Our day to day activities use applications which write to databases or log files that leave behind digital footprints that could be relevant during litigation.
In today’s connected world, so many of the tasks we perform on a daily basis can be tied back to some type of electronic system that is constantly recording your actions. Think about your daily routine. You will likely use email, instant messaging and create or edit electronic documents throughout the day, but what about the other interactions you have with modern amenities? Do you have to swipe a key card to gain access into your office? How about that Starbucks rewards card or digital wallet on your Smartphone? What about a time clock where someone has to clock in and out. Our day to day activities use applications which write to databases or log files that leave behind digital footprints that could be relevant during litigation.
When parties institute a litigation hold or readiness program, they identify the usual suspects of relevant sources of ESI including email and office documents. However, unless a specific request is made for atypical data, those other sources are usually not even considered.
Knowing that people’s actions are being constantly recorded is a double edged sword. The data points being collected can be useful to a defense team looking to corroborate statements made by a witness or verify the amount of time spent in a certain location. The flip side is also true. Parties can make requests of opposing counsel for sources of ESI that can be pieced together like a jig-saw puzzle and will ultimately support case themes.
For example, employment litigation alleging improper overtime compensation is one type of action that lends itself to this type of data. When time cards say one thing but employees say something else, the truth often lies in the data. I’m not talking about the CSI type “Zoom & Enhance” fantasies of television dramas, but rather an examination and aggregation of records across different systems that can be used to draw real patterns about behaviors and practice. One can reconstruct the activities of an individual by examining the following items:
- Access control systems using keycards
- Phone records and conversation durations
- SMS Text messages sent and received
- Photos taken on smartphones that include positioning details
- GPS systems, both portable and in vehicles
- Smartphone purchases and transactions
- Network, Application and Database login/logout
- VPN (Virtual Private Network) access details
- Phone long distance codes
- Copy machine access codes
- Time clock entries
- Website access history
- Security footage
- Voicemail records
- Social media and blog posts
However, the process is arduous and may present difficulties at times. It is critical to assess the capacity of each system, identifying what is currently in use or has been used in the past. Do these systems create access/event logs, or do they store information in a database? Where are they stored or archived? Can these systems identify a unique employee and if so, how do they do it? Are employee ID’s or system logins maintained? Are employee phone numbers, access PINs or other usage records maintained and stored?
Once the various relevant sources of data have been identified and gathered, the structure of the content from each source must be analyzed and where possible, normalized. It is also important to understand how these systems store time and date information. Time and date data may be saved in the local time based on the geography of the system, the time zone of the employee or that of the data center where the servers are housed. Changes in daylight savings may need to be applied to the data, so that events can be linked and understood in their proper sequence as they are related to other events from different sources.
The ability to identify and use data points from nontraditional ESI sources provides new challenges and opportunities to litigators, as large volumes of data need to be mined, analyzed and cross referenced. It is important to have a game plan and to start the process early on so that you can understand how the information can be helpful and structure it accordingly. When done right, the data can either set you free or serve as the nail in the proverbial coffin.
