What Lawyers need to know about Metadata

The tremendous growth in corporate electronic communications, and the associated recognition of its evidentiary value in litigation, has presented lawyers with a new source of evidence, but one with a steep learning curve – metadata. Metadata is information about the creation and handling of a document, and it is essentially invisible to the average email user. Its value in determining when a document was received, read, modified, forwarded and to whom it was forwarded and when…is something lawyers will learn to appreciate.

Metadata has the potential to blind-side your practice and undermine your credibility. Consider the case of California Attorney General Bill Lockyer, who issued a letter to other state attorneys-general, calling for a ban on peer-to-peer file sharing software. (1) Though this seemed unremarkable political protocol, the metadata for the letter clearly revealed that a well-known lobbyist for the Motion Picture Association of America (MPAA), Vans Stevenson, had authored earlier versions of the same document. Overnight, the focus shifted from the merits of the proposed legislation, to the propriety of Lockyer’s conduct and investigations into his election contributions. (2)

The Lockyer case serves as an excellent case study into the role that metadata can play in investigations, and related litigation. E-discovery providers are critical to lawyers for their ability to locate and utilize metadata as efficiently as possible. Attorneys who understand this have a significant advantage as the focus of evidentiary discovery expands beyond the review of paper documents to include forensic investigations, in which both the metadata and the e-discovery providers who find it, are central players.

Discovering Metadata
Recipients of Lockyer’s now-infamous letter learned of its true author by viewing the email metadata, or simply the hidden properties about an electronic file, contained within the file itself. Much as web page metadata allows search engines to efficiently locate relevant information, document metadata allows users to locate, search, sort, and store files.

A user might locate Lockyer’s statement on file-sharing by looking for documents with a particular title, date of creation, or author—all of which is revealed by the metadata using ordinary Windows search functions. Metadata allows searchers to group together relevant documents—perhaps discovering a letter sent to the MPAA on the same date, or an inter-office memo on file-haring. Capturing all of a document's metadata will increase your chances of finding relevant information during your searches.

The Lockyer case illustrates why attorneys should make requesting electronic versions of documents a routine part of their discovery requests. When files are transferred to paper, you lose potentially valuable metadata. Aliases, bcc:’s, hidden text and mail server metadata are not fully reflected in a paper-based review. Having access to all of this information could have a significant impact on the direction and outcome of your case.

Better Searching Through Metadata
Once electronic documents are received, attorneys must decide how to organize their review of the documents. In Lockyer’s case, opposing parties did not have to look far to find the damaging evidence they needed, but the value and utility of metadata may not always be so clear-cut. Suppose one of Lockyer’s assistants emailed another MPAA lobbyist who sent a draft version of the letter with a different file name to a junior attorney in the office. Even with metadata, without the right searching software, finding such remotely linked information becomes a matter of luck.

E-discovery providers use specialized software to run far more efficient searches for firms, cutting document review time and reducing the role of chance in discovery. Experienced searchers know where to begin searches, and how to define parameters to yield optimal results. An initial review might flag that “chips” appears in many emails and documents. This flag could then lead reviewers to the discovery that “chips” was being used as a euphemism for campaign contributions.

Sophisticated searching software can flag documents, not only by commonly used terms, but also by rarely-used metadata. For example, the software might flag that a large number of documents were all modified at 11:58 p.m. the evening before the Attorney General sent out his memo. That sort of determination would not be possible without the use of metadata. Having this information easily accessible can lead to a much more efficient, and targeted document review plan.

A file’s location is another undervalued piece of metadata. For instance, a search might reveal a copy of the file-sharing memo in a folder labeled “MPAA Communications.” Less obviously, if an early draft of the memo turned up in folder labeled “pictures of the kids,” searchers could turn their attention to what other documents might be hiding out in this seemingly benign folder.

E-discovery providers are particularly helpful when searches turn up items which are password-protected. In such cases, for instance, metadata can illustrate patterns of usage—answering the question of why a user password protected some, but not other documents. A serious challenge for e-discovery providers is to determine ways that lawyers and paralegals can review meta-data in easy-to-read formats, while efficiently cataloguing and searching large volumes of information.

Metadata’s Role in Discovering Deleted Files
Metadata plays a key role in allowing forensic discovery experts to recover deleted files. For example, suppose an Attorney-General had deleted a first draft of his/her email letter. Now that the file has been deleted, it will no longer show up in directory searches. However, the document's metadata, not concurrently erased, will enable skilled searchers to reconstruct the deleted file.

Deleted files could be of enormous value in intellectual property, unlawful termination, sexual harassment, and products liability actions. In these cases, requesting entire hard-drives, back-up tapes, and other data storage devices should be routine. Computer forensic specialists can use sophisticated software to reconstruct deleted files. The ability to request and recover deleted files opens up new horizons to litigators, with evidentiary resources that were once non-existent now available.

Metadata and the Future of Discovery
As these examples hopefully illustrate, the focus of document reviews is shifting from basement volumes of paper, read and catalogued by attorneys and paralegals acting as librarians, toward complex searches of terabytes of electronic data…with attorneys, software providers, programmers, and reviewers acting in more of a detective-role.

How does a firm prepare its staff to act as detectives in this new age of forensic discovery? The Lockyer memo’s true author would not have been discovered had someone not thought to check the metadata. Likewise, document reviewers who do not look at the “original showing markup” or other features showing past modifications as a matter of routine practice, often miss large amounts of data.

While metadata may yield significant data to an investigation, metadata is also invaluable during discovery on a more functional level. Metadata allows files and documents to be easily categorized and searched. In addition, Metadata plays an essential role in the de-duplication of files. Many firms are rapidly learning of the benefit of partnering with e-discovery providers in the early stages of litigation, specifically in the areas of planning and efficiency.

Working together, e-discovery providers and firms can impose a system of uniformity on discovery. Especially where metadata and other new forms of information are concerned, it is essential that firms minimize subjectivity in their document reviews.To this end, firms need an objective system of templates and filters. Working with their e-discovery and forensic experts, lawyers can ensure multiple checks on subjectivity.

It is equally important that all reviewers use the same system of documentation and that they all understand the goals of the discovery process. Especially where metadata is concerned, relevancy may not be clear until information is considered in aggregate, revealing patterns. Because metadata deals with minute facts and snippets of information, it is easy for document reviewers to think of metadata as individual trees, missing the larger contextual forest of data. Reviewers have to be trained to see the big picture, and to no longer see relevance on a per-document-basis, but rather assign relevance based on uncovered patterns.

Establishing uniform systems of review and documentation is essential to ensuring that metadata and other information uncovered during review will be admissible in court. Just as metadata generated about original files creates a history, metadata generated during the discovery process can be used to answer chain of custody questions, and to prove the authenticity of the information uncovered. Because metadata can be altered, it is important to establish its reliability from the start of an investigation.

As “scrubbing” software, which removes document metadata, becomes more commonplace, it is becoming more important to establish the parameters of the investigation as early as possible.

Working with your e-discovery provider, you can create a list of document types that might have metadata (important names, nicknames, dates of creation, modification, names of computer/network server, etc.), to help narrow down your discovery requests. This initial step in a litigation strategy that recognizes the value of metadata, and the resulting request for metadata preservation, may serve as key steps to preempt possible metadata scrubbing. Therefore, such metadata awareness could be integral to a litigator’s success.

On the defensive, long before discovery becomes a possibility, lawyers who wish to avoid “pulling a Lockyer,” need to examine the potential for metadata to blind-side their firm in representation of its clients. “Security best” practices, such as sending all attachments in .pdf form, and the routine use of metadata scrubbers, should have been implemented long before the point where scrubbing becomes the equivalent of document shredding in discovery. (3) Once a discovery request is received, a firm needs to work with its client to prevent data-destruction. With an e-discovery provider as a part of the team in these early stages, a firm can ensure that inadvertent destruction does not occur.

The Lockyer / MPAA example illustrates both the pitfalls and potential benefits of harvesting metadata during discovery. It also serves as a reminder of the need to plan for e-discovery long before litigation commences. Firms that establish long-term partnerships with e-discovery providers will be in the best position to educate their staff, conduct more efficient investigations, and maximize the potential of metadata.

Return to Resource Articles

-----------------------------------------------

“P2P faces new Legal Scrutiny From States” CNET News, March 15, 2004, http://news.com.com/P2P+faces+new+legal+scrutiny+from+states/2100-1038_3-5173262.html
“P2P faces new Legal Scrutiny From States” CNET News, March 15, 2004, http://news.com.com/P2P+faces+new+legal+scrutiny+from+states/2100-1038_3-5173262.html
“The Lockyer P2P Letter,” P2PNet.net, http://p2pnet.net/story/100

“KM Gets its Missing Link,” FindLaw, Feb. 2005, http://practice.findlaw.com/tooltalk-0205.html
“20 Questions for Electronic Discovery Expert,” FindLaw, Aug. 2002 http://practice.findlaw.com/archives/20questions_0802.html
“E-Discovery: Understanding Preservation Obligations, Cost-Sharing, and Current Developments” FindLaw, Feb. 2005 http://library.findlaw.com/2005/Feb/6/133662.html
“Muddling through the MetaData Morass,” Dennis Kennedy and George Socha, October 2005, http://www.discoveryresources.org/04_om_electronic_discoverers_0405.html
“Best and Worst Practices in Electronic Discovery,” Discovery Today, Brian Walters http://www.discoveryresources.org/pdfFiles/01_bigPicture_bwPractices.pdf