The massive adoption of mobile chat, Slack, Microsoft Teams and other collaborative applications is changing the way companies communicate internally and externally.
These rapidly growing platforms present new ESI discovery challenges as they contain potential evidence for litigation, internal investigations, and compliance matters. Up until now, companies have largely avoided creating collaborative data. However, once courts become familiar with collaborative requests, they will increasingly force production from these sources. Is your organization ready?
The challenge with this new adventure is the lack of standards. Each chat, collaboration, and / or archiving tool is different from the next. Therefore, in the context of an investigation, any combination of chat application and archiving tool presents a unique data challenge for investigation teams.
These applications have fundamentally changed what it means to check information in context. For example, a single Slack conversation can contain messages, documents, threads, edits, deletions, images, emojis, videos, and more – all in quick, compact communication that is often informal. Here are some things you can do now to successfully create collaborative data in eDiscovery.
How much collaborative applications are used in your organization
Given the popularity of Slack, Teams, and other collaboration apps, it’s unwise to assume that no one in your organization is using these tools. It is recommended that you work with each business unit in collaboration with IT to identify potential sources of discoverable data.
Rather than narrowing an eDiscovery plan to the prevailing or expected data sources and applications, all software applications should be considered, with an emphasis on software that is likely to contain findable communications or evidence. For example, Box, a cloud-based content storage and file sharing application, allows users to store files in the cloud, but it’s not just simple storage. Box also allows files to work together, as well as adding user notes to the files – potentially relevant communication – on a platform that has traditionally been viewed as storage rather than a collaborative application. So, in addition to identifying collaborative applications in your environment, make sure you clarify with users how each application will actually be used in the normal course of business.
Understand where the data is
When you have verified and documented the applications and users in your organization, take a closer look to understand where the data is actually stored. Just because the data can be viewed through a particular platform doesn’t mean that all of that data can be collected. Many software platforms preview data from other websites or use APIs to facilitate integration. This means that all visible data in the application is on the same server. For example, team chats can preview a website referenced in a message file, but this data is not saved. A collection would only result in the hyperlink to the file. Likewise, Microsoft data is stored in different locations and not all Microsoft data can be collected.
Be prepared to compromise the size of the collection
Traditional eDiscovery wisdom says that everything has to be collected once and the effort to enter it again must be avoided. However, cloud technology and falling storage costs have made it possible to create a potentially unlimited amount of data associated with a particular set of documents. It is more important than ever to properly capture collections. A collection of appropriately sized messages can quickly become unmanageable with attachments. For each collaborative application, learn how to use the software to find the data and break it down into more manageable tranches. For example, you can choose to export Microsoft Teams messages only to one PST and the rest of the custodian Exchange mailbox to another export.
Understand the search options
More sophisticated applications often have built-in search functions. Other tools may have options that are robust enough to make an impact. It is important to understand whether the native front-end search capabilities can be used to reduce collection volume and export. In some cases, the only option is to export all of the data associated with a particular custodian.
Take document versions into account
The cloud has made it possible for groups of users to create files and collaborate on versioned editing. Teams and Docs are two examples of popular version-controlled document collaboration tools. Unlike the static content of a traditional email attachment, a document that users share for collaboration is a link to a file that may have been edited after it was sent. Google Docs can support the retention of up to 40 versions of a document. Deciding which version to capture can have a significant impact on the core of communications, while collecting each version increases the amount of verification work. With technology emerging, the standard has yet to be set and tested in court.
Run data tests to evaluate the verification options
Collaboration data consists of short messages that do not quote previous messages to create context. Instead, it makes sense to group the messages in context by conversation. Most eDiscovery platforms were designed to scan email threads, as email has made up the bulk of eDiscovery records for years. Many of the document review options available have limitations on how to display, search, and tag data from collaborative applications.
Over time, verification platforms will evolve to better support investigative verification of chat and collaborative data. However, there is currently no standard approach to this review. Working with a provider who has developed efficient workflows for chat and collaboration data is critical to save you countless hours of review.
Best practices suggest that legal and investigation teams prepare test data for the types of data that you are likely to collect in the future. Use the test data to evaluate the capabilities of the review platforms currently available and be ready when the courts call for content creation from Teams, Slack, or other collaborative applications.