What Makes a Preservation Letter Presidential

Episode Notes

Transcript

Digital Detectives

What Makes a Preservation Letter Presidential

1/30/2018

[Music]

Intro: Welcome to Digital Detectives, reports from the battlefront. We will discuss computer forensics, electronic discovery and information security issues and what’s really happening in the trenches; not theory, but practical information that you can use in your law practice, right here on the Legal Talk Network.

[Music]

Sharon D. Nelson: Welcome to the 87th edition of Digital Detectives. We are glad to have you with us. I am Sharon Nelson, President of Sensei Enterprises.

John W. Simek: And I am John Simek, Vice President of Sensei Enterprises. Today on Digital Detectives our topic is President Trump’s Lawyers and Craig Ball’s “The Perfect Preservation Letter.”

Sharon D. Nelson: Before we get started, I would like to thank our sponsors. We would like to thank our sponsor SiteLock, the global leader in website security solutions. Learn more at HYPERLINK “http://www.sitelock.com/legal/digitaldetectives”sitelock.com/legal/digitaldetectives.

We’d also like to thank our sponsor  HYPERLINK “http://www.PInow.com” PInow.com. If you need a private investigator you can trust, visit HYPERLINK “http://www.pinow.com”pinow.com to learn more.

John W. Simek: Our guest today is Craig Ball, a Texas lawyer living it up in New Orleans. Craig is a peripatetic presence in legal education around the globe. He’s tried lawsuits in Houston for 25 years before joining the law faculty at the University of Texas in Austin and 11 years practice to serving courts as a Special Master in Computer Forensics and Electronic Discovery.

Craig has delivered more than 2000 speeches and papers on forensic technology and he blogs on topics of interest to lawyers and litigation support at  HYPERLINK “http://www.ballinyourcourt.com” ballinyourcourt.com. As usual it’s great to have you, Craig.

Craig Ball: Thank you John. Always a pleasure to work with you and Sharon.

Sharon D. Nelson: Well, I’m delighted to have you back too, Craig, it’s always a ball. I actually didn’t know, that was coming out of my mouth.

Would you tell us please — because this whole podcast actually originated because I blogged about your blog and you had a blog post called ‘The Sincerest Form of Flattery’, can you tell us what prompted that particular post?

Craig Ball: Yes, I’d be happy to, Sharon, and thank you as always for blogging about my blog and I look forward to blogging about your blog, blogging about my blog. That post is such an incestuous relationship. So that post grew out of a missive I got from other members of the Texas State Bar Computer & Technology section and it’s a group of folks on the council, very tech-savvy for many years, and they kind of served as de facto leaders of helping Texas lawyers stay up to date with computer technology and law practice.

So one of my colleagues sent around this notice and said, hey, this letter that President Trump’s lawyer sent around trying to get the publisher and author of the recent hire and fury booked an article in ‘The New Yorker’ is a very good missive about preserving electronically stored information. Well, that of course piqued my interest, so I tracked down the letter and started reading it and reading it and after the usual, you are a terrible person and your mother should be ashamed of you and we’re going to see you for the start stuff.

I started recognizing the text and I thought, well, that’s funny, this is familiar, and I looked at it and then mind you, we are talking about, it’s 11- page letter and so I’m talking about roughly the last six pages or so of the letter, more than half the letter, and I realized it dawned on me, this not only do I think this is really well-written, but I realized I wrote it, and I mean, not just a little of it, but I’d written essentially six pages of this later verbatim including whatever odd mistakes I’d made in punctuation or weird grammatical constructions, and I’d written it — it took me a while because I’d written it before the Federal Rules of Civil Procedure earliest rules on e-discovery, because it comes out of an article I wrote more than 12 years ago called The Perfect Preservation Letter. As I was shocked to see my work adopted verbatim by the President of the United States. I see this president.

John W. Simek: Well, Craig, I know you get upset fairly easily, but were you all cranked up that they were using pages essentially your own work without attribution, it didn’t have a byline on this letter, I’m sure, right?

Craig Ball: No, there was no — my copyright was not respected, but let’s be pragmatic, I wasn’t — I wasn’t bothered by that a bit. It was an article that I’d written so many years ago for the express purpose of helping other lawyers use it as a drafting aid. So I certainly expected that people would judiciously borrow from the language that I’d put forward and as it was applicable to their case and as it was temporarily relevant that they would use it.

(00:05:13)

So I was flattered that they used it and I’m still flattered that the President of the United States who never seems to be able to listen to anything anybody proposes that he do or say, was willing to borrow six pages of my worst verbatim.

Sharon D. Nelson: Well, I think you’ve already suggested to us something about what the president’s lawyers should have done differently, but go ahead and explain it further.

Craig Ball: Well, as I say, it’s not that I’m bothered that they used the language. I guess if I’m bothered by anything I’m bothered that they didn’t take to heart the language that a company did which was rather important to me; in fact, all those days ago, years ago, I said you won’t find the perfect Preservation Letter in any form book. You have to build it, custom crafted from a judicious mix of technical boilerplate and fact-specific direction.

So what I was saying even back then, and we’re talking about very early days again, before the federal rules governing electronically stored information, there was nothing out there about Preservation Letters, so that’s why I wrote the article and that’s why put forward the language.

The mistake that I think they made had nothing to do with attribution. It’s that they didn’t think about what the issues were in the case and tailor their preservation to the things they really needed. They just used a scattershot approach that is disproportionate to what we should be doing today and considering the issues, the amounting controversy, the position of the various parties and so forth, all of those things laid out in the federal rules, but more than that they fail to update it in recognition of all that’s transpired in modern information technology over the course of the last dozen plus years.

I mean, let me ask it back to you, what form of communication do you associate it most with the President of the United States?

John W. Simek: Well, obviously he’s a Twitter, Twitter user, right? Twitter didn’t exist back then when he wrote you a letter, Craig.

Craig Ball: Of course not, and so tweets and other forms of social networking are conspicuous by their absence. If you’re going to be asking people to preserve things why would you ask them to preserve Lotus 1-2-3, which was still in existence and in wide use back when I wrote that one has fallen off the edge of earth. Why would you fail to include all the new forms of communications like social networking, all those specialized forms of collaboration and messaging that exist today?

So, where I think they failed was in not thinking about what they were using and not updating it to a modern computing environment and a modern communications environment.

Sharon D. Nelson: Do you think they were just under the gun time-wise? Is that why somebody would — I don’t want to make it sound like they were stealing something because your language was open and for people to use, but lifting that language and they should have known how old it was, at least, were they just trying to get something together and scrambling?

Craig Ball: Well, I can’t begin to speculate as to what was going through the minds of the individual lawyers and to be completely fair, they may not have stolen it from me and I use the word “stolen” tongue-in-cheek, they may have borrowed it years ago in creating a form for their firm or they may have borrowed it from another lawyer who took it verbatim.

So I can’t say that they went directly to my — even though it’s my article verbatim, I can’t say that that was their origin, they could have stolen it from somebody who also had stolen it — who had stolen it from somebody else and isn’t that what we do in the law because anybody ever write very much originally. If we did, we would never say things like wherefore premises considered. Who says stuff like that?

Sharon D. Nelson: Well, do you think the fact that they didn’t have to do so much work because they didn’t appropriately updated, diminished the size of their bill at all?

Craig Ball: Oh, I am not going there.

Sharon D. Nelson: I am sorry, I would throw other question.

Craig Ball: I am not going there. I have no doubt that they billed no time at all for simply hitting Print on this, what lawyer would ever charge for drafting something that they pulled from a form book, that would be unethical.

(00:09:56)

Sharon D. Nelson: Okay, you’re having too much fun. Okay, John, it’s your chance.

John W. Simek: Craig, in case our listeners aren’t aware of this, can you tell us, tell them what the difference is between a Preservation Letter and a Legal Hold Notice?

Craig Ball: The way I use those two terms, John, is a legal hold notice is what you send to your client to tell your client of the need to preserve certain forms of documents and electronically stored information in anticipation of litigation or in connection with existing litigation, that’s — I represent you, you need to preserve this for this litigation. That’s a well-known activity to in-house and corporate counsel.

The Preservation Letter is something you send to your opponent or your opponent’s counsel if counsel has entered the case, where you set out your expectations in terms of notifying them of those forms of electronically stored information that you expect your opponent to preserve.

So, one is something you send your own client, one is something you send your opponent, and they have very different effects legally.

John W. Simek: Well, thanks for that. Before we move on to our next segment, let’s take a quick commercial break.

[Music]

Sharon D. Nelson: At least 80 of the 100 biggest law firms in the country had been hacked since 2011. Protect your firm and your clients from cyber attacks with SiteLock. Their industry leading cloud-based suite of website security solutions includes website scanning, web application firewall, including DDoS mitigation, and 24×7, 365 US-based customer support. Give your firm and your clients peace of mind knowing their information is secure. Learn more at HYPERLINK “http://www.sitelock.com/legal/digitaldetectives”sitelock.com/legal/digitaldetectives.

[Music]

Welcome back to Digital Detectives on the Legal Talk Network. Today, our topic is President Trump’s Lawyers and Craig Ball’s “The Perfect Preservation Letter.” Our guest today is Craig Ball, a Texas lawyer and renowned e-discovery and digital forensics expert.

Well, Craig, I think we had all too much fun in that first segment. So this time we’re going to be fairly serious and drain most of the humor from this. Tell us a little bit about what the Preservation Letter accomplishes and does it create a legal duty?

Craig Ball: Well, you could read the federal rules, state rules of procedure cover to cover and you wouldn’t find any reference to Preservation Letter. So no, it doesn’t create a legal duty. The legal duty to preserve information is a creature of the common law, Sharon, and it goes back many, many years to – or the early Jolly Old England and so forth, the need for all of us to preserve the evidence available to us to assist the courts in reaching justice.

What the Preservation Letter does do is it closes the door of an opponent saying, oh gee, oh gosh, oh golly, if I’d only known that you wanted us to preserve emails or text or other items of electronically stored information, we could have done it but we didn’t anticipate that, and oh, by the way, even if you told us, it’s too burdensome, it’s disproportionate to the needs of this case; so we aren’t going to do it, but in any event it’s gone.

So the point here is, the Preservation Letter not only says, hey, these things may be relevant to this case and we expect you to act responsibly and meet your obligations under the law to preserve them, but I use it as a further means to make sure that they understand how to do it in ways that I would find appropriate and acceptable, and in particular, how to preserve certain kinds of metadata and forms of the information that in my experience, I know I’m going to be asking for and will be a much richer and more reliable form of information.

So, it’s about giving notice to prevent people from using the ignorance defense against foliation down the road. It’s about reducing the costs of preservation by showing them the most expedient and narrowest ways to preserve information so that if they were ever a cost shifting or a claim that it was excessive that you can demonstrate that you provided reasonable restraints; and those are really the big two, and the third is it’s instructional.

(00:14:55)

The fact is that most lawyers even today, even a dozen-plus years after I wrote this exemplar still don’t really know how to go about preserving or advising their clients to preserve myriad forms of electronically stored information so that they remain reliable and complete, as you well know in your work.

Sharon D. Nelson: Indeed.

John W. Simek: Well Craig, I know you already talked a little bit about that it probably wasn’t a good idea that they lifted so many words of your original preservation letter and copied them, but tell us a little bit about — a little more about how the lawyers should really go about drafting a good preservation letter.

Craig Ball: You have tapped into one of the great dilemmas of my work for many years. On the one hand, I abhor forms. People who just grab a form and use it blindly, I just hate that.

On the other hand, after many years of sort of banging my head against the wall of trying to get people to understand how to do something and then do it in a way I regard as competent, I found that you can get a lot more people to do something if you give them a form than if you try to instruct them how to do it on their own. We are all of us inherently lazy.

So I do think it’s important that you seek out language that will help you get to the point. One of the art and the science of electronically stored information and e-discovery is using precise language. Lawyers understand how important it is to use precise language when drafting a contract or a petition, but if you are in the IT business, things mean something different. There are peculiar terms with specific meanings and you don’t want to use loose language in either core.

So I do think it’s important to seek out language that hopefully has been drafted by someone who knows what things are called, at least contemporaneous with the time in which you are writing. I don’t think we want to speak about spreadsheets as being Lotus 1-2-3 anymore, but I do think it’s important that you reach out for forms.

And then here’s the key. Don’t use language in a form if you don’t understand what it means. That’s the least we have to bring. But you laugh John, but it’s so true.

John W. Simek: I hear you.

Craig Ball: I guarantee you that most of the people in their definitions, in their request for production as well as in their preservation letters are talking about things they don’t understand.

One of my favorite examples in the definition of documents that floats around in request for production is the term Phono Belts. Most of the people who are defining Phono Belts as a form of document have never seen what a Phono Belt is and don’t know what it is. They will talk about telegrams and they have never received a telegram in their life.

I think it’s the same thing. If you are going to be giving my litany of forms and locations and methodologies, you are going to be adopting it, at least do your client the courtesy of understanding what you are asking for, because when you say I want the metadata and somebody says what metadata, and you say the metadata, and they say but which metadata, and you say I don’t know, I just have a form that says give me the metadata. That’s not good lawyering. That doesn’t give you credibility and that doesn’t serve the court system, the clients or anyone else when you are asking for things and perhaps generating enormous expenses for production and preservation of material that you haven’t the slightest idea what it is or how to use it.

John W. Simek: That follows towards the rule changes too, towards technical competence, doesn’t it, Craig?

Craig Ball: It does, and we have unfortunately failed to really define what technical competence is. California has done a pretty good job setting out nine skill sets required for technical competence when it comes to electronic discovery, but even then, they are more aspirational than they are specific. Where is the core curriculum that every lawyer must understand to label themselves competent in e-discovery, where are the examinations that are going to assure all of us associated with the legal system that those who claim competence can actually demonstrate competence.

I can tell you this, I am not aware of any bar in the United States that has a section testing on e-discovery skills, and I think that hopefully is not a long way off.

Sharon D. Nelson: So in this preservation letter, tell us a little bit more about what it should discuss, and I am particularly interested in how broader or specific you think it should be. I know some people feel differently on that issue.

(00:20:02)

Craig Ball: It’s hard for lawyers to resist the impulse to ask for anything and everything and any and all. This is language we have been taught to use out of fear and out of ignorance for a long time, but that kind of boil the ocean approach to preservation plays right into the hands of an opponent trying to resist preservation.

If you tell someone you must preserve in a manner that essentially requires you to shut down your computers and lay aside your phones and get off the Internet and shut the business, if you were to really try legitimately to comply with the demand, you might as well tell them they don’t have to preserve anything.

And that’s why I think it’s important that you really pick your battles in preservation. If email is your Target, if a mobile device’s text is your target, don’t just try to get them to preserve every instance and every bitten bite, make sure you single out those sources that you have reason to believe are most likely to be implicated in the communications and transactions that form the basis of the claims in the lawsuit, and that’s very hard.

It’s very hard for us to choose one thing over something else and unless you understand both the computing environment of the target, of your opponent as well as the way they were used, it’s challenging to be able to make those wise choices early on.

But it’s important you do, because judges are going to ultimately be asked to consider whether or not someone should have done what you asked them to do and done it the way you asked them to do it. And they are going to look at whether what you asked for was reasonable in scope, was affordable in cost and proportionate to the needs of the case. And if the answer is this person was surgical, this request focused on the things that the absence of which now is so damaging to the ability of one side or the other to prove their case, that’s going to prove to your advantage.

So a little goes a long way and less can be more with respect to demands for preservation.

John W. Simek: So Craig, who should be getting these preservation letters and when?

Craig Ball: Well, would I be any kind of lawyer if I didn’t say it depends John. Depends by the way is the — is my new line of adult diapers for lawyers, but it depends. So we can see that it depends, that’s what you are going to be buying.

Now, it depends on this, you are often providing this notice when there isn’t a lawyer in the case and with the corporation you can perhaps send a notice to general counsel’s office and know that it’s going to get to a lawyer. But in many other instances you have to make a decision, do I send it just to an individual, a potential defendant, a named defendant, do I send it to an employee who was involved in it? Do I send it to a management level, supervisory level person? Do I send it to third parties, people I know, lawyers, doctors, accountants, whoever it may be that act as third-party custodians of data for the potential party. These are decisions that have to be made in terms of timing and in terms of scope based upon peculiarities of the case. Everything should be, as they say, custom tailored to the needs of the case; letters, emails, pretty cheap.

So it’s when in doubt more notice is usually better than less notice. More people recognizing the obligation to preserve and more people preserving when one may choose to destroy is very likely the smarter way to go about it.

I would add to that that there are going to be rare circumstances where sending a preservation notice may serve as a blueprint for a person’s attempt to destroy data. So you have to weigh whether being very specific about certain types of inculpatory data that exists is more likely to trigger spoliation, in which case you need to anticipate that potential for spoliation and lay the groundwork for being able to demonstrate what happened, what was done, and that it was done with the mindset to destroy information and prevent its discovery in the case later on.

John W. Simek: All good points. Before we move on to our last segment let’s take a quick commercial break.

(00:24:53)

[Music]

Advertiser: Does your law firm need an investigator for a background check, civil investigation or other type of investigation? PInow.com is a one of a kind resource for locating investigators anywhere in the US and worldwide. The professionals listed on PInow understand the legal constraints of an investigation, are up-to-date on the latest technology, and have extensive experience in many types of investigation, including workers’ compensation and surveillance. Find a prescreened private investigator today. Visit  HYPERLINK “http://www.pinow.com/”www.pinow.com.

[Music]

Sharon D. Nelson: Welcome back to Digital Detectives on the Legal Talk Network. Today our topic is President Trump’s Lawyers and Craig Ball’s The Perfect Preservation Letter. Our guest is Craig Ball, a Texas lawyer and renowned e-discovery and digital forensics expert.

So Craig, when you receive one of this marvelous preservation letters, what should a lawyer or litigant do?

Craig Ball: The most important thing to do with one of these letters is to acknowledge it and advise those who have sent it those things that you are going to do that have been requested and much more importantly those things you are not going to do, because what you do not want to afford your opponent, if you are the recipient of a preservation demand, is the ability to argue that your silence was a tacit agreement that you were going to do these things.

And all of a sudden you can say, your honor, I would have come to court. I would have forced an order to preserve these things, but having given them explicit notice and told them how to do it and what my expectations were, I had ample reason to believe they would act on my demand. So it’s important you say what you are going to do and say what you are not going to do, and if you are so inclined make counterproposals or offer to do certain things if you shift the cost for same.

I think that there needs to be skin in the game on both sides. A preservation demand should not be made in a callous way so as to prompt needless expense of large amounts of money and time and at the same time the duty to preserve is genuine and the needs of a litigant may be unique enough or the person demanding preservation may have enough of a clear idea of what they need and where the evidence resides that it would be foolish to ignore the specifics of a well and carefully drafted preservation demand. It’s important to use it as a springboard for immediate clear communication and as appropriate cooperation.

John W. Simek: Well Craig, let’s leave the preservation letter topic and jump over to something else and talk about smartphones. What are your thoughts, can litigants preserve them on their own?

Craig Ball: Absolutely, and that’s what I have been writing about most lately. You know John, you are a forensic examiner so you more than most appreciate what a huge impact the efforts to lock down modern smartphones has had on forensics when it comes to these devices. The kinds of things we can do and take for granted with regard to computers in terms of bringing back deleted information and accessing unallocated clusters and the places where forensic data hides has been largely eliminated in an environment like the iPhone, to the point that we can look to the FBI’s dust-up with Apple and the San Bernardino terrorist case as further proof of even some of the best forensics skilled persons in the world can’t get into this data.

And I think that the lesson, the takeaway from that is a lot of what we have done over the last decade in making the smartphone devices the exclusive province of people like you or me, that they only get touched by the white-coated technician with specialized tools and so forth is no longer really that applicable in e-discovery, if it ever was.

In e-discovery we don’t dig down always to the hidden and the forensically significant. We are trying to get the low hanging fruit, the day-to-day usage of such things as messaging, the accessible geolocation data when that’s relevant. And we are fortunate in that the methodologies that are available to custodians to back up and protect their own data are largely sufficient for purposes of preserving that same data in electronic discovery.

(00:29:53)

And so I have written some articles that show low cost, no cost quick methodologies whereby you can advise your client to preserve and they won’t have to give up their phone. They won’t have to lose possession of their phone at all while they do that. And so crucially John, these are methods that don’t enable the holder of the phone, the custodian of the data to alter the data in the form of the preservation. It’s a monolithic enough approach that it doesn’t allow the party to be selective in that which is preserved and that which is not preserved.

Now, it creates some issues about ultimate disposition of the data, how do we divide the privileged and the private from the discoverable and that’s another discussion, but right now there are low cost, no cost, quick ways to preserve the contents of cellphones for e-discovery that are both rich with integrity and don’t require you to dispossess a party of their phone; a crucial, crucial thing here.

Sharon D. Nelson: Well, I think you probably garnered a lot of attention from a lot of folks with that answer alone, not to say the rest of the podcast, which was wonderful.

Thank you Craig for joining us today. I am truly sorry that our audience missed the intermission where we discussed your getting the apple pie after the event, because that was some of the funniest chatter, but I did enjoy the beginning very much and thank you for always being so quick-witted, so erudite, and so generous with your time. We really appreciate your joining us.

Craig Ball: Well, thank you Sharon and thank you John and I hope anyone who would like to learn more about these things might stop by my blog,  HYPERLINK “http://www.ballinyourcourt.com” ballinyourcourt.com. Thank you both for having me today.

Sharon D. Nelson: You bet.

John W. Simek: Well, that does it for this edition of Digital Detectives. And remember, you can subscribe to all the editions of this podcast at  HYPERLINK “http://www.legaltalknetwork.com” legaltalknetwork.com or on Apple Podcasts. And if you enjoyed our podcast, please rate us on Apple Podcasts.

Sharon D. Nelson: And you can find out more about Sensei’s digital forensics, technology and cybersecurity services at  HYPERLINK “http://www.senseient.com” senseient.com.

We will see you next time on Digital Detectives.

[Music]

Outro: Thanks for listening to Digital Detectives on the Legal Talk Network. Check out some of our other podcasts on  HYPERLINK “http://www.legaltalknetwork.com” legaltalknetwork.com and in iTunes.

[Music]

Craig Ball: I have a pie in the oven; I was baking a pie and took this time to take it off. I bet that’s the first time that anybody has ever had to stop one of these podcasts because they were baking a pie and had to pull it from the oven. This is what my life is.