eDiscovery Daily Blog
I Removed a Virus, Did I Just Violate My Discovery Agreement? – eDiscovery Best Practices
As we discussed last month, working with electronic files in a review tool is NOT just simply a matter of loading the files and getting started. Electronic files are diverse, they can represent a whole collection of issues to address in order to process them for loading, and processing them effectively requires a sound process. But, what if the evidentiary files you collect from your custodians contain viruses or other malware?
It’s common to refer to all types of malware as “viruses”, but a computer virus is only one type of malware. Malware includes computer viruses, worms, trojan horses, spyware, dishonest adware, scareware, crimeware, most rootkits, and other malicious and unwanted software or program. A report from 2008 stated that more malicious code and other unwanted programs was being created than legitimate software applications. If you’ve ever had to attempt to remove files from an infected computer, you’ve seen just how prolific different types of malware can be.
Having worked with a lot of clients who don’t understand why it can take time to get ESI processed and loaded into their review platform, I’ve had to spend some time educating those clients as to the various processes required (including those we discussed last month). Before any of those processes can happen, you must first scan the files for viruses and other malware that may be infecting those files. If malware is found in any files, one of two things must happen:
- Attempt to remove the malware with virus protection software, or
- Isolate and log the infected files as exceptions (which you will also have to do if the virus protection software fails to remove the malware).
So, let’s get started, right? Not so fast.
While it may seem logical that the malware should always be removed, doing so is technically altering the file. It’s important to address how malware should be handled as part of the Rule 26(f) “meet and confer” conference, so neither party can be accused of spoliating data when removing malware from potentially discoverable files. If both sides agree that malware removal is acceptable, there still needs to be a provision to handle files for which malware removal attempts fail (i.e., exception logs). Regardless, the malware needs to be addressed so that it doesn’t affect the entire collection.
By the way, malware can hit anybody, as I learned (the hard way) a couple of years ago.
So, what do you think? How do you handle malware in your negotiations with opposing counsel and in your ESI collections? Please share any comments you might have or if you’d like to know more about a particular topic.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine Discovery. eDiscoveryDaily is made available by CloudNine Discovery solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscoveryDaily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.