eDiscovery

In this InfoGovANZ event, the implications and dangers of the widespread use of social media and apps were highlighted in their evidential value in investigations and litigation.  The importance of technical and forensic expertise in the discovery process was demonstrated by reference to particular cases and technology tools by Brett Webber, Principal, ConsilAD and Matthew Golab, Director of Legal Informatics and R&D at Gilbert + Tobin.  Susan Bennett, Executive Director InfoGovANZ and
Principal, Sibenco Legal & Advisory discussed the duties of technology competence and confidentiality, which extends to cybersecurity to protect client information and the implications of a recent High Court decision.

 

Social Media Perils

As Michael Tieu, posted on LinkedIn following the event, ‘[i]t was truly astounding to see how important it is to be wary of who, what, when and where you post on social media. Once the genie is out of the bottle, it’s nearly impossible to put it back inside. Information governance is as important as ever with the continuing incorporation of social media in our daily activities.’   Brett Webber who has worked on more than 2,000 matters involving social media discovery alone, took us through some of his cases to demonstrate how evidence can be gathered from social media including social media of other people.  As Brett says, ‘how social media is found and technically managed can determine winners and losers in cases.’  This requires technical expertise to find probative material and being able to show the meaning within data collections.

Brett discussed his experiences with social media and litigation answering with the questions, ‘what’s out there?’. The volume of relevant data in freely available the public domain is often counter-intuitively high.

Finding relevant data for litigation / discovery

Social media discovery frequently draws upon tools and techniques honed by Open Source Intelligence (“OSINT”) practitioners.  These techniques involve combining sources or data to form a coherent profile of a target or subject. In addition to finding sources of data authored by a party to litigation, it is normally productive to collect material posted “about” the subject (think of items posted by a third party which include a photo of a person, but without a tag or other element which can be controlled by the subject of the photograph). So even where people are cautious of their own online activity, relevant data are often posted by accounts outside of the subject’s possession, custody or control.

Searching for data using tags, hashtags or words is increasingly ineffective when social media includes pictures or videos without tags or text. Other search and analysis techniques such a location or social connection are required. These approaches require consideration of metadata.

Social media platforms are designed to share data not to keep it private. Social media account “privacy” controls or settings are unlikely to protect data in the long-term. The visibility of data in most social networks is dynamic, for example interactions with other users through an item being liked, commented upon, reposted serve to increase the public visibility of any posted item.

Breach data such as the Paradise Papers and Ashley Maddison are increasingly being indexed and made searchable. Even if the breach data contents are not suitable or useable as evidence, the very existence of such data which is connected to a targeted individual can be informative. For example, it can show interests and hobbies (e.g. online dating) interactions with businesses, real-world activities, ownership of an account or connection to third parties or a place.

Data linking or “pivoting” techniques increasingly benefit from access to commercial data sources such as government land and property or licensing information.  Consideration of these sources with social media data can often provide deep insights.

Collecting OSINT as Evidence

Forensic tools offer particular advantages for litigation-related matters.  Speed, rigour,  completeness and the ability to demonstrate compliant collection methods are all important considerations.  The importance of this is increasingly reflected in emerging bodies of legislation and rules such as the US’ Federal Rule of Evidence 902 (14).

When providing evidence, it is very important to be able to show understanding of the “back story” (context) in the matter and how the information will be used.  If any of that would need to be defended in Court and it may be prudent to engage a forensic expert to assist with a defensible collection.

Social media publication methods continue to change very quickly, necessitating a broad portfolio of data search and collection approaches. Examples of changes and the needed adaptation of collection methods include Facebook’s anti-scraping controls, Instagram and LinkedIn’s Application Programming Interface (“API”) restrictions and an increasingly relevant set of social media data which is not accessible from either web-browsers or APIs but which can only be accessed using mobile devices.  Some of these changes have been reactions to highly publicised matters such as the exposure of Cambridge Analytica’s methods.

Methods of data collection commonly used include:

1. APIs or data feeds from social or other databases.

2. Web-scraping.

3. Commercial data aggregators.

4. Mobile devices (physical or virtual).

Sound forensic methods should show how any data was accessed, how it appeared in its original context and that the resultant data collection hasn’t been tampered with or altered in any way.  Attendant metadata should also be collected and able to be explained – showing the relationship of data, sequence of messages and originating author.

Compelled discovery

Most of the discussion above relates to investigation aka informal discovery.  The identification of accounts and ability to demonstrate relevance and that more data can be collected at reasonable cost are often strong supports for discovery applications where the non-public elements of social media accounts are sought.  For this and for law enforcement liaison requests, forensic methods which identify account details such as a number rather than a name enable efficient and precise collection.

The Sedona Primer on Social Media also addresses the limitations of self-produced data such as Facebook’s Your Data.

An eDiscovery Perspective – Social Media is different to email

Although metadata is quite important in typical eDiscovery which involves emails and documents, social media metadata from the social media platform can be as important as the actual content of a message. For example, in typical eDiscovery, when an email is sent, you have some rudimentary metadata including:

Date and time sent; sender; recipient; subject; content of message

Social media typically has much more extensive metadata. For example, you may take a photo with your phone camera which has the location (GPS coordinates) added to the photo. You then share the photo on social media – some of the social media systems may strip the metadata and/or dynamically reduce the size of the file, however they may also store your location when you uploaded the photo to the social media platform, while also tracking every interaction that is subsequently made with your photo – i.e. who looked at it and when, who commented or otherwise annotated (i.e. likes). In some social media forensics tools, it’s possible to access this deep metadata and so you can then build a graph or who, when and where. Whereas going back to an email, you will rarely know the where, and once you have sent the message you can’t really determine who read it or interacted with it.

Data preservation and spoliation

Spoliation in Australia is surprisingly common. ConsilAD’s experience in Australia is that where data has been produced in procedural fairness disclosures and no explicit communication of the data being relevant for prospective litigation or investigation is provided, it is all too common for data to be altered or deleted at source. By contrast our experience in US indicates an almost universal recognition of the obligation to preserve data. A key benefit from discovery using forensic tools is the ability to show the extent of spoliation e.g. to demonstrate the deletion of data by comparison or juxtaposition of available data with the original forensic collection.

Key takeaways:

1. More is out there than most people expect.

2. Just because you don’t operate a social media account, it doesn’t mean that social media will be bereft of content about you.

3. Leaked and breach data sources and the interaction of online friends transforms data from private to public in many cases. Finders keepers?

4. Privacy obligations for collecting social data might reasonably be considered as triggered when targeted collections are initiated.  This means securing the data, logging it and being able to show provenance and lawful collection.

5. Forensic tools speed up data collection and allow data to be shown in its original context, which can be helpful where the meaning or value of data might be contested.

6. There is a requirement to preserve documents once litigation is reasonably anticipated.  Ensuring clients are appropriately advised and organisations issue document/data preservation notices, referred to as ‘legal holds’ is critical to avoid spoliation.

Forensic data collection methods and technology offer effectiveness and efficiency benefits that amateur efforts do not. For lawyers they are required deliver legal services competently and diligently – this includes technology competence particularly for the discovery process in litigation and securing client’s information.

Duty of Technology Competence

The duty of technology competence for lawyers is set out in the American Bar Association Model rule 1.1 as follows:

            To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.

The Model Rules have now been adopted in 36 US States. Susan discussed some of the recent US cases dealing with discovery issues and directions for adverse inferences relating to evidence unavailability, particularly in relation to social media, and/or failures in the document production process leading to sanctions.  The ABA’s Model Rules are also referred to in the Australian Law Council’s Cyber Precedent, which says;

• To be a competent lawyer, you need to understand the value of the information that you are dealing with.

• Failing to properly protect your client’s information that has been entrusted to you could cast doubt on your ability to properly manage your practice.

• As legal practices operate more in the digital realm the issues of cyber security will play a more prominent role. It is important to keep up-to-date with the current risks and the current security measures.

Susan also discussed the implications of the recent High Court decision in Glenore International AG & Ors  v Commission of Taxation of the Commonwealth of Australia & Ors S256/2018.  In this case, Glenmore’s documents were part of the ‘Paradise Papers’ that entered the public domain arising from the cyberattack on the Bermudan law firm Appelby and stolen from its electronic management system.   The High Court in dismissing Glencore’s proceedings, held that legal professional privilege is not an actionable legal right capable of sounding in injunctive relief.  The implication of this decision will be regulators seeking to rely on documents in the public domain as a result of a data breach, which otherwise may have been privileged and not required to be produced.  The High Court observed that once privileged communications have been disclosed, resort must be had to the equitable doctrine of breach of confidence for protection respecting that use of material.

Susan pointed out that the Glencore decision was distinguished from the High Court’s decision in  Expense Reduction Analysts Group Pty Ltd v Armstrong Strategic Management and Marketing Pty Limited where there had been inadvertent disclosure of 13 privileged documents by the appellants’ law firm to the respondents’ law firm.  In that case, the High Court relied on the Court’s roles in the supervision of the process of discovery to permit a party to correct a mistake to deal with inadvertent disclosure of discovered documents.  The High Court also noted the ethical duty under Rule 31 of the Australian Solicitors Conduct Rules, which deals with the duty of a lawyer to return material, which is known or reasonably suspected to be confidential, where a lawyer is aware that is disclosure was inadvertent.

The key takeaways are that the duties of technology competence and confidentiality include:

·       properly securing and protecting client information, including ensuring appropriate contractual protections with technology and cloud suppliers;

·       ensuring appropriate technology and expertise in investigations and litigation to ensure relevant data is retained, identified and collected efficiently.

The rapid changes in technology, widespread and growing use of social media and apps requires lawyers and eDiscovery professionals to continually keep up to date with changes in technology.  It highlights the critical importance of sound information governance to secure and protect client data and information.

Brett Webber, Principal, ConsilAD

Susan Bennett, Executive Director InfoGovANZ and Principal, Sibenco Legal & Advisory

 

In the last week of January 2019, we joined an estimated 8,000 others in the legal technology community in New York for LegalTech.  For the past three years it has been part of the larger Legalweek, which includes a myriad of concurrent events including LegalCIO, LegalMarketing, Business of Law Forum, and Legal Diversity & Talent Management.

Commonwealth Brunch

Our week kicked off on a blue-sky morning with the Commonwealth Brunch in the famous Tavern in the Park.  The Brunch is a tradition initiated by our late dear friend Nigel Murray.  Nigel had been attending LegalTech for some 20 years and enjoyed bringing people together, particularly those travelling from the UK, Australia, New Zealand, Canada and India.  Nigel was one of the UK pioneers in the eDiscovery and Legaltech industry and well known in the international eDiscovery community, including being the key note speaker for LawFest NZ in 2015.  Thanks to Chris Dale for the toast to Nigel and friendship, and to Craig Ball for the photo. Special thanks to James MacGregor of Consilio LLC, Matthew Geaghan of Nuix, and Amit Pandit  of Apt Search & Selection for organising and continuing this great tradition to start LegalWeek.

Themes – AI, dark data, privacy, emerging technologies

Each year there are usually trends that dominate the event. In the past we have seen the dominance of Big Data, Cloud, Cyber to Predictive Coding, with eDiscovery still being a key focus.

To highlight the trends, Jobst Elster / InsideLegal.com produced a word cloud based on the event agenda (shown below). It is fascinating to see the evolution of themes over the years as the article also provides word clouds from previous events.  You can see the evolution here https://insidelegal.typepad.com/files/2019/01/inside-legalweek-2019-legaltech-agenda-word-cloud-nine-years-and-counting.html.

 

 

The biggest takeaway is how much is changing, and how quickly.

The insights presented are common challenges and opportunities that can be applied to the delivery of legal services the world over. Many speakers highlighted the opportunities and necessity to innovate and embrace technology for today and the future.

There was considerable discussion around the importance of and emergence of greater collaboration. There are now more opportunities for collaboration between – legal departments, law firms, alternative legal service providers (ALSPs) and legaltech companies.

There was plenty of talk around AI, together of what is true AI and not simply automation.

Privacy was also a focus, particularly the impact of the GDPR and the new Californian Consumer Privacy Law which will come into force on 1 January 2020.

Keynotes

US Attorney-Generals on leadership and change

There was the fascinating ‘fireside chat’ with Alberto Gonzales, 80th Attorney General of the United States (2005-2007) and Loretta Lynch, 83rd Attorney General of the United States (2015-2017), as they explored Leadership in the Profession of Law and How It is Changing. They provided some great insights of their journey, together with the trends and evolution of the legal industry.  They highlighted the important of preparation, hard work and the role of mentors in their lives.

 

 

The Attorney-Generals both reinforced the importance of technology in practicing law today with AG Lynch reinforcing “you don’t want every lawyer to be the IT guy, but it is important for firms to make lawyers comfortable with technology”.

The Attorney-Generals discussed the challenge and priority of cybersecurity for government – it is the thing that keeps enforcement agencies awake at night – as well as for the legal profession and their clients.  The rapid changes in technology and the need to protect IP and industries, including agriculture for food security were also highlighted.

The important of privacy and the need for law enforcement to be able to access data in criminal investigations was also discussed.  While the Apple case arising out of San Bernardino was a flash point in the tension between security and privacy, it is clear that the discussion and debate needs to continue.

Brian Kuhn, Founder and Global Leader of IBM Watson Legal

One of the other excellent sessions was the keynote by Brian Kuhn, the Founder and Global Leader of IBM Watson Legal. Brian explored Legal Innovation at Work: Demystifying AI for the Business and Practice of Law, with some great learnings about how the profession can adapt and thrive in a changing market. He reinforced how technological progress is exponential and probably provided one of the best takeaways from the event –

The world has never changed so fast

It will never be this slow again

He also reminded us that AI is dependent on accurate data and that trust is a key issue.

Seeing the technology

The exhibit floor is still a must, even though it still can be overwhelming!

Again, we got to see some exciting new technologies and new releases. It is not solely about what is happening now, but more importantly what is on the road-maps. There were less exhibitors than in past years. This is hardly surprising as the legal innovation and technology market is a very competitive with many excellent events these days, together with evolving ways to gather information, than simply attending in person.

Still, if you provide legal tech you are at Legal tech – in some form or another!

Other events and networking

There are many concurrent events that take place in Legalweek, where you can hear from experts from around the world together with technology and professional service providers.

Susan attended the CDS Corporate Counsel Roundtable NYC 2019 and participated on the Data Privacy panel which focused on the latest privacy developments, particularly the impact of the GDPR globally and the new Californian Consumer Privacy Law – this session was facilitated by Chris Dale from the UK.  Another interesting and interactive session was the Judges panel with retired Judges Francis, Hedges and Mass.  The Judges panel was facilitated by Robert Levvy (ExxonMobil) and Robert Owen (Eversheds Sutherland) and discussed key takeaways from 2018 cases and expectations and trends for 2019.

Another highlight was the Annual Judges Panel and the Practical and Ethical considerations for Social Media Discovery hosted by Driven Inc which took place in the iconic Rainbow Room in the Rockerfeller Center.     The Judges Panel included Judges Rodriguez, Aaron, Laporte, Wettre and Peck (ret.)  – the attendees voted on case studies which led to a very interactive discussion and interesting insights from the judges.  The slide below shows how the attendees voted on a preservation, third party clouds and mobile devices case study where a legal hold had been issued and steps taken to preserve data, but 12 months later the General Counsel becomes aware that highly relevant data has been deleted.

Legalweek which takes place in the depths of New York’s winter, enabled us to experience our first polar vortex. While it was extremely cold, the sunset from the Rainbow Room for the EY LegalTech 2019 reception was spectacular.

Legaltech is a great week as everyone is in the one place, all the leading experts, together with technology providers. Many are from all over the world, who all have perspectives of how legaltech is (or isn’t) impacting the delivery of legal services. The event is a great platform to share experiences and discuss issues, while catching up with the latest technologies and trends.

The greatest value in legal week continues to be the networking opportunities.

There are great opportunities to meet new people and also catch up with old friends.

Below is a photo of InfoGovANZ supporter Active Navigation’s dinner at the American Cut Steakhouse – where it was great to catch up with Peter, Rich and the team.

 

 

Special thanks to Denise Backhouse – Littler, Taylor Hoffman – Swiss Re, Peter Baumann – Active Navigation, Jo Sherman – EDT, Phil Favro – Driven Inc, Eric Schwarz – EY, Warren Kruse – Consilio, Bill Belt – CDS Legal, Wendy Axelrod, Bryn Bowen – Schulte Roth, Rich Kessler – KPMG, David Rohde – Epiq, Anthony Crowell – New York Law School, Julia Miller – Columbia Law School.

Susan Bennett, Principal Sibenco Legal & Advisory, Co-founder InfoGovANZ

Andrew King, Founder & Strategic Advisor, E-Discovery Consulting, Advisory Board member InfoGovANZ

 

 

The terms Personal Information or Personal Data have been increasing in usage for a while, and with the recent focus on the European GDPR, and the Australian NDB (Notifiable Data Breaches).  This article considers these definitions from the perspective of document production in litigation and regulatory investigations – the process of eDiscovery.

In eDiscovery we are used to redacting sensitive information – most typically legally privileged or commercially sensitive information.  However, prior to the commencement of the Royal Commission into the Financial Services Industry (FSRC) the volume of documents requiring redaction was fairly modest in most matters. This certainly changed with the FSRC, as all documents that are tendered at a public hearing are required to have contact information and customer names redacted. This has resulted in significant efforts in reviewing all documents that are going to be tendered to ensure that the documents have been adequately redacted.

What is Personal Information?

The Office of the Australian Information Commission sets out a very helpful guide on What is personal information. Types of personal information listed are:

• sensitive information (including information or opinions about an individuals racial or ethnic origin;

• political opinion;

• religious beliefs;

• sexual orientation;

• criminal record;

• health information;

• credit information;

• employee record; and

• tax file number.

Under common examples, there are further definitions as:

Information about a person’s private or family life:

• a person’s name;

• signature;

• home address;

• email address;

• telephone number;

• date of birth;

• medical records;

• bank account details; and

• employment details

Information about a person’s working habits and practices:

• a person’s employment details:

  • work address and contact details;

  • salary;

  • job title; and

  • work practices as well as other business information such as if a sole trader has taken out a loan

Commentary or opinion about a person:

• a referee’s comments about a job applicant’s career;

• performance;

• attitudes and aptitudes;

• an opinion about an individual’s attributes that is based on other information about them, such as an opinion formed about an individual’s gender and ethnicity, based on information such as their name or their appearance. This will be personal information about the individual even if it is not correct.

Information or opinion inferred about an individual from their activities, such as their tastes and preferences from online purchases they have made using a credit card, or from their web browsing history.

The Royal Commission into the Financial Services Industry has a practice guideline (PG4 Contact Information and customer names in documents to be tendered), which includes Personal Information such as:

• direct telephone numbers;

• email addresses;

• residential addresses; and

• signatures.

What is Personal Data?

Under the EU General Data Protection Regulation (GDRP) the definition of Personal Data includes  any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.  Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the law. Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.

The GDPR protects personal data regardless of the technology used for processing that data – it’s technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example alphabetical order). It also doesn’t matter how the data is stored – in an IT system, through video surveillance, or on paper; in all cases, personal data is subject to the protection requirements set out in the GDPR.

Examples of personal data

• a name and surname;

• a home address;

• an email address such as name.surname@company.com;

• an identification card number;

• location data (for example the location data function on a mobile phone);

• an Internet Protocol (IP) address;

• a cookie ID;

• the advertising identifier of your phone;

• data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.

Challenges for eDiscovery

With the increase in forms of AI and other automation in eDiscovery systems, there are some great tools with which we can identify personal information.   For simple data where there are patterns , it is relatively easy for an eDiscovery practitioner to automatically identify and redact personal information such as:

• patterns of numbers like credit cards and ACNs

• common textual strings like email addresses

In both of these examples a regular expression can be used that is designed to look for patterns of numbers: 4[0-9]{12}(?:[0-9]{3})?; or

for email addresses: ([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})

What can we do about it?

There are interesting developments in the dominant eDiscovery platforms with automatic ‘search and redact’, as well as ways to utilise keyword hit highlighting for key terms.

As you can see from the definitions above, personal information is a lot more complex than these simple patterns and a lot more subjective which would require significant levels of human oversight against both automated identification and redaction, and for the more subjective things such as medical records, commentary against a persons’ career performance.

Matthew Golab, Head of Legal Informatics, Gilbert +Tobin, InfoGovANZ Advisory Board Member

 

eDiscovery is the production of relevant documents that parties to litigation or an inquiry are required to produce to either a Court, Royal Commission, Commission of Inquiry or to a government regulator. The eDiscovery industry is a global industry reflecting the enormous growth in information and the specialised technology which has developed to meet that challenge. While eDiscovery is a specialist area of legal technology the challenge of document production extends well beyond in-house legal departments and requires the assistance of IT departments and records management.

Download Now