White Paper

e-Discovery: Six Critical Steps for Managing

E-mail, Lowering Costs and Reducing Risks
Motions to discover electronic data have become common in today’s world of litigation;
yet, often companies are unprepared to find electronically stored information (ESI),
especially e-mail. This lack of preparedness is driving up the cost of e-discovery and the
cost of litigation in general. In this paper, we examine six steps organizations can take
to control a large part of their e-discovery processes to lower costs and reduce risks.
This paper will show that controlling e-mail requires being proactive; it’s not so much
about how long you save it, but rather how well you control it.

Note: Legal information is not legal advice. Contoural provides information pertaining to
business, compliance, and litigation trends and issues for educational and planning
purposes. Contoural and its consultants do not provide legal advice. Readers should
consult with competent legal counsel.

Sponsored by: LiveOffice LLC

Copyright 2008 Contoural, Inc.

Growth of Electronic Information and Underground Archival

Today on average 96% of all documents created or received within an organization are
in electronic format. While paper is not going away, it represents a minority of the total
documents within an organization. In terms of electronic documents, e-mail represents
the majority; it has become the de facto communication mechanism. Today the average
employee sends or receives more than 140 e-mails per day. Unlike paper, e-mail tends
to accumulate, quarter after quarter and year after year to the point that organizations
are becoming awash in it.
Litigators and regulators are well aware of the importance of e-mail, often making it the
first and most significant target of discovery efforts. The goal of discovery is to
understand the mindset around decisions or actions, and today emails often provide the
most valuable insight as parties prepare for trial. The result is that companies’ growing e-
mail piles becomes the first and most significant target of discovery. Typically, discovery
costs represent at least 50% of the cost of litigation, and most discovery efforts and
costs relate to the collection and review of e-mail.
Stung by expensive discovery costs and legally damaging e-mails, and abetted by IT
storage managers who want to keep data storage costs down, many companies have
implemented 30 or 60 day e-mail and electronic message deletion policies. ’If we get rid
of the message before there is a reasonable anticipation of discovery,’ corporate counsel
and IT managers think, ‘we save time, money and disk space’. While aggressive e-mail
deletion is seemingly a logical solution, it has one little problem: it doesn’t work. Users
save e-mail in “PST” files on their local hard disk or file share; they print them out or
even e-mail them home. Of the more than one hundred medium and large companies
we have analyzed, we have found nearly all that have aggressive 30 or 60 day e-mail
deletion policies don’t actually delete messages. The reality is all they do is drive
“underground archival,” which means that since end users save email in various places,
it’s never really gone, just more difficult and expensive to discover.

Problems with Aggressive E-mail Deletion Policies

When e-mail is deleted from the e-mail server, it still can reside in a number of places:
Systematic
• E-mail always has two copies: sender and receiver. Deleting one copy does not
assure deletion of the second.
• Often copies of e-mails are retained on backup tapes. While many organizations
recycle backup tapes, it is not uncommon to save a “monthly” tape in offsite
storage for disaster recovery purposes. These monthly tapes may be
discoverable.
User-Driven
Users will often save copies of e-mail outside the e-mail server and in many different
places:
• E-mails and attachments will be printed.

Page 2 of 8
Copyright 2008 Contoural, Inc.
 • Copies are saved on personal storage devices, such as iPods or USB thumb
Drives.
• Copies are saved in offline “PST” files on desktops, laptops or file servers.
• Copies may still reside on Smartphones such as Palm devices or BlackBerrys.
These devices are discoverable.
• Users often send copies of e-mails home to personal accounts like Gmail.

FRCP Challenge: Find It Within 99 Days

Since electronic discovery has loomed so large in litigation, the Federal court system in
the United States has instituted a new standard for civil cases involving electronic
records. The December 1, 2006 Amendment to the Federal Rules of Civil Procedure
calls for both parties to meet early on about discovery. Within 99 days after litigation is
initiated, parties must meet to discuss the scope and accessibility of electronic records.
This “Meet and Confer” conference, also called the Rule 26 Meeting, can result in much
more effective discovery, but only if a company is prepared to discuss their ESI, search
through it efficiently, and produce relevant records effectively. Being prepared to
discuss ESI means already having a system in place to organize emails – or finding a
system that can be deployed quickly.
Although the largest corporations face litigation and e-discovery on a routine basis,
smaller companies are not immune from such actions. In fact, since they often cannot
afford extensive preparation for e-discovery and search, they are far more affected by
litigation than their larger cousins. Smaller companies may struggle with effectively
executing a legal hold. Users routinely e-mail documents to one another that are stored
in the e-mail system, regardless of applicable records retention policies. Users also
regularly delete e-mail messages, leading to gaps in the record which can prove
disastrous when these messages are requested as part of a legal case.

Costs of Reactive Discovery

Underground archiving exacerbates e-discovery efforts. When faced with finding e-mail
and other types of ESI within 99 days, both large and small companies need to search
across many different areas:
• backup tapes
• desktop systems, laptops and other systems
• file systems
• polling employees about e-mail saved on USB drives or other types of removable
media
• In some cases, companies may also be required to search employee’s home
systems if there is reasonable evidence that work-related e-mail was sent home
Page 3 of 8
Copyright 2008 Contoural, Inc.
Most organizations, relying on live systems or backup tapes to retain information, simply
cannot meet these requirements and could be subject to sanctions. As a result, outside
companies must be engaged to comb through their backup tapes and produce specific
data.
The expense of e-discovery continues to be a significant part of overall of litigation costs,
driven in part by the need to hire outside firms to assist in finding all of their data.
According to Socha Consulting, it costs an average of $1,000 to $2,000 per gigabyte
(GB) of data to identify, collect and process electronically stored information.
Organizations without an effective and complete e-mail archive can thus find themselves
on the defensive when it comes to e-discovery. They will be unable to bring a credible
list of e-mail records to the initial meet-and-confer session, which can undermine their
case and will undoubtedly be exploited by opposing parties. Once production of e-mail
is required, they will often be unable to locate all requested messages or will have to turn
to expensive and time-consuming outside recovery firms to handle the search.
After-the-fact e-discovery is especially costly because it requires a great deal of work
before search and production can begin. Either an entire e-mail archive must be created
from scratch just for a single e-discovery action or all of the many potential sources of
data must be searched and data extracted, which is extremely costly and time
consuming. If using an on-premise solution, e-discovery from an archive is similar to
any other archive application implementation: The software and hardware must be
procured and configured, data sources located, and content ingested - all before search
and production can begin.
Since most environments are not well-organized, companies must turn to backup tapes,
laptops, and file shares to fill in gaps in the e-mail server’s record of messages. Each of
these has its own challenges, as any company which has implemented an e-mail archive
can attest to, and while none are insurmountable, all require a great deal of effort.
Reading data from backup tapes is time consuming, requiring the sourcing of
appropriate tape drives and software, storage space, and swapping of media. Experts
suggest that recovery of data from tape, once the appropriate infrastructure is in place,
will take roughly ten times longer than was required to write to the tapes in the first
place. Although disk-based data sources like laptops and file shares will not be delayed
like a restore from tape, all of these sources require similar time and effort to ingest the
content.

Six Steps to Switch E-mail Discovery from a Reactive to a Proactive

Process

The nature of electronically stored information, coupled with new demands around e-
discovery, is creating a tipping point for many organizations. They are coming to the
conclusion (sometimes after it’s too late) that taking a proactive approach to storing,
managing and controlling electronic documents, especially e-mail, will put them in a
better position to respond to litigation when it occurs, and reduce the costs of litigation.
Nearly every legal action taken against a company will involve some type of electronic
discovery. Companies must prepare for this. The traditional reactive approach to e-
discovery must be changed, with systems that can be deployed quickly and enable

Page 4 of 8
Copyright 2008 Contoural, Inc.
immediate, proactive storage and production capabilities for e-mail. The following six
steps capture the best practices for becoming proactive in e-discovery for e-mail.

Step 1: Capture E-mail Early

The traditional, reactive approach to finding e-mail is to manage and control it after the
fact – once it has been read and saved by employees. This means in the event of
discovery, organizations spend significant effort and incur large costs trying to regain
control of e-mail. Much effort is made to locate, retrieve, and deduplicate messages that
originated from a centralized system.
Rather than regain control reactively, many organizations are proactively taking control
of e-mail through the use of archiving technology. This technology allows the retention of
internal, as well as incoming and outgoing e-mail messages at the mail server. The key
to being litigation-ready with e-mail is to implement archiving technologies that can
create a complete archive of all messages and store them according to a clear retention
policy. The archive must be a superset of all other e-mail repositories, an archive that
includes all messages passing through the mail environment – whether on-premise or
hosted – regardless of user actions or any mail stored in personal archives. With a
comprehensive archive in place, old concerns about locating data and discovery of holes
in the record are erased – the archive becomes a one-stop shop for e-mail search and
production. With active archiving technology, e-mail is captured as it is created by or
arrives to an individual within an organization, reducing the likelihood that critical
information will be missed and ensures defensibility. Companies that capture e-mail
early can go to the Rule 26 Conference with the assurance they have all relevant
documentation.
When faced with the need to preserve e-mail, organizations should avoid the apparently
“easy” path of relying on backup tapes as the exclusive method for preserving e-mail.
This strategy can backfire since it can be extremely expensive to recover information
quickly from even a modest set of backup tapes. In addition, the need to preserve e-mail
can last for months or years, so an e-discovery action could require that hundreds or
thousands of backup tapes be reviewed. For these reasons, companies should consider
implementing “smarter” alternatives, including immediate implementation of e-mail
retention journaling. Better to start capturing e-mail quickly with an effective e-mail
retention system than allow backup tapes to accumulate. Many e-mail archiving systems
– SaaS or hosted e-mail retention systems in particular – can be deployed very quickly
and mean that companies can still arrive prepared and organized at their Rule 26
conference.

Step 2: Capture E-mail from All Over

Most organizations have employees in multiple locations, and hence have e-mail being
created and received from multiple locations. In addition, litigation or regulatory
discovery requests typically require organizations to find all relevant documents from all
locations, not just those at centralized locations. This problem is particularly acute for
companies with many locations or branch offices. This is even more challenging for
those companies with numerous international locations. Having all the e-mail from just
headquarters is not enough. Gaining control of e-mail requires being able to capture e-
mail from all locations, including laptops and mobile devices.

Step 3: Have One Place to Search for E-mail

Page 5 of 8
Copyright 2008 Contoural, Inc.
To avoid the expense and time of struggling with underground archival, the emerging
best practice is to have a centralized copy of all e-mail in one place. While other copies
of e-mail can exist in other places, if companies save a copy of every e-mail in a
centralized archive (these copies would be considered copies of record) e-mail is easier
to search and retrieve. Under this type of system, companies need only search the
centralized archive and need not search through the “convenience” copies on desktops,
laptops, file systems, etc.
This, of course, can greatly speed the process of discovery, as well as significantly
reduce costs. The process of search and production will change once this system is in
place. Rather than relying on outside parties to act on requests, legal staff can
interactively search the archive themselves, iteratively weeding out nonresponsive
records (those records not relevant to the discovery request) and reducing the volume of
production. They can then create a single complete set of data, often in a variety of
formats as required.
Furthermore, this “do-it-yourself” search and production greatly reduces the cost and risk
of legal action. Rather than going through the effort of setting up a new data archive for
each action, a comprehensive archive is always ready to be searched, and in-house
interaction with the archive reduces request/response lags and misunderstandings. A
superset archived e-mail is, quite simply, the best way to become litigation-ready.

Step 4: Automate Retention of E-mail for Litigation Hold

Lack of e-mail control can result in another serious issue: inadvertent spoliation.
Spoliation is a legal term for alteration or destruction of evidence that may pertain to a
legal action. Inadvertent spoliation for e-mail is the accidental or unintentional deletion
of e-mail that should be preserved. Companies have a responsibility to preserve
documents and ESI relevant to a litigation. This responsibility starts not when they are
actually served with a suit, but when there is a reasonable belief that litigation may
occur. When companies don’t control e-mail, inadvertent spoliation is a serious risk and
unfortunately common. This can include employees deleting files from an inbox and not
having that information backed up, overwriting backup tapes, etc. Companies that
engage in spoliation can face sanctions from the court or even suffer loss from a
summary judgment arising exclusively from the spoliation.
Becoming litigation-ready in part means enacting processes that can affect defensible
litigation holds. For e-mail, this means enacting “top down,” automated litigation holds
that do not depend upon employee compliance with the hold request. When e-mail is
held in a centralized archive, litigation holds can be accomplished by freezing some or
all of the archive.

Step 5: Update Your E-mail Retention Policy

Many e-mail and document retention policies are out of date. They do not reflect newer
compliance requirements such as FRCP. Furthermore, many of these policies don’t
reflect the ubiquitous nature of e-mail and ESI; these older policies are based around a
paper paradigm. Often the average employee is unaware the he or she should be
following a policy. The result is that many of these policies sit on the shelf, and are not
followed. From a risk and legal perspective, it is worse to have a policy you do not
follow, than to have no policy whatsoever. Policies may be and often are discovered.
The opposing side will make a significant issue that you did not follow your own policies.
They may raise questions designed to raise suspicion about an organization’s intent,
Page 6 of 8
Copyright 2008 Contoural, Inc.
criminal or otherwise, that can be very damaging to their defense. As part of becoming
litigation ready, companies should create and/or consistently update document retention
policies. Policies should align with current regulatory requirements and e-discovery
environments – also covering how to manage legal.. Good policies are media-agnostic,
and they cover paper, and ESI, including e-mail. Today’s policies tend to be simpler and
clearer, making it easy to understand what should be retained and for how long.
Furthermore, good policies must be written so that they can be automated to the
greatest extent possible, avoiding manual processes.

Step 6: Centralize Control of E-mail Deletion

Many organizations forget the final step in e-mail control: deletion. Users want and need
to retain e-mail for a period of time, but after a while the users and business have no
need to retain some e-mail. Most companies today have a de facto policy of saving all e-
mail forever. Or they periodically ask employees to manually delete their own e-mail,
which the employees never do. The result is that e-mail tends to accumulate. When
faced with discovery, companies must identify and review significant amounts of e-mail,
driving up costs of litigation.
Companies should implement an effective litigation and regulatory hold process. Make
sure that you preserve any e-mail that may be relevant to an anticipated or ongoing
litigation or regulatory inquiry. Third, follow your policy to preserve documents and e-mail
needed to meet regulatory requirements. The amount of e-mail that needs to be
preserved for regulatory requirements above the user-driven “high water mark” is
typically a smaller amount of messages. Once these steps are in place, a company
should deploy an automated, periodic deletion process to avoid excessive accumulation.

Final Thought – It’s Not About Retention, It’s About Control

Much of the internal debate around e-mail often revolves around whether e-mail should
be retained, and if so, for how long. These discussions sometimes miss the point. It’s not
really about retention it’s about control. Good strategies should enable the following:
• Know what e-mail you have
• Know how to find it
• Be able to retrieve it
• Be able to ensure certain e-mail is not deleted when it needs to be preserved
• Be able to control centralized deletion of e-mail when it should be deleted
• Be able to do all of the above easily, defensibly and cost-effectively.
While the above feels very challenging, many organizations have successfully been able
to enable e-mail archiving systems giving them this level of control.

Page 7 of 8
Copyright 2008 Contoural, Inc.
About Contoural, Inc.
Contoural is a leading independent provider of business and technology consulting
services focused on litigation readiness, compliance, information and records
management, and data-storage strategy. Contoural helps clients address the
business requrements emerging around data. For example, electronic discovery
rules—under the new Federal Rules of Civil Procedure—now require U.S.
companies entering litigation to know what electronically stored information they
have, where it is stored, and how quickly they can retrieve it. Similar issues and
requirements affect business records in many countries worldwide.
Similarly, legal and regulatory compliance requirements under emerging privacy
laws are motivating enterprises to take a closer look at the integrity and security of
electronic document files and other digital data. Contoural helps clients understand
the business requirements for managing records, and then assists clients in aligning
these business needs with their IT strategies and storage spending. These services
bridge the gap between applications and data storage.

Contoural services include:

ƒ Records-retention policy development
ƒ Litigation hold process development
ƒ Litigation-discovery process improvement
ƒ ESI Survey Data Map development
ƒ Data classification and storage strategy
ƒ Data archiving solution design and program management
With these services, Contoural helps enterprises ensure compliance and reduce risk,
while also achieving litigation readiness and reducing costs.
Contoural, Inc.
1935 Landings Drive
Mountain View, CA 94043
650-390-0800
www.Contoural.com
info@contoural.com

Page 8 of 8
Copyright 2008 Contoural, Inc.