Email Archives & Litigation: Here's How to Get It Right

In January, U.S. District Court Judge Barbara L. Major hit Qualcomm (NSDQ: QCOM) with an $8.5 million penalty for failing to produce e-mail relevant to a patent lawsuit against Broadcom (NSDQ: BRCM). "Qualcomm intentionally withheld tens of thousands of decisive documents from its opponent in an effort to win this case and gain a strategic business advantage over Broadcom," Major wrote. At issue: Qualcomm failed to search the computers of key witnesses before completion of the trial, a catastrophic oversight because e-mail disputing Qualcomm's main argument was subsequently found by a Qualcomm attorney.

Then Qualcomm compounded its error by not turning the newly discovered e-mail over to Broadcom.

Maybe you're thinking, "We'd never do anything that dumb." But stupidity isn't the only gotcha here. In June 2007, the city of Dallas settled a wrongful termination suit for $1.55 million after the city failed to turn over records, including e-mail, relevant to the case. To no avail, lawyers for the city cited a complex e-mail system that made it difficult to conduct a proper search. These are just two examples of the critical role e-mail plays in legal action--and of the perils implicit in searching the millions of messages most enterprises store.

Because nothing gets a product sold like the threat of litigation, we're seeing a surge in two markets: e-mail archives, and tools to aid in legal discovery, the process by which information relevant to litigation or an investigation is found, analyzed, and turned over. Legal discovery is the new growth engine for archiving technology: Gartner estimates spending on discovery software and services will grow 35% every year for the next three years, while IDC forecasts that sales of e-mail archiving applications will jump to $1.7 billion by 2011, up from $631 million in 2007. And this spring saw significant activity in the archiving market. Dell purchased MessageOne, a software-as-a-service provider of e-mail archiving, continuity, and compliance services, for $155 million. Barracuda Networks and Trend Micro launched archiving appliances. And in April, Oracle announced a forthcoming product line, the Universal Online Archive, to store and manage unstructured data; its first module will be the Oracle E-Mail Archive Service.

It's no coincidence that growth of the e-mail archiving and legal discovery markets are intertwined. Lawyers target e-mail, and not only because it's the primary communication method for executives and employees and provides a record of an organization's business procedures. E-mail also often contains unguarded speech, which can become damning evidence during a trial.But archiving is only the beginning of a legal discovery process, which includes several components. A map of these, known as the Electronic Discovery Reference Model, or EDRM, is becoming widely accepted in the world of legal discovery. We'll examine this model, which is general enough to be applicable to a wide variety of organizations yet provides a clear set of guidelines and could be the basis of an e-discovery policy. We'll also show where e-mail archives fit, and where they need to link to other components.

Figure 1:

Next Page: Archives on the rise

See original story on InformationWeek.com.

Enterprises have long turned to e-mail archives to ease the strain that large volumes of mail put on production servers. By off-loading older messages, mail servers run faster, backups are streamlined, and IT can better enforce retention and disposition policies. Archives also make discovery easier, at least for e-mail. Without an archive, IT has to search backup systems and users' hard drives for relevant mail. If older mail is kept on tape, it has to be restored onto a mail server before it can be searched. Archives avoid both problems because older mail is saved to disk and is fully searchable.E-mail archives also are being extended to store other types of content, such as Microsoft Office and SharePoint documents and .wav files. That's because in 2006 the federal courts clarified the definition of discoverable information to include electronic data along with paper documents. The rules call it electronically stored information, or ESI, which covers any type of electronic data you find in today's businesses. Enterprises involved in litigation now have an obligation to preserve relevant ESI and be prepared to produce it in court.

Products from e-mail archive vendors such as Symantec and Mimosa Systems can store and index multiple content types. Other vendors, such as Hewlett-Packard, offer general-purpose archives for e-mail and other unstructured data.

Webcor Builders, a contractor based in San Mateo, Calif., bought Symantec Enterprise Vault in 2002 to ease the load of older mail on its Exchange servers, but the company quickly realized it also would help with its discovery efforts. Senior VP and CIO Gregg Davis said IT used to respond to discovery requests by restoring older e-mail from tape or other media, or even individual PST files on users' PCs. "We knew we were never doing the best possible job," Davis says. "It made us nervous on the IT side to sign off that we turned over everything." He purchased Discovery Accelerator, an add-on module aimed at the discovery process, and the difference is night and day. "Now, we put in the search terms and it comes up in 10 minutes and we send it to attorneys. It's a massive time savings, but it also gives us tremendous peace of mind," Davis says. "You want to avoid the fine or possible civil penalties or having your case thrown out. The excuse of 'We didn't have the tool' won't fly."

Litigation was responsible for the American Psychological Association investing in an e-mail archiving platform. CIO Tony Habash says the Washington-based group underwent a "painful" legal discovery effort in 2007. Many staff members stored messages on their hard drives or CDs, so searching for and collecting relevant data was a laborious manual process.

"We ended up pulling it together, but it was a lot of work, and it drove the momentum for archiving," Habash says. He chose a service from MessageOne. For a midsize organization, the SaaS model was attractive because it took the operational burden off his IT staff. Habash is also taking the opportunity of the deployment to construct a coherent retention policy."We are coupling archiving with processes and user education on what e-mail to keep and why, and how and when messages will be gotten rid of," he says.

What to Look for in E-Mail Archiving

Next Page: Follow the map To help make sense of it all, many enterprises now rely on the Electronic Discovery Reference Model, a conceptual framework that guides IT through all the stages required to meet federal rules that govern the use of ESI in litigation. EDRM was launched in 2005 by consultants George Socha and Tom Gelbmann, and more than 100 organizations have since participated in construction of the framework. EDRM also has been widely adopted by vendors. Companies that sell content repositories and discovery and legal review tools use the model to describe where their products fit in the process. Socha and Gelbmann are now overseeing creation of an EDRM XML schema to facilitate data transfers from one set of products to another. Thirty organizations, including Symantec and Autonomy, have signed on to help develop the schema.

As the graphic below shows, there are nine main steps in the discovery process. E-mail archiving products may include many of the functions outlined in EDRM and also can be used to export content to tools that specialize in other phases of the process.

The first step in the EDRM framework is information management. This is more a goal than a step: Those with mature data management architectures will be able to meet discovery requests with a minimum of fuss. In a well-developed system, unstructured information is indexed on a schedule so that IT can quickly find and identify relevant data. Information should be stored in managed repositories, such as an archive or a content management system, for easy retrieval.

Next step is identification. Once a discovery request is initiated, the organization has to determine what information is required, where it's stored, and who are the custodians, defined as individuals who have relevant information under their control, say, on their hard drives or on a file server or storage system.Search and index technologies are required for identification. A good e-mail archive will index the metadata and content of e-mail, including attachments. An index makes discovery searches faster and more efficient by returning a higher percentage of relevant information. Most archives index the content stored in them and provide search capabilities for both users and administrators. Also valuable in the identification stage are search products from vendors such as Autonomy, Kazeon, StoredIQ, and Recommind.

Figure 2: Photo illustration by Jupiterimages

Preservation and collection come next. Once you identify the data you want, IT has to preserve it and ensure that it isn't altered or deleted. For instance, opening a document can change critical metadata, such as the access date, which can then affect the validity of the document--known as "spoliation" by legal types. In addition, if the enterprise has a retention and disposal policy, potentially relevant data must be placed under litigation hold, which suspends deletion of e-mail and files that may be relevant in a lawsuit.

An e-mail archive also can serve as a preservation system. It provides a common repository for actionable information and removes the preservation burden from individual employees--an excellent idea. Symantec Enterprise Vault's Discovery Accelerator add-on module lets an investigator put archived mail on litigation hold. Many archive products also will encrypt mail and create a hash value for each message to prove that no changes were made.

The processing, or culling, phase aims to reduce the initial size of the data set. A first-round search is likely to produce reams of irrelevant mail, documents, and files, including duplicates and content unrelated to the legal matter. E-mail archives often include the ability to eliminate duplicate copies of messages and attachments before they're saved, thus serving as a form of early processing.The review, analysis, production, and presentation phases are oriented more toward legal counsel. A host of specialized products and services from vendors including Attenex, LexisNexis, Clearwell, and Xerox Litigation Services provide a workflow and management system for the material related to a case.

Because e-mail is the primary target of lawyers, an e-mail archive makes a sensible foundation for organizations facing--or expecting to face--litigation. As the EDRM diagram shows, an e-mail archive will play a significant role in many phases of the discovery process. An archive can reduce your discovery time from days or hours to minutes. Look for capabilities such as litigation hold, indexing, and search in an e-mail archive product or service.

And don't forget that archives are useful outside the courtroom. They provide additional storage resources for users and ease the strain of growing mail volumes on production e-mail systems.

Andrew Conry-Murray, Information Week