Electronic discovery is any process in which electronic or other non-paper forms of data is sought, for the purpose of using the data as evidence in a civil or criminal legal case. The electronic data can be electrical, mechanical, magnetic, wireless, optical, etc. The information may be stored on a hard drive, compact disc, digital video disc (DVD), flash drive, or with any other method or technology. This article is my opinion, and not legal advice. I am a judgment broker, and am not a lawyer. If you ever need any legal advice or a strategy to use, please contact a lawyer.
The stored data which might be discoverable is known as Electronically Stored Information (ESI). The ability to completely delete or destroy ESI is reduced when data is backed up either on or off-site. Completely deleting data is not a trivial task, because the most common way to delete a file is to remove its first file letter/number character and make that disk space available for other data. Until that specific file location has been overwritten, the deleted file is still accessible and recoverable.
Modern operating systems will offer to “securely” delete files, however that is not fail-safe. Commercially available scrubbing programs do more than merely delete files, they overwrite the file locations several times with random characters, so that the deleted file gets “scrubbed clean”.
However, the only “foolproof” way of destroying stored information is to physically destroy every hard drive or other storage device or system, where the file has ever been stored. Physical destruction of a device or computer file may include one or more actions to destroy the media the data file resides on; including shredding the media, burning or melting the media, liberal use of a sledge hammer, degaussing, etc. If a file has ever been sent over the internet, it might never get completely destroyed.
Discovery of electronically stored information (ESI) can be done onsite, offsite, online or offline. In civil matters, most information available offsite and offline is obtained through the use of a Subpoena Duces Tecum (SDT).
The data that can be asked for with a SDT is usually within the scope of Federal Rules of Civil Procedure (FRCP) 34(a). When the SDT requests document(s) and thing(s) that are not stored on paper, care must still be taken to insure the data stays usable, accessible, and admissible in the court. The witness or defendant is usually compelled to disclose the format of the ESI, and any required passwords, to enable the data to be examined by an agent of the court at the time the court specifies.
Whether civil or criminal, either in cases of trade secrets or with malware, or when any other data-related evidence is needed; the electronically stored information (ESI) must be captured. The handling of ESI, once secured, is subject to the same chain of custody challenges as all other evidence types are. However, in ESI situations, since there are no paper documents, the handling and storage of ESI must be carefully managed by people specifically trained for such matters. Analysis and evidence gathering by cyber-forensic technicians is conducted on a digital copy of the original drive or media which is subject to examination. The goal is to avoid any chance of harm being done to the original evidence.
The court clerk does the judge’s bidding. It is the same as if the judge handed it to you. I have never seen a judge handle SDT records, it is always handled by the clerk. I would just be sure there is a declaration by the custodian of records in the paperwork package. The custodian’s affidavit is not sufficient to protect the chain of custody once the documents leave court.
Where the case warrants, having the documents taken into custody by a deposition officer at court. In some instances, especially when law enforcement is involved, the court may order the seizure of computers for forensic analysis, or may order a surreptitious intrusion under the guise of a search warrant, or some other form of subpoena.
When critical evidence is needed, and there is a risk that such evidence may be deleted, modified, or destroyed; the means of electronic discovery may be expedited by hacking into a computer or network system. Most occurrences of hacking into a computer or network under such conditions is conducted by government agencies executing search warrants. The type of media most often examined is that which is suspected of storing evidence of financial crimes, theft of trade secrets, or other internet-related potential crimes.
Documents that you have gathered and intend to use for an alter ego/sucessor liability motion, at the trial, you will want to re-subpoena the records to the hearing.
For your motion, I think you can avoid a tampering argument by using the declaration from the records custodian and your own declaration as to getting the records from the court clerk, maintaining them in the office, they have not been altered, etc. I think it would be hard for the other side to overcome that.
At trial, the lawyer handling your case does not want to be a witness for you. So if the lawyer takes possession of the documents, then the lawyer may become a witness in the case. I suppose the situation is different with a non-attorney judgment enforcer. But the way to handle it at trial is to re-subpoena the records from the witness so what the lawyer did with the documents does not matter. In a motion setting you can handle it through a declaration.
Chain of custody is not usually that important in civil cases. Although it can become an issue if there are claims of tampering, forgeries, etc. It is much more important in criminal cases where the burden of proof is so much higher. I suppose if the stakes are high enough or for other extenuating circumstances then the belt-and-suspenders approach of involving a court reporter or other measures would make sense. For a more typical case I do not think it is necessary.
Some have thought should be given to the notion that simply sending a new SDT against the same witness for the same documents might be problematic. Especially with smaller witness (accountants, landlords, etc.), I could certainly envision them bringing a motion for a protective order based on the request being burdensome since the documents have already been produced. Just because you (the creditor) did not maintain the proper chain of custody, should not mean they need to duplicate their work of document production. And, documents being produced at an ORAP, cerainly pursuant to CCPs 708.120 and 708.130, are evidence, not discovery.
In any circumstance where one may wish to offer into evidence, the documents produced. Perhaps you received documents that you intend to use for an alter ego/sucessor liability motion. The documents produced are hearsay. However, one exception to the hearsay rule is under EC 1560/1561, where a proper custodian affidavit is produced. But, that only takes you as far as the court production. What happens when those documents leave court, who is to say that the documents have not been altered? Hearsay is excluded because of its inheriant unreliability. Exceptions, such as business records, exist where the inherant unreliability is addressed, in this case, through a 3rd-party that states ‘these are accurate records, properly maintained, etc.’ However, once those docs leave the court and are in the sole posession of the creditor party, you once again have the arguable issue of unreliability.
A competent attorney on the debtor’s side will likely be able to have these documents excluded as being hearsay. And, questioning of a witness as to the documents may be limited based on a lack of foundation. Look at Evidence Code 650, particularly (d), about how the records were handled, who appeared, who got to see them, etc. If the other side was not there, there may be a waiver issue.
With respect to reliability of business records I think that goes to the question of the reliability of the records themselves. A tampering question is more of an authentication issue. See Evidence Code 1400.
The docs produced are hearsay. However, one exception to the hearsay rule is under EC 1560/1561, where a proper custodian affidavit is produced. But, that only takes you as far as the court production. What happens when those documents leave court, who is to say that the docs have not been altered? Hearsay is excluded because of its inheriant unreliability. Exceptions, such as business records, exist where the inherant unreliability is addressed, in this case, through a 3rd-party that states ‘these are accurate records, properly maintained, etc.’ However, once those documents leave the court and are in the sole posession of the creditor party, you once again have the arguable issue of unreliability.
A competent attorney on the debtor side will likely be able to have these documents excluded as being hearsay. And, questioning of a witness as to the documents may be on limited based on a lack of foundation.
Perhaps a simple solution is sending a new SDT (Subpoena Duces Tecum) against the same witness for the same documents might be problematic. Especially with smaller witness (accountants, landlords, etc.), I could certainly envision them bringing a motion for a protective order based on the request being burdensome since the documents have already been produced. Just because you (the creditor) did not maintain the proper chain of custody, should not mean they need to duplicate their work of document production. And, documents being produced at an ORAP, cerainly pursuant to CCPs 708.120 and 708.130, are evidence, not discovery.
The custodian’s affidavit is not sufficient to protect the chain of custody once the documents leave court. That is why I suggest, where the case warrants, having the documents taken into custody by a deposition officer at court.
Some use a bates stamp on the SDT documents right after they arrive. Actually, the process is to scan them to the file in PDF format, then do a squeeze to reduce file size, I use this not just to keep track of pages where I find important data, but if I have to file a motion or use them at a hearing this is how the court prefers to see your evidence. This adds of bit of chain-of-evidence when you tell the court these were taken from the envelope and bates-stamped immediately after they arrived and all pages are intact.
Bates stamping is excellent for evidentiary purposes. Just try telling the judge (or witness), please turn to Exhibit B, then, 15 pages down, right after the document that says, “signature card” in the top left, please direct your attention to …. It is much easier to say, please turn to page 15 of Exhibit B.
(The Bates system may help, however it does not really address the Chain of custudy issue.) BATE-stamping is simply a must if there is going to be anything more that “light litigation”. It is easy to do – just convert all the documents to a single PDF file, and then use the Adobe Acrobat Professional program’s “Footnote” feature to BATE-stamp them all at once.
BTW, voluntarily producing large files to the other side can have a productive side-effect, which is that if a debtor’s counsel receives a bunch of BATE-stamped documents, the attorney will tell his client that he needs to review them so that there are no surprises, and that drives up the debtor’s bill (which drives the debtor nuts). It also keeps the debtor’s counsel from claiming surprise and wanting a delay – “Oh, no, no, no, Your Honor, we voluntarily sent them those documents last April so they knew all about them.”