New Homework Added to the TAR Course and a New Video Added to AI-Ethics

September 3, 2017

We have added a homework assignment to Class Sixteen of the TAR Course. This is the next to last class in the course. Here we cover the eighth step of our eight-step routine, Phased Production. I share the full homework assignment below for those not yet familiar with our instructional methods, especially our take on homework. Learning is or should be a life-long process.

But before we get to that I want to share the new video added to the AI-Ethics.com web at the end of the Intro/Mission page. Here I articulate the opinion of many in the AI world that an interdisciplinary team approach is necessary for the creation of ethical codes to regulate artificial intelligence. This team approach has worked well for electronic discovery and Losey is convinced it will work for AI Law as well. AI Ethics is one of the most important issues facing humanity today. It is way too important for lawyers and government regulators alone. It is also way too important to leave to AI coders and professors to improvise on their own. We have to engage in true dialogue and collaborate.

______

Now back to the more mundane world of homework and learning the Team’s latest process for the application of machine learning to find evidence for trial. Here is the new homework assignment for Class Sixteen of the TAR Course.

____

Go on to the Seventeenth and last class, or pause to do this suggested “homework” assignment for further study and analysis.

SUPPLEMENTAL READING: It is important to have a good understanding of privilege and work-product protection. The basic U.S. Supreme Court case in this area is Hickman v. Taylor, 329 US 495 (1947). Another key case to know is Upjohn Co., v. U.S. 449 U.S. 383 (1981).  For an authoritative digest of case law on the subject with an e-discovery perspective, download and study The Sedona Conference Commentary on Protection of Privileged ESI 2015.pdf (Dec. 2015).

EXERCISES: Study Judge Andrew Peck’s form 502(d) order.  You can find it here. His form order started off as just two sentences, but he later added a third sentence at the end:

The production of privileged or work-product protected documents, electronically stored information (“ESI”) or information, whether inadvertent or otherwise, is not a waiver of the privilege or protection from discovery in this case or in any other federal or state proceeding. This Order shall be interpreted to provide the maximum protection allowed by Federal Rule of Evidence 502(d).
Nothing contained herein is intended to or shall serve to limit a party’s right to conduct a review of documents, ESI or information (including metadata) for relevance, responsiveness and/or segregation of privileged and/or protected information before production.

Do you know the purpose of this additional sentence? Why might someone oppose a 502(d) Order? What does that tell you about them? What does that tell the judge about them? My law firm has been opposed a few times, but we have never failed. Well, there was that one time, where both sides agreed, and the judge would not enter the stipulated order, saying it was not necessary, that he would anyway provide such protection. So, mission accomplished anyway.

Do you think it is overly hyper for us to recommend that a 502(d) Order be entered in every case where there is ESI review and production? Think that some cases are too small and too easy to bother with that? That it is o.k. to just have a claw-back agreement? Well take a look at this opinion and you may well change your mind. Irth Solutions, LLC v. Windstream Communications, LLC, (S.D. Ohio, E Div., 8/2/17). Do you think this was a fair decision? What do you think about the partner putting all of the blame on the senior associate (seven-year) for the mistaken production of privileged ESI? What do you think of the senior associate who in turn blamed the junior associate (two-year)? The opinion does not state who signed the Rule 26(g) response to the request to produce. Do you think that should matter? By the way, having been a partner in a law firm since at least 1984, I think this kind of blame-game behavior was reprehensible!

Students are invited to leave a public comment below. Insights that might help other students are especially welcome. Let’s collaborate!

 

Leave a Comment » | AI Ethics, Evidence, Lawyers Duties, New Rules, Review, Search, Spoliation/Sanctions, Technology | Tagged: , , , , , , , , | Permalink
Posted by Ralph Losey

Added to the 13th and 14th Class of the TAR Course

June 25, 2017

Notice to all TAR students and anyone else who might be interested in my latest thoughts on AI-enhanced document review, new material has been added to the e-Discovery Team’s TAR Course. The new content includes two video lectures that provide examples of applications of the methods taught. One new video is placed at the end of Class 13 on Random Prevalence. That is Step Three in the standard eight-part work flow. The other more lengthy video is at the end of  Class 14 on Steps Four, Five and Six. This video provides an example of the iterated training cycle.

Class Fourteen is the longest, most difficult class in the Course. It could be broken down into three, easier to manage classes. But the three iterated steps 4-5-6 do go together, so logically they should be taught together in one long class. In the new video for this class, which is shown in two parts due to length, Ralph gives an example of this workflow and also discusses quality control. The video refers to a new graphic added, a screen shot of an actual case we handled. New text was also added to explain the folder naming protocol we typically use to keep track of our search activities in predictive coding projects.

You can go to the classes themselves, Class 13 and Class 14, where you will find the new materials at the end. Or you can keep reading here where the new material added is reproduced in full.

Thirteenth Class: Step Three – Random Prevalence

We close this class with an example to illustrate how this prevalence step works. Below is a screen shot of a project Ralph was working on in 2017 using KrolLDiscovery software. In the video that follows Ralph explains the prevalence calculation made in that case and how it helped guide his efforts. You will see another video discussing this case at the end of the next class.

By the way, Ralph misspoke in the video at point 8:39 when he said 95% confidence interval, he meant to say 95% confidence level. The random sample of 1,535 documents created a probability of 95% +/- 2.5%, meaning a 95% confidence level subject to an error range or interval of plus or minus 2.5%.

Fourteenth Class: Steps Four, Five and Six – Iterate

Concluding Case Example

We conclude this class with a two-part video where Ralph illustrates the 4-5-6 steps taken on a particular case. The same case was discussed in the last class. Just above his video is the screen shot of the various document directories that he named to record his efforts up to the eleventh round of training. Each directory contains the actual documents referenced and details of the search itself, what you could call the search metadata. (Those are not shown in the screen shot.) Each directory may also contain multiple sub-directories of documents that illustrate other searches. The directories can further nest as per standard computer protocols.

This kind of directory naming protocol serves to document the key procedures you followed. It is an outline of your work-flow. Each directory contains the electronic files you retrieved by each procedure. This makes it easier to refresh your memory and quickly access the underlying documents found from different searches. You can, if need be, also contemporaneously create a detailed memorandum that further documents each step. We sometimes do so in special cases, but here we only used this far-quicker folder naming protocol and did not also create a memorandum to file. We do this largely as a cost and time-savings measure. The preparation of a full, detailed narrative of work flow can become quite time consuming and expensive. Whereas using this protocol to create a running record of your activities takes comparatively little time.

It is important for quality control purposes to keep a history of your work like this, even if it is just in outline form. The folder histories we create are fairly short and abbreviated, as you can see, but they were originally far less detailed than this. We have found that this level of detail of work description, combined with the actual documents, makes it easier to analyze your efforts and decide what to do next. Yes, it takes some time to do this, and slows your work a little bit, but it is well worth the efforts from the gains in quality that you will achieve.

As an added benefit, this kind of history also strengthens the defensability of your efforts. Although we are almost never challenged, if we were, we could easily recreate and explain our actions. That kind of evidence could be required in exceptional circumstances to prove that reasonable efforts were made under Rule 26(g) Federal Rules of Civil Procedure or other rules and law. As you might imagine, Losey can testify for hours, if need be, on predictive coding and the 4.0 methods that were followed in a particular case in which he was involved. He would provide this testimony by relying on his memory, refreshed by contemporaneous notes like you see in the screen shot below. You can do the same.

____

____

_

e-Discovery Team LLC COPYRIGHT 2017

ALL RIGHTS RESERVED

_

Comments Off on Added to the 13th and 14th Class of the TAR Course | Lawyers Duties, Metadata, Related Legal Webs, Review, Search, Spoliation/Sanctions, Technology, VENDORS | Tagged: , , , , , , , , , , , , , | Permalink
Posted by Ralph Losey

Attorney’s Duty of Confidentiality and the New ABA Ethics Opinion 477: ‘Securing Communication of Protected Client Information’

May 15, 2017

This essay focuses on a lawyer’s ethical duty of confidentiality. It consists of a video of my lecture on this subject discussing the main ethics opinions on electronic communications and encryption. Just a few days after the video was made, the American Bar Association Standing Committee on Ethics and Professional Responsibility published an important new Formal Opinion 477 (May 11, 2017) entitled Securing Communication of Protected Client Information. This new Opinion is covered in some detail after the videos.

The duty to protect a client’s secrets is so important that I have also added these videos to the eighty-five class e-Discovery Team Training course in Module 4-K.  I have also added the written discussion on the new Formal Opinion 477.

Rule 1.6 – Confidentiality of Information

The following Duty of Confidentiality lecture is based on the ABA Model Ethics Rule 1.6 – Confidentiality of Information:

(c) A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.

See eg: NY Bar Opinion 749, 2/21/17 (“Duty to protect a client’s confidential information from cybersecurity risk and handling e-discovery when representing clients in a litigation or government investigation.”)

______

See: ABA Formal Op. 99-413 (Mar. 10, 1999):

A lawyer may transmit information relating to the representation of a client by unencrypted e-mail… because the mode of transmission affords a reasonable expectation of privacy from a technological and legal standpoint.

Also see: Cal. Op. 2010-179

Encrypting email may be a reasonable step for an attorney to take … when the circumstance calls for it, particularly if the information at issue is highly sensitive and the use of encryption is not onerous.

See: State Bar of Texas, Opinion 648 (2015) that identified several instances where encryption or some other method of security may be appropriate, including:

  • communicating highly sensitive or confidential information via email;
  • sending an email to or from an account that the email sender or recipient shares;
  • sending an email to a client when it is possible that a third person (such as a spouse in a divorce case) knows the password to the email account, or to an individual client at that client’s work email account, especially if the email relates to a client’s employment dispute with his employer (see ABA Comm. on Ethics and Prof’l Responsibility, Formal Op. 11-459 (2011));
  • sending an email if the lawyer is concerned that the NSA or other law enforcement agency may read the lawyer’s email communication, with or without a warrant.

May 11th 2017 ABA Opinion: Securing Communication of Protected Client Information

After I created the above video the ABA published a new opinion on lawyer confidentiality, Formal Opinion 477 (May 11, 2017) (hereinafter “Opinion“). The Opinion was written by the American Bar Association Standing Committee on Ethics and Professional Responsibility. It addresses the reasonable efforts lawyers and law firms must take to ensure that communications with clients are secure and not subject to inadvertent or unauthorized security breaches. It updates Formal Opinion 99-413 quoted above and discussed in the video. This update was sorely needed and very well done. My congratulations to the Committee. I expect many state Bars to follow and adopt this ABA recommendation. I urge you to carefully read this new Opinion in full. Here is the ABA introductory synopsis:

Securing Communication of Protected Client Information

A lawyer generally may transmit information relating to the representation of a client over the internet without violating the Model Rules of Professional Conduct where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access. However, a lawyer may be required to take special security precautions to protect against the inadvertent or unauthorized disclosure of client information when required by an agreement with the client or by law, or when the nature of the information requires a higher degree of security.

The Standing Committee on Ethics and Professional Responsibility goes on to explain in the Opinion how much things have changed since the 1999 opinion on the use of unencrypted email.

[T]he term “cybersecurity” has come into existence to encompass the broad range of issues relating to preserving individual privacy from intrusion by nefarious actors throughout the Internet. Cybersecurity recognizes a post-Opinion 99-413 world where law enforcement discusses hacking and data loss in terms of “when,” and not “if.”4 Law firms are targets for two general reasons: (1) they obtain, store and use highly sensitive information about their clients while at times utilizing safeguards to shield that information that may be inferior to those deployed by the client, and (2) the information in their possession is more likely to be of interest to a hacker and likely less voluminous than that held by the client.5

Opinion pg. 2.

The Standing Committee again “rejects requirements for specific security measures (such as firewalls, passwords, and the like)” and stays with the “reasonable efforts” standard. This somewhat controversial position is made in reliance of the ABA Cybersecurity Handbook (ABA 2013) which, instead of mandating specific security measures such as encryption:

… adopts a fact-specific approach to business security obligations that requires a “process” to assess risks, identify and implement 101 appropriate security measures responsive to those risks, verify that they are effectively implemented, and ensure that they are continually updated in response to new developments.12

Opinion quoting Cybersecurity Handbook at pg. 4. You see the Committee is moving slowly and cautiously. That is prudent here because so much training is required to bring the Bar up to speed on the many arcane technicalities involved in cybersecurity and encryption. This is fast becoming The Hot Specialty in the legal profession. Electronic Discovery is so yesterday. If I were not so involved in the AI aspects of searching for evidence in near-infinite haystacks of information, I would try to include this specialty too. But for now at least it is too challenging to try to do both at once.

The Opinion points out that a fact-based analysis means that strong protective measures, like encryption, are necessary in some circumstances. Encryption software and use-procedures are becoming easier. Now any intelligent person can understand the processes and use them effectively, not just cryptologists. All lawyers should either learn this or associate with an attorney who does. We all need more training in this area, myself included, to stay competent in the fast-moving information explosion era. All of the illegal hacking going on today is outrageous.

In other circumstances involving certain highly sensitive information (such as, in my opinion, classified military information, or certain trade secrets sought by Chinese corporations, as well as certain personal and corporate divorce investigations or political) it may be reasonable to avoid electronic communications altogether. Opinion at pgs. 4-5.

But in most circumstances,

… for matters of normal or low sensitivity, standard security methods with low to reasonable costs to implement, may be sufficient to meet the reasonable efforts standard to protect client information from inadvertent and unauthorized disclosure.

Opinion at pg. 5.

The Committee does not specify the reasonable efforts required in such matters, but does say that “unencrypted routine email generally remains an acceptable method of lawyer-client communication.” Opinion pg. 5. The Opinion at pgs. 5-10 then provides a list of considerations as guidance:

  1. Understand the Nature of the Threat.
  2. Understand How Client Confidential Information is Transmitted and Where It Is Stored.
  3. Understand and Use Reasonable Electronic Security Measures.
  4. Determine How Electronic Communications About Clients Matters Should Be Protected.
  5. Label Client Confidential Information.
  6. Train Lawyers and Nonlawyer Assistants in Technology and Information Security.
  7. Conduct Due Diligence on Vendors Providing Communication Technology.

Well done by the Committee. An update on this topic was sorely needed. Now a wide-spread education program to explain the seven guidance points is in order. Time will tell how long this complex technical guidance will suffice. How long will it be before encryption of some level becomes a per se rule. How long before encryption is required in all attorney communications. It will be required some day, of that I am sure. Just not today. Still, if I were the Committee I would be working on a draft.

My Prediction of Future Tightening of Attorney Ethics Due to Increased Cybersecurity Concerns

The Opinion is the last word for now, but I predict that sometime within the next five years the American Bar Association Standing Committee on Ethics and Professional Responsibility will agree on a new Formal Ethics Opinion. The next opinion will, I predict, require encryption in all electronic communications and all Electronic Information, whether in transit or in storage. The “it depends” exceptions in the current Opinion will be eliminated. The predicted opinion will likely impose additional duties on attorneys and law firms to protect client data.

The expected expanded duties will cause disruptive change to the profession. It will be difficult for many lawyers and law firms to keep up. But I predict the Bar will have no choice but to do so because of accelerating advances in hacker technology. These advances will further empower criminal and state hacking. We are already seeing these developments now. See eg.: Perlroth & Sanger, Hackers Hit Dozens of Countries Exploiting Stolen N.S.A. Tool (NYT, 5/12/17); Keren Elazari, We must act now to prevent future malware epidemics (Financial Times, 5/14/17).

The development of Bitcoin and other anonymous currencies adds to our problem because they facilitate untraceable extortion payment schemes, one form of which is known as ransomware. We are seeing this now in the WannaCry exploit. Damian Privitera, Global Cyberattack Exploits Known Vulnerabilities  (Jackson Lewis, 5/15/17); What is WannaCry and how does ransomware work? (The Telegraph, 5/13/17); WannaCry cyber attack (wikipedia); Scott & Wingfield, Hacking Attack Has Security Experts Scrambling to Contain Fallout (NYT 5/13/17).

Unprotected email, websites and other ESI repositories are an invitation to blackmail. Illegal hacking tools are already easily available to any criminal or script kiddie with rudimentary computer skills. It is no longer the exclusive area of the hacker elite.  Nothing is safe without back-ups, encryption and other protections, including attorney client communications and law firm ESI. Even mundane communications have metadata value that may help hackers. The situation grows worse every year. As a result, lawyers will, in five years or so, likely be required to use encryption and other confidentiality tools in all communications, include the mundane. It will be automatic. There will be no if and or buts.

In view of what seems to be an inevitable requirement of full encryption, all lawyers and law firms should start preparing now. Your CISOs and attorneys should start working together on this requirement as soon as possible. See eg., Lazzarotti, et al, Ransomware Attacks: Prevention and Preparedness (Jackson Lewis, 5/14/17). It never hurts to stay ahead of the curve. You will succeed if you work together as a team for the common good. Neither technologists nor lawyers should dominate. Natural leader(s) of the team can emerge from both sides and change over time. The use of outside specialists is, as always, a key ingredient for success, not only for the expertise, but also for the objective perspective.

Conclusion

Confidentiality is a critical problem facing all lawyers today. We all need to stay proficient in this area, including especially the uses of encryption. The smooth operation of our system of justice depends on the confidentiality of the attorney client relationship. Lawyers must be able to maintain  the secrecy of their clients’ ESI. They must also protect their own work-product, including investigations, strategies, mental impressions and communications. The ABA Formal Opinion 477 (May 11, 2017) is a helpful addition to this literature. But it is, I think, just a harbinger of even more stringent ethical requirements to come. The increasing cyber dangers and failures of security will force the ABA to go much further than this. We all need to spend more time increasing our knowledge in this important area.

For further reading I suggest the following articles and information resources.

  1. Joe Lazzarotti

    R. Losey, eDiscoverySecurity – Addresses cybersecurity issues from an e-discovery perspective.

  2. Joseph J. Lazzarotti, Damon W. Silver (Jackson Lewis), Data Privacy Primer for Law Firms (April, 2017). Excellent resource of all lawyers.
  3. Lazzarotti and Silver, Cybersecurity Risk Management for Law Firms (April 5, 2017) (requires registration, but is free). Jackson Lewis CLE Webinar.
  4. Jackson Lewis blog, Workplace Privacy, Data Management & Security Report.
  5. Lazzarotti, Law Firms: Updated Cybersecurity Primer and Other Resources (Jackson Lewis, 5/15/17).
  6. Lazzarotti, et al, Ransomware Attacks: Prevention and Preparedness (5/14/17).
  7. Ethics Opinions Related To Technology (Calif. Bar).
  8. ABA Legal Technology Resource Center.
  9. ProtonMail.com – Free Encrypted Email.
  10. GoldenFrog.com – Internet Security, Encryption.
  11. Confide – Confidential Text Messages, Encryption Plus.

Comments Off on Attorney’s Duty of Confidentiality and the New ABA Ethics Opinion 477: ‘Securing Communication of Protected Client Information’ | Evidence, Forensic Exam, informaton, knowledge, Lawyers Duties, Metadata, New Rules, Related Legal Webs, Review, Search, Security, Spoliation/Sanctions, Technology, VENDORS, wisdom | Tagged: , , , , | Permalink
Posted by Ralph Losey

The Nine Tasks the California Bar Says an Attorney Must Know to be Competent in e-Discovery

May 7, 2017

The California Bar issued an important ethics ruling in mid-2016 that all lawyers should know about. The State Bar of California Standing Committee on Professional Responsibility and Conduct Formal Opinion No. 2015-193 (final version August 2016). The key component of the Opinion is the list of nine tasks that an attorney should either be able to do, or, if they cannot, to associate with other legal counsel who does. Below is the language from the Opinion that describes these tasks followed my video explanation of the knowledge required to competently perform them. The video is divided into four parts with some intentional overlap for emphasis.

Just a few years ago this kind of knowledge was considered arcane and was only known by e-discovery specialists. Now the California Bar has taken a bold leap forward to make this knowledge required for all attorneys who litigate in California. The California Bar has thus raised the bar of competence for everyone by making this an ethical imperative in their state. Note, that as footnote seven to the Opinion makes clear, this is not intended to be an exhaustive list. For instance, attorneys must also know how to properly obtain an opposing party’s ESI.

This development is so important that I have also added these videos to the TAR Course, class one of sixteen, and to the eighty-five class e-Discovery Team Training course in Module 1-N, which is now entitled Ken Withers on Discovery and Cooperation, the Sedona Cooperation Proclamation, and the California Bar Ethics Opinion Setting Forth Nine Minimum e-Discovery Skills That All Attorneys Should Know.

California Formal Opinion on Ethics No. 2015-193 (final version August 2016), at pages 3-4:

Attorneys handling e-discovery should be able to perform (either by themselves or in association with competent co-counsel or expert consultants) the following:

1. Initially assess e-discovery needs and issues, if any;

2. Implement/cause to implement appropriate ESI preservation procedures;

3. Analyze and understand a client’s ESI systems and storage;

_____

_____

4. Advise the client on available options for collection and preservation of ESI;

5. Identify custodians of potentially relevant ESI;

_____

6. Engage in competent and meaningful meet and confer with opposing counsel concerning an e-discovery plan;

7. Perform data searches;

_____

8. Collect responsive ESI in a manner that preserves the integrity of that ESI; and

9. Produce responsive non-privileged ESI in a recognized and appropriate manner. FN7

____

FN 7 – This opinion focuses on an attorney’s ethical obligations relating to his own client’s ESI and, therefore, this list focuses on those issues. This opinion does not address the scope of an attorney’s duty of competence relating to obtaining an opposing party’s ESI.

Conclusion

California is now leading the charge in pushing for e-discovery competence. It may be a while before other state Bar associations are bold enough to follow suit, but eventually they will. In the meantime California lawyers have the same challenges of competence as the rest of the country, but for them, it is now an ethical imperative. It will be interesting to see if this opinion has the intended effect and raises the competency bar of all litigating attorneys in California. Alternatively, it could significantly increase the consulting and co-counsel work of e-discovery lawyer specialists. It will probably be a combination of both, but I suspect the greatest impact will be in boosting the specialty. Those who can easily pole vault over the new standards may soon have more work than they can handle.

3 Comments | Evidence, Forensic Exam, informaton, knowledge, Lawyers Duties, Metadata, New Rules, Related Legal Webs, Review, Search, Security, Spoliation/Sanctions, Technology, VENDORS, wisdom | Tagged: , , , , , , , , , , , , , | Permalink
Posted by Ralph Losey

« Previous Entries
%d bloggers like this: