Social Technology

By:  Trent Livingston

Modern eDiscovery deals with much more than just documents. In 2020, people created 1.7 MB of data every second, and most of that data was likely stored in a database. Now, newer applications like Facebook, Twitter, Slack are storing copious amounts of data ranging from tweets, wall posts, and chats.

Many of these artifacts are stored with complementary data that can include file links, reactions (such as “likes”), and even geolocation information. Accessing this modern data in order to leverage it for a discovery request often requires some sort of archive process from the originating application, and that is when JSON enters the picture.

JSON stands for “JavaScript Object Notation”, but that doesn’t mean you need to know how to write JavaScript (or any code for that matter)!  If you’ve ever dealt with discovery surrounding any of the aforementioned applications, you’ve likely come across a few JSON files. In a nutshell, think of JSON as a relational spreadsheet where one column of data in one tab of your spreadsheet is defined by another column of data in another tab in another spreadsheet.

For example, you might have a column called “Address” in a spreadsheet and that column contains a series of numeric “id” values that reference another tab in that same spreadsheet. In this secondary tab, each address is broken down into values for that address that may include things like “country”, “zip”, or “street”.  All those values that have the same “id” belong to the “address” reference in the previous tab. Simply put, this is structured data. JSON data is no different. However, JSON can contain a multitude of data structures varying from simple to complex.

The problem with JSON is while there are multiple JSON viewers and formatters online, they do not understand the defined data structures within.  Each platform defines these data structures differently, and while the vehicle may be the same, the defined structure is usually different from application to application (as well as the application’s version).  Therefore, the data within the JSON often comes out in an unexpected format when using a generic formatting tool, and the relationships between the data are often lost or jumbled. (By the way, you should never use any online “free” tool to format potentially confidential or privileged information).

Therefore, it is important to work with someone who understands JSON as an eDiscovery data source.  A single JSON file just a few megabytes in size may represent hundreds, if not thousands of messages, contain numerous links to files, as well as key data relevant to your investigation or litigation. Contained within a JSON file could be any number of nested data formats, including:

• Strings: a sequence of zero or more Unicode characters, which could include emojis in a Unicode format, usernames, or an actual text message.
• Numbers: a numeric value that can represent a date, intrinsic value, id, or potentially a true/false value represented as “1” or “0”.
• Objects: a series or collection of one or more data points represented as named value pairs that create meaning as a whole, such as longitude, latitude, elevation, rate of speed, and direction that make up the components of a device’s location.
• Arrays: a collection of values or elements of the same type that can be individually referenced by using an index to a unique identifier, such as the choices of a color of a car on a website or a set of canned response values listed in a software chat application.

The thing to remember is the JSON file is actually one big “object”, which is the parent to all of the named value pairs beneath it.  Within this object, you can have more objects that contain numbers, strings, arrays, and yet even more objects. Confused yet?

Not to worry! It is understandable that all this JSON data can quickly become a source of frustration!  The question that remains is, “How do I make sense of all of this structured data and present it for review in a reasonably usable format?” 

Here are some tips:

1. Make sure you do not overlook JSON as part of your electronic discovery protocol
2. Leverage an experienced team to help you understand the JSON output
   • Document the source application whenever possible (some JSON include access keys that can expire or be terminated at any time, such as Slack)
   • Preserve the JSON file as you would any other evidentiary data source
   • Document the chain of custody for the JSON file (originating application and version of that application, who conducted the export, as well as any access keys that may be transitory or temporary and their date of expiration)
   • Treat each JSON file and associated content as a potential source of PII, confidential, and/or privileged information given the breadth of data that each may contain
3. Work with a team and a product that can parse, ingest, and subsequently present JSON data in a usable format for review and production

While there is not an off-the-shelf solution for every JSON file in existence, CloudNine ESI Analyst is a platform designed for the multitude of data types that can be extracted from just about any JSON file out there. Many of which can be easily mapped to a data type construct within our SaaS application that allows for presentation, review, and production in a reasonably usable format.

Contact us today for a demonstration and further detail!

In litigation, knowing the full picture is the only way to effectively represent your clients. The only problem is most of the story is often stored on electronic devices like smartphones, laptops, or tablets.

While eDiscovery can be dated back to 1981 and the first substantial use of email in litigation (Governors of United State Postal Service v. United States Postal Rate Commission), integrating newer, modern data types like text messages, computer activity, and financial data, has been a bit more challenging. These challenges relate back to how eDiscovery has historically worked and why modern data sources don’t fit nicely into that process. 

When eDiscovery was introduced with email and electronic documents as the primary source of information, simple messages and documents were sufficient to tell the story in a linear document review workflow. But, with sophisticated technology like Slack, chat applications and smartphone messaging where communications occur in real time, the conversion to documents for review hinders a proper evidence analysis.

Making sense of all that data only works when it is presented in the way it was originally communicated. The old documentation process simply doesn’t provide the insight you need to leverage modern data in litigation.

Case Study 1: Tackling Disparate Modern Data from Multiple Sources

No matter how small or large your case is, reviewing modern data can be challenging. Between smartphones, laptops, social media apps, and other connected devices, there’s a plethora of data to sift through to find the evidence you need to support your case. This process becomes even more complicated when the data is presented through the lens of traditional eDiscovery meaning, in traditional document format. What once worked for simple electronic communications no longer tells the whole story within complex, real-time and editable messaging technologies like WhatsApp, Slack and social media.

So what happens when you have to produce data from hundreds of international sources, and need it to tell the story of what actually happened? Let’s look at a case study of a construction company who had to do exactly that.

The Problem:

One of the largest construction companies in the world required the collection of modern data from 300 international sources. While the sheer number of sources was a challenge in itself, the real difficulty was working with disparate data from so many different sources.

Each business unit within the company used different technology so data had to be collected from a vast number of sources – local desktops, laptops, smartphones, tablets, and backup servers.

Plus, because so many BYOD devices were used, legal, data privacy, IT, and risk & compliance departments had to be consulted throughout the collection and review process to ensure no U.S. or international privacy laws were broken.

The Solution:

Ultimately, our client needed to understand who said or did what, and when. Basic documents with communications from readily available sources wouldn’t be enough, because they couldn’t easily identify the critical timeline of events or the intentions of each party. In the end, CloudNine ESI’s actor normalization function was the key to finding the evidence needed.

The Results:

By matching specific individuals to different aliases and phone numbers, attorneys were able to identify a handful of photos shared from the vast amount of data collected that proved the construction company was at fault. These photos were presented to the court in the form of inline bubble messaging that was easy to read and view.  To learn more about this use case, click here.

Case Study 2: Overcoming the Personal Device eDiscovery Challenge

There’s an expected, inherent trust between a company and its employees which means employees typically won’t do work that’s a conflict of interest with their current employer. Unfortunately, that trust is sometimes broken by actors that take advantage of their position.

The Problem:

When a heavy equipment manager became the target of a moonlighting case that cost his company money, attorneys were discouraged when they couldn’t find any evidence of wrongdoing. There were no documents, emails, or invoices to be found through traditional eDiscovery.

The Solution:

Fortunately, the key to the case was the manager’s smartphone.

By gaining access to his phone, attorneys were able to secure tens of thousands of text messages directly related to the case. This helped them discover how he operated his illegal side hustle. They also learned he was sharing confidential, copyrighted, and proprietary information through photos sent via text message.

The Results:

Through CloudNine ESI Analyst, attorneys were able to create conversation threads which were easy to review and produce. These threads not only helped them identify other involved parties, but let them produce messages, including embedded images, videos, GIFs, and emojis.

Without the ability to review and analyze the bad actor’s smartphone data, the case likely would not have gone forward.  

To learn more about this use case, click here.

Case Study 3: Protecting Company Data with Modern eDiscovery

The average American holds 12 jobs in their lifetime so it’s safe to say you will lose employees from time to time. Whether purposeful or accidental, the odds are good their personal devices will contain confidential or proprietary information when they walk through the door for the final time.

So what if you could examine their devices and remove all sensitive material before they left?

The Problem:

An employee spent six months working from home on a personal laptop before announcing his resignation to work for a competitor. If the employee was allowed to leave without a device review, he’d likely be leaving with documents that would benefit both him and his new employer.

Whether he would ever used those documents or not, chances are he’d find himself in the middle of a long, expensive trade secrets case which would also impact his new employer.

The Solution:

The representatives of the employee’s current company needed a way to access his personal laptop and identify any confidential or proprietary documents to be destroyed before he went to work for their competitor. They sought out a solution to easily identify these risks to protect their company, the employee and the employee’s future company.

The Results:

With CloudNine ESI Analyst, company representatives were able to access his personal laptop, create a chain of custody and review the data found on it. This allowed them to find confidential and proprietary data and remove it before the employee left for his new position, protecting all parties involved.

By doing this in advance, you preserve the data and protect it without relying on your employees to remember if they have sensitive information on their devices or not.

To learn more about this use case, click here. 

CloudNine ESI Analyst – A Modern eDiscovery Solution for Modern Data Review

While most law firms, corporations, and LSPs are challenged to review modern data through traditional eDiscovery tools, they struggle to pull the true value out of the data. Each text and corporate chat message are recreated as stand-alone documents, leaving you to piece them all together like a giant legal jigsaw puzzle with missing pieces and others that simply don’t fit the storyline.

With a robust and flexible modern eDiscovery tool like CloudNine ESI Analyst, you have access to alternative data to help you put the puzzle together through linear storytelling that creates a digital trail of evidence, including some of these popular sources:

• Text messages (SMS and MMS)
• Call logs
• Voicemails
• Messenger applications (Slack, Teams, WhatsApp, Messenger, etc.)
• Computer activity
• Financial transactions
• Geolocation

Modernize your investigations and litigation by effectively managing the data in a single platform instead of wasting time managing a menagerie of documents in siloed systems.

Every case is unique and requires you to find the facts and context to tell the complete story. Contact CloudNine and learn how we can help you leverage all the data to get to the truth of the matter. Contact us to learn more.