The Smoking Gun: Evidence, Discovery, and Digital Forensics

Introduction

“The recent ruling in the Red Wolf case completely underscores the fact that the judge expects the attorneys and the experts to display a true technological competency as they are dealing with all the digital evidence in a case.”

In the matter Red Wolf Energy Trading, LLC v. Jylkka, et al., Senior U.S. District Court Judge Mark L. Wolf entered a default judgment against the defendants and granted a second motion for sanctions. The case brought to light an unprecedented, yet critically important judgment for modern-day litigators. This decision shines a strong spotlight on the need for practitioners and their clients to understand today’s digital technology trends and to carefully select their partners when exploring communications across an ever-expanding list of channels.

This interview is with two of the leading experts at UnitedLex, Derek Duarte and Colleen Freeman, hired by the law firm Armstrong Teasdale to help expeditiously review the discovery exchanges and determine what data was missing from the documents provided by the defendants. The discussion includes detailed guidance to navigate digital communications, strategies to select an electronically stored information (ESI) partner for these types of complex litigation cases and a deep dive into the role data scientists and legal practitioners can play in this landscape.

A Case Study on the Difference Between Winning and Losing in Complex Litigation

Derek, how did you become involved in digital forensics?

Derek: Back in undergraduate, I took an internship with the Berkeley City Attorney’s Office. And because I was young and had experience working with computers, they put me on all their eDiscovery matters.

One of my first experiences was on a case that involved the relevant date range from 1860 to 2000 regarding who built a portion of Berkeley’s underground infrastructure and whether or not the city had maintained it and integrated it into the infrastructure. It was interesting, because I learned how to search e-mail systems and pull data from those systems, as well as how to search archived warehouses and paper record-keeping systems. And that really helped formulate my approach to how I look at this data in cases that I am involved with, even now.

In this case, I was able to find an old paper letter from 1927 that broke open the case during the course of the review. And that’s what made me go to law school and really, where I got the taste for this type of work. And, more and more often, clients would ask me: how would you prove this? How would you figure this out?

I kept using that same approach over and over again, and eventually, I went and got certified as a forensics expert through Global Information Assurance Certification (GIAC), and I also sit on their Advisory Board. For most of these cases where I have been involved, I have been asked to testify on these types of trade secret matters.

Colleen, how did your career progress as an eDiscovery consultant?

Colleen: I had a very early interest in entering the field of law. While attending Boston College, I sat on the Student-Faculty Judicial Board which dealt with alleged violations of the Student Code of Conduct. This fueled my interest in wanting to pursue a career in the law.

Through my work in the compliance department at Fidelity Investments, I fielded inquiries from regulatory bodies and federal agencies such as the National Association of Securities Dealers (NASD) and the Securities and Exchange Commission (SEC). My department was also responsible for overseeing the employee trading gate, and even back then, our ability to uncover fraud and detect employee noncompliance with trading really was an interest for me. I also worked at a national accounting firm to help them build out their forensics, litigation, and valuation services line in Boston. This is how I got involved in eDiscovery early on, well before we started putting the “e” in eDiscovery. It was an exciting time as the firm was in the process of building out their eDiscovery service line and their own evidence lab in Texas. I got in on the ground floor and it helped me to think about discoverable information and the detection of fraud in new ways.

In my work, teaming up with our forensic experts like Derek and our data experts adds tremendous value. Not only do I bring a lawyerly perspective, looking at the case from all the important angles, but I also look at the case from a true eDiscovery perspective. By having that strong foundation in eDiscovery best practices, I can advise clients on what to do, what not to do in eDiscovery, and the dangers around self-collecting, which has been coming up quite a bit in some of our cases.

How did UnitedLex end up working with Armstrong Teasdale on this particular matter?

Colleen: My work in this case dates back to 2019. John Sten reached out to me (currently an Armstrong Teasdale Partner and Boston Office Managing Attorney) when the case was first filed and asked if I could help out on the case. During the early phase of discovery, I was hired to assist with the plaintiff’s collection efforts, devise the review methodology and oversee a team of reviewers. Due to some of our early successes in the case and my long-term client relationship with John, he sought me out again to help fight these egregious discovery abuses. This is a great example of the power of a strong client relationship. They can achieve greater successes when partnering on these matters and allow us to be a true trusted advisor.

One thing we want to underscore in this matter is that Red Wolf’s counsel was only given 5 days to retain a forensic expert, analyze the Slack archive and file an affidavit documenting the expert’s findings. That’s when our team at UnitedLex was hired to help counsel meet the considerable challenges in the case and execute on such a tight timeline.

John needed my help with determining which forensic expert would be best suited to perform the Slack analysis and report their findings. I knew if anyone could help us quickly with reviewing the Slack archive and uncovering any anomalies it would be Derek Duarte.

Derek and I worked the entire weekend with an expert team of data analysts to get this right for our client. We understood the critical need to replicate the workflow and perform a detailed forensic analysis of the old Slack archive. I am especially grateful that our entire UnitedLex team brought a contagious positive energy and really rolled up their sleeves for this client.

This litigation battle and the astonishing outcome underscores the importance of delivering for our clients as well as understanding the latest legal applications for digital technologies. In this case, it resulted in a significant victory for the firm’s client.

What impacts will the post pandemic, remote-first environment have on cases like these? Do you anticipate they will increase in frequency and scope?

Colleen: Since the pandemic started, there has been a growing dependency on eDiscovery professionals. One major new challenge that our clients at UnitedLex are facing is how to manage the proliferation of chat communications and emerging data sources. By all accounts, chat communication tools appear to be replacing email for corporate communications. This is presenting new challenges for our clients and their outside counsel when faced with responding to discovery requests.

During the pandemic, the entire world stayed in touch through Zoom, Teams and other video chatting platforms like FaceTime. These virtual interactions helped us all feel connected during the shutdown and created a dramatic shift in how we communicate both personally and professionally.

The standard reliance on corporate communication channels like email is starting to decrease, even becoming obsolete in some cases, as employees are more and more moving to less formal channels to communicate—like video conferencing, chat, and text—in the post-pandemic, hybrid workplace. The need for lawyers and experts with technological competence to manage these communication channels successfully, to reconstruct conversations across multiple communication vehicles, is on the rise. Conversations may begin in e-mail, then move to text, and then continue on a call. After the call, they might move right back into text or use a chat messaging platform like Signal where their instant messages are encrypted.

This all poses a challenge for litigators today who are tasked with reconstructing important communications in response to discovery requests. This work now requires a higher degree of digital and technological competence. In fact, most states now require attorneys to keep up with technology as part of the “duty of competence.” Today, attorneys have a “duty of technology competence” and are expected to understand how technology may affect their case and their client’s legal discovery obligations.

“Red Wolf’s counsel was only given 5 days to retain a forensic expert, analyze the Slack archive and file an affidavit documenting the expert’s findings. That’s when our team at UnitedLex was hired to help counsel meet the considerable challenges in the case and execute on such a tight timeline.

I think we’re going to see, with the exploding data volumes, a growing dependency on the expertise that Derek, myself and our team of data experts can bring. Lead counsel’s selection of these types of experts could make a critical difference in whether you succeed with your claims in court or whether you’re going to get embroiled in discovery disputes and possible motions for sanctions.

Derek: I would say it has definitely increased in frequency and scope because of the pandemic, as organizations focus on allowing everyone to get their work done and at the same time, being secure. And so, it is very fragmented with a lot of communication systems. There’s a huge uptick in the use of these collaborative messaging systems and the need to analyze them. I don’t think it’s going to continue to grow from where it is now though. I think it’s kind of at its peak, and security teams need to figure out how to manage this securely.

The legal practice itself has not caught up to where the IT and security industry is today, still looking at e-mail or word documents. On the Red Wolf case, you can see how the other side treated Slack here. They’re not really thinking about these new tools in the framework of “how does it work?” and “how is it actually used?”

What pitfalls should ESI providers look for in these cases? Are there any common red flags to avoid?

Derek: I think they need to know that discovery really is about determining facts right and surfacing evidence. And so, playing “gotcha eDiscovery Games” is, I think, going to be severely punished. This Slack case is the beginning of judges reacting, because you have a huge informational advantage. With all these chat programs, it’s easy to be disingenuous and hide the ball. And that’s not at all what the spirit of discovery is all about.

It’s all about diligent search and reasonable inquiry or variations of that concept and then sharing information with the other side so that you can litigate it. And I think a lot of people have used this technical complexity to play “gotcha games” in the discovery process. I think, if you know something happened, and you’re trying to figure out a way to play a gotcha game, you have to be wary of that – that’s not the strategy here.

In addition, be very wary of vendors who are selling, what I like to call, “magical dust artificial intelligence (AI) solutions.” It’s impossible to say, “I’m going to throw in all my Slack, all my text messages, all of my documents and all of my emails, and we’re going to have the answer of what should be responsive, what should be privileged and whatnot.” That’s not how Discovery works. The tech can’t do your job for you. Providers and their experts really need to think about what actually needs to be determined in this case.

And then you have experts both in how the company works and how the data works who provide a reasonable answer and a reasonable production. You need to stay focused there, and if your process doesn’t involve that, no AI tool can plug that gap.

Colleen: I believe this case raises an important issue in our industry that has long been a subject of debate, namely the overreliance on IT departments to help corporate clients collect their own data. A lot has been written on the dangers of self-collecting data and the inherent risks involved when clients self-collect. Unless data is authenticated and collected in a sound forensic manner that is repeatable and defensible, then there is always the chance that it won’t be admitted into evidence.

There are many examples of self-collection gone wrong, and important case law highlights these instances. When data needs to be collected, it is critically important to consider whether you should hire an outside forensic consultant. While there may be some appropriate situations which call for self-collection, I would caution legal practitioners against relying solely on clients to collect their own data.

I think the Red Wolf case is a perfect example of the overreliance on an IT programmer with no experience in eDiscovery. Due to his lack of experience, he wrote a flawed programming script that parsed out messages that were potentially relevant. It was exactly this type of unsuspecting error that not only caused the case to go on for almost four years, but as the judge highlighted in his opinion, is a waste of judicial resources. It even interfered with the court’s ability to reduce a staggering case backlog. It’s also been proven that allowing individual parties to a litigation to collect their own documents is never appropriate, particularly where they have a stake in the litigation.

Certainly, IT serves an important function for a corporation in terms of protecting their digital assets as well as the security of their systems and networks, especially while many employees are still working in hybrid remote environments. But what they’re not really looking at is the preservation of evidence. Many support functions are not trained in forensic science and may not appreciate that simply turning on a laptop or sending an e-mail could inadvertently overwrite data or cause spoliation of evidence. This type of inadvertent spoliation could quite possibly have some far-reaching consequences.

Read the full case study by downloading your free copy: https://unitedlex.com/insights/the-smoking-gun-evidence-discovery-and-digital-forensics/