Legal Discovery Should Focus on Electronic Evidence

In 1998 America, businesses have computerized almost all of their important business records. The larger the business, the more this is a truism. Experts estimate that up to 30% of the data on computers is never printed. Yet, many lawyers continue to live in an earlier era when it comes to their discovery requests in litigation. They continue to request paper printouts and documents when their focus should be the underlying computer files. Here's how to get to the heart of the electronic evidence.

Notice

You're first step is to put the other side on notice of your intent to seek computerized records during discovery. ("Discovery" is the court procedure that forces both sides in a lawsuit to exchange information. Discovery includes depositions, requests for documents, interrogatories and other things.)

Notice is important because courts will sanction parties that destroy or modify computer records. The key to getting that sanction is showing the court the other side had notice and still destroyed or modified the computer files. At the same time that you send your notice letter, you should seek an appropriate court order requiring the preservation of electronic evidence. You may need to be innovative on this preservation of evidence issue.

For example, you may want to request that the other side permit you to make an immediate sector-by-sector copy of some hard drives. They could then be held by an appropriate third party, like a special master, until the court has the opportunity to decide what information you should be given from that hard drive. You must emphasize to the court that computer information tends to be dynamic and that you need to take an immediate snapshot of that information before the computer alters it in the ordinary course of business. You must also argue for a sector-by-sector copy and not a file-by-file one because sometimes the best information isn't in the files. Rather, it's in random sectors on the hard drive that were part of files until the files were "deleted."

In case you don't know it, when a PC "deletes" a file, it leaves the information intact on the hard drive. It's there until new information overwrites it. These overwrites occur in a somewhat random process. Until the computer overwrites this information, it's potentially "smoking gun" material waiting for a thorough and techno-savvy lawyer to find it.

System Layout

After you get your preservation order, you should use interrogatories (written questions to a party that must be answered in writing and under oath) and depositions (sworn oral testimony) to learn about the computer system's topography. You'll probably want to focus on the staff of the Information Systems (IS), Information Technology or general computer department.

You want to ask about such items as the operating systems and software used, the backup routines, the location of storage for backups, archiving procedures, system security including encryption, logs and audit trails maintained, remote access ability, directory structure and other things. For obvious reasons, you can anticipate that they will resist revealing anything about system security and remote access. You'll need to be as narrow as possible in your requests in these areas, but you need to know who can alter files, control the system and whether they can do it from outside the office.

In your discovery, you must be sure to focus on what are often weak links in an evidence destruction effort -- backups, diskettes, home computers and laptops. (Maybe I shouldn't be so harsh. I know that the other side never engages in document destruction. Rather, when they're deleting documents, they're implementing the corporation's Document Retention Policy.)

The lore of electronic discovery is filled with stories of backups with smoking guns. This happens because many companies and organizations archive backups indefinitely. (Oliver North's undoing was the White House's archival backup system that he didn't even know existed. While he shredded and deleted, the backup system saved for posterity.)

While they may have sanitized the current data that you get in discovery, it's much harder for anybody to sanitize backups. In fact, I would say that it would take a massive effort by experts even to attempt it. The problem is that indications of the approximate date of the tampering would likely fill the tampered backups. Rather, I think that the expert looking for tampering is the likely winner over the expert attempting it.

Keep Digging

You must develop a new habit. In every single deposition of every witness, you must ask them about their use of computers. What software do you use? In what directories do you store your files? Do you use any file naming conventions? What passwords do you use? While they inevitably don't want to tell you this, you need to ask and let the court decide the parameters on compelling the revelation of passwords. Who has access to your system? Who knows your passwords? Where is your server physically located? Do you have a home computer or laptop? Do you take work home? How do you transfer data between your home, office and laptop? Do you use encryption? What type of encryption do you use? What files do you encrypt? You can be sure that the encrypted ones are the juicy ones.

Computer skills and knowledge vary widely. This line of questioning helps you determine the witness' skill and sophistication. You may learn that the witness doesn't have the answers to any of these questions in which case you may want to focus on the secretary or assistant. Often, the good stuff is on the secretary's computer.

It's probably largely a generation thing, but many lawyers are still extremely uncomfortable around computers. Even the ones who can use computers themselves don't feel qualified to ask computer people about system topography and software. Either way, you just can't ignore the potential of electronic evidence.