Federal Rules of Civil Procedure and ESI: The Evolution of E-Discovery and Computer Forensics – Pt1

Nearly all documents start on a computer and discovery for litigation necessarily requires accessing electronically stored information (ESI). Rules regarding ESI in discovery – whether opponents are allowed access to it and who pays – are fast-evolving and differ from state to state. The Federal Rules of Civil Procedure are used as a touchstone and precedent by courts and states to help define their own rules. This series will look at a few of the major cases, opinions and outcomes that have informed this evolution.

Rowe Entertainment v. William Morris Agency – 2002 –

The Back Story:

Leonard Rowe, of Rowe Entertainment, was a promoter of some 30 years experience. He was president of the Black Promoters Association (BPA). The acts he promoted were primarily black musical artists. At the time, William Morris Agency had a near-monopoly on the kind of musical acts Rowe represented, and that he wanted to represent. However, he found noteworthy that he and his fellow black promoters were never able to represent a white artist. He suspected that they were not being allowed to do so for the entire 114-year history of the William Morris Agency.

He and his fellow promoters in the BPA were required to pay a 50% deposit for many artists. He discovered/asserted that white promoters had different requirements – for instance, white promoters were only required to pay deposits of 10% or even less. Furthermore he found that white promoters were able to represent both white and non-white artists. He called foul and, along with several other plaintiffs, sued the William Morris Agency (along with about 30 other defendants) for anticompetitive racial discrimination.

Among Rowe’s discovery demands were production of a broad (“sweeping”) range of emails, which the court found to be less than focused on the subject matter of the case. The judge let the production go forward, but shifted the entire cost of production to Rowe. The judge used eight factors to decide thus. These factors became the touchstone nationally for several years on how to weight the cost and responsibility for production (especially of emails) of ESI, and whether such production should be allowed to move forward.

This set of eight factors became known as the “Rowe Test.” The factors, each of which was considered to be more or less of the same importance, were:

1. The specificity of discovery requests

2. The likelihood of discovering critical information

3. The availability of information from other sources

4. Purposes for which the responding party maintains the requested data

5. Relative benefits to the parties

6. Total cost of production

7. Relative ability and incentive to control costs

8. Resources available to each party.

Only number 3 was found in favor of Rowe, as the information was not available from other sources. The remaining seven factors were found in favor of William Morris, leading the judge to allow the discovery to proceed, but that Rowe would have to pay the entire cost. The cost amounted to about $200,000.00.

What do the eight factors actually mean?

1: The specificity of discovery requests refers to how targeted the requests are. If the requests are closely targeted to the kind of critical electronic documents and emails only from key players and that are most likely to be of relevant subject matter, then the court should favor having the producing party pay. If the requesting parties demands are overbroad, asking for everything in (and out of) sight rather than what is likely to be relevant, then the court should favor the producing party, leaving the requestor to shoulder the majority of the cost of production.

In the Rowe case, the judge found Rowe’s demands to be “sweeping” and found that the this factor then favored having the requestor (Rowe) bear the cost of production.

2: The likelihood of discovering critical information. If there is strong evidence that the data being sought is of near-certain relevance to the case, or better, if there is an admission by the producing party that the requested electronic data is relevant, the court should favor having the producing party pay. On the other hand if the requests appear more or less to be a fishing expedition, the court will be looking to the requesting party to pay.

In the Rowe case, the court wrote, “However, there has certainly been no showing that the e-mails are likely to be a gold mine. No witness has testified, for example, about any e-mail communications that allegedly reflect discriminatory or anti-competitive practices.” Based on this factor, the court favored William Morris again.

3: The availability of information from other sources. Are alternate sources of discovery available – for instance in hard-copy (paper) form, or as individuals files on computers that personnel has already searched for responsive data? If not, the court should find this factor in favor of the requestor, making it more likely for the producer to be told to bear the cost o production.

This was the one factor found to be in Rowe’s favor, as there was little or no evidence the demanded emails could be found or produced, except by searching backup tapes and hard drives for them.

4: Purposes for which the responding party maintains the requested data references the reason the data exists. Is it kept just for disaster recovery or data recovery purposes? Does it exist simply because someone just forgot to discard it – and the producing party can show this to be true? Then the cost of searching this data more likely should be shouldered by the requestor.

Is it kept for ongoing business purposes, which might include accessing backup tapes or hard drives on a regular basis? Then the court should find it more likely that the producing party should pay for production.

The court found that William Morris either kept much of the requested data inadvertently, or had it just for archiving purposes.

5: Relative benefits to the parties: in most cases, the production will favor the requestor – else why would they request the data? This was also true in the Rowe case, and hence this factor would again favor Rowe having to pay for discovery costs.

6: Total cost of production: If the cost is not substantial, or if discovery is more like traditional discovery, the court should be less likely to shift costs, and leave the presumption that the responding party should bear the costs. However, at the time of the Rowe case, email discovery was more an exception than the rule and hence the court found that this factor would favor William Morris, i.e. that this factor should make Rowe more likely to bear the burden of cost of production.

7: Relative ability and incentive to control costs. In general, the requestor determines the scope of its requests, which would have the court favor having the requestor pay. Such was the case with Rowe.

8: Resources available to each party. This factor only comes into account when there is a large disparity between the sizes of the two parties, such as in a case where an individual faces off against a corporation, where the smaller of the parties may not have the ability to pay for production at all. In a case such as Rowe, where the parties are both companies, the factor is unlikely to come into play, to be a neutral factor.

Rowe was one of the formative cases in what has become Civil Rules with regard to electronically stored information (ESI). The 8-factor test was particularly important in informing future cases as to what ESI should be allowable in discovery and who pays for producing it.

The case itself has had several episodes and court opinions as recent as 2012 have raised popular interest in what many see as racist-based court decisions, where others see outcomes based primarily on following (or not following) technical rules.

Next in this series, another important case leading to the current Federal Rules of Civil Procedure, Zubulake v. UBS Warburg

Computer Forensics – Criminal vs Civil – What’s The Difference?

In the field of computer forensics, as in the field of law, procedures in civil cases differ somewhat from those in criminal cases. The collection of data and presentation of evidence may be held to different standards, the process of data collection and imaging can be quite different, and the consequences of the case may have very different impacts.

A couple of quick definitions may be in order. Criminal law deals with offenses against the state – the prosecution of a person accused of breaking a law. Such offenses may of course include crimes against a person. A government body, or the representative of a government body accuses the person of having committed the offense, and the resources of the state are brought to bear against the accused. Guilty outcomes can result in fines, probation, incarceration, or even death.

Civil law covers everything else, such as violations of contracts and lawsuits between two or more parties. The loser in such a dispute often must give payment, property or services to the prevailing party. Imprisonment is not at issue in civil cases. As a result, the standard for evidence is not as high in civil cases as in criminal cases.

For the law enforcement computer forensics specialist, a certain amount of extra care should be taken in collecting data and producing results, for the standard of proof is higher. There are advantages on the data collection end, however. For once a court has authorized a search warrant, an officer (and possibly several) with badge and gun can go seize the defendant’s computer by surprise and by force. Once the computer has been seized and imaged, all data is accessible and may result in additional charges being brought against the defendant.

By contrast, in a civil case, there tends to be a lot of negotiation over what computers and what data can be inspected, as well as where and when. There is not likely to be any seizing of computers, and quite a long time may take place between the time the request to inspect a computer is made and the time the computer is made available to be inspected. It is common for one party to have access to a very limited area of data from the other party’s computer. During this time, a defendant may take the opportunity to attempt to hide or destroy data. The author has had several cases wherein the computer needed for analysis was destroyed before the plaintiff had the opportunity to inspect. Such attempts at hiding data are often discovered by the digital forensic sleuth, who may in turn present evidence of such further wrongdoing in expert witness testimony.

Opportunities for learning techniques and interacting with other professionals may differ as well. While some computer forensic software suites and training, such as Access FTK, EnCase, or SMART Forensics are available to most who can pay, others, such as iLook are available only to law enforcement and military personnel. While many support and professional organizations and groups are available to all, some, such as the High Technology Crime Investigation Association (HTCIA) are not open to professionals who provide for criminal defense (with a few minor exceptions).

When law enforcement has a case involving computer forensics, the intention is to locate enough data to find the defendant guilty in court, where the standard for information presented tends to be fairly high. From the time digital data or hardware is seized and acquired, Rules of Evidence must be kept in mind (Cornell University has the complete and voluminous code on its website). Law enforcement personnel must follow accepted procedures or evidence could be thrown out. Acquisition of data and discovery in criminal cases often must follow sometimes strict and differing procedures depending upon whether the jurisdiction is federal, state, or municipality and at times depending upon a judge’s preferences.

In a civil case, the initial processes of electronic discovery may be just to find enough data to show one or the other party whether they are likely to prevail, should the case go all the way to court. As such, the initial presentation of data may be fairly informal, and be just enough to induce the parties to settle the case. On the other hand, the data found may be so minimal the line of inquiry into electronic evidence is dropped.

Although we use many of the same tools, computer forensic professionals in private practice and those in law enforcement are held to different standards, have access to different resources, and their work results in substantially different outcomes between the criminal and civil cases to which they contribute.