Unlocking the Electronic File Cabinet

What does the law say about digital discovery and evidence?

UNLOCKING THE ELECTRONIC FILE CABINET

  1. Preliminary Consideration:
  • Definitions:
  1. Electronic evidence: Any evidence that comes in digital form rather than paper or tangible form: Electronic business records, on-line banking, spreadsheets, e-mail.
  2. Computer forensics: The collection, preservation, analysis and presentation of electronic evidence.

Electronic discovery in family law is particularly important where there is financial discovery stored on a spouse’s personal or business computer that may reflect transfer to off-shore accounts, to third parties, financial worksheets which may not have been printed, and e-mail.   

Increasing trend of storing electronic data using computer software applications that maintain potentially discoverable information.

  • Importance of electronic evidence in today’s technology: Electronic business records, e-mail, financial records stored on home computers, Internet transaction. Electronic data are obtained in 3 out of 4 lawsuits involving Fortune 500 companies.”1
  • Use for electronic discovery:
    • Application to family law: Correspondence, tax and accounting records, addresses and phone books, presentation files, business plans, calendaring information, task lists, etc., any of which can reside on a computer in the form of text files, graphic files, audio files, hidden files, system files, e-mail and even deleted files (if not over-written).
    • Many documents are in electronic form and not printed to hard copy.
    • Personal and corporate data attached to e-mails.
    • Resuscitate deleted files if not over-written, determine when the file was created and modified, and when the file was deleted (if it was deleted).

___________________________________________________________

1”Electronic discovery”, National Law Journal, July 17, 2006, page 9.

    • Determine how data may have been leaked, how e-mail may have been forged, how a network can be penetrated and whether keystroke logs or other tracking device may have been placed on the system.
  • Sources of electronic evidence.
    • Cellular telephones
    • Hard drives
    • Floppy disks
    • Optical disks
    • Network storage
    • Remote Internet storage
    • Handheld device (PDAs)
    • Back-up devices
    • Active data storage, including servers, work stations, laptops
    • Off-line storage, including back-ups, archives, disks, tapes, CD-ROM, and any other forms of media
  • Electronic files include:
    • Word processing files
    • Spreadsheet files with assets lists
    • Budgets
    • Financial plans with projections
    • Historical expenditures
    • Expert financial models
    • Financial management programs with check, credit card, asset and investment data
    • Database files with financial data, contact lists, assets
    • E-mail programs
    • Calendar programs
    • Brower history files
    • E-mail, along with header information archives, and any logs of e-mail system usage
    • Data files created with word processing, spreadsheet, presentation or other software
    • Databases and all file logs that may be required
    • Network logs and audit trails
    • Electronic calendars, task lists, telephone logs, and contact managers
    • Backup tapes
    • Network servers
    • Backup P.C. hard drives
    • ZIP discs
    • ZIP C.D.s
    • JAZZ drives
    • Floppy discs
  • Types of digital information that scan be discovered:
    • Records created in different applications such as spreadsheet or word processing applications stored on the hard drive, a floppy disk, or magnetic tape e.g. customer lists, financial records, purchase and sales reports, and personnel files.
    • Original documents such as letters, memoranda, invoices, and design specifications.  Of particular interest are drafts of original documents such as letters or memos.   A daft may contain a line or two discussing potential liability for a course of action that may not be included in the final letter or memo.
    • Databases used by individuals or local area networks.
    • Logs and text of electronics messages or e-mail, including
      “trashed” or deleted messages, message drafts, or mailing lists.
    • Electronic messaging records for messages within a specific company’s network or across a wider network, such as the Internet.
    • Manufacturer’s specification for the computer.
    • Source codes for computer programs.
    • Voice mail transcriptions.
  • Preliminary checklist: Considerations by practitioner planning to request electronic information or data.
    • Locate a qualified computer forensic expert.
    • Request that the electronic information be submitted in computer-readable form.  This allows counsel or computer forensic expert to complete key word searches to locate relevant information and reformat the information in a preferred form, such as table or list.
    • Determine how the cost for obtaining and handling the electronic information will be paid.   Discuss with opposing counsel the sharing of costs.
    • Identify potentially relevant electronic information and in what format it might be stored, such as e-mail, graphics files, or word processing files. 
    • As requesting party, utilize traditional discovery methods to obtain information about the computer system including the specific computer systems involved in the litigation.  Your computer forensic expert will help you with this.
    • Discuss with a computer expert, technology issues such as the framing of discovery questions.
    • As party to whom request for electronic evidence is sought, consider requesting a protective order where such information is privileged, or contains trade secrets.
  • How to find a computer forensic expert:
    • Speakers at continuing legal education on electronic discovery.
    • Should be skilled in collecting, preserving, analyzing, and presenting electronic evidence.
    • Must be a good communicator, be able to translate technical concepts.   Speak to him or her yourself.   Do not delegate that to a paralegal or secretary.
    • Be careful of designations and qualifications – all forensic experts are not created equal.
    • Many are trained in law enforcement. 
    • Some sample certifications:
      • EN Case Certifications Examiner (EN CE)
      • Certified Information Forensic Investigator (CIFI)
  • Voir Dire of computer forensic expert’s credentials:
    • Written exam required?
    • Prove minimum time spent in computer forensics.

Note: There is no certifying body in the computer forensics field, so be very careful who you hire.   Costs on an hourly basis may be from $200.00 to $400.00 per hour.

  • Protocol for obtaining or producing electronic discovery:
    • Send a Notice to Preserve and Retain Data (anti-spoliation letter). (Sample attached.)
    • Discovery request.
    • Computer expert or producing party makes a mirror image of hard drive sought to be discovered. (If need established for hard drive.)
    • Mirror image given to party whose hard drive or other electronic device was copied (the producing party).
    • A privilege log must be made within thirty (30) days of the request, otherwise objection is waived and the Court can enter an Order compelling the production, American Funding, Ltd. v. Hill, 402 So.2d 1369 (Fla. 1st DCA 1981). Where claim of privilege sought, the Court must hold an in-camera inspection to review discovery requested to determine whether claim of privilege is valid.   Ashemimry v. Ba Nafa, 847 So.2d 603, 605 (Fla. 5th DCA 2003).
    • Party’s counsel then provides to party seeking the discovery any non-privileged information is responsive to the discovery request.
    • Objection to production of electronic evidence of Motion for Protective Order.   Whether the burden and expense of producing far outweighs any possible benefit in discovery.  Antiok v. Scrapbook, 210 F.R.D 645 (D. Miss. 2002).
    • Inventory Data.
    • Search data using the date range, names, key words, and file types.
    • Attorney reviews.
    • Receive responsive lists from attorneys.
    • Expert retains mirror image until end of litigation, at which point mirror image is destroyed.   Playboy Enterprises, v. Wells, 60 F. Supp. 2d 1050 (So. Dist. CA, 1999). Simon Property v. My Simon, Inc., 194 F.R.D. 639 (So. Dist. In. 2000).
  • How to obtain computer/burden of proof:  The requesting party has the burden of proof for inspecting of opposing party’s computer system.  For the requesting party to prevail, must show:
    • The procedure will not be invasive, will not take an excessive amount of time, and will not harm the computer or databases.
    • Define the parameters of the time and scope of the information requested.
    • Place sufficient access restrictions to prevent compromising information and to prevent harm to the computer and database.
    • Unlikelihood of retrieving the same information in a less intrusive manner.  Eugene J. Strasser, M.D. P.A. v. Bose Yalamanchi, M.D., P.A, 669 So. 2d 1142 (Fla. 4th DCA 1996).
    • The requesting party is restricted only to electronic data related to a specific request.  It cannot be an over-broad and encompassing request, i.e., you cannot obtain the entire hard drive and entire file cabinet without showing of wrong doing of opposing party.
    • Menke v. Broward County School Board, 916, So.2d 8 (Fla. 4th DCA 2005):  Although Rule 1.350(a)(3) does encompass requests to examine computer hard drives as decided in Strasser, supra, “intrusive searching of the entire computer by an opposing party should not be the first means of obtaining relevant information.” Searching should first be done by the party to whom discovery requested unless evidence of data destruction designed to prevent the discovery of relevant data in a particular case.

Practice tips:  If your client is requested to produce his/her computer, your client should have the opportunity to search his/her computer first to find the specific information requested.   Your client does not necessarily have the right to inspect the opposing party’s hard drive unless there is proof of destruction of electronic files.

  1. Statutory and case law:
  • Federal Rues of Civil Procedure:
    • Rule 26(a)(1)(C): Obligates parties to provide opponents with copies of or descriptions of documents, data compilations, and tangible in the parties; possession, custody or control.
    • Rule 34:  Electronically stored information subject subpoena and discovery for use in legal proceedings.   Permits a party to serve another party a request to produce data compilations.

Proposed amendment: Rule 34 now defines computer-based information and other digitally stored data “as electronically stored information” (ESI).

    • Rule 26 Duty to preserve documents that may be relevant in a particular case.
    • Rule 1001(1): Defines “written and recordings as letters, words or numbers, or their equivalent, set down by handwriting, typewriting, printing photostating, photographing, magnetic impulse, mechanical or electronic recording, or other forms of data compilation.” Notes to his rule “dictate its expansion to include computers, photographic systems, and other modern developments.”
    • Rule 1001(3): “If data is stored in a computer or similar device, any printout or other output readable by sight, shown to reflect the data accurately, is an original.”
    • Proposed Amendment to 26: Meet and confer:  Requires the parties to meet very early in litigation and discuss a number of discovery-related issues.   A report must then be issued to the Court, at which time the Judge will consider this information and will enter a scheduling order.
      • Helps to avoid the risks associated with spoliation of evidence. 
      • Encourages parties to establish proper procedures to preserve evidence and copy of image computer hard drives or other electronic storage media in an agreed upon fashion. 
      • Helps everyone to know in advance how to deal with the risk of inadvertent disclosure of privileged or work product – (“claw-back” agreement.)
  • Florida Rules of Civil Procedure: While there is no specific rule with regard to discovery of electronic data, these general rules are applicable to discovery of electronic data by case law.
    • Fla. R. Civ. P. 1.280(b)(1): “Parties may obtain discovery regarding any matter, not privileged, that is relevant to the subject matter of the pending action.
    • Fla. R. Civ. P. 1.350(a):  “Any party may request any other party to . . . inspect and copy, test, or sample any tangible things that constitute matters within the scope of Rule 1.280(b).” (Computer is a tangible thing.)
    • Rule 1.350(a)(1), Florida Rules of Civil Procedure – Allows a party to request any other party to produce documents, including writings, drawings, graphs, charts, photographs, phono-records, and other data compilations.  (Emphasis added.)
    • Rule 1.350(a)(3), Florida Rules of Civil Procedure – Requires a party to permit entry upon designated land or other property, subject to the restriction of Rule 1.280 “for the purpose of inspection and measuring, surveying, photographing, testing, and sampling the property.” This is the applicable statute for requesting the inspection of opposing party’s computer system or search of financial information on the computer.
  • Other Florida cases:
    • RBES, L.C. v. Santana, 770 So.2d 277, (Fla. 3rd DCA 2000): Computer inspections have been found proper not only for a party’s computer, but also for non-parties.
    • Strasser vs Yalamanchi, 669 So.2d 1142 (Fla. 4th DCA 1996):

It must be shown that no less intrusive means exists and that sufficient parameters are in place.   Such parameters include:

  • Not invasive.
  • Not take an excessive amount of time.
  • Not harm the computer or databases.
  • The information seeking party must define the parameters of time and scope and must place sufficient access restrictions to present compromising information and to prevent harm to the computer and database.
  • Must also show the likelihood of retrieving information. 
  • That there is no less intrusive manner.
  • Southern Diagnostic Associates v. Bencosme, 833 So.2d 801, 803 (Fla. 3rd DCA 2002): Parameters or limitations must be in place in an e-discovery request to ensure no production of “confidential and privileged information.”
  • Menke v. Broward County School Board, 916 So.2d 8 (Fla. 4th DCA 2005): The Menke case involved a defendant school teacher who had been suspended due to allegations of improper sexually explicit e-mails with minor students.   The Plaintiff School Board sought to inspect Menke’s personal computer for evidence of e-mails and instant messages.   The 4th DCA reversed the trial court’s order of production as it did not allow Menke the opportunity to assert privilege as to electronic communications with counsel.   As there was no evidence as to intentional deletion of files, the production of the hard drive was not proper. Production of the entire computer hard drive, regardless of resulting privacy concerns discoverable only where there is evidence of intentional deletion by a party warranting this e-discovery request. (Query: How is one to determine if there was deletion of files without inspecting the hard drive?) The Menke Court adopts Etzion v Etzion, N.Y.S 2d 944 (NY Supp. Ct. 2005) for its protocol for reviewing a defendant’s computer file to ensure privacy, confidentiality and privilege.
  • Zanardi v. Zanardi, 647 So.2d (Fla. 3rd DCA 1994): Conduct in-camera inspection of information to determine whether assertion of attorney/client privilege is valid.
  • Out of State cases:
    • Rosenberg v. Rosenberg, 2002 W.L. 1649 (Minn. CT. App. Jan 8, 2002) – The Wife feared the Husband was failing to report income produced by his business and sought access to his business computer hard-drive.   She had no real evidence to suggest that income was unreported.   Held:  spouse must allege something more that the speculative possibility that the computer might contain relevant evidence. Obtaining the hard drive of the computer is a last resort, not the first resort.   There must be some showing that the information is not available by other means.
    • Hazard v. Hazard, 833 S.W. 2d 911 (Tenn. Ct. App. 1991):  Copy of letter from the Husband to his former attorney stored in the Husband’s computer in the marital home, to which the Wife had complete access, was not privileged.
    • Stafford v Stafford, 641 A. 2d 348 (Vt. 1993): Husband’s file in the family computer called “my list” which was an inventory and description of the Husband’s sexual encounters with numerous women is discoverable.
    • In Re: Marriage of: DeLarco, 313 Ill. App. 3d 107, 728 N.E. 2d 1278 (2000): Discoverability of attorney fees records on computer.   
    • Anti-Monopoly Inc. v. Hasbro, Inc. 1996 WL 22976 (S.D.N.Y. Jan 23, 1996): “[T]oday it is black letter law that computerized data is discoverable if relevant.”
    • Byrne v. Byrne, 168 Misc. 2d 321, 650 N.Y.S. 2d 499 (N.Y. Sup. Ct. 1996): In a divorce proceeding, the wife took her husband’s laptop used for personal financial information and gave to her attorney to obtain possible evidence and information about the couple’s finances and marital assets.  Husband later objected to Wife’s access to computer.  Court held wife shall have access to computer just as access to home filing cabinet.

“The computer memory is akin to a file cabinet. Clearly, [the Wife] could have access to the content of a file cabinet left in the marital residence.   In the same fashion, she should have access to the contents of the computer.   [The wife] seeks access to the computer memory on the grounds that [the husband] stored information concerning his finances and personal business records in it.   Such materials is obviously subject to discovery.”

    • Tulip Computers Int’l. v. Dell Computers Corp., 2002 WL 818061 (D. Del. April 30, 2002): The court granted a motion to compel Dell to produce hard drive disks for plaintiff’s expert to conduct a key word search on and plaintiff was to then give the defendant a list of the e-mails that contained the search terms.   The defendant was to then produce those documents to the plaintiff after a review for privilege and confidentiality claims.
    • Superior Consultant Co. v. Bailey, 2000 WL 1279161 (E.D. Mich. Aug. 22, 2000): The court ordered a defendant to create and produce for the plaintiff a backup file of the defendant’s laptop as well as any other computer he had access to.
    • Playboy Enterprises, Inc.  v. Welles, 60 F. Supp. 2d 1050 (S.D. Cal. 1999): Court ordered discovery of defendant’s deleted e-mail after admission that deleted e-mail. Court appointed computer expert.
    • Linnen v. A.H. Robins Co., 1999 WL 462015 (Mass. Super. June 16, 1999): The court sanctioned the defendant for not turning over electronic database and stated: “A discovery request aimed at the production of records retained in some electronic form is no different in principle, from a request for documents contained in any office file cabinet.”
    • Van Westrienen v. Americontinental Collection Corp., 189 F.D.R. 440 (D. Or. 1999); Plaintiff is not entitled to “unbridled access” to defendant’s computer systems and should investigate “other less burdensome” avenues of inquiry.
  • Discovery Sanctions Available  Discovery Misconduct:
    • Spoliation of electronic data:
      • Evidence of spoliation of electronic data, if willful, may provide grounds for striking of leadings or defenses   Bulkmatic Transport Co. v. Taylor, 860 So.2d 436, (Fla. 1st DCA 2003).
      • Evidence of intentionally lost, misplaced or destroyed electronic data should result in sanctions under Rule 1.380(b)(2) as well allowing for an adverse inference and sometimes including Mercer v. Raine, 443 So.2d 944, 946 (Fla. 1983).
      • Default judgment or striking pleadings.  Martino v. Wal-Mart Stores, Inc., 908 So.2d at 346, 347.
  • Where e-mail has been deleted from back-up tapes/cost shifting analysis:
    • Zubulake v. UBS Warburg, LLC, 217 S.R.D. 309 (S.D.N.Y. 2003) (“Zubulake 1”): Court ordered production of deleted e-mail from back tapes and articulates a new seven-factor cost-shifting analysis:
      • The extent to which the request is specifically tailored to discover relevant information;    
      • The availability of such information from other sources;
      • The total cost of production, compared to the amount in controversy;
      • The total cost of production, compared to the resources available to each party;
      • The relative ability to each party to control costs and its incentive to do so;
      • The importance of the issues at stake in the litigation; and
      • The relative benefits to the parties of obtaining the information. 
  • Practical Considerations:
    • Early in the case, if your client believes that the computer at home has necessary financial or misconduct information on it, take computer to forensic expert to have the hard drive imaged just as he or she would have access to the file cabinet.
    • “Different standard if your client has possession of the family computer.” Copying the entire hard drive is O.K./akin to the file cabinet.
    • Where request computer from opposing party requires the specificity of a Request for Production of Documents.
  1. Spyware – Is it legal?  Statutes to be aware of:
  • Title III of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U.S.C. Section 2510-2522: Generally prohibits interception of wire, electronic and all communications.
  • Title 18 U.S.C. Section 2511(1)(a): Applies to the person who willfully intercepts such wire, electronic, and oral communications Subsection (c) applies to any person who knowingly or having reason to know that the communication was obtained through an illegal interception willfully discloses its contents.
  • Electronic Communications Privacy Act of 1986 (ECPA), 100 Stat, 1948 as amended: Enlarges the coverage of Title III to prohibit the interception of “electronic” as well as oral and wire communications. Title III now applies to the interception of conversations, over both cellular and cordless phones and whether communications are “oral”, “wire” or “electronic” as defined by 18 US.C. Section 2510 (1994 ed., and Supp. V).
  • Important cases:
    • “Spousal snooping” of electronic mail that is stored on a computer is not an interception of e-mail in violation of the act.   Interception comes only with transmission.  See Frasier v. Nationwide Mutual Insurance Company, 352 F. 3d 107 (3d Cir. 2003); United States v. Steiger, 318 F.3d 1039, 1048-49 (11th Cir. 2003); Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir 2002); Steve Jackson Games, Inc. v. U.S. Secret Serv., 36 F. 3d 457 (5th Cir. 1994); see also U.S. v. Councilman, 245 F. Supp. 2d 319 (D. Mass. 2003); Wesley College v. Pitts, 974 F. Supp. 375 (D. Del. 1997), summarily aff’d, 172 F.3d 861 (3d Cir 1998).
    • O’Brien v. O’Brien, 899 So.2d 1133 (Fla. 5th DCA 2005):

Installation of spyware program on a computer which simultaneously copied electronic communications of husband with another woman by electronic mail and instant messages as they were being transmitted was illegal “interceptions” of electronic communications under Security of Communication Act.

  • Practical/ethical considerations:
  • Whether spyware is legal will depend upon whether you are listening into a “electronic communication” within the meaning of the statute.   In U.S. v. Ropp, 2004 WL 2823039 (C.D. Cal., Oct. 7, 2004) held that the use of hardware spyware device “Key Katcher” did not violate the ECPA because the transmission of keystrokes from a keyboard to a computer’s processing unit is not the transmission of an electrical signal by a system and does not constitute “electronic communication” within the meaning of the statute. 
  • Warn any client who plans to use spyware that Federal law will criminalize this behavior very soon.   In Virginia, there is a specific statute that grants each individual a right of computer privacy, even if the computer is jointly owned. Violator is subject to both criminal and civil penalties.
    1. American Bar Association, Section of Family Law, Family Advocate, Winter 2006, Vol. 28, #3, Electronic Evidence: Recommends that counsel advise their clients to avoid using spyware.   Better alternative is to have a forensic image made of the computer in your client’s possession.   This can be done while the spouse is at work or away on a business trip.   This protects both attorney and client against any civil or criminal claim of computer trespass or invasion of computer privacy.  You have the forensic image without the civil or criminal liability.

Resources:

    • Family Advocate: “Electronic Evidence”, ABA Section of Family Law, Winter 2006, Volume 28, No. 3
    • The Sedona Principles: Best Practices, Recommendations and Principles of Addressing Electronic Document Production. www.thesedonaconference.org
    • Electronic Discovery:  “Everything You Always Wanted to Know Before It’s Too Late”, Florida Bar Continuing Legal Education Committee and the Business Law Section, January 20, 2006
    • Paul R. Rice, Electronic Evidence, Law in Practice, American Bar Association, 2005
    • Nelson Olson, and Simak, the Electronic Evidence and Discovery Handbook: Forms, checklists and guidelines, American Bar Association, Law Practice Management Section, 2006
    • Cohen and Lender, Electronic Discovery, Law in Practice, Aspen Publishers, 2006
    • Digital Discovery and Evidence: Best Practices and Evolving Law. Published by Pike ad Fischer, Inc., a division of the Bureau of National Affairs, Inc.  See www.pf.com/digitaldisc.asp for further information.
    • Electronic Discovery and Document Storage: Management and Litigation Issues: Lorma Education Services (August 25, 2005)
    • E-Discovery Explosion, Legal Assistant Today, (July/Aug. 2006)
    • International Journal of Digital Evidence (www.ijde.org)
    • Grenige and Gleisner, III, E-discovery and Digital Evidence (2005)
    • Michele C.S. Lange, Kristin M. Nimsger, Electronic Evidence and Discovery: What Ever Lawyer Should Know, (ABA, Section of Science and Technology Law, 2004)   
Posted in eDiscovery and tagged .

Carolyn S. Zisser

Highly regarded in marital and family law, Carolyn S. Zisser is a well-respected lecturer and author on family law subjects for the American Bar Association, Florida Bar, Jacksonville Bar Association and private legal seminar companies.