Law Review Article Published on the Mathematics Underlying e-Discovery: “HASH: The New Bates Stamp”

This is a really good article on hash algorithms by Ralph C. Losey (HASH: The New Bates Stamp) . Originally Published in the Journal of Technology Law & Policy 1 (June 2007) it offers a compelling new concept / solution for tagging and identifying ESI.

Even if you do not consider yourself to be on the "technical" side of eDiscovery, understanding the hash alogrithm or "hash stamp" is fundemental to anyone wanting to understanding how eDiscovery technology works. Not only can the harsh stamp identify all computer documents like the 100-year-old Bates stamp does for paper documents, it can also authenticate them and reveal if there have been any alterations from the original. This would serve to protect the legal profession from the ever-present danger of fraudulent manipulation of the ephemeral bits and bytes that now make up electronic evidence.

The authentication properties of hash have long been known and used in e-discovery, but there was a serious problem with also using hash as a naming protocol: hash values are way too long.

The two most common kinds of hash are called MD5 and SHA-1. An MD5 hash is 32 alphanumeric values, and the SHA-1 has 40 places. Here is an example of the shorter MD-5 hash: 5F0266C4C326B9A1EF9E39CB78C352DC

For all practical purposes, either of these numbers are too long for normal humans to use to identify an electronic document. For that reason, hash was deemed impractical for use as a document naming protocol, even though it had tremendous advantages in authenticity control.

This where Ralph, the author is this article, got the got the “big idea” last September to truncate the hash values and just use the first and last three places. Under that system the above hash becomes the much more manageable: 5F0.2DC

As explained further in the Article, the six place identification alone avoids collisions 98.6% of the time. In the rare event they match, the full hash values can be consulted. Ralph, who I beleive understates his technical capabilities and insight, gives credit to computer expert, Bill Speros, an attorney consulting in litigation technology and data management, for doing the statistical study to confirm his theory.

So, if you are at all interested in keeping up with eDiscovery technology, this article is well worth reading.

Labels: Bates Stamps, Discovery, eDiscovery, ESI, FRCP, Hash, Litigation, Litigation Mathematics, MD5, SHA-1, The New Bates Stamp

posted by Charles Skamser @ 10:28 AM 0 Comments

The eDiscovery Paradigm Shift

Clausewitz and eDiscovery

From: wrrobinson, 6 months ago





A unique look at the principles of war derived from military theorist Clausewitz and how Clausewitz might apply those principles to the challenges of electronic discovery.




SlideShare Link

Labels: Discovery, eDiscovery, ESI, FRCP

posted by Charles Skamser @ 5:14 PM 0 Comments

Chain of Custody Study

Regardless of the collection method employed, strict chain of custody records must be maintained for all documents, data, and objects collected so that their authenticity can be assured. Without this assurance the data may not be reliable as evidence in litigation. Every collector, whether a third party vendor, an internal corporate representative or outside counsel representative should document procedures for accepting, storing, and retrieving documents, in the event that he or she may be called upon to testify.

Chain of custody records should be maintained for every "touch" of each item by a search operator. Because the volume of audit history that a large-scale collection project generates can be enormous, selecting tools and processes with automated audit history and the scalability to handle all the audit data is extremely important. Technologies such as Windows Event Logs or Syslog have been proven to scale adequately. Numerous native and third-party solutions exist to parse through, analyze, summarize and report on those types of data logs.

I am in the process of developing a whitepaper regarding "Chain of Custody". As such, I am looking for examples, where:

(1) standard and reasonable Chain of Custody Best Practices were followed and the outcome was as expected (i.e. there were not issues);
(2) standard and reasonable Chain of Custody Best Practices were followed and the outcome was as not as expected (i.e. there were issues);
(3) standard and reasonable Chain of Custody Best Practices were not followed and as a result there were issues.

As part of my investigation, I am looking for written Chain of Custody Best Practices and any onDemand software solutions that have been developed, either home grown or commercially available, to support Chain of Custody.

Labels: Chain of Custody, Discovery, eDiscovery, ESI, Litigation

posted by Charles Skamser @ 3:37 PM 0 Comments

Preservation

Preservation for eDiscovery has become a complicated, multi-faceted, evolving concept. Starting with the nebulous determination of when the duty to preserve arises, then continuing into the litigation hold process and the staggering volumes of material which may need to be preserved (ESI and hard copy) in multiple global locations, platforms and formats, the task of preservation is an enormous challenge for the modern litigator.

Seeking a foundation in reasonableness, wrestling with the scope of preservation is often an exercise in finding an acceptable balance between offsetting the risks of spoliation and sanctions related to destruction of evidence, against allowing the business client to continue to operate its business in a somewhat normal fashion.

I am curious if anyone has developed a standard approach and/or best practices within your organziations, whether on the legal side or the business / IT side to address the mutlitude of issues and constantly changing expectations surrounding Preservation?

Further, I am interested in hearing from any vendors that have developed Software-as-a-Service (SaaS) offering to support and/or automate the preservation process.

In the weeks to come, I will be posting my research and own ideas on this subject along with all of your resopnses.

Labels: eDiscovery, ESI, FRCP, Litigation, Meet and Confer, Preservation

posted by Charles Skamser @ 2:45 PM 4 Comments

Electronic Discovery Reference Model

Having been in the software development industry for for the 25 years and therefore exposed to standards and best practices such as CMMI and Six Sigma, it is very comforting to know that the eDiscovery Industry as set forth on a path to define its own standards throught the Electronic Discovery Reference Model (EDRM).












Launched in May 2005, the Electronic Discovery Reference Model (EDRM) Project was created to address the lack of standards and guidelines in the electronic discovery market - a problem identified in the 2003 and 2004 Socha-Gelbmann Electronic Discovery surveys as a major concern for vendors and consumers alike.

Given the fact that the EDRM provides the beginnings of a standard roadmap and best practices, this Blog will be reffering to the EDRM frequently.

The completed reference model provides a common, flexible and extensible framework for the development, selection, evaluation and use of electronic discovery products and services. The completed model was placed in the public domain in May 2006.

Labels: eDiscovery, EDRM, ESI, FRCP, Litigation, Meet and Confer

posted by Charles Skamser @ 2:12 PM 0 Comments

Changes in Federal Rules of Civil Procedure

Given the provocative focus of this Blog, I decided that the initial post needed to provide the statutory foundation for this Paradigm Shift. As such, on December 1, 2006, the electronic discovery-related amendments to the Federal Rules of Civil Procedure went into effect. Following is a summary of the electronic discovery amendments:

Rule 16(b)(5);(6): Pretrial Conferences, Scheduling Management.The scheduling order entered under this rule includes provisions for disclosure or discovery of electronically stored information and permits the parties to reach agreements for asserting claims of privilege or protection as trial-preparation material after production.

Rule 26(a)(1)(B): General Provisions Governing Discovery; Duty of Disclosure; Required Disclosures; Methods to Discover Additional Matter.This rule requires that parties, without awaiting a discovery request, provide to other parties a copy of, or description by category and location of, electronically stored information.

Rule 26(f)(3);(4): General Provisions Governing Discovery; Duty of Disclosure; Conference of Parties; Planning for Discovery.This rule requires that parties confer to discuss any issues relating to preserving discoverable information and any issues related to disclosure or discovery of electronically stored information. This includes the form or forms in which electronically stored information should be produced, and any issues relating to claims of privilege or protection as trial-preparation material. If the parties agree on a procedure to assert such claims after production, the parties should discuss whether to ask the court to include this agreement in an order.

Form 35: Report Parties Planning Meeting.The form adds a brief description of the parties' proposals for handling the disclosure or discovery of electronically stored information.

Rule 26(b)(2)(B): General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; Limitations.The rule provides that a party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost. On both a motion to compel discovery or for a protective order, the burden is on the responding party to show that the information is not reasonably accessible because of undue burden or cost. Even if that showing is made, the court may nonetheless order discovery from that party if the requesting party shows good cause, considering the limitations that are set forth in Rule 26(b)(2)(C) (i.e. whether the discovery sought is cumulative, burden of expense outweighs the benefit, etc.). The court may also specify conditions for the discovery.

Rule 26(b)(5)(B): General Provisions Governing Discovery; Duty of Disclosure; Discovery Scope and Limits; Claims of Privilege or Protection of Trial Preparation Materials; Information Produced.This rule provides that if information is produced in discovery that is subject to a claim of privilege or protection as trial-preparation material, the party making the claim may notify any party that received the information of the claim and the basis for it. After being notified, a party is required to promptly return, sequester, or destroy the specified information and any copies it has and may not use or disclose the information until the claim is resolved. A receiving party may promptly present the information to the court under seal for a determination of the claim. If the receiving party disclosed the information before being notified, it must take reasonable steps to retrieve it. The producing party is required to preserve the information until the claim is resolved.

Rule 33(d): Interrogatories to Parties; Option to Produce Business Records.This rule provides that where the answer to an interrogatory may be derived from electronically stored information, and the burden of deriving the answer is substantially the same for the responding party and the requesting party, it is a sufficient answer to the interrogatory to specify the records from which the answer may be derived or ascertained. The responding party must allow the requesting party reasonable opportunity to examine, audit of inspect such records and make copies, compilations, abstracts or summaries.

Rule 34(a);(b): Production of Documents, Electronically Stored Information, and Things and Entry Upon Land for Inspection and other Purposes; Procedure.This rule provides that any party may serve on any other party a request to produce electronically stored information. The rule would also permit the party making the request to inspect, copy, test or sample electronically stored information stored in any medium from which information can be obtained - translated if necessary by the responding party into a reasonably usable form. The rule provides that the request may specify the form or forms in which electronically stored information is to be produced. The producing party may object to the requested form or forms for producing electronically stored information stating the reason for the objection. If an objection is made to the form or forms for producing electronically stored information - or no form was made in the request - the responding party would be required to state the form or forms it intends to use. If a request does not specify the form or forms for producing electronically stored information, a responding party must produce the information in a form or forms in which it is ordinarily maintained or in a form or forms that are reasonably usable. A party need not produce the same electronically stored information in more than one form.

Rule 37(f): Failure to Make Disclosures or Cooperate in Discovery Sanctions; Electronically Stored Information.This section of Rule 37 provides that absent exceptional circumstances, a court may not impose sanctions under the rules on a party for failing to provide electronically stored information lost as a result of the routine, good faith operation of an electronic information system.

Rule 45 Subpoena; Form; Issuance: This rule adds that a subpoena shall command each person to whom it is directed to attend and give testimony or to produce and permit inspection, copying, testing, or sampling of among other things, electronically stored information. In addition, a subpoena may specify the form or forms in which electronically stored information is to be produced. Subpoenas may be served to not only inspect materials but to copy, test or sample those materials. Similarly to Rule 34, if a subpoena did not specify the form or forms for producing electronically stored information, a responding party is required to produce the information in a form or forms in which it is ordinarily maintained or in a form or forms that are reasonably usable; and a party need not produce the same electronically stored information in more than one form. As in Rule 26(b)(2)(B), a party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost. On both a motion to compel discovery or for a protective order, the burden is on the responding party to show that the information is not reasonably accessible because of undue burden or cost. Even if that showing is made, the court may nonetheless order discovery from that party if the requesting party shows good cause, considering the limitations that are set forth in Rule 26(b)(2)(C) (i.e. whether the discovery sought is cumulative, burden of expense outweighs the benefit, etc.). The court may also specify conditions for the discovery. Similarly to Rule 26(b)(5)(B), if information is produced in response to a subpoena that is subject to a claim of privilege or protection as trial-preparation material, the party making the claim may notify any party that received the information of the claim and the basis for it. After being notified a party would be required to promptly return, sequester, or destroy the specified information and any copies it has and may not use or disclose this information until the claim is resolved.

Labels: Discovery, eDiscovery, ESI, FRCP, Litigation, Meet and Confer, Pretrial Conference, Subpoena

posted by Charles Skamser @ 10:06 AM 0 Comments