Effectively Interviewing Custodians To Find ESI

Podcast: Play in new window | Download

Listen to Sherry Harris, from the law firm Hunton Williams based in Richmond, Virginia discuss the process of effectively interviewing a custodian to identify and collect only the meaningful, targeted folders of Electronically Stored Information (ESI). In this podcast, Sherry Harris will closely parallel the e-collection process to the paper collection process used by many for a long time.

Sherry Harris is an E-Discovery Advisor with over 30 year of experience, all at Hunton & Williams LLP, managing complex litigation. She leads the firm-wide E-Discovery Team of approximately 100, including the development, implementation and execution of E-Discovery Best Practices and Protocol.

Charter Member, The Sedona Conference Working Group on Electronic Document Production and Retention, and active participant in many special project groups
Steering Committee Member, The Sedona Conference Working Group on Electronic Document Production and Retention
Member, The Sedona Conference RFP+ User Group
Co-Editor, The Sedona Conference Glossary For E-Discovery and Digital Information Management, 2nd Edition
Co-Editor, The Sedona Conference RFP+ Group, Navigating the Vendor Proposal Process: Best Practices for the Selection of Electronic Discovery Vendors, 2nd Edition
Member, Georgetown University Law School E-Discovery Advisory Board and special subcommittee developing curriculum for Georgetown Law E-Discovery Training Academy

[DDET Click here to read the transcript]
Karl Schieneman – Interviewer, JurInnov

Sherry Harris – Guest, Hunton & Williams

K: Hello everyone. Welcome to another edition of ESI Bytes where we try to make e-discovery topics accessible to anyone anywhere for a price they can afford – free by the Internet. My name is Karl Schieneman and I’m with JurInnov. I’m pleased to have a really interesting show today. We have (as our guest) Sherry Harris who is an e-discovery advisor with over 30 years of experience all at Hunton & Williams – an Am Law 100 Firm based in Richmond, Virginia, correct?

S: That’s correct. That’s where our home office is.

K: Sherry leads the firm-wide e-discovery team of approximately 100 personnel involved in implementing and executing e-discovery best practices and protocol. She oversees all the educational programs in e-discovery. She’s also one of the charter members of the Sedona Conference. It seems be a lot of the initial speakers we’ve had on ESI Bytes, a substantial number of presentations and articles. Just like everyone else that’s been on ESI Bytes, Sherry, we’re thrilled to have you here talking about sort of collection methodology. Before we start, let’s talk briefly about how you got interested in the e-discovery world.

S: Well Karl, it happened kind of naturally. As you mentioned, I’ve been at Hunton & Williams for a good many years now, so I’ve grown up with technology in the work place. I was one of the first users of pc’s when they entered the market place here. I’ve always challenged technology and pushed the envelope a little bit. I’ve learned about it in the workplace. As I tell many people, I’ve been doing e-discovery before e-discovery was cool. Electronic files have been around even before pc’s. When discovery involved anything that was electronic, we knew that we had to collect it in some manner, depending on how technology allowed us to do it in that day and make available to ourselves and representation of our clients.

K: I like the concept that e-discovery’s cool now.

S: Well, it’s a buzzword, that’s for sure.

K: Well, you gave a presentation at Georgetown last year where you paralleled the identification and collection of discovery in e-discovery to the old paper world. Can you describe this process to us and sort of describe how you view it today?

S: Sure. Basically, the presentation at Georgetown was how to control costs in small stakes litigation because often the cost of electronic discovery can surpass the amount in controversy in smaller stake matters. We’ve applied this practice even in very large stake litigation in a collaborative manner with opposing counsel and everyone understands and wraps their arms around it. Well, it really is a very effective way to get to the most meaningful documents and to the heart of the issues. The basic principles are very much parallel to the paper universe. We’ve always had paper document collections in discovery. When you do that, you want to explore the key players’ universe of documents so you look in their office (and) in their extraneous files they may have carried home or keep in the trunk of their car in a garage. Things like central departmental files or files that may be maintained by their assistant, files that they would be responsible (for) or maintained in all-site storage areas, and even dead storage areas that people have long forgotten about that are all-site storage areas. This very closely parallels with the electronic universe we’ve found because the custodians office files are very much like their computer files, but on their hard drives. Their hard drive very closely parallels their paper office files. Their extraneous files very closely parallels what may be on their home computer, PDA, or any portable media like CD’s, DVD’s, diskettes or things like that. The files maintained by the assistant and the central office files are very much like what may be contained in their document management system or out on network group shares that they used to collaborate with their co-workers. The offsite storage warehouse very closely parallels the back-up tape recycling and any other collection or repositories of back-up tapes that their IT group may have. Then the dead storage – the long forgotten spider-infested sheds and warehouses closely parallels what we found in many of our clients universes. Just boxes and boxes of old backup tapes stored on media that is no longer easy to mount and review. The goal is (like I said) to review the custodians universe of electronic files. In doing so, you have a very interactive interview process with the custodian which is critical in all situations as recently pointed about by Magistrate Judge Andrew Peck in his opinion of March 19, 2009 in the gross construction matter. Many people have already been quoting the opening paragraph of that opinion, but to me, the most important part is when he said it should serve as a wake-up call to the bar about the careful thought they should be giving in defining search terms or key words. He warned (that) we’re using key words (and) counsel must (at a minimum) craft the key words as input from electronically-stored information’s custodian as to words and abbreviations they used. I think the most important part there is the fact that he has put emphasis on obtaining input from the custodian of the electronic records. Very often, I think in particularly large litigation folks will go out and get entire hard drives, entire mailboxes in areas off of network shares and run what they think is a carefully set of crafted key word searches across them without input from each of the individual custodians. My personal experience has proven that that’s not necessarily the best way to do because in every industry and often even in particular to each individual they may use acronyms and abbreviations about which the counsel are not aware (of). So obtaining the custodial input is very, very important.

K: So this is really, you almost take the labels off and treat it like it’s a paper case at the beginning of really getting your arms around particular custodians.

S: Right. You’re just looking at technology resources. We’ve also started doing this remotely. You don’t have to be desk side with a custodian to do it. With the magic of “live meeting” (and) set-up a meeting within seconds with a custodian as long as their logged into the entities network using their username and password on their entity-issued computer. You then have them share their desktop out and navigate through a very set systematic process through their electronic universe. We have boiled this down to a very detailed checklist that’s several pages long. We have a systematic process that we follow from beginning to the end so we can later say with good faith that we had a process in place that was followed with every single custodian without exception from beginning to end. When you first start this, naturally every custodian wants to say, “Well, everything’s in my email. We need to look at that.” I go to email last quite frankly. We start out looking at a custodian’s desktop for any folders, files or shortcuts they have on their desktop to electronically-stored information that may be potentially relevant to the particular matter we’re discussing with them. Then we go onto My Computer (and) look at all the network shares that they’re patched to (and) all of their network shares (including their personal network shares) and explore with them all of those areas in as much detail as we need to with their full understanding of the types of documents that we’re looking for. Their knowledge – which we don’t have, of their record storing procedures over time and (we) drill down to the lowest possible level their folders and sub-folders where we might find potentially relevant information. After we cover all their network shares, we then move to their hard drive and follow the same process with their hard drive and look closely for offline email stores during that process as well. Many custodians don’t realize that they have old email stores that were loaded up in their current email system, so we very carefully look for those as well. By looking in all the suspect areas where those would be stored with application data, but also by running some searches for extension to find whatever often find email stores they might have. After we cover their network share universe and their hard drive, we then move onto their email and in very much detail go through all their open email stores and later open any that we found offline that might not be currently visible in their email system. Again, the goal is to drill down as far as possible to identify potentially relevant information. We all know how we manage our email and we all know we have sometimes tens of thousands of emails. Very often, they’re fairly well organized by subject matter. You may have as many as hundreds of folders and very complex foldering structure. If we became involved with litigation and talked to the custodians, we learn very quickly that the majority of those folders have nothing to do with the matter we’re discussing with them at that time. Their confidence level is usually very high that we will not find anything relevant in the large number of folders. Identifying the folders is important. Just like you would go through their desk and paper files with them to go through to pull out the folders and binders that may relate to the matter you’re discussing with them. It’s very, very similar to the paper process – pulling only the relevant folders and binders instead of just blindly applying key words to the process.

K: It almost seems like you’re auditing – having to spend a little bit of time in an accounting firm checking off steps so that down the road you can defend the audit. Is that part of the way you look at this?

S: That’s precisely the way we look at which makes the checklist very important in the process to make sure that you follow it to a tee. In addition, as we go through the process, we take screen snapshots and paste them into a Word document. Sometimes I can end up with a couple of hundred screen snapshots from a custodial interview (or) from an “e-scoping” as I call it to scope the custodian’s electronic universe. We take screen snapshots every step of the process. Not just where we find things, but where we don’t find things as well so that later not only can we refer back to that without bothering the custodian again, but we can also do that to prove the process; to show that we did and the interview is also followed up with a detailed interview memo. With the checklist, the screen snapshots, and the interview memo to memorialize the process if it’s ever challenged in the future, we can explain and prove exactly what we did and the detail that we went to. It’s a very transparent auditable process to show that we made a reasonable good faith effort to find everything in that custodian’s electronic universe. I’ve even had people come to depositions (after we’ve done an e-scoping of them) and the other side naturally will inquire what they did to locate and provide documents to counsel for discovery. The custodian begins to explain that some crazy lady went through every single file on their hard drive and every network share that they were mapped to and all of their email and actually helped them find things that they didn’t even know existed anymore. It very quickly sits the other side down because they know we’ve done our homework and we’ve done what we should do.

K: A benefit of litigation organization. Jim Michalowicz would be proud of the records management benefit of litigation.

S: Right, and every custodian’s different. There’s no question that once in awhile you’ll run into the poor records manager and you have to come up with an alternative approach for certain individuals if you find that they have all their sent mail for the last three years in a single folder as a .pst file. Obviously, you’re not going to take that entire folder because it’s going to have 6,000-7,000 messages in it. You don’t want that. The vast majority of them will be totally irrelevant. You may have to find/explore alternative approaches with certain custodians. After doing this with hundreds of custodians over many years, I have found that the majority of custodian really do file their folders really well. That’s their business. If they don’t keep their folders organized, they can’t find what they need when they need it. They do it as a matter of business practice, for the most part.

K: With all this talk – The Trial Academy just released a paper last month about the concern about discovery. Sedona’s been working very hard on this Collaboration Proclamation. Do you do this drill-down in interviewing detail and complete before your meet and confer process starts, or do you do some of it and then meet with the other side to figure out scope at that point? How do you work with the other side in this process? Where does this fit in?

S: It fits in where you need it. It fits in where the lawyers need to find documents for the litigation. If they’re in the initial work product background finding process (before the meet and confer) before discovery requests have been served, they still need to find the most relevant documents. The perfect example of this (is when) I was involved in litigation with one of our Fortune 50 clients. It was a case in Florida with our Miami office. The lawyers thought that if they found the most important documents right away, they would be able to dispose of the matter short of discovery and save client a lot of money (of course). The lawyer did not initially grasp the concept of e-scoping of custodians and insisted that we just run key words across their email stores and their hard drives. Finally, I acquiesced and we did that, but the volume that was returned was so great that it was prohibitive to processing and reviewing in the timeframe that they had. I finally convinced them to take two hours of time and e-scope the three key custodians. Once we did that, we very quickly drilled down to the critical documents that we needed including some that did not hit on the key word searches because in that instance, the custodians actually were using acronyms that the lawyers were not aware of. We gathered a very small amount of documents and were able to dispose of the litigation in only a few weeks – well before the meet and confer and the discovery process. The costs savings in that (and that was the example I used in the Georgetown presentation when I showed a cost comparison for the custodian), that key word search would have cost nearly $20,000.00 to process and review just in the fact finding process. That was before we got into discovery. After we did the e-scoping, we accomplished the collection processing and review for about $1200.00 (which was) way under what it would have cost. In the email from the associate to the partner, I used a quote that he wrote. It said, “It seems that that through e-scoping we have reduced the cost per custodian substantially. May we have permission to process these custodians and see what we get? Our filing date is 2 weeks away.” The end result (like I mentioned in that) was that it resulted in identification of an email folder spotted by the keywords with directly relevant materials which they used in that 2 week briefing process to completely dispose of the matter pre-discovery. Yes – it’s effective in discovery to respond to discovery requests, but it can also be effective in any other situation where you need to find important documents. There’s no exchange for looking at your clients documents and talking to your client about them. In the process of interviewing the custodian, we also go into other detail with them. We inquire how long they’ve had the current computer that’s been issued to them by the company and if they had other computers during the relevant time period, we’ll explore with their IT group where those computers may be. We also explore whether they have or used one entity issued computer, which is sometimes the case. They may have a desktop and a laptop. We’d have to scope both of those. They may use a central computer located in a lab or a central departmental area that’s shared by folks. We also look to see if there are profiles of other users on their hard drive. If another laptop or desktop has been re-deployed and another custodian had it, we’ll have to go into that custodian’s profile and documents on there. We talk to them about their PDA, their use of a home computer, any old backups that may exist of their old hard drives on portable media and whether they use jump drives like that for business purposes. We go beyond the electronic universe that even we can see in the e-scoping to make sure that we leave no stone uncovered in the process.

K: That really seems to be a practical way to approach this. There still are today clients that will go grab every piece of electronic data that they can find from a relevant custodian and dump it into something and start looking. So your experience has been taking some effort and thinking/investigating upfront and is cost-effective (as oppose) to just dumping and searching.

S: Right. It’s also not only much more cost-effective, but it’s a more meaningful, defensible process. We’ve seen some cases come out, you know, US v. McPeet, Victor Stanley and then the gross-destruction case I mentioned (just to mention a few) where judges are questioning the use of keyword searches and their effectiveness. Simply running keywords without…if you’re gonna use keywords and you have to use it for certain custodians, it needs to be a very iterative process. We have found this to be very reliable and efficient.

K: Well Sherry, are there any other potential minefields to avoid, because electronically-stored information is very unlike paper.

S: Yes. There are minefields to be avoided. I guess one thing (that) I should have mentioned upfront is that when we do this, we view preservation and collections as two very distinct steps in the process. Even when we do this, we preserve very broadly. We cast a wide net. If you preserve well, you can always go back to the preservation universe if the issues change or you missed something in this process. Yes, there are minefields (and) there always will be. There were minefields in the paper world. That is why we preserve broadly but then try to focus our collections on the electronically-stored information that’s relevant to the matter we’re discussing – just like you do in the paper world, and calculate to lead to the discovery of visible evidence. Again, comparing it to the paper universe, you talk about a warehouse of boxes with 60,000 boxes (and) very rarely does anyone go to the extreme of forwarding over every piece of paper in all 60,000 boxes. You come up with some logical manner to approach it (and) to narrow the universe of boxes you need to go through. This is exactly what the process does with electronically-stored information. You have a network group share that could be tera bytes large and never would anyone think it reasonable to go through every single file in that network share. So what you do is come up with a logical approach to narrow it down to just the folders (a/k/a boxes) that you need to go through.

K: We’re sort of near the end here, but I wanted to touch a little bit on email because I found it interesting that you don’t start with the email (and instead) you do it last. When people talk about electronically-stored information, invariably everyone seems to focus on email. These are your best smoking guns. Do you have any other tips on working with email once you start tackling it?

S: Not really. You are correct that everyone focuses on email. I recently received a call from one of our lawyers who was running into a few obstacles with a client. The client wanted to do their document discovery only in email. Only in active email on the exchange server because they thought that’s where everything was going to be. If you go through an electronic-scoping process, you very quickly learn that there is a lot of electronically-stored information in other places besides the active email stores on the company servers. Like I mentioned, there are offline email stores that people have that they don’t even realize they have anymore. Sometimes when an employee has left the business, their email will be made available to a custodian from a network group share and just left there to sit for a period of time so that folks can go back to it for historical business purposed if they need to. There’s just a lot more information out there than email sitting on hard drives and network shares. Yes, there’s a lot of email, but a lot of our meaningful documents come from other places as well.

K: Now looking into the future, Sherry, what are your predictions for any future improvements in the collection field of e-discovery?

S: I think that certainly much more use will be made of search and retrieval technologies and the tools used for concept-based searching and review, clustering, things like that. They’re already much more readily available review tools than there were just a couple of years back. I see a large growth in that area.

K: That’s nice to hear since that’s my focus. Anyway, this is great. Sherry, I really appreciate you joining us here on ESI Bytes Show. I think this has been very useful. I can think of a couple of clients that I’ve been approaching and talking to that possibly could have benefited from this. Actually, I should say potential clients. This is very useful. I hope to have you on future shows.

S: I would like that. Thanks for having me, Karl. If you ever need anything just feel free to give me a call.

K: Okay. You’ve listened to another edition of ESI Bytes. If you’ve found this show interesting and want to find other podcasts on electronic discovery, you can go to www.esibytes.com . You can also email me at kas@jurinnov.com . Our goal here is for people to learn from ESI Bytes before ESI Discovery bites you back. Thanks a lot, Sherry, and have a nice day.

Re3corded 03/30/2009

[/DDET]