In a case where I’d identified evidence of a departing employee’s data theft, plaintiff’s counsel sought an affidavit in support of a motion to gain direct access to the new employer’s data storage to see how the stolen data was distributed and used.  I replied that I could supply the testimony but offered that the wiser strategy was not to move for direct access but instead seek an agreement or order that the other side’s forensic expert hew to an agreed-upon examination protocol.  That would afford opposing counsel a proper opportunity to withhold and log content deemed privileged or otherwise outside the scope of discovery.

I’ve worked both sides–and the middle–of countless so-called “bad leaver” cases, where employees are accused of taking data from one employer to another to secure a better job or a competitive advantage.  When I’m in the middle, I’m a court-appointed neutral examiner and, in that trusted role, it’s appropriate that I see the whole picture by looking at all implicated devices and accounts: the sources from which data was taken, the transfer media and the target devices and accounts where stolen data and its progeny reside. As a neutral examiner and attorney, I’m well-situated to balance the need to know what happened against the need to guard against improper or abusive discovery.

But when I’m acting for the party suing a competitor alleging data theft, viz., as a partisan expert, the party suspected of benefitting from the theft must be protected from unduly intrusive access to their devices.  Both sides have trade secrets requiring protection and both engage in privileged communications with counsel.  As well, material encountered on examination often has no relevance yet hurts and shames just by being divulged.

As a partisan working for one side or the other, I’d like to be able to say, “trust me, I’ll be bulwark against revealing your privileged communications and irrelevant stuff,” but that’s not a role I covet absent considerable trust and an express agreement.  Trying to be partisan and neutral fosters divided loyalties, and as an attorney, I’m obliged to avoid conflict of interest or anything that looks like it.  Lay examiners should, too.

Trust is devoutly to be wished in these situations…but it’s hard to trust those you believe to be thieves. Justified or not, that mistrust frequently extends to those protecting the thieves, i.e., their counsel.  So, in the absence of trust in people, the law trusts in sound and transparent processes.  In these matters, a well-crafted forensic examination protocol ensures that the right evidence is scrutinized in the right ways, and material legitimately withheld is protected. 

By setting out what devices and sources need to be examined, what artifacts must be assessed and reported upon and how much oversight and transparency is allowed, the opposing expert serves as proxy for my hands and eyes.  Keyword searches and hash matching alone don’t cut it; a good examination protocol encompasses the singular signs of data theft and makes it difficult to suppress indicia of bad behavior.  A good protocol makes production of evidence and artifacts the rule unless there’s legal justification to withhold relevant and responsive evidence—and then there must be disclosure via a privilege log or other means.  I discuss drafting forensic examination protocols further in this article.  The points made in the article are just a start: proper protocols are tailored to the issues and evidence in the case, and constructed to promote integrity of process.

Can all this be abused?  Sure.  But, effective e-discovery is a marathon, not a sprint.  Certainly, this is true of efforts to seek sanctions.  If the process just described can be proven to have been gamed or corrupted, judges respond aggressively to protect the integrity of their courts, among those responses the turnover of an opponent’s devices, that is, the dread direct examination.

So, the takeaway: though sometimes direct access can be secured by agreement, don’t jump straight to a motion to compel access to an opponent’s computers and data storage when the other side says “no.”  Instead, pursue alternatives that fairly balance legitimate needs for disclosure against legitimate needs to protect trade secrets, privacy and privilege.  Do this using a well-crafted forensic examination protocol that obliges the other side to engage competent people, deploy them competently and afford reasonable transparency. The other side remains responsible for discovery until it’s clear they can’t be trusted.  Then, follow up by asking the Court to appoint a properly trained and -certified neutral examiner.  Seeking to compel access to an opponent’s digital media is a last resort and should be treated as an extraordinary remedy—a punishment for discovery abuse more than a tool of discovery.

I’m a tool guy.  I pride myself on having the right tool for the task at hand. Digital forensics demands a broad range of specialized software, adapters, cabling, screwdrivers and spudgers.  Yes, “spudger” is a real word.  The forensic examiners I know enjoy swapping tool recommendations because often having the right tool to collect or parse electronic evidence means the difference between a quick victory or an agonizing series of defeats.

Delving deeper into the Alex Jones Discovery Debacle in a Law.com article bylined by Emily Cousins, I saw mention of Jones’ counsel passing around a “white hard drive” bearing no label or markings, nothing whatsoever advising the drive held privileged attorney-client records and court-protected documents.

After twenty-odd years as a certified digital forensic examiner and ESI Special Master, I’m custodian for countless hard drives and storage media holding sensitive data—media in all colors, shapes and sizes.  One common thread across all is the adhesive paper label affixed to each.  Arguably, the most valuable tool in my forensics lab is an 18-year-old Brother QL-500 label printer purchased secondhand from a clearance bin at Office Depot.  The 1-1/7″ x 3-1/2″ labels it spits out aren’t as slick as the Mylar bar codes used in other shops, but they’re a quick, cheap and nearly idiot proof alternative.  Leastwise, this idiot would be lost without them.

You’d be amazed how much information fits on a little paper label; but, even if it’s no more than a matter name and “PRIVILEGED AND CONFIDENTIAL – SUBJECT TO PROTECTIVE ORDER,” that might have proved sufficient to forestall the ugly spectacle of Jones’ Connecticut counsel invoking the Fifth Amendment at a disciplinary hearing.

In a similar vein, a five-cent paper label affixed to the back of a laptop or phone is an effective, low-tech way to remind custodians and IT personnel that the device is subject to legal hold before it gets wiped, discarded, sold or traded in.  Is it ALL you need to do for a defensible hold?  Clearly not, but shouldn’t labeling physical media be as much a part of your routine, prudent processes when handling sensitive media as it is part of mine?

I don’t do paper; but my paperless practice demands I keep track of and protect physical media.  Encryption of contents plays a key role, as does a sound chain-of-custody; yet it’s the old-school paper labels that still save the day. 

Brother no longer makes the QL-550, but sells suitable alternatives.  Dymo markets a LabelWriter 550 that looks like my Brother’s twin brother.

Poring over Requests for Production this morning, I was gratified to see the client sought native forms of electronically-stored information; but the request said only, “All documents shall be Bates stamped and provided in native format.”  Is that sufficient? To me, specifying forms of production is best done via an agreed ESI production protocol, but failing that, requesting parties should supply more detail than simply asking for “native format.”  I believe requests need to lay out the forms sought for particularized types of ESI and specify the essential ancillary metadata to be produced in load files. 

Requesting native forms in discovery demands a few adaptations versus the way hard copy documents were sought in years past.  Take that request, “All documents shall be Bates stamped and provided in native format.”  If a document is supplied natively and not printed out or “flattened” to a static TIFF, where do you “stamp” the Bates number?  The solution is simple (in the file name and load file), but not obvious to lawyers unschooled in e-discovery.

Specifying more than “native format” in the request is sensible because much ESI doesn’t lend itself to production in its “true” native forms.  The “true” native form of email is typically a database of multiple user accounts holding messages, calendars, contacts, to-do lists, etc.  An opponent need not (and won’t) produce such a massive, undifferentiated blob of data.  So the better practice is to specify preferred near-native forms be produced; that is, forms that preserve the integrity and utility of the evidence and support the granularity needed for discovery of only relevant, non-privileged material.  As well, providing a load file specification ensures you obtain metadata values that only the producing party can supply (like Bates numbers, originating hash values, source paths and custodians). Too, you want that metadata in a structure suited to your needs and tools.

Native productions are more utile and cost-effective, but only to requesting parties prepared to reap their superior utility and savings.  One reason why producing parties have gotten away with producing inefficient and unsearchable static image formats (TIFFs) for so long is because TIFF images can be viewed in a browser; hence, recipients of TIFF productions can read documents page-by-page without review software.  Yet, that easy access comes at a perilous cost.  TIFF productions are many times larger in byte volume than native production of the same material, making it significantly more costly for requesting parties to ingest and host the evidence.  Moreover, TIFF images tend not to work well for common formats like spreadsheets and PowerPoint presentations, and don’t work at all for, e.g., video and sound files.  Finally, evidence produced as TIFF images gets shorn of metadata and searchable electronic content, requiring that the stripped metadata and searchable content be produced separately and reconstructed using software to comprise, at best, a degraded “TIFF Plus” facsimile of the evidence. 

For these reasons and more, requests for production must either succeed the entry of an agreed- or court-ordered production protocol or requesting parties must include useful and practical instructions about the forms of production right in the body of the Request.

To simplify my client’s task, I drafted an Appendix to be grafted onto the Requests for Production and suggested my client take out “All documents shall be Bates stamped and provided in native format” and substitute the phrase: “All production should be produced in accordance with the instructions contained in Appendix A to this Request.” It’s not perfect, but it should get the job done.

The Appendix I supplied reads as follows, and I don’t offer it as a paragon of legal draftsmanship.  Each time I create something like this, it’s a struggle deciding what details to omit versus supplying all features of a full-fledged production protocol.  I’ve kept it to about 1,000 words, and a tad verbose at that.  It’s for you to decide if it adds substantial value over simply asking for “native format.”  Tell me what do you think in the comments. If you’d like a Microsoft Word version of Appendix A to play with, you can download it from this link: http://craigball.com/Request_for_Native_Production-Appendix_A.docx

Appendix A: Forms of Production

I. Definitions

“Electronically Stored Information” or “ESI” includes communications, presentations, writings, drawings, graphs, charts, photographs, posts, video and sound recordings, images, and other data or data compilations existing in electronic form on any medium including, but not limited to: (i) e-mail, texting, social media or other means of electronic communications; (ii) word processing files (e.g., Microsoft Word); (iii) computer presentations (e.g., Microsoft PowerPoint); (iv) spreadsheets (e.g., Microsoft Excel); (v) database content and (vi) media files (e.g., jpg, wav).

“Metadata” means and refers to (i) structured (fielded) information embedded in a native file which describes the characteristics, origins, usage, and/or validity of the electronic file; (ii) information generated automatically by operation of a computer or other information technology system when a native file is created, modified, transmitted, deleted, or otherwise manipulated by a user of such system; (iii) information, such as Bates numbers, created during the course of processing documents or ESI for production; and (iv) information collected during the course of collecting documents or ESI, such as the name of the media device, or the custodian or non-custodial data source from which it was collected.

“Native Format” means and refers to the format of ESI in which it was generated and/or as used by the producing party in the usual course of its business and in its regularly conducted activities. For example, the native format of an Excel workbook is a .xls or .xslx file and the native format of a Microsoft Word document is a .doc or .docx file.

“Near-Native Format’ means and refers to a form of ESI production that preserves the functionality, searchability and integrity of a Native Format item when it is infeasible or unduly burdensome to produce the item in Native Format.  For example, an MBOX is a suitable near-native format for production of Gmail, an Excel spreadsheet is a suitable near-native format for production of Google Sheets, and EML and MSG files are suitable near-native formats for production of e-mail messages.  Static images are not near-native formats for production of any form except Hard Copy Documents.

II. Production

1. Responsive electronically stored information (ESI) shall be produced in its Native Format with Metadata.

2. If it is infeasible to produce an item of responsive ESI in its Native Format, it may be produced in a Near-Native Format with options for same set out in the table below:

3. Paper (Hard-Copy) documents or items requiring redaction shall be produced in static image formats scanned at 300 dpi e.g., single-page Group IV.TIFF or multipage PDF images. If an item uses color to convey information and not merely for aesthetic reasons, the producing party shall not produce the item in a form that does not display color. The full content of each document will be extracted directly from the native source where feasible or, where infeasible, by optical character recognition (OCR) or other suitable method to a searchable text file produced with the corresponding page image(s) or embedded within the image file.  Redactions shall be logged along with other information items withheld on claims of privilege.

4. Each item produced shall be identified by naming the item to correspond to a Bates number according to the following protocol:

5. If a response to discovery requires production of discoverable electronic information contained in a database, you may produce standard reports; that is, reports that can be generated in the ordinary course of business and without specialized programming.  All such reports shall be produced in a delimited electronic format preserving field and record structures and names.  If the request cannot be fully answered by production of standard reports, Producing Party should advise the Requesting Party of same so the parties may meet and confer regarding further programmatic database productions.

III. Load Files

Producing party shall furnish a delimited load file in industry-standard Opticon and Concordance formats supplying the metadata field values listed below for each item produced (to the extent the values exist and as applicable):

The chart above describes the metadata fields to be produced in generic, commonly used terms.   You should adapt these to the specific types of electronic files you are producing to the extent such metadata fields are exist in the original ESI and can be extracted as part of the electronic data discovery process. Any ambiguity about a metadata field should be discussed with the Requesting Party prior to processing and production.

Yesterday, I posted on the inadvertent production of privileged texts and other matter in the Alex Jones defamation trial.  In the day that’s passed, the Austin, Texas jury returned a compensatory damages verdict of $4.1 million dollars, and minutes ago, assessed punitive damages of $45.2 million.  More has come to light overnight respecting the lawyers’ errors, confirming what I’d only been able to speculate about yesterday.  Now, I want to add a point about features of Texas law that very well could determine if there will be a mistrial or a new trial on appeal.

In yesterday’s post, I explored the Texas rules of procedure and evidence permitting a party who unwittingly produces privileged data to “snap back” that evidence by belatedly asserting its privileged character and demanding return (Tex. R. Civ. P. Rule 193.3 and Tex. R. Evid. Rule 511).  I also touched on counsel’s ethical duty to notify an opponent who has mistakenly supplied material relating to a lawyer’s representation of a client (ABA Model Rule of Professional Conduct 4.4b).

Concluding yesterday’s post, I posed questions:

• Was a new link to a collection scrubbed of privileged content ever supplied?

• Why didn’t defense counsel promptly object at trial and protect the record?  

• Will we next need to discuss the crime/fraud exception to attorney-client privilege?

One of these now has an answer: Based on remarks of counsel at a hearing on Defendants’ Emergency Motion for Enforcement of Protective Order dated December 2, 2021 (filed August 4, 2022), the updated link promised was never supplied.  Further, no subsequent assertions of privilege or other action pursuant to Tex. R. Civ. P. Rule 193.3 were made by Defendants.  It appears the ball was dropped, prompting one to wonder whether defense counsel hoped he would wake up and find it was a bad dream (like–DATED REFERENCE WARNING–Pam seeing Bobby Ewing in the shower).  In the run up to a high-profile trial, it’s more likely it just slipped through the cracks.

Since defense counsel Andino Reynal clearly didn’t expect the text messages to emerge at trial, it remains a conundrum why defense counsel failed to object when they came up and were shown to the jury.  Take it from someone who spent decades trying cases in Texas courts and another decade teaching electronic evidence at Texas’ premier law school (whaddya mean “which one?“), when improper evidence that hurts your client is mentioned to a jury panel, let alone proffered for them to see, counsel must leap to his feet and assert a prompt, clear objection.  There are exceptions to this, but any trial lawyer worth his salt understands the duty to protect the record by timely objection.  Even if you’re loath to appear obstructionist by objecting, you nevertheless rise and say, “Objection.  May we approach, Your Honor?”  Then, quietly make your record at the bench.

This is rooky stuff: You protect the record by timely objection or waive grounds for that objection.

While I’m pointing fingers, I’m wondering why on Earth plaintiffs’ counsel Mark Bankston thought he could broach allegations of discovery misconduct in front of a Texas jury?!? 

This point hasn’t come up in any reporting I’ve seen but the Texas Supreme Court takes a dim view of litigants airing the dirty linen of discovery abuse to jury panels.  Texas’ approach is in marked contrast to Federal practice where judges let juries hear questions of spoliation. In Texas, as a matter of law, the trial judge determines whether spoliation has occurred and what sanctions to impose.  Evidence of spoliating conduct is inadmissible in Texas. Brookshire Bros., Ltd. v. Aldridge, 438 S.W.3d 9 (Tex. 2014)

An argument can be made that spoliation is one thing and telling the jury that opposing counsel “messed up” and supplied documents meant to stay hidden is something else.  Perhaps; but, I’ll bet my boots there was a pretrial order on a Motion in Limine barring mention of discovery disputes without first seeking leave of court.  Too, the Texas Supreme Court’s concern that juries may be prejudiced by discussion of matters reserved exclusively to the Court’s determination would seem to hold true for telling juries that opposing counsel “messed up.” 

There’s been a lot of digital ink devoted to lambasting defense counsel for his mistakes, but in his fervent (and understandable) eagerness to tag Alex Jones, it remains to be seen if Plaintiffs’ counsel overstepped and the whole damages phase must be retried. If so, UGH, just UGH!

P.S. I just noticed that plaintiffs’ counsel practices with a Houston firm with “Ball” in its name. That’s not me nor anyone in my family. No connection whatsoever.

I reserve this space for topics I’ve mulled over carefully in hopes that, even if I’m late to the party, at least I’ll be properly dressed. But yesterday, the media covering the Alex Jones defamation damages trial in Austin lit up with the news that Jones’ counsel inadvertently produced privileged mobile text messages and failed to seek their return in time to prevent waiver of privilege. The “inadvertently” produced messages reveal that (SPOILER ALERT!) Jones is a discovery-obstructing, lying scumbag.

That’s not political commentary; that’s the key fact finding of the Court during the liability phase of the case (“scumbag” is synopsis, implicit but unstated by Her Honor).  Jones’ discovery misconduct was so egregious, it compelled the judge to enter a default judgment on liability.  Hence, the ongoing case determines only compensatory and punitive damages.

Wow! Seamy Texas headlines in my wheelhouse of e-discovery and digital evidence! Got to love that! I write (hastily) to explore the applicable Texas rules as well as to parse—admittedly on skeletal information–what seems to have transpired and what it signifies.

To begin, Alex Jones is a 48-year-old, right-wing conspiracy theorist broadcasting rants and raves to millions of listeners who get off on the garbage he spews. Jones and his InfoWars entities were sued for defamation arising from such vile acts as claiming that the murder of 20 six- and seven-year-old children at Sandy Hook Elementary School was a hoax and “false flag.” So, he’s a horrible person, but the legal and factual issues don’t change because a party is a horrible person; horrible people are why we need courts and lawyers.

On August 3, 2022, Jones was on the stand under cross-examination when plaintiffs’ lawyer Mark Bankston asked:

“Mr. Jones, did you know that 12 days ago, your attorneys messed up and sent me an entire digital copy of your entire cellphone with every text message you’ve sent for the past two years?  And when informed, did not take any steps to identify it as privileged or protect it any way, and as of two days ago, it fell free and clear into my possession and that is how I know you lied to me when you said you didn’t have text messages about Sandy Hook.  Did you know that?”

Jones previously testified he’d searched his phone for texts about Sandy Hook and found none.

Consider five elements of the question, because all go to the question of whether privileged communications produced in error may be used by counsel:

1. “12 days ago”
2. “your attorneys messed up”
3. “sent me…every text message you’ve sent for the past two years.”
4. “when informed, did not take any steps to identify it as privileged or protect it any way”
5. “as of two days ago, it fell free and clear into my possession….”

Hearing this, any lawyer’s ears will perk up, certainly any e-discovery lawyer’s. Diligent, competent lawyers don’t ‘mess up” by producing every text message irrespective of relevance, responsiveness and privilege! That could prompt a waiver of privilege–every lawyer’s nightmare!

Unless the lawyer practices in the Great State of Texas, a jurisdiction with strong safeguards against unwitting waiver of privilege by inadvertent production. Texas Rule of Civil Procedure 193.3(d) offers a get-out-of-jail-free card that’s easy to play:

Tex. R. Civ. P. Rule 193.3 Asserting a Privilege

…

d) Privilege not waived by production. A party who produces material or information without intending to waive a claim of privilege does not waive that claim under these rules or the Rules of Evidence if – within ten days or a shorter time ordered by the court, after the producing party actually discovers that such production was made – the producing party amends the response, identifying the material or information produced and stating the privilege asserted. If the producing party thus amends the response to assert a privilege, any party who has obtained the specific material or information must promptly return the specified material or information and any copies pending any ruling by the court denying the privilege.

Aha! So THAT’S what all the twelve days/ten days/two days stuff is about!

Jones’ counsel had ten days from his discovery that privileged information had been unintentionally produced to amend the response to assert a privilege and demand its return. In Texas, we call that “snap-back” and in federal court, it’s what Rule 502 of the Federal Rules of Evidence was intended to fix.

Texas has its own evidence rule on point, Rule 511(b)(2):

Tex. R. Evid. Rule 511: Waiver by Voluntary Disclosure

…

(b) Lawyer-Client Privilege and Work Product; Limitations on Waiver

…

(2) Inadvertent Disclosure in State Civil Proceedings. When made in a Texas state proceeding, an inadvertent disclosure does not operate as a waiver if the holder followed the procedures of Rule of Civil Procedure 193.3(d).

Pulling it together:

At some point on or before Friday, July 22, 2022, defense counsel supplemented discovery responses in such a way that two years of Jones’ cell phone messages were produced.  How?  No clue!    Perhaps by placing it into a production “drop box” repository hosted online?  The method of production doesn’t matter, and the form of production is unhelpfully characterized as “digital;” even the time of production isn’t critical.  What matters most is when did defense counsel discover privileged information was produced and what did he do about it?

I expect the July 22 date refers to a communication from plaintiff’s counsel informing defense counsel that privileged or confidential material may have been inadvertently produced. 

I expect it because ABA Model Rule of Professional Conduct 4.4(b) provides:

“A lawyer who receives a document or electronically stored information relating to the representation of the lawyer’s client and knows or reasonably should know that the document or electronically stored information was inadvertently sent shall promptly notify the sender.”

Texas’ disciplinary rules don’t mirror ABA Model Rule 4.4(b), but smart, ethical counsel will supply the notice if for no other reason than failing to do so puts the lawyer receiving the information at risk of unpleasant outcomes, including being booted from the case by disqualification.

Once notified, the snap-back provision kicked in and—tick…tick…tick—defense counsel had ten days to “[amend] the response, identifying the material or information produced and stating the privilege asserted.”  Again, Texas liberally protects against unwitting privilege waiver, so all defense counsel had to do was write something, anything, akin to “the texts we supplied contain privileged attorney-client communications and non-responsive confidential information.  Return them now, destroy any copies and do not use of share any information they hold.”  It wouldn’t have required much specificity since plaintiffs’ counsel knew what he had and believed his opponents counsel “messed up.”  All it would have taken was a peep of timely objection. Yet, as plaintiffs’ counsel put it in court, defense counsel “did not take any steps to identify it as privileged or protect it any way.”

But, literally just as I’ve written the preceding, my dear friend, Mary Mack, the Empress of E-Discovery, sent a text indicating Plaintiffs’ counsel Bankston e-mailed defense counsel Reynal shortly before midnight on Friday, 7/22 and, discussed the production stating: “My assumption is now that you did not intend to send us this? Let me know if I am correct.”

The following day, July 23, 2022, defense counsel F. Andino Reynal replied:

“Thank you Mark.  There appears to have been a mistake in the file transfer…. Please disregard the link and I will work on resending.  Andino”

So, the plot thickens! It’s not clear that defense counsel “did not take any steps to identify it as privileged or protect it any way.” Still, if what I’ve related here is all there was in term of exchanges (and it shouldn’t be), plaintiffs’ counsel is betting heavily that specific assertions of privilege are required for snap back to apply and that citing a “mistake” and asking plaintiffs to “disregard the link” is insufficient to forestall waiver in a state that bends over backwards to protect attorneys from the consequences of inadvertent waiver.

Gutsy or unprofessional? Your call. Was a new link to a collection scrubbed of privileged content ever supplied? Why didn’t defense counsel promptly object at trial and protect the record? Will we next need to discuss the crime/fraud exception to attorney-client privilege? Any way you cut it, this mess promises to be a case study in discovery abuse and lawyer misconduct. Stay tuned!

UPDATE: Here’s a motion filed by Jones on August 4, 2022: