E-Discovery Protocol - Federal Court

In a recent decision by the Federal District Court for the District of Columbia, in D’Onofrio v. SFX Sports Group, Inc., 2008 WL 4737202, Civ. A. No. 06-687 (JDB/JMF) (D.D.C. Oct. 29, 2008), the Court articulated its own e-Discovery protocol to resolve a dispute between the Plaintiff (a former employee of the Defendant) and the Defendant, SFX Sports, a subsidiary of Clear Channel Communications, Inc.  In this gender discrimination case, the Court took the unusual step of creating the Court’s own e-Discovery protocol.  The Court elected to create this e-Discovery protocol out of frustration with Plaintiff and Defendant attorneys.

(This opinion is the second significant e-Discovery opinion in this gender discrimination case.  The first opinion by the same Judge is found in D’Onofrio v. SFX Sports Group, Inc., 2008 WL 189842, Civ. A. No. 06-687 (JDB/JMF) (D.D.C. Jan. 23, 2008). [1]

At the time of the Court’s opinion, there appeared to be some deficiencies with the parties’ e-Discovery process. The Defendant’s response to the Plaintiff’s request for production of relevant electronic materials was potentially inadequate.  This offers both a cautionary note to practitioners and background to this Case:

• Defendant’s counsel failed to appropriately implement a litigation hold.  The Defendant’s CFO (the de-facto head of IT) was first asked to make a copy of the Plaintiff’s files on the Defendant’s server in March of 2008, two years after Plaintiff notified Clear Channel Communications (the parent company of the Defendant) that she intended to file suit;

• Defendant’s initial searches of electronically stored information were too restrictive to find all categories of responsive material requested by the Plaintiff;

• Defendant’s counsel proposed protocol was “highly technical,” very restrictive, relied on undefined “buzz words” and did not clearly articulate a process whereby responsive materials could be easily identified; and

• The Defendant’s CFO (and technical expert), apparently decided on his own initiative to scrap the Plaintiff’s computer after the he decided that it could not be used to search for items requested by the Plaintiff.

After the forensic expert in this case has conducted a forensic analysis of the Defendant’s servers, sanctions may become an issue to the extent to which electronically stored information has been lost due to the Defendant’s action (or inaction).

This case is especially instructive because the Court in this case provides a framework of the protocol that it finds to be a comprehensive e-Discovery protocol.  The protocol (in summary) included twelve key topics.

I. Items to be searched and scope of search.

The Court after hearing arguments from both parties concluded that the scope of the search appropriately included all repositories of electronically stored data where any of the following might be found:

1. E-mails to or from Plaintiff including e-mails in which the Plaintiff’s name appears in the “cc” or “bcc” lines;
2. E-mails in which the Plaintiff’s name is mentioned;
3. Electronically stored information created by the Plaintiff;
4. Electronically stored information sent to the Plaintiff, whether sent to the Plaintiff directly or as one of the other recipients; or
5. Electronically stored information where the Plaintiff’s name appears (this could include her full name, her first name, last name or initials.)

II. Time Limitations.

The Plaintiff’s expert was permitted three days of access (12 hours each day) for each of the Defendant’s locations.

III. Persons Present.

Both the Plaintiff and Defendant agreed it would be permissible to have representatives of both parties present during the search process.  The Court also agreed.

IV. Credentials to Access the Relevant Systems.

The Defendants are not required to give credentials to the Plaintiff’s expert.  However, the Court required that the Defendant have a representative present during the searches who has full credentials to access all relevant systems and will assist Plaintiff with access to the system without qualification or obstruction.

V. Commands.

The Defendant’s Information Technology representative (“IT Representative”) will execute all system commands requested by Plaintiff’s expert and the Plaintiff’s expert shall observe the results of the commands when executed.

VI. Production.

The production step, in this instance, pertains with how to handle attorney-client or work product privileges for material found during the secondary search.

The Court took the position that the Plaintiff’s expert is functioning as a “quasi-judicial officer” who will being making a complete copy of the results of his (the expert’s) search available to the Court for an in-camera review by duplicating the results on a DVD that will be filed under seal in the docket of the case.

Second, the Plaintiff’s expert, functioning in as a “quasi-judicial-officer”, shall also be required to make a second DVD containing the search results available to the Defendant’s counsel.  Defendant’s counsel will be provided no more than three weeks to examine those results and file, in accordance with Rule 26 of the Federal Rules of Civil Procedure, a privilege log, raising specific only claims, where privilege is applicable to any electronically stored information that is on the DVD.  The Court, citing Victor Stanley, Inc. v. Creative Pipe, Inc. , 250 F.R.D. 251, 263-67 (D.Md.2008), warned that only the most specific claims of privilege possible will be considered.  All other claims will be deemed waived.

VII. System Overview.

The Court required that the Defendant provide any and all material necessary for the Plaintiff’s expert to identify relevant information repositories and collect said data.  The Court also noted that it expected the Defendants’ representatives to provide the Plaintiff’s expert with a comprehensive explanation of how the system works, what searches it is capable of running, and how the results of those searches will be produced.

VIII. Prior Searches.

The Court required that the old searches be rerun to establish the effectiveness and consistency of the searches previously run by the Defendants.  Based on this protocol specification, it is not clear whether the Court feels comfortable with the accuracy of the searches run by Defendant.

IX. New Searches.

The Court did not comment on the content of the new searches per se within its protocol, but rather focused on the effect of the new searches.  First, the Defendant was permitted the right to object to any search if the Defendant’s technical lead believes the search would negatively impact the Defendant’s information systems; however, the Court was careful to point out that this type of analysis should normally be done in the off hours to minimize the possibility of such an issue.

X. Imaging.

The Court’s protocol highlighted the importance of imaging a hard-drive and/or server prior to examination.  (Based on the Court’s opinion there seems to be some ambiguity as to the applicability of mirror imaging to servers versus the less onerous forensically sound copy that preserves a server’s files and the associated metadata.  The physical imaging of servers usually involves acquisition of many physical volumes (drives) that have been configured in an array of some format (typically RAID 0,1, 5, 6, 10); the analysis of such images once obtained is difficult considering the probability of recovering previously deleted files.)  The Court’s protocol called for a mirror image of the relevant computers to preserve the computer’s memory at the moment of the search and that this mirror image is then searched instead of using the source computer directly.  The Court noted two advantages to this method: (i) it relieves the investigators (and the subjects of investigation) of the burden of removing the computer from the premises and (ii) it prevents any later claim that the search of the computer itself destroyed some portion of contents.  The Court noted that both parties did not disagree on the issue of not needing to image the Defendant’s backup server (Legato server). A Legato is a backup application that performs disk-to-disk backup.  Restoration from a Legato backup server from an image is not typical.  For one reason, the data is encrypted using a 256 AES encryption algorithm.  (See http://www.emc.com/collateral/software/data-sheet/h2257-networker-ds.pdf for a general background on EMC’s Legato backup solutions.)  Unlike servers, desktops, and other similar computing devices the ease of access combined with the longer half-life of deleted data makes forensic images much more practical.  However, encrypted images from a Legato backup server (as well as hard-ware encrypted hard-drives within a Desktop) would be much less useful.

XI. Email Restores.

In this case, the Defendant had run a previous search that did not yield complete results. Accordingly, the Court with respect to the protocol it created focused on “new searches” as discussed above.  The Court required the Defendant (the producing party): (i) to restore the items during the search, where necessary to render the electronically stored information “reasonably usable,” “capable of being read on a computer using either commonly available word processing software, such as Word or Word Perfect, e-mail software such as Outlook or Lotus Notes, or Abode Acrobat Reader and without the necessity of having to buy other software because only that software renders the restored e-mail”; and (ii) that new search results, after restoration, must contain metadata for the restored e-mails.

XII. Cost.

The presumption under the Federal Rules of Civil Procedure is that the producing party bears the costs of complying with a discovery request. Peskoff v. Faber , 251 F.R.D. 59, 61 (D.D.C.2008) (citing Oppenheimer Fund, Inc. v. Sanders , 437 U.S. 340, 358 (1978) ). However, the Court may shift a portion of the costs to the requesting party in the event that the discovery request would unduly burden the producing party. Id.  In this instance, the Defendant offered to pay $10,000; the e-Discovery expert did not provide the Court a budget, but indicated that if the fee for the examination of the Defendant’s computer system would exceed this the Court would consider how to allocate those costs.