When your ESI isn't in your control

One of the emerging challenges in eDiscovery is the fact that more and more potentially discoverable information is being created and stored on social media sites or in the "Cloud," meaning that it is on someone else's storage medium, and in a physical location that the creator and end-user may or may not know about. Collecting and producing data stored on the internet is a challenge that litigants will have to face going forward.

For data that is on company owned (or controlled) hardware it is much easier to make native and forensically-sound copies of any data for review and production. In that event you have direct access to the hardware (most likely) and the systems that it is stored on, to run whatever software or alter whatever hardware you may need. 

Now, employees tweet, CEO's Facebook and everyone is using services like DropBox to store documents, including business-related ones, "in the cloud." The practice of dealing with this information is not yet mature.

Recent cases have suggested that Twitter profiles and other social media can be demanded by party opponents in discovery. That makes it important for companies to know how to collect and preserve this ESI in addition to the emails and documents that are already being handled.

ComputerWorld recently addressed the issue of social media collections in an article "Are social media e-discovery's next nightmare?" There, they go through a number of methods of collecting this data. Some are simplistic, like using a "web crawler" application to visit the relevant social media sites and save the pages that contain ESI to a local harddrive, or taking screenshots of the relevant pages. Others are more complex, like creating custom applications that interface with different social media platforms to pull their data and metadata in a "native" format.

Getting the metadata as well as the actual content of the postings will often provide more context than a simple screenshot. How was the post made (Twitter users use a variety of applications to post content), when was it made (services like Facebook allow postings to be scheduled or backdated), and perhaps even who has viewed the posting.

The best method may be for the various platform providers to offer their own tools for retrieving this data. Twitter is reportedly planning to release a tool to allow users to download their backlog of tweets from the service's archive. Facebook similarly allows users to download all of their profile data, photos and chats from the service. If other services ultimately do the same, it would be a great benefit to the eDiscovery world to have easier access to all of the relevant aspects of that ESI.

Currently, there collection of this social media data remains complicated, however, and companies should have social media policies in place that are designed to limit the use of these services for sharing business information. Those policies may not completely prevent the need to collect or produce this information, it may limit the amount of information that needs to be produced. 

As for information stored in the "cloud," ComputerWorld notes:

Under the Federal Rules of Civil Procedure, a party to litigation is expected to preserve and be able to produce electronically stored information that is in its "possession, custody or control." But in the cloud, the situation isn't so clear. Information that's electronically stored in the cloud is presumably under your control, but it may not technically be in your possession, says James M. Kunick, principal and chair of the intellectual property and technology practice at law firm Much Shelist.

The terms of any agreement with a Cloud provider are vital when it comes to eDiscovery. When the data stored is not in the possession of the company that controls it, it may be difficult or expensive to retreive that data in a format suitable for production.

That means that using services like DropBox, which are available to the general public, might not be the best decision for big businesses. For large companies that have significant amounts of data to store on these systems, it is important to negotiate contract terms that ensure that the company retains ownership of it's data and intellectual property and retains access to that ESI, to use it, copy it, export it, or delete it as needed.

Adopting new technologies and services is important for keeping up with the fast pace of modern business, but when those technologies affect the way you create, store and access business data, the challenges for litigation are inherent.