CRM - 2.C.3 / 3.B.3 - Litigation Support / eDiscovery
___________ is information created, manipulated, communicated, stored, and best utilized in digital form, requiring the use of computer hardware and software. a) ESI b) PDF c) XML d) USB e) RTF
a) ESI
A litigation ___________ is a temporary suspension of destruction of records that maybe relevant for litigation or investigation. a) hold b) case file c) discovery d) agreement e) order
a) hold
The phase of ediscovery when potentially responsive documents are identified for further analysis and review is: a) identification b) preservation c) collection d) processing e) review
a) identification
To potentially limit ___________ ___________, organizations that allow employees to participate in online public forums should add a disclaimer to the body of every email or posting. a) legal liability b) litigation discovery c) phishing opportunities d) security breaches e) disgruntled employees
a) legal liability
The production phase of eDiscovery occurs before ___________ in the eDiscovery reference model. a) presentation b) review c) preservation d) identification e) collection
a) presentation
___________ is the destruction alteration or mutilation of evidence that may pertain to a legal action. a) Deletion b) Spoliation c) Emulsion d) Maceration e) Cancellation
b) Spoliation
A retention schedule should be considered one element of a company's legal ___________ program. a) virtual b) compliance c) department d) storage e) data
b) compliance
When used as evidence in ___________ proceedings, the authenticity of records must be established. a) classification b) judicial c) reformatting d) scanning e) destruction
b) judicial
___________ ___________ is a deliberate and malicious act to interfere with a government investigation or judicial proceeding.
Obstruction of Justice
___________ ___________ occurs when opposing sides request info they believe relevant to lawsuit; prompts the submission of a legal hold/info hold order/record hold.
Requests for Production
A(n) ___________ ___________ is a formal notice notifying custodians that the hold is lifted. Once a long term hold has been lifted, the information should be evaluated to determine whether it still needs to be retained.
Rescission Notice
___________ is the procedure to cease the routine destruction of records when it is determined that those records may be relevant to foreseeable or pending litigation, a government investigation, or a regulatory audit.
Suspension
Preservation Plan
- COMMUNICATION: need to preserve relevant documentation should be communicated as soon as possible via record/legal hold (containing what documentation/date ranges are relevant) - SUSPEND DESTRUCTION: routine lifecycle mgt is halted until hold order is released, records should not be modified or destroyed, systems should also halt automated destruction processes - ENLIST IT: provide IT list of depts/employees who may be owners of relevant documentation; allows IT to identify applications and repositories the custodians use and ensure ESI is not deleted - PRESERVATION COORDINATOR: oversees the protection of relevant documentation
List 4 collection methodologies.
- EMPLOYEE: letting the custodians themselves copy relevant files into a shared drive or portable storage device. Most experts advise against employee self-collection pointing out that most employees aren't technically savvy and are highly likely to make mistakes and overlook key documents; error prone - IT: members of the IT department performing the actual data collection at the direction of legal; preferred method but can be time consuming and keep IT professionals from other business-critical projects - EXTERNAL: 3rd party outside expert is likely to have set procedures and all the necessary tools and skill to perform a collection that will withstand the highest levels of judicial scrutiny; can be very costly - REMOTE: employ a centralized internal collection system that is integrated with company data sources allowing ESI to be collected remote; support more targeted collections by applying search and analytics technologies
eDiscovery Reference Model (EDRM) Phases
- IG - Identification - Preservation - Collection - Processing - Review - Analysis - Production - Presentation
Legal Hold Components
- RECIPEINTS: custodians w/ relevant ESI - DATE: of legal hold notification - MATTER: formal name of lawsuit - RELEVANT DOCS: may also include relevant time frames - FORMAT/TYPE: electronic, physical, structured, unstructured - LOCATION/REPOSITORIES: on-prem, offsite, or on cloud - PRESERVATION INSTRUCTIONS: spells out that custodians should cease until further notice all destruction or modification of relevant ESI - CONFIRMATION OF RECEIPT/HOLD: by custodian, includes confirmation that they are preserving info in their possession - PERIODIC HOLD REMINDERS: should be sent to those on legal hold reminding them the hold has not been lifted, can be distributed by reissuing the original hold notice or through email, intranet, or voicemail, etc., and should be documented to provide proof of company efforts towards hold compliance
Types of ESI that must be collected:
- active - cloud - mobile - offline/archived - backups - hidden/previously deleted
eDiscovery Ethical Considerations
- avoid data dumping - issue timely litigation holds - be thorough and complete when searching for relevant ESI - be careful of revealing trade secrets/privileged info - be knowledgeable of current best practices re technology and privacy
Ways in which legal holds can affect corporate policy:
- change the rules on how data are backed up in a system - how tape vaults or other storage archives are maintained - whether physical storage media are recycled
eDiscovery Validation
- ensure in a cost-effective way whether a set of searches performed in a production request are satisfying and not overly broad - ensure that the validation produces enough results in a timely way, to assess and evaluate whether modification of initial set of searches is required - allow for comparison of alternative search methodologies. - proactively monitor chain of custody, hashing (digital fingerprints), and audit trails to ensure information is reliable
To be considered authentic and reliable, a record must meet the following criteria:
- must have been created at or near the time of the event that is the subject of litigation - must have been created by a person with knowledge of the event - must have been maintained in the regular course of an organization's business
Discovery involves what 4 broad forms or categories of production:
- paper - quasi-paper (TIFF/PDF) - quasi-native or near-native - native
Native File Format
- produced in the same format in which it was created - often a preferred method because it permits users to take advantage of analytic tools in ediscovery software that may not be available if files are converted into image files - when files are converted to images they lose information such as textual content and metadata. Because this data is lost, also lost is the ability to search for information contained in the document - should always include complete and unchanged metadata - must be used for online content such as a company website, social media posts, or online collaboration applications - native-format files with intact, unchanged metadata may become critical to proving an element of the case or to successfully arguing that evidence has been spoliated (i.e. may not help your case!)
To be admissible as evidence, a record must satisfy what two foundation requirements that apply to all evidence?
- record's content must be relevant to the matter at issue - its authenticity must be firmly established
When documentary evidence is destroyed due to retention policy, courts consider what 3 aspects?
- whether there are frequent lawsuits with the same issue - whether the records retention policy is reasonable - whether the document retention policy was issued in bad faith
The ___________ and ___________ of electronic records can be affirmed by thorough documentation of record creation procedures, as well as by descriptions of training given to data entry personnel, video camera operators, or other personnel responsible for creation of electronic records.
Accuracy; Trustworthiness
The key to establishing ___________ for business records is to integrate their creation and maintenance into the records management program prior to the initiation of any litigation.
Admissibility
___________ is guided by the Federal Rules of Evidence (FRE), which apply in federal courts and the Uniform Rules of Evidence (URE), which apply in those state courts where they have been adopted.
Admissibility
___________ is the quality of being permitted to serve as evidence in a trial, hearing, or other proceeding.
Admissibility
___________ ___________ is a written list of facts directed to the other party; they are asked to admit or deny each item.
Admissions of Fact
___________ ___________ is a finding by a court that information contained in records that were inappropriately destroyed by a person or party is incriminating or unfavorable to that party, even though the information is not available to the court.
Adverse Inference
A primary concern regarding the legal admissibility of electronic records is the inability to detect the ___________ of the information.
Alteration
___________ ___________ is the succession of offices or persons having seizure, control, transfer, analysis, and disposition of physical or electronic evidence.
Chain of Custody
ESI is evaluated for content and context, including key patterns, topics, people, and discussion during the ___________ stage.
Analysis
The EDRM phase ___________ involves evaluating ESI for content and context, including key patterns, topics, people and discussion.
Analysis
___________ demonstrates reliability of record to court's satisfaction.
Authenticity
ESI is gathered during the ___________ stage.
Collection
Gathering occurs during the EDRM phase ___________. Whatever approach is taken must be legally defensible, meaning it must ensure that the contents and metadata (key attributes of the data such as date created and file size) aren't altered as a result of the collection process.
Collection
___________ ___________ is a finding by a court or administrative tribunal where the court or tribunal orders documents to be produced by a person or party for use in legal proceedings and the party defies the order by failure to deliver the requested documents to the court.
Contempt of Court
Some ___________ ___________ applications allow certain pre-processing, such as de-NISTING and applying date range and custodian limitations before the ESI is loaded into the processing application.
Data Culling
___________ ___________ is an ongoing, iterative process of searching and limiting your original data based on specific criteria, such as date ranges and keywords to hides documents that may not be relevant to your case.
Data Culling
___________ ___________ is when a party decides to over-provide information, whether it was requested or not, in an attempt to hide the needle of relevant information in a haystack of electronic documents. It makes it difficult and time-consuming to sift through the massive amount of information for relevant pieces, vastly increasing the costs to review the data for relevance.
Data Dumping
___________ is the gathering of sworn testimony from witness or parties involved in lawsuit.
Deposition
___________ involves each party to the lawsuits providing a comprehensive list of info relevant to the matter, such as list of witnesses/documents.
Disclosure
___________ ___________ is the process of retrieving and producing a record for use in a legal proceeding.
Document Production
Review Planning
Early in the litigation the case team must make a determination about the scope of the review: what is to be reviewed, how it is to be reviewed, and what is the intended outcome. To a great extent, the discovery order will direct what data is to be collected and reviewed.
___________ ___________ ___________ is information created, disbursed, or stored in an electronic format.
Electronically Stored Information (ESI)
___________ is proof of testimony, documentation or physical items submitted pertinent to alleged facts.
Evidence
___________ ___________ is how it came into being, how it developed, how it was organized and the results of its activities.
Evidential Value
___________ ___________ is the usefulness of records in documenting the functions and activities of an organization or institution.
Evidential Value
A(n) ___________ ___________ is how a business or organization makes changes to its method of records management in order to preserve information because of a pending litigation, audit and/or an investigation.
Legal Hold / Litigation Hold / Preservation Hold
T/F Records stored on personally owned USB flash drives are exempt from discovery due to the ownership of the media.
FALSE. Discovery is based on the content of the record and therefore applies to personally owned USBs used to store company information.
T/F Every investigation leads to a discovery phase.
FALSE. Not every investigation leads to a discovery phase.
T/F The records produced by technology are always trustworthy and can be admissible to court as evidence any time.
FALSE. There are concerns about the legality of records maintained and produced by technology - including the admissibility of these records in evidence and their acceptance by government agencies.
A(n) ___________ ___________ must be implemented as soon as the organization receives a summons or complaint, when the organization is first on notice regarding possible legal proceedings, or when a pre-litigation dispute or repeated inquiries about a specific matter suggests that legal proceedings can be reasonably anticipated.
Legal Hold / Litigation Hold / Preservation Hold
The EDRM phase ___________ involves locating potential sources of ESI and determining its scope, breadth and depth. eDiscovery teams use a variety of methods to identify sources of potentially relevant ESI, including reviewing case facts, interviewing key players, and assessing the data environment.
Identification
The ___________ stage is were the records that should be preserved are identified.
Identification
The EDRM phase ___________ ___________ sets the policies, procedures, processes, and controls implemented to manage a company's information.
Information Governance
___________ is a formal set of written questions that a witness/party to lawsuit is required to answer under oath.
Interrogatory
Presenting discovery in ___________ or ___________ ___________ format is preferred as it retains the record's metadata and context.
Native; Near-Native
Near-Native File Format
One converted to a different format, but maintains as much relevant information (metadata and content) from the original file as possible so that it may be searched and viewed in other programs such as ediscovery software. Relational databases, email, and PDFs sometimes fall into this category.
___________ ___________ uses keyword search, filtering and sampling to automate portions of an eDiscovery document review. The goal is to reduce the number of irrelevant and non-responsive documents that need to be reviewed manually.
Predictive Coding
During the EDRM phase ___________, ESI is displayed before audiences (at depositions, hearings, trials, etc.), especially in native and near-native forms, to elicit further information, validate existing facts or positions, or persuade an audience.
Presentation
The ___________ stage is how ESI is displayed as evidence.
Presentation
A legal hold is issued during the ___________ stage.
Preservation
During the EDRM phase ___________, ESI is protected against inappropriate alteration or destruction, most typically done through a litigation hold.
Preservation
Records are prepared for attorney review/analysis during the ___________ stage.
Processing
The EDRM phase ___________ entails reducing the volume of ESI and converting it, if necessary, to forms more suitable for review and analysis phase. Typically performed by specialized software, processing might entail extracting files from folders, deleting meaningless system data, or converting certain file formats in preparation for attorney review.
Processing
During the EDRM phase ___________, ESI is delivered to others in appropriate forms and using appropriate delivery mechanisms.
Production
During the ___________ stage, materials are gathered to be presented.
Production
ESI is evaluated for attorney/client privilege information during the ___________ stage.
Review
The EDRM phase ___________ is by far the most expensive of the ediscovery stages, review involves evaluating ESI for relevance and attorney/client privilege.
Review
The preservation of metadata from electronic documents creates special challenges to prevent _____________.
Spoliation
Period of time during which legal action can be taken pertaining to some matter is ___________ ___________ ___________ ___________ .
Statutes of Limitations / Limitations of Action / Periods of Prescription
___________ ___________ is a court order requiring a witness to appear in court, produce relevant records, or provide testimony believed relevant to a legal case as part of a pre-trial litigation process.
Subpoena Duces Tecum / Discovery Order
T/F A potential method to locate and produce records is to follow company rules and standards when naming and sorting records.
TRUE
T/F A value of monitoring document creation is to minimize litigation risks.
TRUE
T/F Numerous repositories, lack of filing structure, and the absence of file naming conventions can impede eDiscovery search.
TRUE
T/F One of the challenges to locate and produce records and information required for a legal case is that many people that are asked to locate records do not have the training and do not understand the legal requirements behind what they are being asked to do.
TRUE
T/F Penalties for non-compliance with the discovery process can include imprisonment and fines.
TRUE
T/F Producing discovery in the correct format is important because outside counsel's software needs to be able to open any records produced and provided to them.
TRUE
T/F The original paper copy of a record may be asked for in a legal situation and therefore should be kept.
TRUE
___________ ___________ ___________ is a set of rules governing items admissible into evidence in U.S. Courts.
Uniform Rules of Evidence (URE)
Collection vs Preservation
While collecting as a way to preserve certainly meets the court's requirements, it is a very costly and inefficient way to do so. Think of preservation in terms of ensuring potentially relevant data isn't deleted. Courts don't prescribe a particular method for preservation, they just require that it gets done. Collection, on the other hand, is the first tangible step towards producing documents to the other side. While certainly not all collected documents will ultimately get produced, the idea is that collection feeds into the review process, which in turn dictates the production set.
The ___________ department controls your access to the various electronic system locations and without their support, you will not be able to search and locate the electronic records you require. a) compliance b) legal c) Information Technology (IT)
c) Information Technology (IT)
Electronic records must demonstrate ___________ for admissibility purposes. a) transferability b) compliance c) authenticity d) spoliation e) duplication
c) authenticity
___________ refers to the process of locating securing and searching electronically stored information with the intent of using it as evidence in a legal case. a) Enterprise searching b) Spoliation c) eDiscovery d) Subpoenas e) Tagging
c) eDiscovery
When determining the reliability of a record, courts assess if the record was made: a) only by the person whose job it is to create the record b) from information transmitted by a person with knowledge of the event c) in the course of regularly conducted business activity d) on the proper media and in the correct format e) in the regular practice of that business
c) in the course of regularly conducted business activity
___________ is the part of the litigation process in which opposing parties exchange relevant documents, testimony, and other information. a) Investigation b) Disposition c) Spoliation d) Discovery e) Compilation
d) Discovery
___________ is destruction of evidence, including records that an organization knows are relevant to impending or ongoing litigation. a) Encryption b) Migration c) Shredding d) Spoliation e) Resolution
d) Spoliation
Some search tools that could be used to locate and produce the records and information required for a legal case could include which of the following? a) full-text searching b) course searching c) induction searching d) all of the above
d) all of the above
The following are essential for the RIM manager to know during an investigation or discovery phase: a) types of media b) location of records c) good indexing system d) all of the above
d) all of the above
Once the discovery process has been initiated, relevant email and instant messaging communications: a) should be separated, email kept and instant messages destroyed b) should be destroyed as soon as possible c) should be destroyed, but in compliance with the records retention schedule d) cannot be destroyed e) can be destroyed, but only by witnessed destruction
d) cannot be destroyed
A litigation hold is a stipulation requiring an organization to preserve all data that may relate to a legal action and be made available for: a) destruction b) spoliation c) research d) discovery e) protection
d) discovery
Email is often a target of ___________ because organizations lack email management. a) digital storage reduction b) upgrades c) audits d) electronic discovery e) classification
d) electronic discovery
The investigative phase of litigation when the opposing party can obtain access to recorded information believed to be relevant to its case is: a) spoliation b) reference activity c) court investigation d) pre-trial discovery e) continuity
d) pre-trial discovery
Records are generally introduced in evidence to support a case or point or view, or to: a) illustrate the use of information technology b) review legal issues related to the records c) illustrate a "live" testimony d) respond to a subpoena e) present an organization's policy
d) respond to a subpoena. You would not introduce evidence in a case unless you are responding to a subpoena - the other four answers would not rise to the level of "a business record"
When a company receives a subpoena for documents which are scheduled for destruction, the RIM manager should: a) proceed with destruction of records already pulled but stop destruction of other records b) proceed with destruction of all records according to the RRS c) screen records already pulled to hold those he believes of interest to the court, but destroy the rest d) stop all destruction of records covered by the subpoena e) discuss with attorneys what records can be destroyed
d) stop all destruction of records covered by the subpoena
Which is typically not done as part of the document review during eDiscovery. a) tagging b) searching c) validating d) redacting e) culling
e) culling
From a judicial standpoint a business record must be made: a) only by the person whose job it is to create that records b) by or from information transmitted by a person who knowledge of the event c) of any business transaction decision or business activity d) on paper or on electronic media e) in the regular practice of that business activity
e) in the regular practice of that business activity.
Once the eDiscovery process has been initiated, relevant communications should be: a) deleted b) printed c) backed up d) forwarded e) saved and unaltered
e) saved and unaltered
When receiving a subpoena for documents, the RIM manager must: a) question the applicability of the subpoena b) question the authority of the court to issue the subpoena c) request instructions from the IT manager d) examine the subpoena to see what may be excluded e) suspend all destruction actions for responsive documents
e) suspend all destruction actions for responsive documents
___________ is the process of identifying and providing all electronically stored information and records relevant to a legal case. Involves the process of producing it from electronic repositories/applications.
eDiscovery
The___________ ___________ ___________ ___________ is a framework that outlines standards for the recovery and discovery and of digital data.
eDiscovery Reference Model (EDRM)
