Imagining the Possibilities, Identification and Preservation Fundamentals Series Part 3

A multi-part series on the fundamentals eDiscovery practitioners need to know about the identification and preservation of potentially-relevant ESI

In “In the Beginning,” we reviewed the importance of effective identification and preservation as well as the triggers for doing so.  In “Legal and Technological Scope,” we reviewed the scope of what must be identified and preserved.  In this Part, we discuss the first steps for identification.

Now that we have reviewed the importance of performing effective identification and preservation and discussed the potential legal and technological scope of what we might need to identify and preserve, we are ready to start discussing the actual identification process.  We’re going to break down the identification process into two parts: imagination and investigation.

A World of Imagination

We don’t spend a lot of time talking about imagination in legal practice, but it’s pretty essential to effective identification.  Each new discovery project can be fairly opaque at the outset.  You may know the main issue and underlying event, but you may not know much beyond that about the relevant individuals, the various potential claims and defenses, etc.  All of that knowledge will only be developed as you proceed with the project.

The first step, then, must be brainstorming to figure out what and who might be relevant.  Doing this effectively requires collaborating with:

• Individuals with direct knowledge of the relevant legal issues
• Individuals with direct knowledge of the relevant factual issues
• Individuals with direct knowledge of the organization’s IT systems and devices

Essentially, in-house counsel, outside counsel, internal IT, any external collection resources, and any relevant senior employees all need to contribute to this effort.  Starting with what you know about the type of matter, the underlying facts, and the involved individuals, you must extrapolate what types of relevant materials are likely to exist within the organization and where (or in whose custody) those materials are likely to be.

This process can be aided by checklists of potential sources (like those used for custodian surveys/interviews), but it is a fundamentally imaginative exercise: imagine the events at issue in the context of normal organizational operations and think about what might have been generated.  For example:

• Might there be departmental records, like HR files?
• Could there be useful data about the events in your ERP systems?
• Would employees have discussed the events via the internal chat client?
• Maybe the relevant office used shared network folders?
• Perhaps copies of deleted records exist on the back-up tapes?

Additionally, it is beneficial to imagine what distinctive characteristics relevant materials from these sources might bear, i.e. how you would try to find them if running searches for them:

• Are you seeking evidence of intent in communications between certain employees?
• Are you looking for evidence of internal awareness in executive meeting minutes?
• Will relevant documents contain certain keywords, like a name or project code?
• Are you looking for contracts executed with a particular party or on certain dates?
• Are you looking for metadata evidence of an employee altering key documents?

Having some ideas about distinctive characteristics of this type will also be helpful to you as you move on to investigation and preservation.

Finding Your Key Players

A key part of this exercise is figuring out who your key players are likely to be for the matter.  Key players are those with the direct knowledge of the underlying events and those most likely to have relevant materials.  The phrase rose to prominence after Zubulake V in 2004, which used it to describe the essential recipients of a legal hold within an organization.

In addition to the individual employees, managers, and executives involved in the events underlying the matter, it is also critical not to forget other types of important players that may be in possession or control of relevant materials:

• Individuals responsible for enterprise or departmental IT systems – organizations may have any number of enterprise systems (e.g. email, backup, or document management) and departmental systems (e.g. benefits, payroll, research, or compliance) that may contain relevant information beyond that held directly by individual custodians; the individuals responsible for managing such systems are important players to include in your identification and preservation process to ensure materials aren’t missed or lost

• Third-party service providers – organizations very commonly outsource one or more business functions, like payroll or benefits (or even email), to specialized third-party service providers, and the data they possess on your organization’s behalf may contain relevant materials you need to identify and preserve; these service providers (or the relevant individuals within them) are also important players to include in your identification and preservation process to ensure materials aren’t missed or lost

Completing your initial brainstorming by making a list of all your expected key players – including important enterprise, departmental, or third party players – will help prepare you for the investigation and preservation steps that come next.

Upcoming in this Series

In the next Part, we will continue our discussion of identification and preservation fundamentals with a look at the investigative aspects of identification.