An Open Door Gives Away The Secret, But Rule 502 Attracts It Back

March 31, 2009

Pyramid at Night with the All Seeing Eye branded with the latest nonsenseA new case involving the movie The Secret provides excellent analysis of new Evidence Rule 502 while at the same time taking irony to new heights. Heriot v. Byrne, 2009 WL 742769 (N.D. Ill. March 20, 2009).

I do not normally write a blog in the middle of the week, but the sarcastic potential and ironies in Heriot v. Byrne are just too much to resist – sleep can wait. The Law of Attraction compels this exposé. Consider the facts. This is a law suit about a movie called The Secret, where one of the corporate defendants is named The Secret, LLC. All of the parties in this law suit were somehow involved in the conception and making of The Secret. The movie was a huge New Age success. The exalted spiritual masters who conceived and produced The Secret did so, or so they say, to share the secret of the ages as to how to attract success and happiness in your life.

Well, now the real secret is out, these special masters have indeed attracted what they deserve, they have attracted lawyers and fights over money. The plaintiffs claim to own part of The Secret. The defendants deny that and have filed counter-claims of their own. The plaintiffs’ primary goal seems to be their accounting claims where they are trying to find out how much money The Secret has made, which, so far, the defendants have kept secret.

But wait, there’s still more secrets. The defendants accidentally received some of the plaintiffs secret emails to their attorney. They received these secrets because the plaintiffs’ e-discovery vendor made a mistake. The named of the vendor is Open Door Solutions. You cannot make this stuff up. If this were a movie, you would not believe it, which, by the way, appears to have been the judge’s reaction to the movie, but we will get to that in a minute.

Back to the open-door disclosure of the plaintiffs’ secret attorney communications. When these secrets were accidentally disclosed to defense counsel, they denied that they were secrets at all. Alternatively, they said that even if they were once secrets, they were no longer secrets, because the secrets were revealed. They argued that the disclosure of the secrets by handing them over to opposing counsel waived any attorney client privilege that these secrets might have once enjoyed.

Plaintiffs tried to protect their secrets by relying on new Evidence Rule 502. It protects attorney-client secrets and requires clawback of inadvertently disclosed secrets if certain conditions are met. Defendants denied clawback and the applicability of Rule 502. Defendants claimed that the plaintiffs’ disclosure of secrets was not inadvertent. Even if the disclosure was inadvertent, defendants argued that Rule 502 should still not protect the secrets because it only protects secrets where reasonable steps to prevent disclosure were taken. The claimed that the way-too-open-door handling of plaintiffs’ alleged secrets was negligent and thus not protected by Rule 502. Finally, they argued that even if these secrets were protected by Rule 502, they should still be allowed to tell these secrets, and not give them back, because of the crime-fraud exception to the attorney-client privilege. That is the rule where a client cannot keep secret any communications he may have with his attorneys about a crime or fraud that he may commit in the future. (Confidential communications about past crimes and fraud committed in the past can, however, be kept secret.)

Secret Shh!So to summarize, open door mistakes led to a battle between the masters of The Secret over the attorney-client secrets of a man who claimed to own part of The Secret and wanted its secret profits disclosed. The defendants, purported sole owners of The Secret, including  one called The Secret, LLC., wanted to keep their profits secret, but disclose the plaintiffs’ secrets, claiming they were not secrets at all, or if they were, they were bad secrets not entitled to secrecy, or they were waived by a way-too-open door handling of the secrets. (Try saying that real fast.)

Magistrate Judge Martin C. Ashman attracted to himself the task of sorting out this tangled web. As mentioned, Judge Ashman was not too impressed by the movie The Secret, as he begins his opinion by noting:

This case involves a controversy over The Secret, a made-for-television documentary that purports to reveal the “most powerful law in the universe.” The Secret, http://www.thesecret.tv/ (last visited Mar. 17, 2009). As if that declaration was not grandiose enough, the website further claims that, “[b]y applying the knowledge of this law, you can change every aspect of your life.”  

Although Judge Ashman did not think The Secret the parties had created was much of a secret, he did think the plaintiff’s secrets were bona fide and entitled to protection. He upheld the attorney-client privilege by applying Evidence Rule 502. He held that the open-door disclosure was a mistake, and happened in spite of the reasonable steps to prevent disclosure that had been instituted by plaintiff’s attorneys. For that reason, Judge Ashman enforced the clawback provisions of Rule 502 and required that the defendants, including The Secret, LLC., to keep the plaintiffs’ secrets secret.

Factual and Procedural Background

Open Door

This saga of secrets began innocently enough with the defendants’ request for production, including  “[a]ll documents relating to United States visa applications filed by or on behalf of Heriot.” The plaintiff, Drew Heriot, happens to be a citizen of Australia, as are most of the other parties to this action.

Since all documents these days are created electronically, this triggered e-discovery, which in turn triggered the attorneys for Heriot to seek the help of an e-discovery vendor, the mentioned Open Door Solutions. Open Door provided electronic scanning, optical character recognition, and other discovery related services.  Here is the court’s description of the process which Open Door (here called the “Vendor”) and Heriot’s attorneys set up for this production:

First, the Vendor created a database of the documents provided to it by Plaintiffs (“Master Database”), which Plaintiffs then could review. (Id. at 3-4.) Second, during April and May of 2008, Plaintiffs “had paralegals and other non-lawyers conduct a preliminary review [of] the documents in the Master Database,” assigning documents “general, pretrial discovery codes.” (Id. at 4.) One general code was “immigration,” which Plaintiffs “used to flag documents (primarily e[-]mails) that had anything to do with Mr. Heriot’s immigration to the United States.”(Id.) (Editors note: the misspelling of “immigration” in the Westlaw transcription was corrected as an obvious error.)

Third, Plaintiffs searched for responsive documents in their Master Database. (Id.) Fourth, once identified, these responsive documents would be “coded for subsequent copying and inclusion in the Production Database.” (Id.) Additionally, Plaintiffs would mark responsive documents “as either Confidential or Highly Confidential under the Stipulated Protective Order.”

Id. at *2. 

This is a pretty standard plan of action, except that I do not see privilege review and logging specifically mentioned.  To comply with the discovery request regarding Heriot’s immigration visa, plaintiffs requested and received a paper copy of the visa file from Heriot’s immigration lawyer. Next, plaintiffs gave the Heriot’s visa application to Open Door with instructions to:

(1) scan and add it to the Master Database, (2) copy the scanned versions to the Production Database, … (3) electronically stamp the application as ‘Highly Confidential’ for production[,] … [ (4) ] Bates Stamp all documents in the Production Database, and … [ (5) ] include Mr. Heriot’s visa application and other sensitive material at the front of the production.

Id. 

Now we come to the mistake of Open Door. (By the way, mistakes like this can and do happen to most everyone sooner or later, but seem to happen more often to some than to others.) Frankly, from the court’s limited description of the facts in the opinion, I cannot understand exactly what the vendor did wrong that supposedly blew the privilege review, but I gather it had to do with mixing the sensitive visa related materials in with the general database and not placing them in the front of the production for review as instructed. The vague description makes me more sympathetic towards Open Door and a little suspicious about the attorneys. All we know for sure is that mistakes were made here and secret emails were unintentionally produced.

On August 25, 2008, plaintiffs produced around 1,499 documents comprised of 6,952 pages. This is a pretty small production by today’s standards. Plaintiffs did not withhold any documents for privilege and so did not produce a privilege log. That does seem odd. Two months later, on October 22, 2008, plaintiffs counsel discovered the mistake in production while preparing for a deposition scheduled for October 24, 2008. The next day, October 23rd, they notified defense counsel of the inadvertent production and demanded the return and destruction of certain documents they claimed were privileged. The defense complied, but kept one copy for use to challenge the claimed privilege protection. The defendants then promptly filed a motion to compel production, including the challenged documents, which were filed under seal. The plaintiffs opposed that motion and filed their own unrelated motions to compel.

Legal Analysis on Waiver

Judge Ashman begins the legal analysis with the following overview of the law (citations omitted):

Ordinarily, disclosure of confidential information to an unprotected third party operates as a waiver.  Under FRE 502, however, disclosure of privileged information will not operate as a waiver when “(1) the disclosure is inadvertent; (2) the holder of the privilege or protection took reasonable steps to prevent disclosure; and (3) the holder promptly took reasonable steps to rectify the error, including (if applicable) following Federal Rule of Civil Procedure 26(b)(5)(B).” FED.R.EVID. 502(b)(1)-(3). All three elements described in FRE 502 must be satisfied to prevent a waiver. Id.

Id. at *5

Wave byeThe court then considered the issue of whether the new rule superseded prior federal common law concerning waiver of attorney-client privilege. The court basically said it did, unless the prior law (here Judson Atkinson Candies, Inc., v. Latini-Hohberger Dhimantec, 529 F.3d 371, 387-88 (7th Cir.2008)) was not conflicting. Here Judson was not conflicting (it was harmonious) and so the court used Judson to supplement its analysis and articulated the following test (footnote omitted):

This Court therefore adopts the following test. First, a court determines whether the disclosed material is privileged. If it is not, the inquiry ends. If the material is privileged, the court applies FRE 502(b). If the court concludes that disclosing party satisfied all of the elements in FRE 502(b), the privilege is not waived. If, however, the disclosing party fails to satisfy any of the FRE 502 elements, the privilege is waived. In applying FRE 502(b), the court is free to consider any or all of the five Judson factors, provided they are relevant, to evaluate whether each element of FRE 502(b) has been satisfied. This Court applies and explains the details of this test in the following sections.

Id. at *7. Judge Ashman then applied the test where he began by finding that most of the emails in question were privileged. The judge personally reviewed all of the emails and found they contained legal advice to Heriot from his immigration lawyer. A few emails included prior non-privileged communication with a third party. They were to be produced, but with redactions to protect the privileged part of the email chain. A few others had been sent to third parties and, as to them, no privilege was allowed. Id. at *8-*9.

Next the court addressed the Crime-Fraud Exception to the attorney-client privilege. Here is the court’s summary of this law:

Although communications subject to the attorney-client privilege are protected, that protection can be forfeited when, for example, “ ‘the attorney … assist[s] his client to commit a crime or a fraud.’ “ U.S. v. Al-Shahin, 474 F.3d 941, 946 (7th Cir.2007) (quoting Mattenson v. Baxter Healthcare Corp., 438 F.3d 763, 769 (7th Cir.2006)). In other words, “[t]he crime-fraud exception places communications made in furtherance of a crime or fraud outside the attorney-client privilege.” U.S. v. BDO Seidman, LLP, 492 F.3d 806, 818 (7th Cir.2007) (citing U.S. v. Zolin, 491 U.S. 554, 563, 109 S.Ct. 2619, 105 L.Ed.2d 469 (1989)).

Id. at *9. It turns out that the defendant’s arguments here were very weak and there was no basis for a claim of fraud in these emails between Heriot and his immigration attorney. 

Three Part Test of Rule 502(b)

Judge Ashman then moved on to consider whether the three requirements of FRE 502(b) were met wherein disclosure of privileged information will not operate as a waiver when:  

(1) the disclosure is inadvertent;

(2) the holder of the privilege or protection took reasonable steps to prevent disclosure; and

(3) the holder promptly took reasonable steps to rectify the error, including (if applicable) following Federal Rule of Civil Procedure 26(b)(5)(B).”

Rule 502(b)(1)-(3) Fed.R.Evid.

1. Inadvertence

Oops! Shit happens.The court put the burden of proof on the party claiming the privilege in accord with established case law. This is the way it should be. Judge Ashman then found that the first requirement had been met, that the disclosure had been inadvertent. This was the right result, but he labored way-too-hard to get there. In my opinion, it is hard to see how a disclosure like this could be anything but “inadvertent,” taking the normal common sense meaning of the word as “unintentional,” or “not attentive.” Defense counsel here argued in accord with case law that “inadvertent” meant something completely different, that inadvertent here means “not negligent.” The defendants main argument on this point was that the disclosure was “not-inadvertent” because, in their words “Plaintiffs’ counsel … [was] asleep at the switch.” Heriot v. Byrne, supra at *11. Judge Ashman went along with that argument, but then went to great lengths to show they were not quite as asleep as alleged and so the disclosure was inadvertent as required under the rule.

I think this misreads the rule by conflating all three criteria into the first one. This incorrectly resurrects somewhat contra case law that Rule 502 supersedes. Obviously plaintiffs’ counsel was “asleep at the switch” when the production was made and that is exactly what inadvertent means, not attentive or unintentional. For part one of Rule 502(b) three-part test, the party should only have to prove that the disclosure was not done on purpose, that it was a mistake.

Here Judge Ashman made a finding that the disclosure was inadvertent because a variety of factors were met indicating the mistake was understandable and prompt corrective action was taken. These facts are relevant to the second and third prongs of the rule, not the first prong of inadvertence. For that reason I think Judge Ashman made a harmless error in stating:

To determine whether a disclosure was inadvertent, “this Court has … look[ed] to factors such as the total number of documents reviewed, the procedures used to review the documents before they were produced, and the actions of producing party after discovering that the documents had been produced.” WunderlichMalech Sys., Inc. v. Eisenmann Corp. (Eisenmann II), No. 05-C-4343, 2007 WL 3086006, at *3 (N.D.Ill. Oct. 18, 2007) (citing Wunderlich-Malech Sys., Inc. v. Eisenmann Corp. (Eisenmann I), No. 05-C-4343, 2006 WL 3370700, at *3 (N.D.Ill. Nov. 17, 2006)). This Court can find no reason to discard these factors, which aptly address the issue of whether a party inadvertently disclosed confidential information.

Id. at *11. The plain language of the rule is good reason enough for me. The court should have disregarded these prior case law factors, at least in so far as the determination of  the “inadvertence” test is concerned. All a party should have to prove to meet the first part of the test is that the disclosure was not intentional. If someone intentionally made the disclosure, and then just changed their mind for some reason, like perhaps new counsel was retained, then you would fail the first test. But if the disclosure was a mistake, an unintentional accident, then according to the normal commonsense meaning of the word, it was inadvertent, and you move on to the next two steps. 

This is, by the way, the only mistake I see in this opinion, which undertakes the difficult task of interpreting and applying a new rule with very little prior case law. This is otherwise a well reasoned opinion demonstrating excellent scholarship. I just hope that the many future cases that are likely to cite this decision do not make the same mistake of conflating the three criteria in Rule 502(b).

2. Reasonable Steps to Prevent

bank-vaultThe next thing to be proved under the Rule is that “the holder of the privilege or protection took reasonable steps to prevent disclosure.” Now we get into the facts and circumstances incorrectly considered by Judge Ashby in the determination of the first step. The defendants here argued that it was unreasonable for plaintiffs not to review the ESI after it was readied for production. They made this argument, even though plaintiffs’ counsel they had already reviewed the email and other documents before they were delivered to the vendor, here Open Door, for final processing and production. The defendants’ position would require either a double review, or review only after processing by a vendor. Either alternative is not acceptable in most circumstances, although I for one do not like a vendor to make direct productions, and where possible would prefer to make a final quick overview myself before production, just to be sure obvious errors were not made. Judge Ashby wisely rejected defendants contention and held:

… a pre-copy review procedure is not per se unreasonable. The procedure used here-where Plaintiffs reviewed the documents and then provided them to the Vendor for production-was reasonable; no disclosure would have occurred but for the Vendor’s error. 

Id. at *14. Of course, had plaintiffs counsel made a quick inspection before turning over the CD, this error might well have been caught. But whether mistakes were made is not the issue. Of course mistakes were made, or the unintentional disclosure would not have occurred. The issue is whether there was a reasonable procedure in place. Here the judge said there was and I do not disagree.

3. Reasonable Steps to Rectify

The third and final test under Rule 502(b) is whether the party that made the unintentional disclosure “promptly took reasonable steps to rectify the error.” Here there was a two week gap between the time of the production and the time the disclosure was noticed. Plaintiffs notified defendants the very next day after the mistake was discovered, so the defendant had to argue that the two month delay was not prompt or reasonable. This means they had to argue for the necessity of a post-production review.  I know that some attorneys and judges contend this is the intent of Rule 502: that you have to look again at documents already produced to verify that you caught and logged all privileged documents; that to do otherwise is not reasonable and constitutes a violation of Procedure Rule 26(b)(5), which requires that all withheld privileged documents be logged. This same people are at a loss to explain the Rules Commentary that expressly states:

The rule does not require the producing party to engage in a post-production review to determine whether any protected communication or information has been produced by mistake.

I agree with Judge Ashman who held:

Plaintiffs had no duty to re-review the documents after providing them to the Vendor. Id. That would be duplicative, wasteful, and against the spirit of FRE 502. Additionally, imposing on disclosing parties a duty to re-review would chill the use of e-vendors, which parties commonly employ to comply with onerous electronic discovery. Against this grain the Court cannot cut.

Heriot v. Byrne supra at *13.

I think it is clear that Rule 502 does not require another review after production, just to make double-sure that a mistake was not made and privileged documents inadvertently disclosed. If your preproduction steps to prevent disclosure were reasonable, then you are done and should not have to do anything more to search for privileged documents. Your only remaining duty should be to rectify, if and when you happen to discover a mistake while doing something else, like in this case, reviewing documents to prepare for a deposition, or you are advised of the mistake by opposing counsel. Many times when the later happens, opposing counsel will cooperate and just notify you of the mistake and send it back. This is especially true in circumstances where the vendor or law firm make a big mistake, like mislabeling a CD and turning over information to the wrong party. This kind of thing can easily happen despite all kinds of reasonable precautions and good intentions. When it does, most opposing counsel are very polite about, as they should be, and they tell but don’t look. After all, we all know that “Where discovery is extensive, mistakes are inevitable ….” In re Sulfuric Acid Antitrust Litig., 235 F.R.D. 407, 417 (N.D. Ill. 2006), quoted with approval in Heriot at *11.

Conclusion

This case, much like the movie, shows just how much time and money can be wasted over a few garden variety secrets. The parties would have been much better off practicing what their movie preaches. Of course, if that were true, there would have been no lawsuit and these secrets of 502 would not have been revealed. At least, not in such an ironically attractive manner.


New 4th Circuit Ruling on Illegal e-Discovery Adds Teeth to Federal Anti-Hacker Email Privacy Law

March 29, 2009

Hacker - misguided IT experts, often extremely smart and immatureThe Fourth Circuit Court of Appeals has strengthened federal anti-hacker email privacy law by allowing a civil suit for punitive damages alone, even when there are no actual damages. Van Alstyne v. Electronic Scriptorium, _F.3d_, 2009 WL 692512 (4th Cir. March 18, 2009). The Court recognized that the intentional taking of email stored online was a violation of the  Stored Communications Act (“SCA”), 18 U.S.C. §2707, allowing a victim to sue for monetary damages to punish the hacker and deter such future conduct.

This is a significant advance in privacy protection law because previously, punitive damage awards under the SCA were not allowed without proof of actual damages. Id. at pg. 16. People Helpers Found., Inc. v. City of Richmond, 12 F.3d 1321, 1326 (4th Cir. 1993). This is in accord with the general rule that punitive damages are never allowed without proof of actual damages unless a statute expressly allows it. Id. The Court found such authority in the civil enforcement section of the SCA, which states:

If the violation is willful or intentional, the court may assess punitive damages.

18 U.S.C. §2707(c). This is the first time the SCA has been so interpreted by a Circuit Court of Appeals and the first time punitive damages, costs, and attorney fees for an SCA violation have been allowed without proof of damages.

It is a Crime to Hack Into an Online Email Account

The unauthorized access of an AOL account in Van Alstyne constituted a violation of the SCA, which is part of the Electronics Communications Privacy Act (“ECPA”), 18 U.S.C. §2510, et seq. As the opinion at page 8 explains:

Section 2701 of the SCA creates a criminal offense for whoever “intentionally accesses without authorization a facility through which an electronic communication service is provided” or “intentionally exceeds an authorization to access that facility,” and by doing so “obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system.” 18 U.S.C.A. §2701(a)(1-2).

As background, Bonnie Van Alstyne was employed as Director of Marketing for Electronic Scriptorium, a small data-conversion company. She claimed she was fired after rejecting sexual advances from the CEO, Edward Leonard. At that point, Leonard did a little self-help e-discovery (we presume without any assistance from his lawyer) and hacked into Van Alstyne’s AOL email account.

AOL's old logo modified to look sadThis AOL account, like any online email service, is considered ”a facility through which an electronic communication service is provided” covered by the SCA. Leonard had somehow discovered Van Alstyne’s AOL password. We are not told how he did that, but he could have lawfully discovered it by looking on company computers. Regardless, Van Alstyne had never authorized Leonard to access her AOL account. Leonard used her AOL user-name and password to read her email. We do not know all of the nefarious motives behind this invasion of privacy, but certainly one motive was to try and find something that he could use against Van Alstyne to defend the sexual harassment claims. He found a few emails he liked, downloaded them, and provided them to his lawyer. The lawyer in turn surprised Van Alstyne with these emails during her deposition.

The downloading of emails from Van Alstyne’s AOL account without authorization constituted “obtaining … a electronic communication while it is in electronic storage in such system” and thus a clear violation of the SCA was established. The Court held that if the SCA is intentionally violated, then punitive damages, costs, and fees can be awarded, even though no damages were caused by the taking of the electronic communication.

Court Requires Actual Damages to Trigger the Statutory Minimum

The Court did, however, draw the line at the automatic award of the minimum statutory damages of $1,000 per unauthorized access. It held that it is not permitted under the statute without proof of some damages. In so doing, it followed the Supreme Court in Doe v. Chao, 540 U.S. 614, 627 (2004). The Supreme Court in Doe considered nearly identical language in the Privacy Act, 5 U.S.C. §552a (g)(4), and held that the $1,000 minimum statutory damages award was available “only to plaintiffs who suffered some actual damages.”

The Fourth Circuit considered itself to be bound by Doe, but reportedly five district courts in five different circuits did not. They had previously held to the contrary that proof of actual damages was not required to receive the statutory minimum award under the SCA. For this reason, some consider Van Alstyne to be a setback for privacy law, and indeed it is, to a degree. Still, this is a slight setback and pales in comparison to a Circuit Court of Appeal allowing punitive damages under the SCA without proof of actual damages.

Here is the Court’s summary, at page 8, of the civil action of damages allowed under the SCA:

Section 2707 provides a private cause of action for “any . . . other person aggrieved” by a violation of § 2701. 18 U.S.C.A. §2707(a). Under § 2707, a district court may award equitable or declaratory relief, a reasonable attorney’s fee and other costs, and “damages under subsection (c).” 18 U.S.C.A. §2707(b). Subsection (c) provides:

The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000. If the violation is willful or intentional, the court may assess punitive damages. In the case of a successful action to enforce liability under this section, the court may assess the costs of the action, together with reasonable attorney fees determined by the court.

The Court rejected plaintiff’s arguments that the reference to a minimum award meant that you should receive $1,000 for every violation, even if there were no “actual damages.” I found the Court’s argument on that point persuasive and even forgetting Doe, which of course you cannot do, I do not see how five district courts were persuaded to rule to the contrary. If Congress had intended to allow a minimum statutory damage award absent proof of actual damages, it could easily have said so in the statute. For instance, The Wiretap Act, which like the SCA is found within the ECPA, does exactly that:

In any other action under this section, the court may assess as damages whichever is the greater of . . . the sum of the actual damages suffered by the plaintiff and any profits made by the violator . . . or . . . statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000.

18 U.S.C. §2520(c)(2). I would support an amendment to the Stored Communications Act to provide for an automatic award of damages in an amount even greater than $1,000 per violation, but regardless, we now have incentive enough from actual and punitive damages to sue to enforce this important law.

Lesson For Hackers: Computer Privacy Law Now Has More Teeth

Hacker animation

Although this case arises out of an employer context, and involves other claims of sexual discrimination and wrongful discharge (thus the search for her email), this is not really an employment case, but rather an individual privacy rights case. This decision strengthens the protection of the Electronics Communications Privacy Act by encouraging civil suits to enforce the SCA email protection segments of this law.

Since it is often difficult or impossible to prove actual damages from an invasion of email privacy, there is little encouragement for victims to sue under the Stored Communications Act if the suit requires proof of damages. Further, as Van Alstyne argues in this case, if you do try to prove damages, such as emotional distress, you often open yourself up to very invasive discovery of all aspects of your personal life. This is something that most people, including Van Alstyne, are unwilling to do. The net result is that the hacker often walks, undeterred from doing it again to the next victim.

If a person is just embarrassed and annoyed by the interception and theft of their email and other electronic messages, and they cannot easily prove actual hard dollar damages, they had no incentive to sue the perpetrator. (They might be able to get an injunction or declaration, but so what.) If you must prove actual damages, then the victim’s only real hope to try to punish and deter a computer hacker is though the criminal system. A victim could file a complaint and hope the prosecutor would bring criminal charges. But as a practical matter, unless money is involved, few prosecutors have the time, money, expertise, or inclination to prosecute such computer privacy cases. The reluctance to prosecute non-monetary hacker cases is especially true in situations such as in this case, where there is ongoing civil litigation between private parties.

Aside from cases where there are actual damages, such as credit card or medical information hacker cases, criminal prosecutions for breach of computer privacy alone are few are far between. The only exception is the high profile case, such as 2008 Republican Vice presidential candidate Sarah Palin, whose Yahoo email account was hacked into during the election. A college student accessed her email account by guessing the answers to her security questions, and then publicly bragged about it. You betcha he was tracked down and indicted under the SCA. But even there, the student has not yet been convicted and there may be problems with the SCA criminal case.

Sarah Palin

Although many people use online email, it is far from secure. It is all too too easy to discover a person’s online email account password and “hack” into their email or other cloud computing accounts, including social media accounts such as Facebook. The ease of such computer intrusion or hacking is shown by this case and the Sara Palin case. This is especially true if you know the person, or they are a public figure and you can guess their password security questions as the Palin case shows. It is also easy to do if you have access to the person’s work computer and can trace their Internet use history, something most employers today can do.

There are many other instances of email hacking going on today that you never hear about, particularly in divorce or harassment cases. Thanks to Van Alstyne, in the future you will to start to hear about this much more often. The Fourth Circuit has strengthened the rights of computer users to privacy by adding punitive damage teeth to the Stored Communications Act. Since cloud computing has now become so pervasive, this is an important decision for everyone’s privacy rights, including corporations at risk for having their own computers and email systems hacked. Hackers beware! You may not only go to jail, but be sued for punitive damages and fees by everyone you hack.

Apparently this change in the law may also help plaintiffs in class-actions cases that allege SCA violations, such as suits against service providers like AT&T for turning over private email to the government without a valid subpoena. It will make it easier to state a cause of action under the SCA because you will no longer have to plead damages, just an intentional violation. According to class-action attorneys Al Gidari and Ryan Mrazik in their article on the Van Alstyne decision in Digestible Law:

Practically, this case actually makes it easier for plaintiffs to survive motions to dismiss for failure to plead actual damages because they now can assert the conduct was “willful or intentional” and discovery will be required to determine if punitive damages are warranted. And, because whether conduct is willful or intentional is a question of fact, it will be difficult for defendants to win summary judgment after discovery as well. In sum, the Fourth Circuit’s decision may open the door to much more SCA litigation.

Attorneys Gidari and Mrazik recommend that:

Companies should carefully consider when and whether to access, use, or disclose stored communications or customer information and ensure their conduct comports with SCA-authorized activities to avoid the now higher risk of litigation.

That is good advice for companies, spammers,  Gladys Kravitz-types, and hackers alike.

Lessons for e-Discovery Lawyers:
Beware of Illegally Hacked Email

Beware: Email Privacy Law now has some TeethThere are important lessons here for e-discovery lawyers too. The unauthorized access of a person’s private email account to discover and retrieve their email is a crime. Just because you know a person’s user name and password, does not give you the right to use it. This kind of self-help e-discovery is not only unethical, it is criminal. You must employ a request for production or subpoena. You cannot hack into their private email accounts or home computers any more than you can break into their house and steal papers.

Of course, this is different from a situation where you look at the contents of the employee’s office, or office computer, or office email account. See IT Workers Read Your Personal Email and U.S. Law is Generally OK with That. An employer can use an employee’s password to access their company computer and company email because they have authority to do that. But I have never seen an employment agreement or policy which provides an employer with authority to access an employee’s private email account, such as AOL, Yahoo, or Gmail, or hack into their home computer systems, regardless of whether they may sometimes use these computers and email services for business.  Also See: Quon v. Arch Wireless 529 F.3d 892, 2008 WL 2440559 (9th Cir., June 18, 2008), which I wrote about in More “Must Read” 2008 Cases. In Quon the Ninth Circuit held that a company’s disclosure of text messages to the employer, who was the “subscriber” and not “an addressee or intended recipient of such communication,” violated the SCA.

Van Alstyne sends a clear signal to the computer-savvy-Bar. You cannot use self-help in the guise of discovery or employee monitoring to hack a person’s private email account. Yes, I know it is ridiculously easy to hack into these online email and social media accounts. It might be a simple way get at the truth, expose liars, and win the case. It could be done surreptitiously and never disclosed. But don’t do it. This kind of self-help e-discovery is a crime. You could go to jail (up to five years), be fined, and lose your license. Also, as this case holds, you could face a civil suit and a jury with the power to punish the “bad lawyer” with damages. The CEO in Van Alstyne got tagged with a $100,000 punitive damage award. How much do you think a jury might award to punish a lawyer hacker or his or her law firm? It is an easy button to be sure, but don’t press it, and don’t allow your staff, hired detectives, or vendors to do it either.

Van Alstyne also sends a clear signal to the computer-challenged-Bar. Consider the facts in Van Alstyne as stated in the opinion. Van Alstyne was shown several emails during her deposition. They were presented to her in paper form and had apparently not been disclosed to her attorney before the deposition. She had written these emails before she was fired and she recognized them. Apparently they were all work related in some way and hurt her case.

Van Alstyne had primarily used her employer’s Outlook email for work, but would sometime also use her personal AOL email account. She suspected that some of the emails shown to her during the deposition were from her AOL account, not her Outlook account. (I do not know why this was just a suspicion, instead of obvious from the email address, but perhaps the emails all just showed the same user name or perhaps that portion of the email was not included on the papers shown to her). Here is the Court’s explanation of what happened after the deposition:

Van Alstyne believed that these exhibits were actually taken from her AOL account and not her company account. With her suspicions aroused, Van Alstyne began pursuing the possibility that Leonard and ESL had broken into that private account. Sure enough, during a June 2006 deposition, Leonard admitted that he accessed Van Alstyne’s AOL account after she left the company. He further testified that the emails produced during the deposition represented the only occasions on which he had accessed her account.

It turns out that Leonard, the alleged sexual harasser, was not entirely truthful during his deposition testimony. He had far more of Van Alstyne’s AOL emails than that. In truth, he had accessed her AOL account many, many times. In later depositions Leonard admitted the truth. Here are the Court words in footnote 2 about Leonard’s false testimony in his first deposition:

These statements were not entirely true. Indeed, Leonard ultimately admitted to accessing Van Alstyne’s AOL account at all hours of the day, from home and internet cafes, and from locales as diverse as London, Paris, and Hong Kong. During discovery, Leonard produced copies of 258 different emails he had taken from Van Alstyne’s AOL account.

Internet Cafe in Paris

A tad obsessive, wouldn’t you say? In any event, after contradictory testimony like that, Leonard’s credibility is shot. It is no surprise that the jury awarded $100,000 in punitive damages alone, just for these unauthorized intrusions into Van Alstyne’s AOL account.

But what about Leonard’s attorney? Did he or she ask Leonard where he got the emails they were going to use for the deposition of Van Alstyne? I would hope so, and hope that the client lied to his attorneys and said they were all from his company’s computers. Still, it would seem that a diligent investigation and supervision of the discovery process would have revealed the true origin of these emails.

Sergeant Schultz of Hogan's HerosThe lesson to be learned here by attorneys is to always ask and be sure you understand where and how your client obtained email that they turn over to you. Especially in a heated case like this with allegations of sexual harassment, you need to be sure the emails were obtained legally. This is now a common problem in divorce cases. If your client has hacked into someone’s private email to get the evidence, they may well have committed a crime, as this case shows. They should be counseled accordingly. You cannot simply act like Sergeant Schultz in Hogan’s Heros and say “I know nothing!” The dumb as you want to be defense will not work with savvy opposing counsel or judges. You have a duty to inquire and cannot simply look the other way. If you learn the evidence is tainted, you do not use it and just hope that nobody notices.

Don't look a gift horse in the mouthI am not suggesting that is what happened here. I do not know; but the facts stated in the opinion raise some disturbing questions. Clearly we should all exercise caution in the discovery of an adversaries’ email and other personal computer information. When it comes to private email we should forget the common proverb; we should carefully look a gift horse in the mouth.

Conclusion

Everyone who uses email in the clouds can now rest a little safer, thanks to this important ruling of the Fourth Circuit. We can only hope that other Circuits will follow Van Alstyne and allow punitive damage, cost, and fee awards for unlawful invasion of email privacy without proof of actual damages. This will encourage active enforcement by private parties in civil lawsuits. If a jury is mad at the hacker, be they a young student, like in Palin, or the CEO of the company, as in Van Alstyne, we could see quite a few six figure punitive damage awards (assuming the judge does not reduce the size of the award as unreasonably high; see Abner v. The Kansas City So RR , 513 F.3d. 154 (5th Cir. 2008)). Nobody likes to have their email privacy invaded and now we have another way to fight back.



Flat Earth Society Admits World is Round, Wants to Learn to Circumnavigate

March 14, 2009

Flat Earth cosmologyShocking, but true! The country’s leading trial lawyers now admit that e-discovery is an “extraordinarily important … fact of life that is here to stay.” They understand that written evidence is no longer flat. It has digital depth wherein metadata, searchable indices, and other electronic mysteries reside.

The American College of Trial Lawyers, a group whom I have written about many times before, has recently reversed itself (without admitting it of course). These elders of the trial bar have subtly revised many of their anti-e-discovery, old-paper-world, pre-digital positions. They now accept the need for electronic discovery. They are even beginning to realize that they are part of the problem, urging other trial lawyers to go to workshops to obtain “technical knowledge about the issues involved in electronic discovery.” They are starting to take responsibility for the e-discovery crises, instead of blaming the new rules and judges. They now urge reform (who doesn’t), not abolition. As I will point out, many of the reforms they urge are good, but do not go far enough and fail to adopt the key reform needed of discovery cooperation. Instead, they still want judges to fix things for us, while at the same time admitting this would require a substantial increase in judicial funding, which is an increase that I support, but do not see happening any time soon.

grandpa-simpson-shakes-fist-at-cloud1Yes, Grandpa Simpson has stopped waving his clenched fist at cloud computing. He has opened his hand, apparently ready to shake with, not at, us geeky e-discovery types. Don’t get me wrong, the trial lawyers (especially the ones my age or older) are still mad as hell. Who can blame them? The world has changed way too fast and discovery is a mess. But at least the leaders of the trial bar appear ready to start a real dialogue, to go back to school, and start to figure it all out. 

The Prior Interim Report and Survey of the American College of Trial Lawyers Task Force on Discovery and the Insitute for the Advancement of the American Legal System

emperors_clothes

Six months ago I wrote about the  Interim Report & Litigation Survey of the prestigious American College of Trial Lawyers. My article was entitled Trial Lawyers Turn a Blind Eye to the True Cause of the e Discovery Morass. Although I praised part of the report, I was highly critical of the e-discovery aspects, especially the parts blaming almost everything wrong with the litigation today on electronic discovery, the new Rules, and our judges. Like the small child in the story of The Emperors New Clothes, I pointed out the obvious: that the real culprits here were the trial lawyers themselves. They were not clothed with the technical competence needed for e-discovery. Their inability to practice law in the Twenty First Century was, and still is, one of the main reasons e-discovery has become too expensive and risk-filled. 

Although my opinions were controversial outside of e-discovery, most everyone specializing in this area agreed. I wrote about the problem of trial lawyer competence again in Why E-Discovery is Ruining Litigation in America and What Can Be Done About It.  I quoted the immortal words of cartoonist Walt Kelly who said in Pogo: “We have met the enemy and he is us.” Pogo got it. Now it appears the trial lawyers do too.

Most lawyers do not understand e-discovery and all of this ESI stuff. Deep down, like a naked Emperor, they are embarrassed by this. They know full well that their clients all create and store their writings on computers. Lawyers know that these ESI documents are key evidence in most cases, but they are unable to handle this evidence, even though “writings” are supposedly their stock in trade. They know they should get this evidence out of the computers and into the court rooms, but they don’t know how. Trial lawyers, long the Emperors of the legal profession, were, at first, too embarrassed to admit their own inabilities. They found themselves lacking knowledge, dressed only in the flimsy garb of e-discovery vendor smoke and mirrors. Strutting around naked like that can be very embarrassing. It also makes you vulnerable to the flatterers and connivers, those who promise to make you look good, if you just pay the price.

Most trial lawyers today are still incompetent in e-discovery, but at least now their leaders are finished with the magic clothes. They are starting to admit the own technical nudity. There is no shame in this. It is not their fault. The world has changed from paper to digital writing at an alarming rate. The technology and information explosion is unprecedented in human history. They are trial lawyers, damn it, not information scientists, librarians, IT geeks, or forensic engineers. If they had the desire or talent in math and science needed to solve the deep riddles of computers, they would never have gone to law school in the first place. They would have gone to med school and made some real money. But seriously, with a few noted and very recent exceptions (Georgetown and U.F. come to mind), they do not teach this stuff in law school. Where were they supposed to learn it to begin with?

Ostrich head - careful, they bite

The CLEs on the subject have proven inadequate, even when trial lawyers bothered to sit in. I do not blame them for avoiding these events, or looking at their blackberries in the back of the room, instead of paying attention. Many of the e-discovery CLEs I have attended have been hopelessly boring or vendor-driven and slanted. Others have been long on scare and horror stories and short on useful information. Many of them, especially the “pay-to-play” types are “the blind leading the blind.” I will not go near them. The trial lawyers have, for the most part, avoided these geek-fests. They are instead focused on honing the other skills needed for dispute resolution, hoping that discovery would somehow take care of itself, or be handled properly by the kids fresh out of law school (it was not). But now all that appears to have changed. The trial bar has awakened and woe unto the sneaky vendors, consultants, and others who have been deceiving them with whole cloth. An angry ostrich is a dangerous animal.

It is about time. The first reaction to e-discovery of these otherwise very talented and bright attorneys in the trial bar was, in my opinion, a tad immature. Most of them will admit that in private and I do not really blame them. The complexity and difficulty of all this can be overwhelming. That is why the Interim Report in some instances reminded me of Grampa Simpson shaking his fist at the clouds. I know that deep down they wish it would all just go away, that everyone would go back to paper letters and phone calls, and stop all of this annoying email, texting, and who knows what else. The delusional ostrich approach has always had a strong appeal to everyone.

Ostrich with Head in Sand

But the trial bar is a smart bunch and most are usually very responsible. They appear to have heard the criticism, not just from me, but from a host of others. 

The Final Revised Report

The Final Report of the American College of Trial Lawyers and the Institute for the Advancement of the American Legal System was adopted on February 25, 2009. It contains several substantial revisions to the lame Interim Report. The revisions show that the trial bar has moved on to a more mature reaction to the information revolution. The leaders appear to have a new, more positive attitude. They are waking up and beginning to take responsibility. I congratulate them for that.

If you have read my prior articles on this group, you may be having a hard time believing that our criticism was heard and the College has made such a dramatic shift in just six months. Let me state my case. First of all, the Final Report quotes extensively and approvingly from The Sedona Conference. Even more incredible, the Final Report includes the Sedona Principles, both the U.S. and Canadian versions, as two out of the three Appendixes to the report. These are the same Sedona Principles that I include on the right side of my blog and whisper before I go to bed each night. The only difference is that I include the copyright notice, and obtained permission first, as required by law. But, at least they endorse them by inclusion and I, for one, am impressed.

Next, consider the following statements from the Final Report at pages 15 and 16:

In order to contain the expense of electronic discovery and to carry out the Principle of Proportionality, judges should have access to, and attorneys practicing civil litigation should be encouraged to attend, technical workshops where they can obtain a full understanding of the complexity of the electronic storage and retrieval of documents.

At a minimum, courts making decisions about electronic discovery should fully understand the technical aspects of the issues they must decide, including the feasibility and expense involved in complying with orders relating to such discovery. Accordingly, we recommend workshops for judges to provide them with technical knowledge about the issues involved in electronic discovery. We also recommend that trial counsel become educated in such matters. An informed bench and bar will be better prepared to understand and make informed decisions about the relative difficulties and expense involved in electronic discovery. Such education is essential because without it, counsel increasingly will be constrained to rely on third-party providers of electronic-discovery services who include judgments about responsiveness and privilege among the services they provide, a trend we view with alarm.

Ok, it is true they mention judges first as needing training and couch all of e-discovery education with the cloak of Proportionality, but still, they admit that trial lawyers should also go back to school, or workshops, or whatever. Not only that, they recognize the need for a “full understanding,” not  just a quickie CLE superficial understanding, of  ”the complexity of the electronic storage and retrieval of documents” and “technical knowledge about the issues involved in electronic discovery.”  If the trial lawyers really do that, it will be huge because this is, in my view, the core problem. Of course, once they gain a full understanding of storage and retrieval, they will realize the need to also gain a full understanding of a host of other critical issues, such as efficient review and evidence authentication. They may even be convinced to give up their precious Bates stamps and start to use algorithmic hash instead. Losey, HASH: The New Bates Stamp, 12 Journal of Technology Law & Policy 1 (June 2007). They may even begin to understand the need and importance of attorneys who are e-discovery specialists. See the Conclusion to Trial Lawyers Turn a Blind Eye to the True Cause of the e-Discovery Morass.

The Final Report also includes an important insight that “such education is essential because without it, counsel increasingly will be constrained to rely on third-party providers of electronic-discovery services.” That is exactly what I have been saying for years. They view this development with alarm. So do I. The dog has been wagging the tail for far too long and that is one reason the costs of e-discovery are out of control. This is not the fault of vendors, although some have been like the Emperor’s tailors. A vendor will naturally be cautious and look to legal counsel’s leadership in the proper risk/reward balance of what to review, and how aggressive to be with search culling. Without knowledgeable lawyers at the helm, the vendors always err on the side of caution, sometimes extreme caution, and as a result, the clients often end up paying for the review and production of way too much information.

The Final Report then goes on to make a frank admission of why trial lawyers are “encouraged” to go back to e-discovery school (assuming they can find one):

Likewise, trial counsel are often uninformed about the technical facets of electronic discovery and are ill-equipped to assist trial courts in dealing with the issues that arise.

Want more proof? Well here is the clincher at page 16:

Electronic discovery, however, is a fact of life that is here to stay. We favor an intensive study to determine how best to cope with discovery of this information in an efficient, cost-effective way to ensure expenses that are proportional to the value of the case.

Ok, so it is a tad grudging –  how to “cope” with it – but it talks again about intensive study (something Sedona and others have been doing for a long time), once again implicitly admitting the need to learn. The truth is, the Final Report includes many gratuitous negative comments (like my own sarcastic remarks, only not funny). For instance, the Final Report includes these learned comments at page 2:

Electronic discovery, in particular, needs a serious overhaul. It was described by one respondent as a “morass.” Another respondent stated: “The new rules are a nightmare. The bigger the case the more the abuse and the bigger the nightmare.”

Yet another jab at how awfully expensive and burdensome e-discovery has become contains an important admission at page 15:

Although electronic discovery is becoming extraordinarily important in civil litigation, it is proving to be enormously expensive and burdensome.

So when you ignore the negative tone, which is obviously needed to placate the angry ones who are naturally upset about having to practice law in a high-tech world they barely understand, you see that they now understand e-discovery is an “extraordinarily important … fact of life that is here to stay.” This is major progress.

The Trial Lawyers Supposedly Radical Recommendations

The Final Report goes on to make a series of principles and related reforms they contend are needed to save the American system of justice:

Some of the Principles may be controversial in some respects. We encourage lively and informed debate among interested parties to achieve the common goal of a fair and, we hope, more efficient, system of justice. We are optimistic that the ensuing dialogue will lead to their future implementation by those responsible for drafting and revising rules of civil practice and procedure in jurisdictions throughout the United States.

I am not going to review all of their principles, just a few that I found especially interesting and applicable to e-discovery. I will, however, try to comply with their request that the debate be lively.

The Final Report calls for the reform of notice pleading. This proposal has been around for many years in the e-discovery community and promoted by many, including especially Anne Kershaw. Anyway, here is what the Final Report says about it at page 5:

Notice pleading should be replaced by fact-based pleading. Pleadings should set forth with particularity all of the material facts that are known to the pleading party to establish the pleading party’s claims or affirmative defenses.

Most everyone in e-discovery, excluding only the most hard-nosed plaintiffs lawyers, agree with this one. How are you supposed to know what ESI to preserve, much less produce, if you cannot determine from the pleadings what the case is all about. I have written about this before in What’s Wrong With This Picture? Star Trek Lessons for e-Discovery. So here is a strong point of agreement with the American College of Trial Lawyers. 

Here is another. At page 7 the Final Report states:

Proportionality should be the most important principle applied to all discovery.

That is one of the mantras of The Sedona Conference and all knowledgeable e-discovery lawyers. Glad to see the College gets it too. Hopefully they will learn the many skills needed to embody the Proportionality Principle in e-discovery, including the all important Sedona Conference Cooperation Proclamation, a principle conspiciously absent from their report. We need dialogue with them on this point so that they can understand how cooperation and proportionality go hand and hand in the world of e-discovery.

The Final Report states, at page 9, that the following is both its most “radical” proposal and its most “significant:”

After the initial disclosures are made, only limited additional discovery should be permitted. Once that limited discovery is completed, no more should be allowed absent agreement or a court order, which should be made only upon a showing of good cause and proportionality. 

They go on to explain:

This Principle changes the default while still permitting a search, within reason, for the “smoking gun”. Today, the default is that there will be discovery unless it is blocked. This Principle permits limited discovery proportionately tied to the claims actually at issue, after which there will be no more. The limited discovery contemplated by this Principle would be in addition to the initial disclosures that the Principles also require. Whereas the initial disclosures would be of documents that may be used to support the producing party’s claims or defenses, the limited discovery described in this Principle would be of documents that support the requesting party’s claims or defenses.

I personally think this proposal might work, but only if coupled with another truly radical counter-balancing proposal that they did not make. This is a proposal I have made many times before: require initial disclosure of all relevant information known to a party, not just the relevant information that supports their case. In other words, require a full and fair disclosure, not just one-sided disclosure. Require disclosure of evidence that both supports and harms your case. If you know of a smoking gun, evidence that harms you case, go ahead and produce it along with the evidence that supports your case. Put all the cards on the table, the good and the bad. Make that mandatory. Only this measure can take the excessive costs, delay, and gamesmanship out of e-discovery that everyone, including the trial lawyers, profess to abhor. (“At present, the system is captive to cost, delay, and in many instances, gamesmanship.” Final Report pg. 24) That would be a substantial reform, yet the College of Trial Lawyers does not go that far. Instead, they only recommend disclosure of evidence that supports your case, something the federal rules have long required.

In fact, even though the College of Trial Lawyers criticize the new federal rules for e-discovery and say they provide no real guidance, many of their other principles and recommendations are already embodied in the federal rules. For instance, the following supposedly new advice will seem very old-hat to anyone who knows the federal rules that went into effect in 2006:

Promptly after litigation is commenced, the parties should discuss the preservation of electronic documents and attempt to reach agreement about preservation. The parties should discuss the manner in which electronic documents are stored and preserved. If the parties cannot agree, the court should make an order governing electronic discovery as soon as possible. That order should specify which electronic information should be preserved and should address the scope of allowable proportional electronic discovery and the allocation of its cost among the parties. Pg. 12.

We call on courts to hold an initial conference promptly after a complaint is served, for the purpose of making an order with respect to the preservation of electronic information. In this regard, we refer to Principle 5 of the Sedona United States Principles for Electronic Document Production. Pg. 13.

Initial pretrial conferences should be held as soon as possible in all cases and subsequent status conferences should be held when necessary, either on the request of a party or on the court’s own initiative. Pg. 18.

Electronic discovery should be limited by proportionality, taking into account the nature and scope of the case, relevance, importance to the court’s adjudication, expense and burdens. Pg. 14

Although the Final Report does not give due credit to the new federal rules, the College appears to realize that proportionality is already addressed in the rules. Still, they go on to criticize new Rules on e-discovery as inadequate and traps for the unwary:

Although the Advisory Committee on Civil Rules attempted to deal with the issues in new Rule 26(b)(2), many of our respondents thought that the Rule was inadequate. The Rule, in conjunction with the potential for sanctions under rule 37(e), exposes litigants to a series of legal tests that are not self-explanatory and are difficult to execute in the world of modern information technology. The interplay among “undue cost and burden,” “reasonably accessible,” “routine good faith operation,” and “good cause,” all of which concepts are found in that rule, presents traps for even the most well-intentioned litigant.

Sorry, I disagree with the College there. The new rules are pretty good and provide clear guidance to those with ”technical knowledge about the issues involved in electronic discovery.” 

Many of the other principles recommended involve a much more active judiciary with hands-on involvement with discovery of all forms, including especially e-discovery. This suggests a move towards the Civil Law model used in Europe and elsewhere where judges control discovery, not lawyers. The College seems to recognize that these suggestions are not practical in our current system:

These Principles call for greater involvement by judges. Where judicial resources are in short supply, they should be increased. This Principle recognizes the position long favored by the College. Judicial resources are limited and need to be increased.

If Pigs Could FlyThese proposals by the College of Trial Lawyers for an expanded and much more active judiciary are truly radical. They might work, but only if the American public is willing to devote substantially more resources to the judiciary. Indeed, for this to work, the number of judges and support staff would probably have to be doubled and the pay increased. I do not think there is the political will for this yet in the United States, especially in the current economy. Since many of the proposals here hinge on such a fundamental change, I do not take them too seriously. I am not saying they are a bad idea, just that America is not prepared to fund them.

No, I think we are stuck with lawyer controlled discovery for the foreseeable future. That is why strategic cooperation and full disclosure of all relevant facts, both good and bad, are imperative. The College’s reliance on judges instead is misplaced.

Conclusion

Nerds and Frat Boy from the movie Revenge of the Nerds Electronic discovery has been called the “nerds revenge” of the legal world. If so, the trial lawyers are the cool fraternity boys. They stuck with their paper chase way too long because that is what they knew. Even though paper went out with the 90s, they kept pretending their flat-earth skills were relevant.

Now they can deny the truth no longer. The evidence is in the computer and only the nerds know what to do. When the frat-boys and girls play with the damn things, they have to hire vendors to show them what to do. Then, they end up running up ridiculously high review and production bills. The managing partners and vendors do not mind the high fees, but the trial lawyers do. Yes, the trial lawyers themselves also benefit monetarily from the system; but still, they do not like it. They have to answer to the angry clients asked to pay these exorbitant bills. They also have to answer to the angry judges who have little sympathy for incompetence, and its twin sister “aggressive gamesmanship,” used to try to mask inadequacies. But worst of all, from their point of view, the discovery costs and risks make it even more unlikely that they will get to go to trial. They are tired of all this. They see the justice system that they truly love falling apart because of this nonsense. They want peace with the nerds. They want to break their dependencies with the vendors and regain the competence they had before the information revolution. This Final Report shows this.

The question is, do the nerds care, or have they had sand kicked in their face one too many times? The fist has stopped shaking at the clouds and now reaches out for help. But will they get it? Will the nerds-that-know put on the technical workshops that the College of Trial Lawyers have called for? That remains to be seen. The nerds might want to kick some sand of their own and rake in the riled clients. They may be perfectly happy to continue to let the tailors teach and the blind lead. Even if some are willing to teach, is it too late for most of the trial lawyers in practice today? See the Conclusion to Why E-Discovery is Ruining Litigation in America and What Can Be Done About It.

I will give the last words to the trial lawyers, after all, I spent most of my career in their shoes. The Final Report ends with these strong words that we should all take to heart:

Our civil justice system is critical to our way of life. In good times or bad, we must all believe that the courts are available to us to enforce rights and resolve disputes – and to do so in a fair and cost-effective way. At present, the system is captive to cost, delay, and in many instances, gamesmanship. As a profession, we must apply our experience, our differing perspectives and our commitment to justice in order to devise meaningful reforms that will reinstate a trustworthy civil justice system in America.


Jason Baron on Search – How Do You Find Anything When You Have a Billion Emails?

March 4, 2009

Jason Baron speaking at the University of Florida on Feb. 26, 2009You think you’ve got email problems, Jason R. Baron just received 200 million emails from the outgoing Bush administration! Jason is the Director of Litigation for the National Archives and Record Administration (“NARA”), the government agency responsible for maintaining and searching all of these emails, and more, in response to never-ending information requests. NARA keeps the permanent records of the U.S. government, including the emails and other records of the White House and Presidential Libraries. As difficult as it is to search for one relevant email in a universe of 200,000,000, the situation is getting worse all of the time. Jason expects the Obama administration, if it goes for two terms, to generate over a billion emails by 2017. These kinds of Carl Sagan type numbers (“Billions and Billions!”) help motivate Jason to think long and hard about the future of search and explains why he has reached out to information scientists for help. See egNational Institute of Standards and Technology TREC Legal Track, the general TREC conference, and the DESI III at ICAIL 2009 workshop in Barcelona.

Jason shared his thoughts and science outreach efforts with about 60 law students at the University of Florida last week in a class that Bill Hamilton and I usually teach. Jason spoke for two hours before students who had previously read Jason’s scholarly writings on the subject and the landmark cases. Paul & Baron, Information Inflation: Can The Legal System Adapt? 13 Rich J.L. & Tech 10 (2007); Baron, Jason, Editor, The Sedona Conference® Best Practices Commentary on Search & Retrieval Methods (Aug. 2007); Baron, Jason, E-discovery and the Problem of Asymmetric Knowledge (Presentation at the Mercer Law School Ethics in the Digital Age Symposium, Nov. 2008); Disability Rights Council of Greater Wash. v. Wash. Metro. Area Transit Auth., 2007 WL 1585452 (D.D.C. June 1, 2007); United States v. O’Keefe, 2008 WL 449729 (D.D.C. Feb. 18, 2008); Victor Stanley, Inc. v. Creative Pipe, Inc., 2008 WL 2221841 (D. Md., May 29, 2008). This is the perfect format to give Jason sufficient time to present a full overview of his ideas and projects in this area. It also led to excellent questions and discussions, which are hard to come by in a typical attorney CLE program where few, if any of the attendees actually study the material in advance.

Jason Baron at the University of Florida School of LawI say Jason Baron had time to provide a full overview of his ideas because it would take a day or more to flush out all of the details of his work on this subject. Typically, e-discovery CLEs include search as part of a curriculum, and, at best, you only hear Jason Baron as part of a panel with limited time. I know because I’ve been on two search panels with him. That is better than nothing, but not really adequate for a full airing of his views or mine. See eg. a webinar on March 19, 2009 where Jason is a panelist: Buyer Beware: How TREC Can Help You Evaluate Your E-Discovery Investments. This free Webinar promises to be better than most and I suggest you attend. Still, search is a critical issue for e-discovery and deserves a full day in-person seminar of its own, at least.

I call on the vendors out there to sponsor a two-day, ad-free, seminar devoted entirely to search. Then, Jason and others could take the time needed to really get into the meat of these issues. For instance, given a couple of hours, I could lay out my current thinking and practice on search and cost, a topic that I can only sketch in very broad outline in a 20-minute share of a panel discussion. I know that Anne Kershaw and Patrick Oot, among others, also have important insights to share with the e-discovery community on the topic of search.

Tobacco Litigation e-Discovery

smoking-killsJason began his presentation with a story of his experience assisting trial attorneys in the Department of Justice on the tobacco litigation team. In the early 2000s, the team at DOJ worked with various agency counsel (including Jason representing NARA) on the task of responding to discovery requests from the tobacco industry in U.S. v. Philip Morris. This was a mammoth e-discovery project. There were 1,726 Requests to Produce propounded by tobacco companies against 30 federal agencies for tobacco related records.

The hardest part of the project was the search of 32 million Clinton era email records. It started by Jason and his team studying the requests and “dreaming up” 12 keyword combinations to search/cull the 32 million emails. They ran some tests on samples and then had the good sense to do something that was then new and daring: they told the tobacco company requesting parties what the search terms were and invited them to participate. The tobacco company lawyers responded favorable and suggested some new terms that were then explored. This was followed by more sampling to find “noisy” terms, that is, keyword terms that generated too many false positives (Marlboro, PMI, TI, etc.). The results were reported back to the opposing counsel and a consensus was reached as to additional terms to be used in the search protocol. Then and only then was the full search run against the 32 Million emails. Here is an example that Jason gave of one of the boolean search strings that was used in the search:

(((master settlement agreement OR msa) AND NOT (medical savings account OR metropolitan standard area)) OR s. 1415 OR (ets AND NOT educational testing service) OR (liggett AND NOT sharon a. liggett) OR atco OR lorillard OR (pmi AND NOT presidential management intern) OR pm usa OR rjr OR (b&w AND NOT photo*) OR phillip morris OR batco OR ftc test method OR star scientific OR vector group OR joe camel OR (marlboro AND NOT upper marlboro)) AND NOT (tobacco* OR cigarette* OR smoking OR tar OR nicotine OR smokeless OR synar amendment OR philip morris OR r.j. reynolds OR (“brown and williamson”) OR (“brown & williamson”) OR bat industries OR liggett group)

As a result of the search, 99% of the documents were culled out. But that still left 320,000 emails, plus attachments. About half of those were found to be relevant, which, in my experience, is a high precision ratio. Of the relevant emails and attachments, about 20% were found to be privileged. They were logged and withheld, and the 80% balance of relevant files were produced. Although I am sure the documents uncovered were of some help to both sides, the sad truth is, none were ever used as an exhibit at trial.

The One Percent Solution Does Not Scale

The parties in the tobacco litigation were, under Jason’s leadership, able to cooperate and agree upon boolean search parameters that reduced the total universe to be reviewed for production by 99%. That is, in my experience, a very high cull rate. The use of keyword based culling alone can rarely, if ever, go beyond the one percent barrier. That is especially true in a negotiated term setting. In the tobacco case the government was willing to search the one percent remaining after culling, here 320,000 emails. The case was big enough (billions of dollars were at stake) and the U.S. government could afford the millions of dollars required for the review and production.

Jason then explained that the core problem is that the one percent solution does not scale. The government could afford to review and produce one percent of the Clinton era email, but cannot afford to review and produce one percent of Bush’s email, which equals 2 million emails (1% of 200,000,000 = 2,000,000), much less the expected email of Obama (1% of 1,000,000,000 = 10,000,000). What would it cost and how long would it take to review ten million emails (1% of 1 billion)? Jason estimates it would cost at least $20 Million and take a team of 100 lawyers working 10-hour days, seven days a week, over 28 weeks. I personally think that is an underestimate in time and cost. But regardless, it is far more than the federal government can afford or is willing to pay for a discovery request (even if, in my opinion, not Jason’s, some of the judges on the D.C. Circuit Court of Appeals do not appear to care how much discovery costs as the decision In Re Fannie Mae Litigation suggests).

Here is how Jason summed up the problem of scale in his talk to U.F. law students:

One percent of a billion after a keyword search is too much. Something has got to change… You have to take that huge volume and somehow cut down the haystack as much as possible that’s reasonable to do searches against, and then those searches need to be more efficient than what they are today. But that problem is a hard one; doing efficient searches is very hard.

Jason then explained some of the many reasons that search of large, heterogeneous data collections is so hard to do. They include such things as “Polysemy,” which means ambiguous terms (e.g., “George Bush,” “strike”), “Synonymy,” which means variation in describing the same person or thing in a multiplicity of ways (e.g., “diplomat,” “consul,” “official,” ambassador,” etc.), and “Pace of Change,” which refers to the never-ending development of new communication media and languages (e.g., twitter, text messaging, and computer gaming, i.e. “POS,” “1337”).

The Myth of Search & Retrieval

myths of the worldMost litigation lawyers today do not understand just how hard it is to search large data-sets. They think that when they request production of “all” relevant documents (and now ESI), that “all or substantially all” will in fact be retrieved by existing manual or automated search methods. This is a myth. The corollary of this myth is that the use of  “keywords” alone in automated searches will reliably produce all or substantially all documents from a large document collection. Again, most litigators think this is true, but it is not. That is not just Jason’s opinion, or my opinion, it is what scientific, peer-reviewed research has shown to be true.  

A study by information scientists David Blair and M.E. Maron in 1985 revealed a significant gap or disconnect between lawyers’ perceptions of their ability to ferret out relevant documents and their actual ability to do so. The study involved a 40,000 document case (350,000 pages). The lawyers estimated that a keyword search process uncovered 75% of the relevant documents, when in fact it had only found 20%! Blair, David C., & Maron, M. E., An evaluation of retrieval effectiveness for a full-text document-retrieval system; Communications of the ACM Volume 28, Issue 3 (March 1985); Also see: Dabney, The Curse of Thamus: An Analysis of Full-Text Legal Document Retrieval, 78 LawLibr. J. 5 (1986); Losey, Sedona’s New Commentary on Search, and the Myth of the Pharaoh’s Curse.

The myth of the effectiveness of keyword search is perpetuated by some e-discovery vendors who claim that a very high rate of “recall” (i.e., finding all relevant documents) is easily obtainable, provided you use their software product or service. In fact, new research performed by information scientists and lawyers at the National Institute of Standards and Technology TREC Legal Track has again confirmed that keyword search alone still finds only about 20%, on average, of relevant ESI in the search of a large data-set, although alternative methods are beginning to achieve better results.

When a large collection of heterogeneous, disorganized, computer files are searched, which is the typical scenario in e-discovery, the search results are divided into four different categories as shown in the search quadrant below.
Search Quadrant - standard in information science

Electronic documents that are relevant to a request for information, and are retrieved by a search process, are referred to as “True Positives.” These are the files we want. We do not want a search to retrieve irrelevant files. The irrelevant files that are not retrieved are called “True Negatives.” In an ideal, perfect world, our automated search would find all relevant files, and only relevant files. We would have 100% True Positives and 100% True Negatives. But in reality, it never works that way, at least not in large sets of data. In reality, a search retrieves both relevant files and irrelevant files. The irrelevant files retrieved are called False Positives.

The ratio between True Positives and False Positives is referred to in information science as “Precision.” Precision is good; it means you spend less time reviewing irrelevant files. That saves money and thus is very important to real world e-discovery. In the Blair and Maron study, for instance, the Precision was 79%, while the Recall was only 20%. That means that 79% of the documents retrieved by the search were relevant, a high rate of Precision in my experience, but 80% of the relevant documents were not retrieved.

The relevant documents that are not found by a search are called “False Negatives.” The ratio between the True Positives, and the False and True Positives, is the “Recall” rate. Thus, in the Blair and Maron study, which was again confirmed in the TREC study, for every 100 relevant files the keyword search sorted through, it identified only 20, the True Positives, and failed to see 80, the False Negatives. In an ideal, perfect search, which again is impossible for large data-sets, you would find all relevant documents and achieve a 100% Recall. Information science research has discovered that in the search of large data-sets there is a typical ratio between Recall and Precision, such that the higher your Precision, the lower your Recall, and visa versa. This is shown in the graph below that I have taken from Jason’s PowerPoint.

Recall Precision GraphThus, for example, if your search only uncovered five documents, and you were lucky enough that all five were relevant, then you would have 100% Precision. There would be no False Positives. But in that circumstance, you would likely have attained a very low Recall rate. You may have found five relevant files, but left behind another five hundred. Thus, in that example, your Recall would be 5/505, or slightly less than one percent (.99%). That is the basic stuff of search analysis. The next instructional step after that, in my opinion, requires venturing into the world of sampling and thus is one of those things that requires a full day seminar, and (horrors) more math.

TREC Legal Track

The Recall Precision trade-off is a problem well known to all of the participants in the Legal Track of the TREC conferences.  The Legal Track supervises an open data search experiment and sponsors an annual meeting where the results are discussed and debated in academic fashion. The participants are primarily professors and their students from information science departments, plus a few attorneys like Jason, and recently a few e-discovery vendors as well. In addition to Jason Baron, the coordinators for the 2008 TREC Legal Track were Bruce Hedin, Ph.D., Douglas W. Oard, Ph.D., and Stephen Tomlinson.

I look forward to the latest Legal Track Overview article to be published later this month detailing the results of the experiments and findings in 2008. In the meantime, I will try and explain some of the basics here. Any over-simplifications and errors are solely my own, not Jason’s or anyone else. Go here for the official, lengthy report on the 2007 TREC Legal Track. Also see Sedona Conference Open Letter on the 2008 TREC Legal Track.

The TREC Conference series is sponsored by the National Institute of Standards and Technology (NIST). It is designed to promote research into the science of information retrieval in general and has a number of different fields of study, or “Tracks.” The first TREC conference was in 1992. The 15th Conference was held in 2006 where Jason Baron and his colleague Doug Oard at the University of Maryland convinced the TREC conference to begin a new Legal Track for the study of problems faced by attorneys searching large data sets to respond to discovery requests. The TREC Legal Track was thus born in 2006 and has continued every year thereafter. This is the first time this kind of study has been performed using non-proprietary data since the Blair and Maron research in 1985. 

TREC Legal Track sets up a search problem using hypothetical legal complaints and “requests to produce” with over 100 categories created to date. The requests are drafted by members of The Sedona Conference with litigation experience. “Boolean negotiations” were then conducted by a control group of expert attorneys simulating real-world conditions. They agreed upon baseline keyword search terms with Boolean operators and wildcards to retrieve data relevant to the requested categories. These categories varied tremendously from the dry and serious shown in the example below, to the slightly whimsical, such as a category requesting all documents making a connection between the music and songs of Peter, Paul, and Mary, Joan Baez, or Bob Dylan, and the sale of cigarettes. Here is the example provided as to how the negotiations went for one of the 100 topics:

Request Number: 52

Request Text: Please produce any and all documents that discuss the use or introduction of high-phosphate fertilizers (HPF) for the specific purpose of boosting crop yield in commercial agriculture. 

Proposal by Defendant (recipient of discovery): “high-phosphate fertilizer!” AND (boost! w/5 “crop yield”) AND (commercial w/5 agricultur!) 

Rejoinder by Plaintiff (requestor of discovery): (phosphat! OR hpf OR phosphorus OR fertiliz!) AND (yield! OR output OR produc! OR crop OR crops)

Final Query (as agreed to by the parties): ((“high-phosphat! fertiliz!” OR hpf) OR ((phosphat! OR phosphorus) w/15 (fertiliz! OR soil))) AND (boost! OR increas! OR rais! OR augment! OR affect! OR effect! OR multipl! OR doubl! OR tripl! OR high! OR greater) AND (yield! OR output OR produc! OR crop OR crops) 

A search was then made of the chosen public document database using the agreed protocols. In 2006, 2007, and 2008 TREC used the nearly 7 million document database from the tobacco litigation. These documents are a set of OCR scanned Tiff type files. The next study in the Summer and Fall of 2009 will use the Enron litigation public data-set. I expect this collection will have no OCR scanning errors and thus, in my opinion, be more reflective of modern practice. See Text REtrieval Conference (TREC) Call to TREC 2009 (more information on the Legal Track will be available soon).

The various search teams participating then ran their own searches of the same database. Up until 2008 most of the participating teams were information scientists from universities, but in 2008 two e-discovery vendors joined the project, H5 and Clearwell Systems. The public database is, of course, totally unstructured and disorganized, and, like real life, it is filled with spelling errors, scanning errors, and language idiosyncrasies. The search teams used various automated methods and protocols to try to locate documents in the database responsive to various categories.

The experiment was, among other things, designed to evaluate the Precision and Recall of the various search methods used by the teams and to compare their results with the arms-length, expert attorney negotiated search terms. The negotiated keyword search method did about the same as the original Blair and Maron study with an approximate average 22% recall rate based on sampling. This means that once again approximately 78% of the relevant documents were not found by the approach now most commonly employed by attorneys. Some of the automated search methods used by the various teams beat this 22% Recall rate, but usually not by much, and not consistently over all categories. The degree of success depended upon the particular category. But, I am pleased to report higher recall – up to 81% — was achieved for at least one individual topic in the so-called “Interactive task,” which more closely models e-discovery practice than TREC’s set piece “ad hoc” task. The Interactive task used “Topic Authorities” drawn from the ranks of the Sedona Conference who acted in the role of senior litigators giving advice and feedback about the topics to the participating teams, and participating teams spent far greater overall resources in attempting to respond to one or two or three topics only. I am not sure if the 81% figure was for the Bob Dylan topic or what, but it is a far cry from the 22% average of keyword searches and shows great hope for the future of search.

The chart below from Jason illustrates the estimated Recall rates attained by search teams on various categories (topics) in the 2006 experiment. The green part of the bar represents the base line keyword search results. The yellow and red parts of the bar represent additional relevant documents captured by alternative methods employed by the search teams. As you can see, keyword search did just fine, comparatively speaking, for a couple of topics, but for most it was out-performed by newer methods.

graph of some search results from 2008 Legal Trec

The TREC Legal Track is grappling with three fundamental issues. In Jason’s words:

(1) How can one go about improving rates of Recall and Precision (so as to find a greater number of relevant documents, while spending less overall time, cost, etc., sifting through noise?)

(2) What alternatives to keyword searching exist?

(3) Are there ways in which to benchmark alternative search methodologies so as to evaluate their efficacy?

This is a work in progress and there are now far more questions than answers. That is what research is all about. The importance of TREC to the legal community has already been recognized by many scholars and at least two leading jurists, Judge Grimm in Victor Stanley and Judge Scheindlin in Securities and Exchange Commission v. Collins & Aikman Corp., 2009 WL 94311 (S.D.N.Y., Jan. 13, 2009).

Jason ended his presentation at U.F. by inviting all of the law students there to be a part of this scientific exploration. TREC Legal Track is seeking volunteers to review files in the next experiment and make a determination of relevance. Participants will receive a detailed explanation of what files should be considered relevant and will then review thousands of files and classify them as either irrelevant, relevant, or highly relevant. See: last year’s Call for Participation by Relevance Assessors.

In view of the high number of electronic documents that must be manually reviewed for relevance, Jason and the Legal Track need hundreds of volunteers, all willing to donate substantial time to this worthy, scientific endeavor. It is open to all law students, paralegals, and attorneys.

Jason has given me permission to invite all of my student, paralegal, and attorney readers to join in the experiment and become a reviewer for the 2009 experiment. The review time will be needed in August and September of 2009. You can control the amount of review work you take on and do the work at home, or wherever you want, at any times you want, 24/7. Have trouble sleeping, have free time, tired of golf? Don’t waste your time watching tv or cruising the Internet. Instead, contribute some of your time and expertise to the advancement of science. Law students can receive pro bono credit in schools where that is required and we can all pad our resume with a really cool line item. For more information on how you can help, email Jason Baron at jason.baron@nara.gov.

Conclusion

The old days of simple keyword search for relevant documents are coming to an end. We can no longer afford its gross inefficiencies and its outrageous expense. There is simply too much data in law suits today to continue using this method of search from the 1980s. It was only able to recall 20% of the relevant information when it first started in the 1980s, and still does little better than that today, even in the hands of experts. My guess is that average lawyers with no special expertise in keyword search are only achieving Recall of from 10% to 15%, but like the attorneys in the Blair and Maron study, think they are getting most of it. The power of myth is strong.

There has got to be a better way than negotiated keyword search. Many people are working on this problem right now, myself included, and breakthroughs are imminent. As Jason Baron put it at the end of his session at U.F.:

We are just at the beginning, sort of the dawn of some new paradigm in the law. There is something happening out there, something different – and you can feel it.

As one vendor I know likes to say, “catch the wave.” Be a part of the solution and make yourself relevant; contact Jason Baron today and volunteer to be a relevancy reviewer. This is a rare chance to be a part of science, a part of history. Don’t let it pass you by.