NIST's Guide to Write Blockers

The National Institute of Standards and Technology's Computer Forensics Tool Testing Program has posted the results of its testing on hardware write blockers. There are separate reports for T4 Forensic SCSI Bridges; Tableau T8 Forensic USB Bridges; WiebeTech Forensic ComboDock; Digital Intelligence Firefly 800 IDE; and FastBlock IDE devices.

Several tests were performed on the write blockers:

1. Identify modifying commands blocked by the Hardware Write Blocker.

2. Attempt to modify a protected drive with forensic tools.

3. Identify read commands allowed by the Hardware Write Blocker [a good result will allow these to be read].

4. Read a protected drive with forensic tools.

5. Identify access significant information unmodified by the Hardware Write Blocker.

6. Determine if an error on the protected drive is returned to the host.

eDiscovery Maturity Model

We all have a vague sense of how well things are going at work. Some projects may not come together as well as others which are less complex or which we have more time to concentrate on. Hopefully over time as we become more experienced, and with help from our co-workers we're able to develop a more organized approach to projects which re-occur on a regular basis. The eDiscovery Maturity Model is a useful way to track how the efficiency electronic discovery or legal work in general can be enhanced.

The model was created by Adam Hurwitz of BIA (Business Intelligence Associates, Inc.) and has been included in the EDRM White Paper Series.

The model depicts five levels of efficiency which each consider the factors of focus, strategy, expertise, and costs.

1. Ad Hoc, Chaotic

2. Managed

3. Standardized

4. Semi-integrated

5. Integrated and Optimizing.

We've all been at Level 1. At the beginning of our careers, or simply when more work is thrown at us than we can handle, it's hard to avoid simply moving point to point along the most easily apparent path to finish a project. You want to "just get it done". There's no time to find outside help - or figure out who can really help - and "individual heroics" are required. You're not calling upon memories of past projects, and you have to figure out how things are done as you go along - no expertise is involved. The project is begun without any idea of how much it will cost in the end. From the perspective of a company performing electronic discovery, this is when their IT collects data from different custodians at different times and using a variety of techniques to do so.

Our aim, perhaps never perfectly achieved for all projects, is to refine our focus. We not only plan more for projects, but adhere to standardized procedures, automate some tasks, and integrate our efforts with those of others.

A more mature strategy over time will move from many vendors being tried by outside counsel; to trusted vendors being preferred; to in-house abilities being developed so that vendors only need to employed in certain situations.

The top electronic discovery expert may at first be the most capable person at a law firm, but later on vendor specialists may be engaged, with an expert team ultimately being created involving members of both the legal and IT team of a company.

Costs can first be controlled with budgets being developed for specific projects, and then ways can be found to implement cost saving measures. Ideally the costs of electronic discovery can be part of the IT budget.

Electronic Discovery Institute Course - Class 22 - Privilege

Here's a continuation of my postings about the Electronic Discovery Institute's online e-discovery certification program, that you can subscribe to for just $1. I last blogged about this program on April 21, 2018. Go to https://www.lawinstitute.org/ to sign up for it.

The course on Privilege is taught by Julie Hanna, an eDiscovery counsel for Fannie Mae; Sarah Padgitt, senior counsel for Baxter International, Inc.; Retired Judge John Facciola, formerly a magistrate judge for the District of Columbia; and David Greenwald, a partner with Jenner & Block LLP. Here are my notes from the course:

A lawyer has a profound obligation to protect the confidences of a client, but there are exceptions to attorney-client privilege. A lawyer must be familiar with the benefits and dangers of technology. Lawyers are particularly vulnerable to hacking. A lawyer must take adequate measures to ensure that a client's data is protected, using available technology. It is not difficult to find someone who will perform a security audit for a firm.

Privilege drives up to 40 to 50% of the cost of discovery.

Attorney client priviege has five basic elements:

1. a client

2. a lawyer acting as a lawyer

3. a communication made for a legal purpose

4. a communication made in confidence

5. a communication made with the intent that it be kept confidential.

Courts will require a clear showing that an in-house lawyer has acted as a lawyer with respect to communications over which privilege is asserted. Attorney-client privilege attaches to communications, but not to facts. Communications made for business purposes are not privileged. The D.C. Circuit in In re KBR broadly defined privilege to include communications made for both business and legal purposes . Communications with people acting as agents of a lawyer, such as financial advisers, may or may not be privileged. Communications must be made with the expectation of privacy.

In-house counsel may provide legal or business advice. Privilege only occurs when legal advice is provided to a company. In-house counsel don't provide legal advice to employees as individuals. In re Vioxx (E.D. La.), held that when Merck disseminated legal questions to many parts of its company, the communications were not privileged, but a lawyer's responses directly to a specific person could be considered privileged.

Documents reviewers should carefully review communications with counsel in order to determine which sections are privileged and which are not. In a corporate setting, the client is anyone with information that the attorney needs to give advice to the company. An Upjohn warning may be given in order to inform an employee that in-house counsel represents the company, and the individual employee. In United States v. Nicholas, the Ninth Circuit ruled that a senior executive was sophisticated enough to understand that he did not have privilege in communications with counsel, but still referred the attorneys to the bar disciplinary committee because they did not warn the employee that his communications were not privileged.

Federal law applies the Upjohn standard but not all states do. The identify of legal interest test may be used to determine if communications fall within the common interest doctrine.

The work product doctrine was established by the Supreme Court in Hickman v. Taylor as a common law protection. It is governed by Federal Rule of Civil Procedure 26. Work product protection is a qualified immunity. Work product can be discovered under some circumstances. Opinion work product, something showing an attorney's thought processes, will be protected under Rule 26. The work product doctrine can cover intangible material, non-documents, that was prepared in anticipation of litigation.

Information that discloses the lawyer's thinking is absolutely privileged. Everything else may be disclosed subject to a substantial need. If communications or documents are to be protected because they are made in anticipation of litigation, a legal hold must also be issued at the same time to order to preserve records relating to the litigation.

Attorney-client privilege may be waived if a communication is disclosed to a third party. Work product protection is more difficult to waive.

Federal Rule of Evidence 502(a) abolished subject matter waiver, except in rare cases. Overly board assertions of privilege may undermine an attorney's credibility. FRE 502(d) enables a court to rule a document disclosure has not waived for the privilege for that document. Entering a FRE 502(d) at the beginning of a case to allow for the claw back of privileged documents can save a lot of time and money in the long run.

FRE 502 can be used to bind all other state and court proceedings to the rulings of the court on privileged documents. Very few states have adopted analogues to FRE 502. In most states subject matter waiver is still a real risk. FRE 502(b) deals with the inadvertent production of privileged documents by requiring reasonable steps to prevent the production of privileged document. In the era of electronically stored information, a review of privileged documents does not require a page by page review of all documents considered for production. Search strategies and other methods must be employed to search for privileged material. Judge Facciola believes that attorneys tend to claim attorney-client privilege excessively for fear of a general waiver, even though FRE 502(a) has abolished subject matter waiver.

Some transparency with respect to privilege review can help enhance the defensibility of the process. Cases will tend to cost less money and go faster when opposing counsel cooperate on discovery matters. Judges will be more supportive of attorneys who aim to be cooperative with respect to discovery disputes. Attorneys should work hard to understand a case at the outset and come to an understanding of what is in the scope of discovery. A categorical document privilege log can help lower privilege review costs. Attorneys can identify areas of potential disagreement by assigning groups of documents to particular categories. A comment added to FRCP 26 in 1993 states that document by document privilege logging may not be appropriate for cases with voluminous information. A rule in New York State commercial courts indicates a preference for category based privilege logs.

Even if a categorical privilege log is agreed to, an attorney should still remain diligent in monitoring when work product and attorney client privilege is claimed. Judge Facciola acknowledged that attorneys ability to review each document is severely compromised by the large size of ESI data sets. He recommends finding some documents that are typical of each category and presenting them for review by a judge.

Lawyers must be familiar with different ways to use technology in order to review data thoroughly and expeditiously. Certain custodians may be prioritized and data duplication can reduce what needs to be reviewed.

Judge Facciola noted that attorneys are inclined to declare that the documents they select for seed sets used in predictive coding should be work product. Current case law is unclear on this point. Judge Facciola believes that the argument that seed sets are work product is more compelling than it is not, but still sees the need for transparency.

The Rule 26(f) conference should be used to reach an agreement on discovery protocols.