Winning the Text and Chat Data Game in eDiscovery

In the ever-evolving world of eDiscovery, the types of data we collect, process, and review have expanded far beyond traditional documents. With the proliferation of short messages, geolocation data, social media posts, financial transactions, and structured databases, traditional document-centric approaches are proving inadequate. This shift necessitates a reevaluation of how we handle data throughout the Electronic Discovery Reference Model (EDRM) to avoid the pitfalls of linear review workflows that are both expensive and tedious.

Embracing Native Review Applications

In the early days of eDiscovery, converting spreadsheets to .TIF or .PDF formats made them difficult to review, as they obscured formulas and data analysis capabilities. Over time, review applications evolved to support native spreadsheet formats, improving efficiency and accuracy. This same approach is now critical for “modern data” such as JSON files from Slack or Facebook, time-keeping systems, financial data, and geolocation information. Processing and parsing this data for ingestion into native review platforms can retain context, facilitate cross-platform communication analysis, and significantly reduce review costs.

Challenges with Document Conversion

Converting modern communications data into documents poses significant challenges. For example, screenshots of text messages or chat conversations, while common, can be cumbersome and costly at scale. Such conversions often strip away context and lead to fragmented reviews, where each message is examined in isolation. This method is not only inefficient but also prone to missing crucial aspects of communication patterns.

Consider a scenario where a custodian starts a conversation via email, switches to Slack, continues with text messaging, and concludes with a phone call. In a traditional document review platform, piecing together this conversation’s context is difficult. By contrast, a native review application can present these communications chronologically, providing a seamless and comprehensive review experience.

Streamlining Review Workflows

Modern review platforms allow for more efficient tagging and categorization of messages within threaded conversations. Relevant, non-relevant, confidential, and privileged messages can be easily identified and isolated, reducing the need to convert the entire corpus of data into documents. This approach not only accelerates the review process but also minimizes costs and enhances accuracy.

Leveraging Advanced Technologies

As Erin Perczak, Co-Founder of Perin Discovery, notes, the inclusion of chat communications in discovery requests has become the norm. This shift underscores the need for tools capable of integrating modern communications with standard discovery formats. Advanced eDiscovery platforms can now handle a diverse array of data types, from emails and loose files to chat communications and beyond.

Expanding the Evidence Spectrum

With the right technology, eDiscovery teams can layer additional data types—such as geolocation, social media activity, user activities, and financial transactions—into their reviews. This capability enables a comprehensive narrative that weaves together various data points into a coherent timeline. For instance, consider an investigation involving an employee suspected of stealing data: text messages discussing the theft, geolocation data showing movements, and financial transactions indicating illicit activity can all be combined to tell a compelling story.

Telling the Whole Story

In cases requiring the collection and production of more than just corporate documents and emails, incorporating modern communications is crucial. Business-related conversations now frequently span multiple platforms, from email to chat applications like Microsoft Teams or Slack, and even text messages. Building a fluid timeline of these conversations enhances case strategy and provides a fuller understanding of the evidence.

Conclusion

Modern data types are reshaping eDiscovery workflows, demanding innovative approaches to data analysis and review. By adopting native review applications and leveraging advanced technologies, legal teams can efficiently handle the complexities of

modern communications, reduce costs, and improve the accuracy and comprehensiveness of their reviews. Embracing these changes is essential for staying ahead in the dynamic landscape of eDiscovery.

You can also download our complimentary guide to learn how to benefit from eDiscovery technology to accelerate finding key evidence in texts and chat data.

Find out more about how CloudNine can help you tackle newer data forms with our cloud-based eDiscovery solution, CloudNine Review, and set a time to meet with us.

The Role of Experts in Data Collection

In many eDiscovery cases, teams of experts handle the collection of traditional and modern data following a proven, standard process. These experts ensure the data is authenticated, which is crucial for maintaining the integrity of the evidence. However, there are instances where evidence such as text messages, social media posts, or chat applications involves just a few exchanges that are critical to the case. In these situations, simple workflows like screenshots, data downloads, or reviewing data in spreadsheets from various collection tools are often used.

Methods of Data Authentication

Regardless of the data acquisition method, authentication is essential and can be achieved in several ways:

• Data Forensic Experts
  Forensic experts can authenticate data from collections, ensuring that the evidence presented actually occurred. Their expertise is invaluable in maintaining the credibility of the evidence.

• Mutual Agreement Between Parties
  During the discovery process, both parties can agree that conversations, social media posts, etc., were indeed created by the custodian. This mutual agreement can simplify the authentication process.

• Self-Collection
  Data downloaded from social media sites goes through a process where it is packaged in HTML or other formats, memorializing activities in a document form. Although this process requires authentication by the person downloading the data, legal teams can be confident that the data is user-created.

A Word of Caution: Ensuring Authenticity

One significant caution in data authentication is the potential for clients to provide seemingly real evidence that may not be authentic. An illustrative case is Rossbach v. Montefiore Medical Center, where a screenshot of a text message exchange was presented as “smoking gun” evidence. The issue was that the screenshot’s emoji was a newer version than when the incident occurred, indicating the exchange was fabricated. eDiscovery expert Doug Austin has written a comprehensive article on this topic.

Here’s how easy it is to create a “real-looking” text exchange. Does the below text message exchange look authentic?

Unless you are a trained forensic professional, it likely does look authentic. However, tools like ifaketextmessage.com make it fast and easy to create such exchanges. (Note: This is just an example and not related to the Rossbach v. Montefiore Medical Center case.

Importance of Verification

In most cases, both parties would agree on the authenticity of text messages and verify them with the other person’s device if the exchange wasn’t deleted. The critical point is to never overlook the verification or authentication of data received from the other party. Ensuring the integrity of evidence is paramount in maintaining trust and achieving fair outcomes in eDiscovery.

In our last edition in the blog series out this week, you will learn how to best review data, documents or a hybrid approach and using this data to tell the whole story.

You can also download our complimentary guide to learn how to benefit from eDiscovery technology to accelerate finding key evidence in texts and chat data.

Find out more about how CloudNine can help you tackle newer data forms with our cloud-based eDiscovery solution, CloudNine Review, and set a time to meet with us.

As an eDiscovery software and services provider who has worked with hundreds of law firms, corporate legal and government teams over the past 20 years, we have learned ways to make the process of data collection for eDiscovery easier and more efficient.

Hiring experts to collect data across newer communications platforms like Slack, Teams, and WhatsApp and devices can be highly effective. Leverage your team’s experienced collection professionals or your software provider’s partners for their expertise.

Data Types to Consider

When collecting data, it may not be as difficult or expensive as you think. Consider these data types:

• Chat applications: Slack, Microsoft Teams, Bloomberg, Line, WeChat
• Email and eFiles: Traditional eDiscovery emails and electronic files
• Text messages: Business-related texts on company and personal devices
• Phone calls/voicemail/memos: Recorded on the same devices
• 3rd party chats: Social media accounts, gaming devices, stock trading applications, etc.
• Location: Geolocation data from smartphones, health devices, cell towers, call detail records, and various applications
• User activity: Automatically generated activities, such as browsing websites or logging into systems
• Social media: Posts, comments, replies, direct messages from personal accounts
• Logs: Visitor logs, patient records, employee activities, cyber incidents

Starting with Custodial Interviews

To uncover the correct data, begin with custodial interviews. Ask questions about work and collaboration processes to understand what applications and platforms are used for business communications.

For example, in a recent case for a global transportation company, an entire department used WhatsApp for communication despite company policy restricting communication applications to text messages and Microsoft Teams. Be creative and intuitive in your questioning to identify all forms of communication.

Addressing Privacy Concerns

The “privacy hurdle” will often arise during custodial interviews and data collection. Custodians may hide forms of communication due to privacy or incrimination concerns. Assure custodians that only specific conversations will be reviewed to alleviate these fears. Targeted collections or data culling activities can ensure efficient data acquisition and processing. Consult with your collection professional or software provider for specific workflows.

Additional Considerations for Modern Data Collection

When dealing with modern data and eDiscovery, consider the following during collection and normalization:

• Data processing and unitization: Does the collected data need processing and organization?
• Email/modern attachments: Are there attachments in emails or chat conversations, or are they hyperlinks?
• Custodian interviews and privacy: What workflows are needed to ensure private data stays private?
• Document review workflows: Are you culling data natively before final document review of all data types? (The answer should be “yes”!)
• Entity normalization: Are you linking custodians and contacts to their phone numbers, email addresses, and application identifiers?
• Data identification: Have you identified all data elements to complete your story? Consider additional data such as:
  • Social media accounts
  • Cell tower data: Geolocation and timestamps
  • Financial transactions
  • User activities from workstations/laptops and smartphone artifacts
  • Call detail records from the cell carrier
  • Surveillance data
  • Time and billing applications
  • Hospital health tracking data

Whatever the case story demands, there is likely data somewhere to support your assertions. Work with your technology and service providers, leveraging their expertise in modern data management.

In our new blog series out this week, you will learn how to best authenticate text and chat data, the importance of verification, and the importance of native review workflows for modern data.

You can also download our complimentary guide to learn how to benefit from eDiscovery technology to accelerate finding key evidence in texts and chat data.

Find out more about how CloudNine can help you tackle newer data forms with our cloud-based eDiscovery solution, CloudNine Review, and set a time to meet with us.

When it comes to ensuring that data is preserved and available for litigation, investigations, or government inquiries, it all starts with establishing and codifying clear data governance policies and procedures.

When updating policies for corporate data governance, consider the following focus areas:

• Bring Your Own Device (BYOD) or Company Issued Device (CID) policies
• Corporate communication applications – Slack, MS Teams, Bloomberg, Confluence, Jira, etc.
• Ephemeral messaging apps
• Privacy considerations around BYOD and CID
• Compliance guidelines
• Business value of each communication channel

Let’s take a high-level look at each area to show the need for further examination.

Bring Your Own Device (BYOD) and Company Issued Device (CID) Policies

One of the largest issues in corporate data governance is the use of new communication applications without proper authorization. Employees often use their devices for communicating internally and externally, which can lead to unintentional confidential data leaks.

Additionally, gaining access to potentially responsive data on these devices during investigations or litigation can be challenging. When creating either a BYOD or CID policy, consider your company’s potential for litigation, internal investigations, or compliance issues.

For highly regulated organizations, BYOD policies may pose compliance risks, as all communications need to be in company-sanctioned applications. Training for all employees, especially executives who heavily use messaging apps, is essential to avoid non-compliance issues. Small to mid-sized businesses might have more relaxed BYOD policies, but education on business versus personal communications is still necessary.

One solution is Mobile Device Management (MDM) platforms, which can help partition corporate versus personal communications and processes. MDMs allow organizations to better access mobile devices and enable IT to monitor, manage, and secure devices, whether they are employee or corporate-owned.

Corporate Communication Apps

Since the beginning of the pandemic, the global workforce has shifted from in-office communications to chat applications like Slack, MS Teams, and Bloomberg. Manfred Gabriel, Partner at Holland & Knight LLP, explained: “The matters we handle for our clients now frequently include data types beyond email and business documents. We are seeing a rise in corporate chat and collaboration tools, such as Microsoft Teams or Slack. Messaging apps like WhatsApp and iMessage are also increasingly collected for the custodians, because business conversations continue to migrate away from email.”

This shift creates downstream issues when this data is subject to litigation or internal investigations. Depending on the organization and the communication app, a technology upgrade may be needed to allow for easier data export for eDiscovery. For instance, Slack only allows data exporting if the customer has the Business+ license or better. Microsoft Teams users face similar challenges, as a Premium version of Teams is needed for less restrictive data exporting.

These considerations should be determined by the staff responsible for exporting, reviewing, and producing this data. Many decisions to use these platforms were reactive and implemented quickly due to the pandemic. If you haven’t already, now is a good time to audit what is currently being utilized and develop a consolidation and information governance (IG) plan around it.

Ephemeral Messaging Applications

Ephemeral messaging applications, where content disappears after a certain time, typically do not serve business purposes and should be banned from approved communication applications unless cleared by the legal department. Understanding the downstream impacts of these applications is crucial when putting together your IG plan.

Privacy, Compliance, and Business Value

These elements should align with your current IG policies but also consider their impact on platforms like Slack, MS Teams, Bloomberg, Jira, Confluence, Zoom, GoTo Meeting, etc. Ask yourself: “What are the impacts of using these applications, and are there business or compliance reasons for keeping this data?” Privacy guidelines should be tailored to device usage, especially with BYOD.

By addressing these areas, you can modernize your information governance policies and ensure efficient text and chat data discovery, making the process smoother and more compliant.

In our next blog of this series, you will learn how to ease the data collection challenge, especially with regard to modern data. You can also download our complimentary guide to learn how to benefit from eDiscovery technology to accelerate finding key evidence in texts and chat data.

Find out more about how CloudNine can help you tackle newer data forms with our cloud-based eDiscovery solution, CloudNine Review, and set a time to meet with us.

What’s today’s biggest eDiscovery dilemma? The proliferation of modern data, including text and data from chat, social media, and communication apps, is adding even greater complexity to the already daunting task of finding evidence.

We create massive amounts of data daily, whether we know it or not. Access to smartphones, tablets, computers, wearable devices, smart cars, and many other electronic devices results in an always-on recording of our daily activities. Coupled with that, we are using smart devices, social media, and chat apps to communicate with one another, with email and phone calls taking a back seat to forms of short message, instant interaction.

Often, this data is largely ignored as evidence, and for good reason. It is voluminous and often too expensive to collect everything for a case. However, consider these staggering statistics on Microsoft (MS) Teams alone:

• Over 1 million organizations use MS Teams, including 91% of the Fortune 100 companies (2024).
• In one year, over 6 billion chats are sent in MS Teams (2024) and over 17 billion in Slack (2023).
• Texting has become a preferred form of communication for both personal and business communications, with over 27 billion text messages sent daily (2023).

When putting together the strategy for your case, you may overlook or consciously leave out texts and chat data, as they seem too challenging to collect. Yet, eDiscovery professionals are beginning to support the notion that this type of data can no longer be ignored as opposing counsel and judges are asking for it to be entered as evidence.

Elizabeth Gary, Associate at Morgan, Lewis & Bockius LLP, highlighted this at a recent conference in New York: “In courtrooms today, communications occurring via chat apps and other newer platforms are viewed as not duplicative to emails. As a result, parties are being compelled to produce this data.”

“In courtrooms today, communications occurring via chat apps and other newer platforms are viewed as not duplicative to emails. As a result, parties are being compelled to produce this data.”

– Elizabeth Gary, Associate at Morgan, Lewis & Bockius LLP

Why are email and electronic documents still the primary evidence pool in most cases when there has been a tremendous uptick in the use of smartphones, chat applications, and a myriad of other apps to communicate at the workplace?

Simply put, the perception of costs, difficulty, and uncertainty around the data volumes and variety are making many legal teams stop short of collecting all of the data.

However, as modern communication channels continue to evolve and dominate, it’s becoming increasingly clear that eDiscovery must adapt to these changes to ensure thorough and effective legal processes.

In our new five-part blog series out this week, you will learn how to best manage modern data in eDiscovery.

You can also download our complimentary guide to learn how to benefit from eDiscovery technology to accelerate finding key evidence in texts and chat data.

Find out more about how CloudNine can help you tackle newer data forms with our cloud-based eDiscovery solution, CloudNine Review, and set a time to meet with us.