ESI is More Than Email

The case of Emergency Response Specialists, Inc., v CSA Ocean Scis., Inc., is an excellent example of the challenges in civil litigation. The case is from Alabama that highlights the many types of ESI that can be relevant in a case. It also highlights the importance of collection experts and phone passwords.

The first relevant opinion is by Magistrate Judge Harwell Davis, III. See, Emergency Response Specialists, Inc. v. CSA Ocean Scis., Inc. (N.D.Ala. Aug. 4, 2016, No. 2:14-cv-02214-WMA) 2016 U.S. Dist. LEXIS 113221 (Hereafter ERS 1). The second is by District Court Judge R. David Proctor, who adopted and accepted Judge Davis’ recommendations. See, (Emergency Response Specialists, Inc. v. CSA Ocean Scis., Inc. (N.D.Ala. Aug. 23, 2016, No. 2:14-cv-02214-RDP) 2016 U.S. Dist. LEXIS 112639 (Hereafter ERS 2).

Judge Davis explained that the Defendant’s president and majority shareholder had a computer crash that corrupted her email production. ERS 1, at *3. The Defendant used the recovery software from the server company to attempt to recover her messages. Id. The Plaintiffs sought the email in native format. The Defendant claimed the recovered email was all that was available. This was very problematic, as the parent-child relationship between the email and attachments was broken. Moreover, the Defendant explained that if the Plaintiff looked at the email threads, they could determine who was the sender of the emails and the dates each message was sent. Id.

The Plaintiff was allowed to review the email production to determine if the messages could be put in chronological order with senders and recipients.

The Defendant was ordered to produce any other unique emails with attachments if they existed on her Defendant’s laptop. ERS 1, at *3-4. The Court ordered the Defendant to also produce text messages and video files. The text messages introduced a common wrinkle with smartphones: what is the phone password?

The context of the case made it appear that a former employee needed to provide his password to his former work phone in the possession of his former employer. ERS 1, at *4-5. Judge Proctor ordered the former employee to cooperate in providing password. ERS 2, at *2. The Court informed counsel that if the former employee refused to cooperate, to report that to the Court, so the Court could further order the former employee’s cooperation. Id.

There are many lessons from this case. The first is the collection of data in a defensible manner. It is wise to avoid having a party turn themselves into a collection expert. While it is entirely possible the Defendant properly used the recovery software, it would likely be less stressful on the party and counsel to have a computer forensic expert attempt to restore the data. It is likely forensic software would have greater options to recover data than server software. This is highly dependent on what caused the crashed, however, if email and attachments could be recovered, that could reduce the need for motion practice.

The other lesson is there are many forms of potentially relevant ESI. Video files can easily be overlooked in a case. Asking a client effective interview questions, and a meaningful meet and confer between attorneys, can help identify the possible types of relevant ESI in a case. The final lesson is passwords on work issued phones. A service provider might have software that can crack a password. Alternatively, requiring this information when an employee leaves a company could also reduce this pain point.

My colleague Ben Rose will analyze the computer forensic issues from this case in our next blog post.

There is More to ESI Besides Email Messages

The case of Emergency Response Specialists, Inc., v CSA Ocean Scis., Inc., is an excellent example of the challenges in civil litigation. The case is from Alabama that highlights the different types of ESI that can be relevant in a case. The case also highlights the importance of retaining collection experts and knowing phone passwords.

The first relevant opinion is by Magistrate Judge Harwell Davis, III. See, Emergency Response Specialists, Inc. v. CSA Ocean Scis., Inc. (N.D.Ala. Aug. 4, 2016, No. 2:14-cv-02214-WMA) 2016 U.S. Dist. LEXIS 113221 (Hereafter ERS 1). The second is by District Court Judge R. David Proctor, who adopted and accepted Judge Davis’ recommendations. See, (Emergency Response Specialists, Inc. v. CSA Ocean Scis., Inc. (N.D.Ala. Aug. 23, 2016, No. 2:14-cv-02214-RDP) 2016 U.S. Dist. LEXIS 112639 (Hereafter ERS 2).

Judge Davis explained that the Defendant’s president and majority shareholder had a computer crash that corrupted her email production. ERS 1, at *3. The Defendant used the recovery software from the server company in an attempt to recover her messages. Id. The Plaintiffs sought the email in native format. The Defendant claimed the recovered email was all that was available. This was very problematic, as the parent-child relationship between the email and attachments were broken. Moreover, the Defendant explained that if the Plaintiff looked at the email threads, they could determine who was the sender of the emails and the dates each message was sent. Id. As such, the Court gave the Plaintiff the opportunity to review the email production to determine if the messages could be put in chronological order with senders and recipients. Id.

The Court ordered the Defendant to produce any other unique emails with attachments if they existed on her Defendant’s laptop.ERS 1, at *3-4. The Defendant was also ordered to produce text messages and video files that were responsive to discovery requests. The text messages introduced a common wrinkle with smartphones: what is the phone password?

The context of the case made it appear that a former employee needed to provide his password for his former work phone, which was in the possession of his former employer, in order to recover the text messages on the device. ERS 1, at *4-5. Judge Proctor ordered the former employee to cooperate in providing password to the Defendant. ERS 2, at *2. The Court informed counsel that if the former employee refused to provide his password, to report that to the Court, so the Court could further order the former employee’s cooperation in recovering the text messages. Id.

There are many lessons from this case. The first is the collection of data in a defensible manner. It is wise to avoid having a party turn themselves into a collection expert. While it is entirely possible the Defendant properly used the recovery software, it would likely be less stressful on the party and counsel to have a computer forensic expert attempt to restore the data. It is likely forensic software would have greater options to recover data than server software. This is highly dependent on what caused the crashed, however, if email and attachments could be recovered, that could reduce the need for motion practice.

The other lesson is there are many forms of potentially relevant ESI. Video files can easily be overlooked in a case. Asking a client effective interview questions, and a meaningful meet and confer between attorneys can help identify the possible types of relevant ESI in a case. The final lesson is passwords on work issued phones. A service provider might have software that can crack a password. Alternatively, requiring this information when an employee leaves a company could also reduce this pain point.

Best Practices for the Collection of ESI

McGibney v. Retzlaff is a Federal case in the Northern District of California. Judge Beth Labson Freeman heard the Defendant’s Motion to Dismiss for Lack of Personal Jurisdiction. Her initial comment was “this case sees the Internet at is worst.” See, McGibney v. Retzlaff, No. 14-cv-01059-BLF, 2015 U.S. Dist. LEXIS 79434 (N.D. Cal. June 18, 2015).

I see a much different issue in this case. The identification of potentially relevant ESI is sorely lacking. The Court was informed about harassment via Internet postings on Twitter, Facebook, and a blog. The Plaintiff asserted that the Defendant used many aliases on these social media platforms, as well as with email.

Preservation and collection of data should occur once potentially relevant ESI is identified. There was no reference in the opinion that listed the Plaintiff’s efforts to preserve the relevant electronically stored information. We see these issues time and again. Here are our recommendations to acquire relevant ESI:

1. Propound Discovery upon the social media providers. The Stored Communication Act generally prohibits the production of stored content without a search warrant or government subpoena. However, those who receive a Discovery Request can identify subscriber information and account login information. Subscriber information may be anonymous, though at times will provide a lead to develop further, such as the IP Address that may be resolved to a specific Internet Service Provider. People are creatures of habit and may use the same username with their ISP, as they do with their social media account(s).

2. Email tracing and serving Discovery upon hosting providers. Email is a transitory medium that contains valuable metadata within the email “header.” Email servers and IP addresses may be identified, as well as accurate (and sometimes obfuscated) email addresses. In the case of Google, the Gmail username refers to the whole account. Again, these are leads to be explored.

3. Preservation notices. These communications should include as much specific information as possible, including account names and date ranges. Time is also of the essence. The opposing party and the third-party who hosts the content should be put on notice, although third parties will be held to a somewhat lower standard in many cases. Nonetheless, a recipient’s obligations and the propounding party’s expectations should be clearly identified.

4. ESI Collection. Social media and email collections should conform to industry standards for the handling of digital evidence. Methods should be defensible and repeatable, and qualified individuals should perform these tasks. Certain software solutions should be used to eliminate the alteration of evidence and its metadata, thereby reducing the potential for spoliation. Also, declarations should be submitted, when necessary, to reduce the risk of inadmissibility for key evidence.