privilege-protected documents. Parties have come up with a variety of ways to address this problem, and both the 2006 and 2015 revisions to the FRCP explicitly incorporated some of these methods. In 2015, the Federal Rules of Civil Procedure were amended to address the inadvertent production of privileged material. This followed the addition, in 2008, of Rule 502 of the Federal Rule of Evidence (“FRE”), which explicitly deals with the waiver of privilege between the attorney and client when privileged materials are produced. PAGE 16 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists There are two primary means of protecting against a claim of privilege waiver through inadvertent production. The first is a “quick peek” agreement, and the second is a clawback provision. The quick peek involves an agreement between the parties that documents will be produced without review, that the requesting party may review them and select the documents it wants produced, and that the producing party will then review those selected documents to ensure that any material containing privileged or work product information are withheld. There are obvious flaws with this system, including that once opposing parties have seen privileged material, it is impossible to unsee it. The opponent has seen the privileged content and, even without using the documents themselves, may—consciously or not—make use of that information. Requesting parties may also resist the quick peek approach because it puts the burden and expense on them to find the relevant material mixed in with the irrelevant material, which is usually the producing party’s responsibility. In cases involving more than a very small volume of ESI, locating responsive ESI is a big undertaking and typically one of the greatest expenses during discovery. Nevertheless, the rules recognize the quick peek as one possible avenue for protecting privilege and may be worth considering in the right circumstances. Clawback agreements are much more common. These provide that each party will take reasonable steps to locate and withhold protected material, but that inadvertent production will not constitute a waiver. Each party is permitted to identify material that it has inadvertently produced and ask that it be returned or destroyed by the opposing party; each party agrees to comply with that request and not make a claim of waiver. These agreements are typically incorporated into the protective order entered by the court early in the litigation, thereby gaining court approval of the process in case there are disagreements. Note, however, that a party seeking to rely on a clawback agreement must (1) take reasonable steps to prevent inadvertent productions, and (2) upon discovery, act promptly to invoke the clawback typically within a defined window of time as defined by the protective order. Failure to take either step may preclude the party from relying on the clawback agreement. FRE 502 was designed to provide further reassurance for parties dealing with the problem of inadvertent waiver. Prior to the existence of the rule, it was argued, sometimes successfully, that even though the parties agreed that no waiver occurred in their case through inadvertent production, that agreement did not extend to other parties in other proceedings and that a later court might find a waiver. It was also possible for parties to argue that waiving privilege on a single document constituted a waiver for all other documents on the same subject (called “subject matter waiver”) which would then be required to be produced. FRE 502 has the following basic provisions: There is no subject matter waiver through inadvertent production of otherwise privileged material; a waiver, if it occurs, is limited to the actual material produced. There is no waiver of the privilege if reasonable steps are taken to identify privileged content and withhold it, and if the producing party makes the request to return or destroy the material promptly upon discovering it has been produced. Any conflict between federal and state law on this issue is resolved in favor of the rule that provides for the greatest protection of privilege claims. The parties may mutually agree that no waiver will occur through inadvertent production. This agreement will be binding only on the parties unless it is incorporated into a court order, in which case it will have wider effect. PAGE 17 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists Rule 502 rule applies even if the case is decided under state law and is also controlling in federal- annexed arbitration proceedings, thereby granting the widest possible protection to litigants. In order to make the greatest possible use of the protections afforded by FRE 502, parties should reach agreement on a clawback provision and ask the court to incorporate that agreement into a court order. They must also take steps to review material for privileged content and withhold that material when it is identified. CONCLUSION The legal framework that governs the e-discovery process may seem like a lot of legal rules and legal procedures to those not trained in the law. Although it is not necessary that you have a law degree or be able to recite the FRCP verbatim, it is important for practitioners to understand the legal context and framework for the work that is involved in e-discovery. For lawyers, this should be a refresher of the civil procedure classes taken in law school; for non-lawyers, this may be more difficult but still of great importance. PAGE 18 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists CHAPTER 2 UNDERSTANDING TECHNLOLOGY AND SOURCES OF ESI As technology evolves and the available tools change, it is imperative all e-discovery professionals understand how hardware and software interact with electronically stored information (ESI). Basic understanding of network systems, computers, file and data management, data storage and the many sources of potentially relevant ESI is critical to providing competent professional services in e-discovery. This section will examine different technologies, the typical sources of ESI, and best practices for handling them in e-discovery projects. SHARED NETWORK RESOURCES - FILE SERVERS In nearly every modern office, in addition to or instead of local storage of files on laptops or desktop computers, one will expect to find shared resources, including file servers or network storage, which may be accessed by multiple users within an organization. A proper ESI preservation and collection effort must consider these shared resources for each client and custodian. A file server is a repository of files, including documents, that exists to store and manage access to those files. File servers are just other computers that contain a hard drive, operating system, and (typically) large storage spaces (or connected network storage). File servers also provide networking capabilities so that a user, connected to the network through a “client” desktop computer, laptop or mobile devices, may access the files and applications residing on the network. A file server provides users access to documents upon demand and can share resources, like printers, among many users. File servers are the heart of any client-server network. They are typically computers equipped with very fast and often redundant storage devices that allow data to be shared among many other servers and/ or workstations throughout a network. A single server can perform a variety of tasks. Businesses tend to dedicate servers to functions, such as storing user data, running applications like databases, delivering web content, managing printing, routing Internet traffic, and handling email stores. Networks connect other devices, too. There may be an application server that runs an organization’s software applications, or one or more print servers sharing network printers. Scanners, copiers, fax machines, telephone systems—all can connect via a network. Shared network resources, then, are file servers or other data and applications that are accessed via interconnected computers and devices. A typical network environment will have one or more file servers from which ESI may need to be collected for discovery. File servers usually contain the most common electronic documents created by users, such PAGE 19 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists as Microsoft Word, Excel, and PowerPoint, Adobe PDF, or WordPerfect files. These files may be stored in an unstructured manner within a dedicated location on the hard drive of the file server, or in a series of Windows directories or folders. They might also be organized and accessible via a Document Management System (DMS), such as iManage, DocsOpen, FileSite, or SharePoint. A DMS will add a layer of complexity to the collection of ESI on a file server because most DMS’ store metadata about the documents on the file server, including a unique document number, version number, and names of network users who have accessed the document. File servers also contain structured or unstructured data used by a wide variety of applications. Database systems for accounting, human resources, sales and inventory, or client relationship management hold data in tables created by, e.g., Microsoft SQL or Oracle. Alone, these data tables are not very useful, but when connected to a so-called “relational database,” they support detailed payroll or sales reports, customer lists, and the like. Common in today’s cloud-based and web-hosted infrastructure environments is the use of virtual servers. A virtual file server functions like a stand-alone, dedicated or physical file server, but a virtual server is a partition of a much larger operating system and data storage environment that enables multiple servers to exist and run on the same physical hardware. Virtual servers share software resources, like operating system functions, random access memory (RAM), and processing capacity. Virtual servers are more cost-effective and easier to maintain than physical servers. There are two ways to collect data from a file server. A forensic collection obtains a bit-by-bit copy of a storage device. It collects every file on a server, copying and preserving all metadata associated with the files, as well as other, non-active data on the hard drives, such as slack space and areas containing deleted or partially overwritten files. This can be expensive, and can amass vast amounts of data, much of which may not be needed for the case. A targeted acquisition will focus on identifying and collecting only active user-created files and may be limited to only specified file types, date ranges, or files held by specific custodians or departments within the organization. Using either approach, steps must be taken to prevent altering the file and its system and application metadata during collection. The approach employed should also support verification of the collection process such as by ensuring that the hash values of the original files match the hash values of the acquired copies. Hash values are numeric values of a fixed length that uniquely identify a file or data source. They are effectively the digital fingerprint of a file. It is important to understand how shared resources function in a network environment. For example, when a document is deleted from a file server, it is not necessarily gone. Typically, the file name is removed from the file table or moved to a recycle bin, but the file itself may still reside in the unallocated space, which is the “free space” on the hard drive where new files may be stored. The file may remain on the hard drive until such time as all the space on the hard drive is overwritten. The point is that delete does not always mean deleted—at least not when it comes to traditional hard drive storage. It may occasionally be necessary to locate files that have been deleted. Newer, solid state drives have become more popular today. They are more durable because they have fewer moving parts, greater resistance to shock and they generate less heat. Because they rely on Flash memory technology, solid state drives are also faster and store data more densely, making it easier to access files. But unlike typical optical disk storage described above, solid state drives do not have unallocated space. When a file is deleted from a solid-state drive, it is generally deleted immediately and permanently. PAGE 20 | ACEDS.ORG © 2020 Association Of Certified E-Discovery Specialists Practitioners must also understand how network file shares are mapped, who has access to which file shares, and what potentially relevant evidence may be derived from them. File shares in a server environment are storage locations or partitions identified typically at the root level of the server. The operating system in use is also Important because different operating systems deal with data and networking differently. The Windows operating system might leave artifacts that will show a file path and local storage location; Linux, Unix, or MAC operating systems may not. Whether or not a file server(s) should be forensically preserved depends on the nature of the investigation. In criminal, quasi-criminal (e.g., anti-trust), or fraud cases, always consider forensic preservation. High stakes patent litigation may also justify the time and expense of forensic preservation. If extracting deleted information or needing to identify when an event, log, intrusion, or other time-critical event took pl

CEDS Certification Exam Preparation Manual 2020 PDF

Document Details

Tags

Related

Summary

Full Transcript

Upgrade to continue