ELECTRONIC DOCUMENT DISCOVERY: A POWERFUL NEW LITIGATION TOOL

---

Other than direct testimony by an eyewitness, documentary evidence is probably the most compelling form of evidence in criminal and civil cases. Often, important communications are committed to writing and such writings can make or break a case. The same is true about documents used to conduct financial transactions. The paper trail has always provided a wealth of information in criminal and civil cases involving fraud. Traditional paper documents have been sought in the legal discovery process for hundreds of years in cases involving white collar crime (financial frauds, embezzlements). In more recent times, documentary evidence has become the keystone in civil cases involving wrongful employment dismissals, sexual discrimination, racial discrimination, stock fraud, and the theft of trade secrets. Today, judges and attorneys are very familiar with documentary evidence in paper form. Unfortunately, the legal process has not kept pace with computer technology and the document discovery rules have changed concerning the discovery of computer-created documents and related electronic data.

In years past, documentary evidence was limited to paper documents. Subpoenas and court orders were issued for the production of specific documents and the best evidence was typically considered to be the final draft of a document in paper form. Today, documents are rarely typed or handwritten. Most documents are created using personal computers with word processing applications or e-mail programs. Most professionals rely on personal computers to maintain diaries and to create their written communications. Most computer users have become prolific writers because of the convenience that computers provide. As a result, more documentary evidence exists today than ever before and it exists in a variety of electronically stored formats. However, you should keep in mind that a majority of computer-created documents are never printed on paper. Many are exchanged over the Internet and are read on the computer screen. Thus, the legal document discovery process has drastically changed as it relates to computer-created documents.

The best evidence rules also work differently today, because copies of computer files are as good as the original electronic document. From a computer forensics standpoint, this can be proven mathematically. There is no difference between the original and an exact copy. In addition, modern technology has created new types of documentary evidence that previously did not exist. This is especially true for the creation of documents on a computer word processor. When electronic documents are created, bits and pieces of the drafts leading up to the creation of the final document are written in temporary computer files, the Windows swap file, and file slack. The computer user is usually not aware of this situation. Furthermore, when computer-created documents are updated or erased, remnants of the original version and drafts leading up to the creation of the original version remain behind on the computer hard disk drive. Most of this data is beyond the reach or knowledge of the computer user who created the data. As a result, these forms of ambient data can become a valuable source of documentary evidence. Lawyers are just beginning to understand the evidentiary value of computer-related evidence and computer forensics in the document discovery process. It is becoming more common for lawyers to seek production of the entire computer hard disk drives, floppy diskettes, zip disks, and even cell phones and palm computer devices. These new forms of documentary evidence have broadened the potentials for legal discovery.

Electronic document discovery is clearly changing the way lawyers and the courts do business when it comes to documents created with personal computers. From a computer forensics perspective, computer data is stored at multiple levels on computer storage media. Some levels are visible to the computer user and others are not. When computer files are deleted, the data is not really deleted. Also, fragments of various drafts of documents and e-mail linger for months in bizarre storage locations on hard disk drives, floppy diskettes, and zip disks. Government intelligence agencies have relied on these secret computer storage areas for years, but the word is starting to get out. Electronic document discovery is making a difference in civil and criminal litigation cases. This is especially true in cases involving the theft of corporate trade secrets and in wrongful dismissal lawsuits. The trail of computer evidence left behind on notebook and desktop computers can be compelling.

A historical perspective helps one understand the evolution of computer forensics and its transition into the new field of electronic document discovery. When computer mainframe giant International Business Machines (IBM) entered the personal computer market in October of 1981, the event quickly captured the attention of corporations and government agencies worldwide. Personal computers were no longer thought of as toys; almost overnight they were accepted as reliable business computers because of the IBM endorsement. Since their introduction, IBM PCs and compatible computers have evolved into powerful corporate network servers, desktop computers, and portable notebook computers. They have also migrated into millions of households and their popularity exploded during the 90s when mankind discovered the Internet.

The worldwide popularity of both personal computers and the Internet has been a mixed blessing. Powerful personal computers are technology workhorses that increase productivity and provide portability. The Internet provides a conduit for the transfer of communication and computer files anywhere in the world via personal computers. However, essentially all personal computers lack meaningful security. This is because security was not factored into the design of the original personal computers or the Internet for that matter. The DOS operating system installed on the original IBM PC was never intended for commercial use. Security was never part of its design; in the interest of maintaining compatibility with the early versions of DOS, upgrades did not adequately address security. As a result, most popular desktop PCs and notebook computers lack adequate security. This situation creates an ideal environment for electronic document discovery of computer files, file fragments, and erased files. Some computer forensics specialists regard electronic document discovery as nothing more than the exploitation of the inherent security weaknesses in personal computers and the Internet.

You would think that the obvious security vulnerabilities of personal computers would be a wake-up call for government agencies and corporations. You would also think that individuals who carry secrets on their desktop and notebook computers would be more careful given these inherent security weaknesses. Lawyers, accountants, bankers, insurance agents, bankers, and health care professionals are particularly at risk because they are responsible for the secrets of others. It is likely that most lawyers don’t even understand the potentials for attorney–client information to be compromised when computer files and data are exchanged with others.

These security issues should be of concern to computer users. However, they provide great benefits to lawyers concerning the potentials of electronic document discovery. Most computer users are unaware that their personal computers track their every move as it relates to documents created over time. This situation provides the technology savvy attorney with an edge when it comes to document discovery. Computer files, erased files, e-mail, and ambient computer data can be subpoenaed in civil and criminal cases. The attorney just needs to understand the potentials and the new twist in thinking that is required to reap the benefits of electronic document discovery.^[ii]

^[ii]“Electronic Evidence Discovery: A Powerful New Litigation Tool,” New Technologies Armor, Inc., 2075 NE Division St., Gresham, Oregon 97030, 2002.

---