Category: Article Page 5 of 8

DownloadPDF

Cite as: Sean L. Harrington, Cyber Security Active Defense: Playing with Fire or Sound Risk Management?, 20 Rich. J.L. & Tech. 12 (2014), http://jolt.richmond.edu/v20i4/article12.pdf.

 Sean L. Harrington*

Trying to change its program

Trying to change the mode . . . crack the code

Images conflicting into data overload[1]

 I. Introduction

[1]        “Banks Remain the Top Target for Hackers, Report Says,” is the title of an April 2013 American Banker article.[2] Yet, no new comprehensive U.S. cyber legislation has been enacted since 2002,[3] and neither legislative history nor the statutory language of the Computer Fraud and Abuse Act (CFAA) or Electronic Communications Privacy Act (ECPA) make reference to the Internet.[4] Courts have nevertheless filled in the gaps—sometimes with surprising results.

[2]        Because state law, federal legislative proposals, and case law all are in a continuing state of flux, practitioners have found it necessary to follow these developments carefully, forecast, and adapt to them, all of which has proved quite challenging. As the title of this Comment suggests, deploying sound cyber security practices is not only equally as challenging, but also “risky,” which may seem counterintuitive in light of the fact that intent of cyber security programs is to manage risk, not create it.[5]

[3]        Cyber security risks concern exploits made possible by technological advances, some of which are styled with familiar catch-phrases: “e-Discovery,” “social media,” “cloud computing,” “Crowdsourcing,” and “big data,” to name a few. Yet, long before the term “cloud computing” became part of contemporary parlance, Picasa used to store photos in the cloud (where the “cloud” is a metaphor for the Internet).[6] This author has been using Hotmail since 1997 (another form of cloud computing). As the foregoing examples illustrate, the neologisms were long predated by their underlying concepts.

[4]        One of the latest techno-phrases du jour is “hack back.”[7] The concept isn’t new, and the term has been “common” parlance at least as far back as 2003.[8] “Hack back”—sometimes termed “active defense,” “back hacking,” “retaliatory hacking,” or “offensive countermeasures” (“OCM”)—has been defined as the

“process of identifying attacks on a system and, if possible, identifying the origin of the attacks.” Back hacking can be thought of as a kind of reverse engineering of hacking efforts, where security consultants and other professionals try to anticipate attacks and work on adequate responses.”[9]

A more accurate and concise definition might be “turning the tables on a cyberhacking assailant: thwarting or stopping the crime, or perhaps even trying to steal back what was taken.”[10] One private security firm, renowned for its relevant specialization, defines active defense, in pertinent part, as “deception, containment, tying up adversary resources, and creating doubt and confusion while denying them the benefits of their operations.”[11] Some have proposed—or carried out—additional measures, such as “photographing the hacker using his own system’s camera, implanting malware in the hacker’s network, or even physically disabling or destroying the hacker’s own computer or network.”[12]

[5]        Back hacking has been a top-trending technology topic over the past year, prompted in part by the controversial Report of the Commission on the Theft of American Intellectual Property (“IP Commission Report”),[13] and has been debated on blogs, symposium panels, editorials, and news media forums by information security professionals and lawyers alike. One with the potential to grab practitioners’ attention was a panel of attorneys David Navetta and Ron Raether—both well regarded in the information security community—discussing the utility and propriety of such practices. One opined that, if the circumstance is exigent enough, a company may take “measures into [its] own hands,” and that it would, “not likely be prosecuted under the CFAA, depending on the exigency of the circumstances.”[14] The other reasoned that hack back “technically violates the law, but is anyone going to prosecute you for that? Unlikely.”[15] He noted, “[i]t provides a treasure trove of forensic information that you can use,” and continued, “[w]ith respect to the more extreme end of hack back, where you are actually going to shut down servers, I think there is a necessity element to it—an exigency: if someone’s life is threatened, if it appears that there is going to be a monumental effect on the company, then it might be justified.”[16] In 2014 at the most recent RSA conference, where the “hackback” debate continued, the presentation was billed, in part, with the proposition, “[a]ctive defense should be viewed as a diverse set of techniques along a spectrum of varying risk and legality.”[17] And, other commentators have urged that “offensive operations must be considered as a possible device in the cyber toolkit.” [18]

[6]        Most commentators and scholars, however, seem to agree that “hack back” is not only “risky,” but is also not a viable option for a variety of reasons.[19] Hack backs and other surreptitious cyber acts incur the risks of criminal liability, civil liability, regulatory liability, professional discipline, compromise of corporate ethics, injury to brand image, and escalation. One practitioner quoted by the LA Times exclaimed, “[i]t’s not only legally wrong, it’s morally wrong.”[20] James Andrew Lewis, a senior fellow at the Center for Strategic and International Studies, characterized hacking back as “a remarkably bad idea that would harm the national interest.”[21] The Cyber Intelligence Sharing and Protection Act, a major cybersecurity bill passed by the House in April 2013, contained an amendment that specifically provided that the bill did not permit hacking back.[22] Representative Jim Langevin (RI-D), who authored the amendment, explained, “[w]ithout this clear restriction, there is simply too much risk of potentially dangerous misattribution or misunderstanding of any hack-back actions.”[23] Further, the private security firm renowned for its active defense strategies, mentioned ante, has attempted to distance itself from the phrases such as “hack back” and “retaliatory hacking,” preferring instead the broader phrase “active defense.”[24] Another example of the importance of subtleties in word choice may be “Countermeasure,” where some appear to have conflated the word with the concept of active defense.[25]

II. Active Defense Approaches

[7]        Self-defense is not an abstraction created by civilization, but a law spawned by nature itself, and has been justified since antiquity.[26] It has been regarded since the early modern period as available to redress injuries against a state’s sovereign rights.[27] There is little question cyber-attacks against a designated critical infrastructure are attacks against a state’s sovereign rights,[28] because much of civilian infrastructure is both a military and national asset.[29] Accordingly, the focus of 2014 NATO International Conference on Cyber Conflict (“CyCon”) is active cyber defense, including implications for critical infrastructure.[30] Likewise, a project sponsored by NATO’s Cooperative Cyber Defense Centre of Excellence is set to publish a report in 2016 that establishes acceptable responses to pedestrian or quotidian cyber-attacks against nations, whereas its predecessor, regarded as an academic text, focused on cyber-attacks against a country that are physically disruptive or injurious to people and possible responses under the UN charter and military rules.[31] Both works are based on the concepts of self-defense and, under certain circumstances, preemptive “anticipatory self-defense.”[32]

[8]        The questions that scholars, policymakers, information security experts, and corporate executives have struggled with, however, is at what threshold do such attacks warrant the protection of the state,[33] whether a private corporation may respond in lieu of or in concert with protection by the state, and to what extent such collusion constitutes excessive entanglement between the private and public sector. Implicit in these questions is whether the government is willing and able to develop a modern and adaptable regulatory and criminal law framework and to allocate adequate law enforcement resources to confront the problem.[34] Because, at the time of this writing, it is widely perceived that the government is not yet willing and able,[35] victims often do not report suspected or actual cyber-attacks, and have resorted to inappropriate self-help, deploying their own means of investigating and punishing transgressors.[36] As one commentator posits,

With regard to computer crime, some might argue that the entire investigative process be outsourced to the business community. Historically, the privatization of investigations has assisted public law enforcement by allowing them to concentrate on other responsibilities, and has prevented their resources from being allocated in too sparse a manner to be useful.” [37]

Awaiting the ultimate resolution of these questions, American corporations have developed an array of active defense tactics. Below are a few of the more common examples of those, and the corresponding challenges:

 A. Beaconing

[9]        Beaconing is one of the most cited active defense techniques, and one mentioned in the IP Commission Report (along with “meta-tagging,” and “watermarking”) as a way to enhance electronic files to “allow for awareness of whether protected information has left an authorized network and can potentially identify the location of files in the event that they are stolen.”[38] A benign version of beaconing is the use of so-called Web bugs.[39] A Web bug is a link—a surreptitious file object—commonly used by spammers and placed in an e-mail message or e-mail attachment, which, when opened, will cause the e-mail client or program will attempt to retrieve an image file object from a remote Web server and, in the process, transmit information that includes the user’s IP address and other information.[40] This transmission is not possible “if the user did not preconfigure the e-mail client or program to refrain from retrieving images or HTML content from the Internet,” or if the user’s e-mail client blocks externally-hosted images by default.[41] “This information becomes available to the sender either through an automated report service (e.g., ReadNotify.com) or simply by monitoring traffic to the Web server.”[42] In one project demonstrating the use advocated by the IP Commission Report, researchers employed such technology in decoy documents to track possible misuse of confidential documents.[43] So, is beaconing legal?

[10]      The Wall Street Journal (the “Journal”) quoted Drexel University law professor Harvey Rishikof—who also is co-chairman of the American Bar Association’s Cybersecurity Legal Task Force—as saying the legality of beaconing is not entirely clear.[44] Rishikof is quoted as saying, “‘[t]here’s the black-letter law, and there’s the gray area. . . . Can you put a beacon on your data? Another level is, could you put something on your data that would perform a more aggressive action if the data was taken?’”[45] The article went on to suggest more aggressive strategies such as “inserting code that would cause stolen data to self-destruct or inserting a program in the data that would allow a company to seize control of any cameras on the computers where the data were being stored.”[46] The Journal, citing an anonymous Justice Department source, further reported that, “[i]n certain circumstances beaconing could be legal, as long as the concealed software wouldn’t do other things like allow a company to access information on the system where the stolen data were stored.”[47]

[11]      Another important consideration is the fact that beaconing may fall within one of the active defense definitions (supra) as “deception.”[48] Although deception is recognized as both a common and effective investigative technique,[49] the problem is the possibility that the activities of the investigator could be imputed under Model Rule of Professional Conduct 5.3 to one or more attorneys responsible for directing or approving of those activities.[50] Under Model Rule 8.4(c), neither an attorney nor an attorney’s agent under his or her direction or control may “engage in conduct involving dishonesty, fraud, deceit, or misrepresentation.”[51] Although the question of whether deception, as contemplated in Rule 8.4, exists in the context of incident response or network forensics investigations is not well settled,[52] most states have held “[t]here are circumstances where failure to make a disclosure is the equivalent of an affirmative misrepresentation.”[53] A few state bar associations have already addressed similar technology-related ethical pitfalls. The Philadelphia Bar Association Professional Guidance Committee advised in Opinion 2009–02 that an attorney who asks an agent (such as an investigator) to “friend” a party in Facebook in order to obtain access to that party’s non-public information, would violate, among others, Rule 5.3 of the Pennsylvania Rules of Professional Conduct.[54] Likewise, the Association of the Bar of the City of New York Committee on Professional and Judicial Ethics issued Formal Opinion 2010–2, which provides that a lawyer violates, among others, New York Rules of Professional Conduct Rule 5.3, if an attorney employs an agent to engage in the deception of “friending” a party under false pretenses to obtain evidence from a social networking website.[55]

B. Threat Counter-Intelligence Gathering

[12]      One of the most seemingly-innocuous active defense activities is intelligence gathering. Security analyst David Bianco defines threat intelligence as “[c]onsuming information about adversaries, tools or techniques and applying this to incoming data to identify malicious activity.”[56] Threat intelligence gathering ranges from everything from reverse malware analysis and attribution to monitoring inbound and outbound corporate e-mail to more risky endeavors.[57] Some security experts claim to frequent “Internet store fronts” for malware, “after carefully cloaking [their] identity to remain anonymous.”[58] The reality, however, is that gaining access to and remaining on these black market fora requires the surreptitious visitor either to: (1) participate (“pay to play”); (2) to have developed a reputation over months or years, or founded the underground forum ab initio;or (3) to have befriended or been extended a personal invitation by an established member. The first two of these three activities implies that the participant would have co-conspirator or accomplice liability in the underlying crimes. Another risk is, if the site is reputed to also purvey child pornography, a court may find that the site visitor acquired possession (even as temporary Internet cache) of the contraband knowingly, even if the true intent of lurking was to gather intelligence.[59] Another obvious risk is that surreptitious monitoring of hacker sites using false credentials or representations is an act of deception which, for the reasons more fully set forth above, could create disciplinary liability for any attorneys who are involved or acquiesce to the activity.

C. Sinkholing

[13]      Sinkholing is the impersonation of a botnet command-and-control server in order to intercept and receive malicious traffic from its clients.[60] To accomplish this, either the domain registrar must redirect the domain name to the investigator’s machine (which only works when the connection is based on a DNS name), or the Internet Service Provider (ISP) must redirect an existing IP address to the investigator’s machine (possible only if the investigator’s machine is located in the IP range of the same provider), or the ISP must redirect all traffic destined for an IP address to the investigator’s machine, instead (the “walled garden” approach).[61]

[14]      Sinkholing involves the same issues of deception discussed ante, but also relies on the domain registrar’s willingness and legal ability to assist. As Link and Sancho point out in their paper Lessons Learned While Sinkholing Botnets—Not as Easy as it Looks!,“[u]nless there is a court order that compels them to comply with such a request, without the explicit consent of the owner/end-user of the domain, the registrar is unable to grant such requests.”[62] Doubtless they were referring to the Wiretap Act (Title 1 of the Electronic Communications Privacy Act), which generally prohibits unconsented interception (contemporaneous with transmission), disclosure, or use of electronic communications.[63] Further, a federal district court recently ruled that intentionally circumventing an IP address blacklist in order to crawl an otherwise-publicly available website constitutes “access without authorization” under the CFAA.[64] Link and Sancho continue that registrars have little incentive to assist because it does not generate revenue, and note that sinkholing invites distributed denial of service (“DDoS”) retaliation which could affect other customers of a cloud-provided broadband connection.[65] Finally, sinkholing is likely to collect significant amounts of data, including personally identifiable information (“PII”). The entity collecting PII is likely to be subject to the data privacy, handling, and disclosure laws of all the jurisdictions whence the data came.

D. Honeypots

[15]      A honeypot is defined as “a computer system on the Internet that is expressly set up to attract and ‘trap’ people who attempt to penetrate other people’s computer systems.”[66] It may be best thought of as “an information system resource whose value lies in unauthorized or illicit use of that resource.”[67] Honeypots do arguably involve deception, but have been in use for a comparatively long time, and are generally accepted as a valid information security tactic (therefore, relatively free from controversy). The legal risks, historically, have been identified as: (1) potential violations of the ECPA;[68] and (2) possibly creating an entrapment defense for the intruder.[69] Neither of these is applicable here, because, respectively: (1) the context of the deployment discussed herein is the corporate entity as the honeypot owner (thus, a party to the wire communication); and (2) the corporate entity is not an agent of law enforcement, and, further, the entrapment defense is only available when defendant was not predisposed to commit the crime (here, a hacker intruding into a honeypot is predisposed).[70] Nevertheless, Justice Department attorney Richard Salgado, speaking at the Black Hat Briefings, did reportedly warn that the law regarding honeypots is “untested” and that entities implementing devices or networks designed to attract hackers could face such legal issues as liability for an attack launched from a compromised honeypot.[71] This possibility was discussed six years ago:

If a hacker compromises a system in which the owner has not taken reasonable care to secure and uses it to launch an attack against a third party, the owner of that system may be liable to the third party for negligence. Experts refer to this scenario as “downstream liability.” Although a case has yet to arise in the courts, honeypot operators may be especially vulnerable to downstream liability claims since it is highly foreseeable that such a system be misused in this manner.[72]

Another honeypot risk is the unintended consequence of becoming a directed target because the honeypot provoked or attracted hackers to the company that deployed it, which hackers might otherwise have moved on to easier targets. Another is that an improperly configured honeypot could ensnare an innocent third party or customer and collect legally-protected information (such as PII). If that information is not handled according to applicable law, the owner of the honeypot could incur statutory liabilities therefor.[73] And yet another scenario is one that, perhaps, only a lawyer would recognize as a risk: “[i]f you have a honeypot and do learn a lot from it but don’t remedy or correct it, then there’s a record that is discoverable and that you knew you had a problem and didn’t [timely] fix it.”[74]

[16]      Finally, there are uses for honeypots which, when regarded as a source of revenue by its owners, have the potential to cause substantial injury to brand image and reputation, and possibly court sanctions: one law firm has been accused of seeding the very copyrighted content it was retained to protect, which the firm used as evidence in copyright suits it prosecuted.[75] Because of these alleged activities, the firm has been labelled a “copyright troll.”[76] The allegations, if proved true, also appear to involve acts of deception, discussed ante, which may subject the firm’s attorneys to attorney disciplinary proceedings.[77] Further, the firm’s attorneys may incur other possible liabilities, such as vexatious and frivolous filing sanctions, abuse of process, barratry, or champerty.[78]

E. Retaliatory Hacking

[17]      A common belief for why corporations have little to fear in the way of prosecution for retaliatory hacking is, “criminals don’t call the cops.”[79] Nevertheless, there is little debate that affirmative retaliatory hacking is unlawful,[80] even if done in the interests of national security.[81] Although there may be “little debate,” there is debate.[82]The views of many passionate information security analysts could be summed up by authors John Strand and Paul Asadoorian, who argue, “[c]urrently, our only defense tools are the same tools we have had for the past 10+ years, and they are failing.”[83] David Willson, the owner and president of Titan Info Security Group, and a retired Army JAG, contends that using “automated tools outside of your own network to defend against attacks by innocent but compromised machines” is not gaining unauthorized access or a computer trespass, and he asks, “[i]f it is, how is it different from the adware, spam, cookies, or others that load on your machine without your knowledge, or at least with passive consent?”[84] Willson provides a typical scenario and then examines the statutory language of the CFAA and offers some possible arguments—but notes his arguments bear stretch marks (and he makes no offer of indemnification should practitioners decide to use them).[85]

[18]      Willson is not alone in searching for leeway within the CFAA. Stewart Baker, former NSA general counsel, argues on his blog,

Does the CFAA, prohibit counterhacking? The use of the words “may be illegal,” and “should not” are a clue that the law is at best ambiguous. . . . [V]iolations of the CFAA depend on “authorization.” If you have authorization, it’s nearly impossible to violate the CFAA . . . [b]ut the CFAA doesn’t define “authorization.” . . . The more difficult question is whether you’re “authorized” to hack into the attacker’s machine to extract information about him and to trace your files. As far as I know, that question has never been litigated, and Congress’s silence on the meaning of “authorization” allows both sides to make very different arguments. . . . [C]omputer hackers won’t be bringing many lawsuits against their victims. The real question is whether victims can be criminally prosecuted for breaking into their attacker’s machine.[86]

Other theories —and assorted arguments bearing stretch marks— analogize retaliatory hacking as subject to the recapture of chattels privilege,[87] entry upon land to remove chattels,[88] private necessity,[89] or even the castle doctrine.[90] Jassandra K. Nanini, a cybersecurity law specialist, suggests applying the “security guard doctrine” as an analogy.[91] She posits that, if private actors act independently of law enforcement and have a valid purpose for their security activities that remains separate from law enforcement, then incidental use of evidence gained through those activities by law enforcement is permissible, even if the security guard acted unreasonably (as long as he remained within the confines of the purpose of his employer’s interests).[92] As applied, Nanini explains the analogy as follows:

If digital property were considered the same as physical, cyber security       guards could “patrol” client networks in search of intruder footprints, and based on sufficient evidence of a breach by a particular hacker, perhaps indicated by the user’s ISP, initiate a breach of the invader’s network in order to search for compromised data and disable its further use. Even more aggressive attacks designed to plant malware in hacker networks could be considered seizure of an offensive weapon, comparable to a school security guard seizing a handgun from a malicious party. Such proactive defense could use the hacker’s own malware to corrupt his systems when he attempts to retrieve the data from the company’s system. Certainly all of these activities are within the scope of the company’s valid interest, which include maintaining data integrity, preventing use of stolen data, and disabling further attack. . . . Similarly, companies may wholly lack any consideration of collecting evidence for legal recourse, keeping in step with the private interest requirement of the private security guard doctrine in general. All hack-backs could be executed without any support or direction from law enforcement, opening the door to utilization       of evidence in a future prosecution against the hacker. [93]

The foregoing theories notwithstanding, what is clear is that obtaining evidence by use of a keylogger, spyware, or persistent cookies likely is violative of state and federal laws, such asthe CFAA or ECPA.[94] The CFAA, last amended in 2008, criminalizes anyone who commits, attempts to commit, or conspires to commit an offense under the Act, including offenses such as knowingly accessing without authorization a protected computer (for delineated purposes) or intentionally accessing a computer without authorization (for separately delineated purposes).[95] Relevant statutory phrases, such as “without authorization” and “access,” have been the continuing subject of appellate review.[96] One federal court, referring to both the ECPA and CFAA, pointed out that “the histories of these statutes reveal specific Congressional goals—punishing destructive hacking, preventing wiretapping for criminal or tortious purposes, securing the operations of electronic communication service providers—that are carefully embodied in these criminal statutes and their corresponding civil rights of action.”[97] At least one court has held that the use of persistent tracking cookies is a violation of the Electronic Communications Privacy Act.[98] Congress is currently considering reform to the CFAA, as well as comprehensive privacy legislation that would, in some circumstances, afford a private right of action to consumers whose personal information is collected without their consent. [99]

[19]      Regardless of the frequency with which retaliatory hacking charges have been brought, one issue that has not yet been included in the debate involves illegally obtained evidence that is inadmissible. This matters because bringing suit under the CFAA or ECPA is a remedy that corporate victims have recently invoked increasingly.[100]

[20]      Another liability —the one most frequently cited— is that of misattribution and collateral damage:

[E]ncouraging digital vigilantes will only make the mayhem worse. Hackers like to cover their tracks by routing attacks through other people’s computers, without the owners’ knowledge. That raises the alarming prospect of collateral damage to an innocent bystander’s systems: imagine the possible consequences if the unwitting host of a battle between hackers and counter-hackers were a hospital’s computer.[101]

Likewise, Representative Mike Rogers (R-MI), sponsor for the Cyber Intelligence Sharing and Protection Act (CISPA) and Chair of the House Permanent Select Committee on Intelligence, warned private corporations against going on the offensive as part of their cyber security programs: “You don’t want to attack the wrong place or disrupt the wrong place for somebody who didn’t perpetrate a crime.”[102] Contemplate the civil liabilities that one could incur if, in an effort to take down a botnet through self-help and vigilantism, the damaged computers belonged to customers, competitors, or competitors’ customers. Aside from the financial losses and injury to brand reputation and goodwill, implicated financial institutions could expect increased regulatory scrutiny and could compromise government contracts subject to FISMA.

[21]      Yet another frequently discussed liability is that of escalation: cybercrime is perpetrated by many different attacker profiles of persons and entities, including cyber-terrorists, cyber-spies, cyber-thieves, cyber-warriors, and cyber-hactivists.[103] Because the purported motivation of a cyber-hactivist is principle, retaliation by the corporate victim may be received as an invitation to return fire and escalate. Similarly, “[e]ncouraging corporations to compete with the Russian mafia or Chinese military hackers to see who can go further in violating the law . . . is not a contest American companies can win.”[104] Conversely, the motivation of a cyber-thief is principal and interest, so retaliation by the target might be taken as a suggestion to move on to an easier target. Because the perpetrators are usually anonymous, the corporate victim has no way to make a risk-based and proportional response premised upon the classification of the attacker as nation-state, thief, or hactivist.

[I]n cyberspace attribution is a little harder. On the playground you can see the person who hit you . . . well, almost always[,] . . . in cyberspace we can track IP addresses and TTPs from specific threat actors, which smart analysts and researchers tell us is a viable way to perform attribution. I agree with them, largely, but there’s a fault there. An IP address belonging to China SQL injecting your enterprise applications is hardly a smoking gun that Chinese APTs are after you. Attackers have been using others’ modus operandi to mask their identities for as long as spy games have been played. Attackers have been known to use compromised machines and proxies in hostile countries for as long as I can remember caring—to “bounce through” to attack you. Heck, many of the attacks that appear to be originating from nation-states that we suspect are hacking us may very well be coming from a hacker at the coffee house next door to your office, using multiple proxies to mask their true origin. This is just good OpSec, and attackers use this method all the time, let’s not kid ourselves.[105]

If, without conclusive attribution and intelligence, the corporate victim is unable to make a risk-based and proportional response, it may be reasonable to question whether retaliatory hacking is abandoning the risk-based approach to business problems exhorted by FFIEC,[106]PCI,[107]and the NIST Cybersecurity Framework?[108] “If we start using those sort of [cyber weapons], it doesn’t take much to turn them against us, and we are tremendously vulnerable,” said Howard Schmidt, a former White House cyber security coordinator.[109]

[22]      Then there is the often overlooked issue of professional ethics—not for the attorney—but for the information security professional.“Ethics,” a term derived from the ancient Greek ethikos (ἠθικός), has been defined as “a custom or usage.”[110] Modernly, ethics is understood to be “[professional] norms shared by a group on a basis of mutual and usually reciprocal recognition.”[111] The codes of ethics provide articulable principles against which one’s decision-making is objectively measured, and serve other important interests, including presenting an image of prestige and credibility for the organization and the profession,[112] eliminating unfair competition,[113] and fostering cooperation among professionals.[114]

[23]      Many information security professionals are certified by the International Information Systems Security Certification Consortium ((ISC)^2®). The (ISC)^2® Committee has recognized its responsibility to provide guidance for “resolving good versus good, and bad versus bad, dilemmas,” and “to encourage right behavior.”[115] The Committee also has the responsibility to discourage certain behaviors, such as raising unnecessary alarm, fear, uncertainty, or doubt; giving unwarranted comfort or reassurance; consenting to bad practice; attaching weak systems to the public network; professional association with non-professionals; professional recognition of, or association with, amateurs; or associating or appearing to associate with criminals or criminal behavior.[116] Therefore, an information security professional bound by this code who undertakes active defense activities that he or she knows or should know are unlawful, or proceeds where the legality of such behavior not clear, may be in violation the Code.

[24]      It would stand to reason that, an organization that empowers, directs, or acquiesces to conduct by its employees that violates the (ISC)Code of Ethics may violate its own corporate ethics or otherwise compromise its ethical standing in the corporate community—or not: when Google launched a “secret counter-offensive” and “managed to gain access to a computer in Taiwan that it suspected of being the source of the attacks,”[117] tech sources praised Google’s bold action.[118]

[25]      Nevertheless, corporate ethics is an indispensable consideration in the hack back debate. The code of ethics and business conduct for financial institutions should reflect and reinforce corporate values, including uncompromising integrity, respect, responsibility and good citizenship. As noted above, retaliatory hacking is deceptive and has been characterized as reckless, and even Web bugs are commonly associated with spammers. Corporate management must consider whether resorting to techniques pioneered by and associated with criminals or spammers has the potential to compromise brand image in the eyes of existing and prospective customers. Similarly, to the extent that financial corporations are engaging in active defense covertly,[119] corporate management must consider whether customers’ confidence in the security of their data and investments could be shaken when such activities are uncovered. Will customers wonder whether their data has been placed at risk because of escalation? Will shareholders question whether such practices are within the scope of good corporate stewardship?

III. Alternatives to Retaliatory Hacking

[26]      The obvious argument in support of active defense is that the law and governments are doing little to protect private corporations and persons from cybercrime, which has inexorably resulted in resort to self-help,[120] and those who vociferously counsel to refrain from active defense often have little advice on alternatives. At the risk of pointing out the obvious, one counsels, “‘when you look at active defense, we need to focus on reducing our vulnerabilities.’”[121]

[27]      Alternatives to hacking back are evolving, and one of the more promising is the pioneering threat intelligence gathering and sharing from the Financial Services Information Sharing and Analysis Center (“FS-ISAC”), which collects information about threats and vulnerabilities from its 4,400 FI members, government partners, and special relationships with Microsoft^®, iSIGHT Partners^SM, Secunia, et al., anonymizes the data, and distributes it back to members.[122] In addition to e-mail alerts and a Web portal, FS-ISAC holds regular tele-conferences during which vulnerability and threat information is discussed, and during which presentations on current topics are given.[123] The FS-ISAC recently launched a security automation project to eliminate manual processes to collect and distribute cyber threat information, according to Bill Nelson, the Center’s director.[124] The objective of the project is to significantly reduce operating costs and lower fraud losses for financial institutions, by consuming threat information on a real-time basis.[125]

[28]      Although, as American Banker wryly observes, “[b]ankers have never been too keen on sharing secrets with one another,”[126] dire circumstances have catalyzed a new era of cooperation, paving the way for the success of the cooperative model developed by the FS-ISAC—even before its current ambitious automation project, which has resulted in successful botnet takedown operations.[127] An illustrative example is the Citadel malware botnet takedown, where Microsoft’s Digital Crimes Unit, in collaboration with the FS-ISAC, the Federal Bureau of Investigation, the American Bankers Association, NACHA—The Electronic Payments Association, and others, executed a simultaneous operation to disrupt more than 1,400 Citadel botnets reportedly responsible for over half a billion dollars in losses worldwide.[128] With the assistance of U.S. Marshals, data and evidence, including servers, were seized from data hosting facilities in New Jersey and Pennsylvania, and was made possible by a court ordered civil seizure warrant from a U.S. federal court.[129] Microsoft also reported that it shared information about the botnets’ operations with international Computer Emergency Response Teams, which can deal with elements of the botnets outside U.S. jurisdiction, and the FBI informed enforcement agencies in those countries.[130] Similar, more recent, operations include one characterized as “major takedown of the Shylock Trojan botnet,” which botnet is described as “an advanced cybercriminal infrastructure attacking online banking systems around the world,” that reportedly was coordinated by the UK National Crime Agency (NCA), and included Europol, the FBI, BAE Systems Applied Intelligence, Dell SecureWorks, Kaspersky Lab and the UK’s GCHQ,[131] and another takedown operation that targeted the much-feared Cryptolocker.[132]   Following the FS-ISAC model, the retail sector has taken the “historic decision” to share data on cyber-threats for the first time through a newly-formed Retail Cyber Intelligence Sharing Center (R-CISC),[133] and the financial services and retail sectors formed a cross-partnership.[134]

[29]      Finally, at the time of this publication, a draft Cybersecurity Information-Sharing Act of 2014, advanced by Chairman Dianne Feinstein (D-CA) and ranking member Saxby Chambliss (R-GA), was passed out of the Senate Intelligence on a 12-3 vote, and is expected to be put to a vote in the full Senate.[135] The bill is designed to enhance and provide liability protections for information sharing between private corporate entities, between private corporate entities and the Government, and between Government agencies.

[30]      Yet another promising option is the partnership that critical infrastructure institutions have formed, or should investigate forming, with ISPs. For example, ISPs currently provide DDoS mitigation services that, although not particularly effective in application vulnerability (OSI model layer 7) attacks, are very capable in responding to volume-based attacks.[136] One senior ISP executive proposed to this author, under the Chatham House Rule,[137] the possibility that ISPs may be able to provide aggregated threat intelligence information, including attribution, based upon monitoring of the entirety of its networks (not merely the network traffic to and from an individual corporate client).

[31]      ISPs’ capabilities are, however, subject both to statutory and regulatory limitations, including, for example, the Cable Act,[138] and proposed rules that would restrict the blocking of “lawful content, applications, services, or non-harmful devices,” that may appear to implicate liability-incurring discretion.[139]

[32]      Nevertheless, several researchers urge that ISPs should assume a “larger security role,” and are in a good position “to cost-effectively prevent certain types of malicious cyber behavior, such as the operation of botnets on home users’ and small businesses’ computers.”[140] Likewise, the Federal Communications Commission has defined “legitimate network management” as including “ensuring network security and integrity” and managing traffic unwanted by end users:

In the context of broadband Internet access services, techniques to ensure network security and integrity are designed to protect the access network and the Internet against actions by malicious or compromised end systems. Examples include spam, botnets, and distributed denial of service attacks. Unwanted traffic includes worms, malware, and virus that exploit end-user system vulnerabilities; denial of service attacks; and spam.[141]

N.B., a 2010 study found that just ten ISPs accounted for 30 percent of IP addresses sending out spam worldwide.[142] And, in 2011, it was reported that over 80% of infected machines were located within networks of ISPs, and that fifty ISPs control about 50% of all botnet infected machines worldwide.[143]

[33]      Other options that some companies have pursued as alternatives to the pitfalls of inherently risky threat counter-intelligence gathering discussed above include risk transfer or automated monitoring, both of which rely on outside vendors or subscription services.

[34]      Under the risk transfer approach, a corporate entity may choose to rely on the findings of a private contractor or company without undue concern for how the contractor or firm acquired the information. U.S. companies already outsource threat intelligence gathering to firms who employ operatives in Israel, such as IBM-Trusteer and RSA,[144] ostensibly because these operatives are able to effectively obtain information without running afoul of U.S. law. For legal scholars, perhaps a case to help justify this approach might be that of the famous Pentagon Papers (New York Times v. United States), in which the Supreme Court held that the public’s right to know was superior to the Government’s need to maintain secrecy of the information, notwithstanding that the leaked documents were obtained unlawfully (i.e.,in alleged violation of § 793 of the Espionage Act).[145] Yet, a corporate entity that knowingly—or with blissful ignorance—retains the services resulting from unethical conduct or conduct that would be criminal if undertaken in the U.S. may nevertheless suffer injury to the brand resulting from revelations of the vendor’s actions.

[35]      Under the automated monitoring approach, corporate entities rely on vendor subscription services, such as Internet Identity (IID™), that use automated software to monitor various fora or social media sites for the occurrence of keywords, concepts, or sentiment, and then alert the customer. Variations of these technologies are in use for high frequency stock trading and e-Discovery. An example might be detecting the offering for sale on a site of primary account numbers and related information by a cyberthief, and providing real-time notification to the merchant so that the accounts can be disabled.

[36]      Other promising options include “big data” approach, which is to employ data scientists and software and hardware automation in-house to draw more meaningful inferences from the data and evidence already legally within the company’s custody and control. For example, David Bianco, a “network hunter” for security firm FireEye, suggests allocating resources for detecting, evaluating, and treating threat indicators according to their value to the attacker, which he represents in his so-called “Pyramid of Pain.”[146] Under this model, remediation efforts are directed toward those indicators that are costly (in time or resources) to the attacker, requiring the attacker to change strategy or incur more costs.[147] Bianco proposed this model after concluding that organizations seem to blindly collect and aggregate indicators, without making the best use of them.[148] Vendors, such as Guardian Analytics,[149] FireEye’s Threat Analytics Program,[150] CrowdStrike’s Falcon platform,[151] and HP’s Autonomy IDOL[152] (intelligent data operating layer) are endeavoring to bring real-time threat intelligence parsing or information sharing tools and services to the marketplace

 

III. Conclusion

[37]      Hack back or active defense, depending on how one defines each—and everything in between—consists of activities that are both lawful and unlawful, and which carry all the business and professional risks associated with deceptive practices, misattribution, and escalation. To urge a risk-based approach to using even lawful active defense tactics would be to state the obvious, and the use of certain types of active defense where misattribution is possible, may be to entirely abandon the risk-based approach to problem solving. Moreover, at the time of this writing, a qualified privilege to hack back through legislative reform seems unlikely, and would be difficult because the holder of such a privilege would not only have to establish proper intent, but also attribution. However, the tools, technologies, partnerships, and information sharing between corporations, governments, vendors, and trade associations are promising; they have already proven effective, and are steadily improving.

 

---

 

* The author is a cyber-security policy analyst in the banking industry and a digital forensics examiner in private practice. Mr. Harrington is a graduate with honors from Taft Law School, and holds the CCFP, MCSE, CISSP, CHFI, and CSOXP certifications. He has served on the board of the Minnesota Chapter of the High Technology Crime Investigation Association, is a current member of Infragard, the Financial Services Roundtable’s legislative and regulatory working groups, FS-ISAC, the U.S. Chamber of Commerce “Cyber Working Group,” the Fourth District Ethics Committee in Minnesota, and is a council member of the Minnesota State Bar Association’s Computer & Technology Law Section. Mr. Harrington teaches computer forensics for Century College in Minnesota, and recently contributed a chapter on the Code of Ethics for the forthcoming Official (ISC)²® Guide to the Cyber Forensics Certified Professional CBK®. He is also an instructor for the CCFP certification.

 

DownloadPDF

Cite as: Kristin Bergman, Cyborgs in the Courtroom: The Use of Google Glass Recordings in Litigation, 20 Rich. J.L. & Tech. 11 (2014), http://jolt.richmond.edu/v20i3/article11.pdf.

Kristin Bergman*

I.  Introduction 

[1]        The future is now.  Wearable computers such as Google Glass (Glass) have begun entering society—we see people wearing these devices on the streets, in classrooms, at parties, and elsewhere.  Though most of these devices are not yet available to the public at large, there has been much hype over the impact Glass will have on our interactions, privacy, safety, and more.  Although this Article will briefly address such controversial aspects, it will focus more narrowly on the potential utility of Glass in litigation.

[2]        Despite the fear that Glass will somehow destroy the world, Glass, and its counterparts, could revolutionize litigation for the better.  Google Glass is a wearable computer device featuring an optical head-mounted display.[1]  These glasses allow wearers to make phone calls, record videos, and run Google searches, in addition to other tasks, through voice commands and a small touchpad.[2]  First-person point of view recordings taken by Glass will provide valuable evidence to supplement witness testimony by placing the trier of fact—whether judge or jury—in the witness’ shoes.[3]  These recordings can help resolve problems of witness credibility, including bias and memory issues, and will provide more useful evidence than recordings from devices like traditional cameras and cell phones.

[3]        This Article will begin by exploring the evolution and features of Glass and other wearable computers.  It will then speak to the particular utility of Glass recordings with focus on the inconspicuousness, accessibility, and first-person perspective, additionally describing prospective uses for Glass’s recording feature.  This Article will proceed to address how these Glass recordings may be used in litigation and the potential legal obstacles to admitting these recordings as evidence in court.  It will conclude by briefly recognizing how Glass could have been influential in prior cases.

 

II.  Background

A.  An Introduction to Google Glass

[4]        Developing out of Google[x]’s Project Glass,[4] Google Glass is a wearable computer device featuring an optical head-mounted display.[5]  The glasses are lens-free with a rectangular display sitting directly above one’s right eye, next to an embedded camera, with a touchpad and microphone on the right arm of the frame.[6]  The latest version is compatible with prescription eyeglasses or sunglasses, and includes a removable ear-bud.[7]  These augmented reality[8] glasses will allow wearers to send messages, take photos and record videos, run Google searches and translations, look up directions and the weather forecast, and more—all with simple voice commands or a light finger tap or swipe.[9]  According to Google Co-founder Sergey Brin in a TEDTalk[10] in early 2013, Project Glass was motivated by an interest in improving the connections between people, freeing one’s eyes and hands to reduce social isolation.[11]  In this way, Glass is meant to minimize the moments individuals miss by virtue of having their heads down and hands occupied by cell phones, cameras, and other devices.[12]  Glass is meant to, instead, overlap digital information and reality.  Babak Parviz, one of the creators of Google Glass, expanded on this concept, emphasizing the importance of rapid access to information and expressing a hope that Glass would be “‘the major next thing in computing and communication.’”[13]

[5]        Google Glass was initially introduced to the public through a limited release called the Explorer Program.[14]  In February 2013, Google accepted applications for the Explorer Program, in which those interested in testing out Glass submitted a short statement of what they would do if they had the device.[15]  Those selected to participate—roughly 8,000 individuals—were invited to purchase Glass for $1,500.[16]  Since this initial round of production, in October 2013 Google expanded its consumer base by allowing all Explorers to invite three friends to join the Explorer Program, essentially quadrupling the size of the Program.[17] It also held a single-day public sale of Glass in mid-April 2014.[18]

B.  The “Tech” Behind Google Glass

[6]       To best contemplate the utility of Google Glass it is important to have a sense of its capabilities and reliability, and, accordingly, this Article will address some of Glass’s relevant specifications and known security vulnerabilities.[19]  Glass can function without being connected to a network, but many of its features are only supported when connected to a cell phone or home network via Wi-Fi and/or Bluetooth.[20]  The device can store up to twelve gigabytes of information.[21]  In terms of images and video, Glass has a 5MP (five megapixel) camera situated right above the right side of the user’s right eye that can film video up to 720p (high definition).[22]  By default, videos will record for ten seconds, but this duration can be extended for as long as the user would like.[23]  After recording videos and other media, users can upload and share instantly over Google+ or YouTube, as well as manually transfer the media through the Micro-USB port.[24]

[7]        Despite its limited availability, some vulnerabilities have already been discovered.  For example, during the summer of 2013 a security company discovered a threat to Glass from the malicious use of Quick Response (“QR”)[25] codes.[26]  As Glass had been set to automatically execute QR codes when the camera feature was in use, a QR code could force the device to connect to a designated Bluetooth device or Wi-Fi network, or to view a particular website.[27]  In addition, as with computers, it may be possible for third parties to “root” a device—obtaining total control over the device’s system—to plant code or spy on the stored data.[28]  This said, at this time photos and videos cannot be substantively altered from the device itself (aside from deleting), though once uploaded to the cloud or a computer hard drive these materials function no differently than other digital media.[29]  All things considered, Glass is a relatively secure device that produces decent quality recordings.[30]

C.  Counterparts to Google Glass

[8]        Although this Article will focus on Google Glass, it is important to recognize that Glass is not the only wearable computer that may appear in the market over the coming years.  Unsurprisingly, Google’s primary competitors in this market will likely be Apple, Samsung, and Microsoft.  As of May 2014, Microsoft was reportedly testing prototypes for eyewear similar to Glass,[31] and Samsung has applied for two patents in Korea for an electronic type of sports glasses with integrated earphones and the “Earphone,” an ear-mounted computing device strinkingly similar to Glass.[32]  Apple holds a patent for “peripheral treatment for head-mounted displays,” but has not made any announcements regarding its particular device.[33]  Google even faces competition overseas from French startup Optinvent, whose digital eyewear platform, ORA-1, is already available for pre-order.[34]  Other devices may also operate similarly to Glass, but have a specialty purpose such as athletic performance or business use.[35]  The exact specifications for most of these devices have not yet been revealed, so it is difficult to project precisely how similar they will be to Glass.  Nevertheless, all appear to include some point of view recording feature on a hands-free device, such that the arguments and projections made in this Article should be applicable to all.

 D.  Popularity of Glass

[9]        There has been much speculation over the prospective popularity of Glass, and whether the mass interest in the device that continues to build online will translate into Glass sales and use.  Some suggest that it may more or less disappear from popular culture within a decade.[36]  Apple CEO Tim Cook is among these skeptics, believing that consumers want wearable devices to be light, unobtrusive, and fashionable, and that Google Glass may be targeting the wrong part of the body.[37]  This is supported by a survey conducted by Bite Interactive suggesting that only ten percent (10%) of Americans would definitely purchase and wear Glass.[38]  Alternatively, Robert S. Peck, a financial analyst of SunTrust Robinson Humphrey, projected that the business would be worth over three billion dollars a year by 2017.[39]  In a similar vein, Google Glass was ranked as the United Kingdom’s most anticipated gadget of 2014 in a survey conducted by the Gadget Show.[40]  Which side of this debate will prevail is impossible to predict, though there appears to be more support for the proposition that Glass will catch on and have a significant impact on society, particularly if the price falls in a reasonable range, potentially comparable to that of a tablet.[41]  We will have to until late 2014 for an answer, once Glass is actually released into the market for the general public.[42]

 

III.  The Utility of Glass Recordings

[10]      Over the last several decades, the inherent weaknesses of witness credibility have come to increasing light.  Google Glass recordings, if used to supplement eyewitness testimony, could help to resolve many of these intrinsic concerns about memory and bias that undermine the reliability of witness testimony.  Though other video recordings may do the same, the design and function of Glass makes this device uniquely situated with respect to other videos—namely its first person perspective, inconspicuousness, and accessibility.

A.  Witness Credibility

[11]      Though we now point to scientific studies for such a proposition, recognition of the faultiness and limitations of witness testimony was pervasive in court decisions that predated such studies.  Many people, even judges, can simply invoke common sense, intuition, and hindsight to acknowledge that eyewitness accounts are not—and cannot be—perfect.  This is point has been enunciated in statements made by Supreme Court justices.  To offer just a sample:

“The vagaries of eyewitness identification are well-known; the annals of criminal law are rife with instances of mistaken identification.”[43]

“The crux of the Wade decisions, however, was the unusual threat to the truth-seeking process posed by the frequent untrustworthiness of eyewitness identification testimony.  This, combined with the fact that juries unfortunately are often unduly receptive to such evidence, is the fundamental fact of judicial experience ignored by the Court today.”[44]

“What is the worth of identification testimony even when uncontradicted?  The identification of strangers is proverbially untrustworthy.  The hazards of such testimony are established by a formidable number of instances in the records of English and American trials.  These instances are recent-not due to the brutalities of ancient criminal procedure.”[45]

[12]      The limitations of eyewitness testimony, as recognized by these justices and many others, primarily fall into two categories: (1) the natural fallibility of an individual’s perception and memory; and (2) the mind’s vulnerability with respect to suggestive influences.[46]  This is particularly clear when considering the work of psychologist Elizabeth Loftus.[47]  She has studied the human mind, noting how one’s memory functions from perception through reconstruction:

Early on . . . the observer must decide to which aspects of the visual stimulus he should attend.  Our visual environment typically contains a vast amount of information, and the proportion of information that is actually perceived is very small. . . . Once the information associated with an event has been encoded or stored in memory, some of it may remain there unchanged while some may not.  Many things can happen to a witness during this crucial retention stage.[48]

 In this way, Loftus recognizes some prominent weaknesses in a witness’ memory which would affect the strength of his testimony, supported by countless other empirical studies:[49] (1) an observer cannot possibly take in all of the information available in a scene; and (2) an observer’s memory may shift over time, including what may naturally be forgotten and what may be reconstructed from suggestive procedures.[50]

[13]      Such reliability problems can be significant, particularly given the great deal of weight juries place on witness testimony.  Recent studies have shown that mistaken witness identification was involved in over seventy-five percent (75%) of some hundreds of exonerations (based on DNA testing after a conviction).[51]  Although the use of Glass cannot resolve all of these problems in every case that comes before a court, increased availability and pervasive use of Glass will produce recordings by witnesses that will address these memory limitations.  Glass recordings will be able to corroborate an individual’s testimony, and the availability of such a recording—which can presumably be accessed and viewed at any time—may eliminate a witness’ susceptibility to other suggestive influences.

B.  Distinctiveness of Google Glass

[14]      In addition to the corroborative value of the unbiased recordings, Glass, as a device and for the recordings it produces, is distinctively useful.  Certainly, cameras, cell phones, and tablets are mobile and can record videos.  However, Glass features unique qualities that will produce superior evidence to these other electronics—Glass has a point-of-view camera on a headset and is a relatively inconspicuous and accessible device.[52]

[15]      First, Glass’s camera is fixed on the right side of the glasses, just above the wearer’s right eye.  This allows for simple mobility and a first person perspective.  As technology journalist Kashmir Hill noted when considering the possible use of Glass in capturing the traffic signals in a felony vehicular manslaughter case: “Despite the fact that there seem to be surveillance cameras everywhere, they often seem not to capture all that we wish they would.  But humans wearing cameras would have an advantage over surveillance cameras: the innate ability to turn their heads to look at something important or interesting.”[53]  As these cameras are effectively headgear, they are as mobile as any witness and more stable than a cell phone.[54]  They can capture any incident on film as quickly as the wearer can adjust his head, unlike stable, pre-programmed surveillance cameras.  In addition, the footage allows viewers later on to literally see the witness’ point of view.  Such a first-person point of view will place the jury—or judge—in the witness’ shoes, seeing as much as the witness did.  These jury members may notice things the witness never did, or things he has since forgotten.  They will experience the scene for themselves, allowing them to rely less on oral testimony, which may be biased, altered, or incomplete.  As such, Glass recordings will be more helpful, reliable, and satisfying than witness testimony or other recordings.[55]

[16]      Second, Glass is more accessible than other electronic devices that may record video.  As mentioned above, the camera is built into a headset.  In this manner, it is already out and available for immediate use.  In addition, it can start recording nearly instantaneously; a voice command of, “Ok glass, record a video” will start the recording process.[56]  This ready placement and voice activation means that recording can start in a matter of seconds, providing almost instant footage depending on the wearer’s reaction time.[57]  Even someone with a cell phone or camera relatively available in his or her pocket or purse cannot begin to record video with such speed.  In addition to how quickly recording can begin, Glass is uniquely accessible because it is hands-free.  Indeed, this is one of the selling points for Glass—you can “[r]ecord what you see. Hands free.”[58]  Their promotional video and website suggest how useful this can be when engaging in sports, dancing, playing instruments, and doing construction.[59]  The key is that Glass frees up the wearer’s hands for other uses.  As the Glass wearer may be in the center of the action or even just moving quickly, it may simply be challenging to hold and use a phone or camera.  Furthermore, Glass will encourage people to record a video in situations during which they may otherwise have felt unsafe or uncomfortable to do so, because they will still have full mobility.[60]

[17]      Lastly, the recording feature on Google Glass is relatively inconspicuous.  Though wearing Glass will likely catch the eye, the difference between when Glass is off and when Glass is on and recording is fairly subtle.  Though there are some rumors of an infrared light, in its current edition, there are two main ways for someone to tell if Glass is recording: (1) the small screen is illuminated when it is in use, such as when the user is taking a picture or recording a video, though it does not distinguish such activity from simply looking up directions or running a Google search; and (2) users have to either speak a command or press the touch pad on the side of the frame in order to record a video.[61]  Particularly when Glass first enters the market, it seems unlikely that the general public will be attuned to these fine details.  In addition, depending on lighting, it may be difficult to tell if the screen is illuminated, and it is fairly simple to pass off a tap of the touchpad as scratching one’s head or tucking some hair beyond your ear.  In these ways, someone wearing Glass could simply record a scene without the immediate awareness of those present.  In this way, using Glass as a recording device is less likely to draw attention than using a camera, or even a cell phone.  Chris Barrett, a filmmaker and Explorer who captured the first arrest on Glass, has already experienced this.[62]  At the Jersey Shore to watch a fireworks show, he was able to record a fight that broke out, through to the eventual arrest of the participants.[63]  Barrett acknowledged the crucial role Glass—as opposed to a cell phone—played in recording this break out, saying, “I think if I had a bigger camera there, the kid would probably have punched me. . . . But I was able to capture the action with Glass and I didn’t have to hold up a cell phone and press record.”[64]  This precise inconspicuousness will lead to more recordings, which—privacy concerns aside—will provide evidence that has previously been unobtainable.

C.  Prospective Uses

[18]      The uses for Google Glass in general are endless, and countless of these uses may involve activity that will be the subject of litigation.  The most predictable scenarios involve physical activities that may [at least appear to] occur more or less spontaneously—rioting, fights, trespass, robberies, and even sexual violence.  In fact, Glass has already been used to capture an instance of domestic violence.[65]  Glass recordings may also be especially useful in handling traffic violations; using Glass allows for immediate coverage of traffic accidents—from those involved and onlookers alike—speedy documentation of license plates during hit-and-runs, and more.  Glass could also be used by responders in documentation of an emergency; for example, as one fire chief who is part of the Explorer program noted with respect to using Glass while responding to a fire, “[p]hoto evidence is more reliable” than relying on memory or digging through ashes.[66]  On the other side, any individual may use Glass to record officers and other government officials who respond to emergencies and crimes, essentially monitoring their conduct—particularly police searches and arrests.[67]  Glass has already made its way into operating rooms, and the recordings taken by the attending surgeon would surely be invaluable in medical malpractice cases.[68]  It is even foreseeable that the increased production of family “home” videos, which one of Google’s founders expressed delight in,[69] could be later used as evidence in custody battles.

 

IV.  Using Glass Recordings in Litigation

[19]      In addition to addressing the utility of Glass recordings in litigation, it is important to recognize any hurdles that may complicate or obstruct the introduction of these recordings as evidence in a trial or hearing.  Overall, it is unlikely that any federal evidentiary rules or their state equivalents will prevent the admission of Glass photos or recordings into evidence during litigation.[70]  Some rules may ultimately serve as obstacles to admission, though these rules would not be unique to records produced by Glass or other wearable computers.  In addition, individual state recording laws may limit the introduction of some Glass-produced videos, and efforts to address privacy concerns surrounding Glass may prevent the production of these videos for litigation in the first place.

A.  Introduction of Glass Recordings as Evidence

[20]      The introduction of a Glass recording as evidence would be simple—much like the introduction of another video during trial.  Having prepared the video as any other exhibit, during the testimony of the relevant witness an attorney need only play the video recording—at an appropriate time during the questioning—have the witness authenticate the video clip by acknowledging its accuracy, and then offer the video into evidence.

[21]      At a demonstration trial at the Court Technology Conference 2013 in Baltimore, Maryland, the Center for Legal and Court Technology (CLCT) contemplated this use, through a Glass-like wearable recording device that is based on the shoulder rather than the face.[71]  In this personal injury case, the two parties were pulled over on the side of the road, and as the defendant exited her vehicle, she turned on the device and began recording the altercation that would later become the subject of litigation.[72]  As the CLCT’s script contemplated, the relevant portion of the direct examination and introduction of evidence may proceed as follows:

Q:        Did you have occasion to record that attack?

A:        Yes

Q:        How and why?

A:        I work for a company, Miracle Vision, that is making a personal video communicator a bit like Google Glass.  I was wearing a unit on my right shoulder, and I turned it on when I got out of my car.  I knew that I should make a record of what happened.

Q:        And did you record it?

A:        Yes, but it failed after a few seconds.  I think that I hadn’t kept it fully charged.

Counsel, with judge’s permission, plays Defense Exhibit A.

Q:        Was that an accurate recording?

A:        Yes.

Counsel offers Exhibit A into evidence.[73]

The video clip depicted the plaintiff exiting her own vehicle and approaching the defendant while raising a baseball bat—valuable evidence to support the defendant’s claim of self-defense.  With no other evidence other than oral testimony to indicate who initiated the fight, the video recording in this “he said, she said” scenario—as presented in much litigation—becomes a central piece of evidence in an unclear case.  Glass recordings will be able to provide this same insight and clarity.

B.  Evidentiary Hurdles

1.  ESI and Existing Evidence Rules

[22]      As Glass recordings are stored in the cloud, they will likely be treated as electronically stored information (ESI) and after meeting basic evidentiary requirements would be admissible.[74]  There are surprisingly few decisions dealing with the admissibility of ESI, but of those that exist, Judge Grimm’s opinion in Lorraine v. Markel American Insurance Co.[75] before the United States District Court for the District of Maryland best articulates the relevant rules for evaluating ESI.[76]  Noting that whether ESI is admissible involves a series of inquiries, Judge Grimm set forth:

Whenever ESI is offered as evidence, either at trial or in summary judgment, the following evidence rules must be considered: (1) is the ESI relevant as determined by Rule 401 (does it have any tendency to make some fact that is of consequence to the litigation more or less probable than it otherwise would be); (2) if relevant under 401, is it authentic as required by Rule 901(a) (can the proponent show that the ESI is what it purports to be); (3) if the ESI is offered for its substantive truth, is it hearsay as defined by Rule 801, and if so, is it covered by an applicable exception (Rules 803, 804 and 807); (4) is the form of the ESI that is being offered as evidence an original or duplicate under the original writing rule, of [sic] if not, is there admissible secondary evidence to prove the content of the ESI (Rules 1001-1008); and (5) is the probative value of the ESI substantially outweighed by the danger of unfair prejudice or one of the other factors identified by Rule 403, such that it should be excluded despite its relevance.[77]

 Most of these rules would not be any more challenging to satisfy using recordings from Glass as opposed to other evidentiary materials.  As such, relevance under Rule 401[78] and probative value versus prejudicial risk under Rule 403[79] will not be addressed by this Article.

[23]      With respect to authenticity, Glass recordings seem like a hybrid.  Because of the way Glass functions with automatic uploading, these recordings may be viewed as a more traditional video recording or more like electronic information.  Under Rule 901(a), “[t]o satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.”[80]  Rule 901(b) goes on to give examples of evidence that satisfies this 901(a) requirement.[81]  As ESI, it may be possible that the metadata automatically attached to the Glass recordings would be sufficient to prove its authenticity, though it may be necessary to secure testimony from a witness with knowledge— presumably the wearer—to secure this.[82]  The easiest way for the party introducing the Glass recording to satisfy Rule 901 is to produce a witness with knowledge—one who recognizes the scene (and sound) depicted by the Glass recording—to attest that the recording is what it is claimed to be.[83]  Based on the fact that Glass is a head-mounted device, it is likely that this will be easy to arrange as the creator of the video would also be an eye witness, probably already solicited to testify.

[24]      Glass recordings would also need to satisfy the original writing requirement, more commonly referred to as the “best evidence” rule.  Rule 1002 states that “[a]n original writing, recording, or photograph is required in order to prove its content unless these rules or a federal statute provides otherwise.”[84]  With recordings automatically synched with Google cloud storage, it may be difficult to determine what is “original” in the colloquial sense.  In all likelihood the initial data or “original” is the recording existing on the Glass device itself, which is effectively useless in that form it cannot be viewed by anyone other than the wearer.  Fortunately, the Federal Rules of Evidence take a broader approach, defining original as “the writing or recording itself or any counterpart intended to have the same effect by the person who executed or issued it.  For electronically stored information, ‘original’ means any printout—or other output readable by sight—if it accurately reflects the information,” including the negative.[85]  As this Rule is primarily concerned with the alteration of evidence, the copy of the recording that is automatically uploaded to the cloud would be considered such a “counterpart.”  If courts are unwilling to consider this more accessible video recording as an original, it should qualify as a duplicate.[86]  Pursuant to Rule 1003, “A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate.”[87]  As an identical copy of the recording is uploaded with no opportunity for alteration, it would certainly reflect the original recording accurately, and there is nothing about the Glass synching process that would invite skepticism.

2.  The Inadequacy of Existing Hearsay Rules

[25]      Though some of the recordings taken by Google Glass will present no hearsay problems, there will inevitably be recordings captured by Glass with that are highly probative yet may amount to inadmissible hearsay.  Though these recordings, like cell phone recordings, may fit into any number of the twenty-plus hearsay exceptions provided for in the Federal Rules of Evidence, this piecemeal application instead highlights a need for a hearsay rule that better accommodates digital photos and videos captured by mobile and wearable recording devices.

[26]      Hearsay means “a statement that: (1) the declarant does not make while testifying at the current trial or hearing; and (2) a party offers in evidence to prove the truth of the matter asserted in the statement.”[88]  In other words, hearsay is an out-of-court statement offered to prove the truth of the matter asserted in the statement, and it is inadmissible in court.[89]  As a preliminary matter, then, there must be a statement made by a person.  Many photos and recordings taken by Glass will not meet these preliminary requirements, and as non-hearsay they will not be susceptible to exclusion under Rules 801 and 802.  Furthermore, they may be admissible as a declarant-witness’ prior statement, an opposing party’s statement, a present sense impression, a record of regularly conducted activity, or under one of the other numerous hearsay exceptions.[90]  However, not every recording will be covered by these exceptions, and therefore this otherwise valuable evidence may be excluded.

[27]      Hearsay rules are based on a concern over reliability.[91]  Law Professor Laurence Tribe noted that out-of-court statements are considered suspect because of “the four testimonial infirmities of ambiguity, insincerity, faulty perception, and erroneous memory.”[92]  Importantly, we are concerned with the in-court witness’ inability to and potential disinterest in providing a faithful account of the out-of-court statement.  Admission of Glass recordings, however, is likely to be faithful to this purpose, encouraging truth-seeking.  Glass recordings greatly reduce issues of ambiguity, insecurity, perception, and memory.[93]  The statements are preserved in these recordings, capturing them accurately and including context as well inflection, mannerisms, and other indicators of sincerity and meaning.[94]  In this way, the exclusion of Google Glass recordings under the existing hearsay rules may be illogical, or at least inconsistent with hearsay’s goal.

[28]      Law Professor Jeffrey Bellin’s proposal for an eHearsay (also called an eSRP) rule captures the need for hearsay rules to adjust to a world in which more social interactions and communications are recorded digitally, which will only increase as wearable technology becomes increasingly ubiquitous.[95]  In particular, he proposes to add another hearsay exception, stating that the following type of statements are not excluded as hearsay where a declarant is not available as a witness:

 

Recorded Statement of Recent Perception.  A recorded communication that describes or explains an event or condition recently perceived by the declarant, but not including: (A) a statement made in contemplation of litigation, or to a person who is investigating, litigating, or settling a potential or existing claim; or (B) an anonymous statement.[96]

With respect to a “recorded conversation,” Bellin proceeds to clarify that “[a]nything memorialized by mechanical or electronic means as the speaker communicates counts as ‘recorded’ for purposes of the eSRP exception.”[97]  On its face, Glass recordings would appear to fit—they electronically memorialize communications.  However, as the article focuses on textual digital statements rather than statements recorded in an audiovisual form, it is not entirely clear whether this exception as proposed would extend to Glass recordings.  Considering the increased prevalence of audiovisual recordings—from short Vine video clips to extended Glass recordings—it should.  Such an inclusive eHearsay rule would go a long way in addressing the reliability of Glass recordings.

C.  Relevance of State Recording Laws

[29]      Beyond these evidentiary rules, other considerations may affect the introduction of these recordings as evidence, including the legality of the acquisition of the recording.  For example, state recording laws will play a role in the recordings captured by Google Glass.  As of May 2014, eleven states are two-party consent states, which means that all parties to a communication must consent to being recorded, while the remainder are one-party consent states in which the consent of a single party to the conversation is generally sufficient to make recording lawful.[98]

[30]      It is certainly foreseeable that some recordings captured by Glass will violate these recording laws—though many will not be illegally obtained.  If an individual’s recording violates one of these laws, however, it can often still be admitted as evidence (though to some degree this may be a question of the judge’s discretion when considering relevance and prejudice under Rule 403).[99]  More likely, a state may have a law on point involving the admission of recordings taken without the parties’ knowledge.  This varies by state, but both one- and two- party consent states have codified provisions limiting the use of recordings of conversations as evidence.[100]

[31]      In terms of particular subject matter, individuals may proceed, with caution, when using Glass to record officers.  Though the issue will not be addressed in depth here, it is likely that Glass will be used to record officers.[101]  It is important to note that four federal circuits have recognized a First Amendment right to record police officers performing their duties, though this right is typically qualified as an individual cannot interfere with the officer’s performance of their duties or violate generally applicable laws.[102]  Overall, though not the most prominent issue, the lawfulness of these Glass recordings cannot be ignored when considering the ability to admit—and the frequency of admitting—these recordings as evidence in litigation proceedings.

D.  Legal Concerns Involving Availability

[32]      As with much technological innovation when first introduced, Glass and other wearable computers are subject to criticism and concern.  Most of the concerns that have arisen to date relate to privacy and safety, and how they are addressed may affect the availability and prevalence of Glass recordings.

[33]      Those privacy concerns raised relate to both traditional vertical notions of privacy, from the government and corporate bodies, as well as a more horizontal notion of privacy from one’s peers.[103]  These anxieties center around the great amount of conduct that may be preserved in photos or film, often without the knowledge of the actors, as well as the government’s and Google’s access to these materials.  Three primary general concerns have been raised.  First, because the recording feature on Glass is rather inconspicuous, this may threaten an individual’s ability to have anonymous interactions, not to mention the unauthorized recording considerations.[104]  Second, without legislation to secure safeguards, it may be possible for government agents to access the Glass data without being held accountable for this privacy invasion.[105]  Lastly, because this data is stored on Google’s cloud servers, Google has complete access to much personal data.[106]  Many others have expressed a fear that Glass will employ a facial recognition feature, but Google has firmly renounced such an attribute.[107]  Congress[108] and authorities from several nations around the globe[109] have expressed their concerns to Google, but legislation addressing these fears has been minimal.  More action has been taken locally, where businesses have banned customers from wearing Glass on their premises, including banks, bars, casinos, and more, primarily based on privacy, safety, and security grounds.[110]

[34]      Legislatures have been less hesitant to respond to the debate over the use of Glass while driving, concerned that Glass poses the same safety hazards as cell phones.[111]  New Jersey, New York, and West Virginia—and even the United Kingdom—have all proposed legislation banning the use of wearable computers, such as Glass, by drivers.[112]  With the first reported traffic violation for wearing Glass while driving in California in late October, 2013,[113] it appears likely that more states will move towards proposing similar statutes.[114]

V.  Conclusion

We can expect an onslaught of new wearable computer product devices such as Google Glass and others that are still only rumors, including eyeglass-mounted computer systems, head-mounted computers, Apple’s iWatch, and other smartwatch devices.[115]

—Judge Herbert B. Dixon Jr.,

Superior Court of the District of Columbia

[35]      Wearable computing is not going away—whether it takes the form of Google Glass or other head-mounted gear, smartwatches, or other devices we cannot yet imagine.  Technology will keep developing, so rather than solely fearing these changes, the legal system and its participants should acknowledge their potential utility.  Glass, as it becomes more available to the public, will expand the base of what individuals choose to and are able to record.  Even more than cell phones, Glass and its counterparts will enable photos and videos to be taken that could serve as invaluable evidence in many hearings and trials.

[36]      This past summer, one blogger posited this question—what would have happened if Trayvon Martin was wearing Google Glasses?[116]  Though most responders recognized that it was unlikely that the expensive technology would have been available to Martin himself,[117] it becomes more believable that George Zimmerman, or a potential onlooker in a similar situation, could have been wearing a pair.  “If one of them said, ‘Ok, Glass, record a video’ at the start, the jury would have had irrefutable evidence of what happened – the key piece missing from the Zimmerman trial.”[118]  This may not be conceivable yet, but it is not difficult to imagine similar circumstances in the future wherein a Glass recording would be as influential in litigation and the pursuit of justice.[119]  In the meanwhile, let us embrace this new technology, learn  its features, capabilities, and limitations, thoughtfully consider  privacy implications, and work with attorneys, judges, and technologists, to make its transition into the courtroom a smooth one.

---

 

DownloadPDF

 Cite as: Joseph P. Smith III, The Tangled Web: A Case Against New Generic Top-Level Domains, 20 Rich. J.L. & Tech. 10 (2014), http://jolt.richmond.edu/v20i3/article10.pdf.

 

Joseph P. Smith III*

“If we had a reliable way to label our toys good and bad, it would be easy to regulate technology wisely.  But we can rarely see far enough ahead to know which road leads to damnation.”[1]

I.  Introduction

[1]        Is the “dot-com” era over as we know it?  On June 13, 2012, the Internet Corporation for Assigned Names and Numbers (“ICANN”) revealed the list of applied-for new generic top-level domains.[2]  Top-level domains are the words at the end of a website’s address, such as <.com>.  ICANN is a non-profit organization responsible for managing the Internet’s system of unique identifiers, including domain names.[3]  ICANN describes itself as the definer of “policies for how the ‘names and numbers’ of the Internet should run.”[4]  It is structured on a multi-stakeholder model including “registries, registrars, Internet Service Providers (ISPs), intellectual property advocates, commercial and business interests, non-commercial and non-profit interests, representation from more than 100 governments, and a global array of individual Internet users.”[5]  ICANN contracts with generic top-level domain registries and registrars to manage the Internet’s domains.[6]  Each registrar is required to enter into a register accreditation agreement with ICANN, which gives registrars the ability to register new domains.[7]

[2]        The list of new generic top-level domains is staggering—ICANN received nearly 2000 applications for the new domains by March 2012.[8]  With the expansion of generic top-level domains, domain registrars and large corporations like Google and Apple jumped at the opportunity to own a piece of the expanding Internet.[9]  Currently, only a few generic top-level domains are used by the masses—<.com>, <.org>, <.gov> for example.  However, new generic top-level domains add nearly limitless terms, including <.app>, <.music>, and <.esq>.  The amount of applicants paying the $185,000 application fee suggests that companies are confident that an Internet expansion will be successful.  To date, ICANN has delegated over 250 new generic top-level domains.  But debate continues as to the value and dangers of massively broadening the available generic top-level domain names available.

[3]        ICANN touts many benefits of the new generic top-level domains, while ignoring the many consequences that outweigh these benefits.  These benefits include greater trademark protection for brands, a more competitive online market, and the ability for niche online markets to flourish.  However, those benefits look less appealing when weighed against the negatives, including conflicts with principles of trademark law, increased difficulty for the Federal Trade Commission in prosecuting online fraud, necessity concerns, and ethical issues between ICANN and new generic top-level domain applicants.

[4]        This article’s purpose is to provide a general understanding of the legal and financial implications of the new generic top-level domains.  By looking at the history and functionality of generic top-level domains, the reader will hopefully have the requisite background to understand the implications of adding new top-level domains.  The article discusses the following topics.

[5]        Section III of this article examines the positive and negative implications of introducing new generic top-level domains.  This section discusses ICANN’s stated policy goals in introducing new generic top-level domains, it addresses the potential benefits of introducing new top-level domains based on economic and trademark rationales, and it analyzes the negative implications of introducing new generic top-level domains and why these negative effects outweigh any positives.  Specifically, it dismisses ICANN’s argument that new generic top-level domains are necessary, exposes the conflict between private ownership of generic top-level domains and trademark law, discusses the detrimental effect new generic top-level domains will have on the FTC’s ability to prosecute online fraud, and addresses the persistent ethical concerns raised by the apparent conflicts of interest between ICANN officials and new generic top-level domain applicants.

[6]        Section IV of this article proposes three remedial measures that attempt to alleviate some of the problems addressed in Part C of section III.  It proposes that ICANN implement a small pilot program rather than continue its plan of examining the roughly 2000 applications it received for new generic top-level domains, that ICANN increase the transparency of the organization in two ways, and that ICANN tweak its Trademark Clearinghouse procedure to balance the power between trademark owners and Internet users.

II.  A Domain Names Primer

[7]        To understand the implications of ICANN’s introduction of new generic top-level domains, an introductory discussion of the history of top-level domains is helpful.  This section will first answer the question “what is a domain name and how does it work?”  Next, it discusses the development of legal rights attached to domain names and domain ownership.  Finally, the article will examine where a domain name is located for the purposes of jurisdiction and review of the two types of domain name dispute resolutions, and discusses the applicability of each.

A.  What is a Domain Name?

[8]        A domain name in simple terms is the combination of words and numbers that lead an Internet user to a website.[10]  The Internet allows users to look up websites through its Domain Name System (“DNS”) using a uniform resource locator (“URL”) to direct users to specific websites.[11]  The DNS uses a tree-like hierarchy to organize URLs.[12]  Commonly, a URL has three parts: a protocol (or third-level domain), a server name (or second-level domain), and a resource ID (top-level domain).[13]  For example, Google’s URL is <www.google.com>.  The most common protocol is <www>, which is an abbreviation for World Wide Web.[14]  To the right of the protocol is a domain name.[15]  A domain name is a combination of alphanumeric characters used by an Internet browser to identify a website.[16]  In the Google example, <google> is the domain name.  To the right of the domain name is the top-level domain.[17]  A top-level domain is used to categorize websites.[18]  In the Google example, <.com> is the top-level domain.  The two most common types of top-level domains are generic top-level domains and country code top-level domains.[19]  Generally, country code top-level domains are two-letter identifiers; e.g., <.fr> for France.[20]  Because country code top-level domains are not changing, this article will focus on generic top-level domains.  Top-level domains expanded only slightly in the early years of the Internet.  In the 1980’s, the Internet only had seven generic top-level domains: <.com>, <.edu>, <.gov>, <.int>, <.mil>, <.net>, and <.org>.[21]  In 1995, the Federal Networking Council (FNS) birthed the modern Internet when it passed a resolution defining it as a “the global information system that is logically linked together by a globally unique address space.”[22]  Within a year, the Internet became the world’s fastest communicator of news, entertainment, and research.  In 2001-2002, seven additional generic top-level domains were introduced: <.biz>, <.info>, <.name>, <.pro>, <.aero>, <.coop>, and <.museum>.[23]  At the same time users were discovering the power of the Internet, businesses were discovering the increasing value of domain name ownership.  For example, the domain <www.business.com> was sold for $7.5 million in 1999.[24]  As businesses realized the value of domain name ownership, domain name disputes quickly followed.

B.  Domain Name Ownership

[9]        During the initial advancement of domain name law, a “personal property” theory was developed by courts to determine who owns a domain name.  The Supreme Court of Virginia set the stage for this theory’s proliferation, becoming the first court to consider whether property rights attach to domain names in Network Solutions, Inc. v. Umbro International, Inc.[25]  The issue in Umbro was whether the contractual right to use a domain name can be garnished to settle a default judgment.[26]  After receiving a default judgment against Canada Inc., Umbro filed suit in Fairfax Circuit Court against the domain registrar Network Solutions as a garnishee of Canada Inc., the debtor.[27]  Network Solutions responded that it had no money or other garnishable property belonging to the Canadian debtor and that the domain names registered by the debtor were non-garnishable contracts.[28]  The lower court found that the debtor’s domain names were “valuable intangible property” subject to garnishment, and ordered Network Solutions to deposit control of the domains to the court.[29]  The Supreme Court of Virginia did not reach the issue of whether the domain name was a form of personal property because Network Solutions acknowledged that it was during oral argument;[30] however, the case nonetheless enabled subsequent judicial opinions to explore the personal property theory of domain ownership.

[10]      After Umbro, federal courts began adopting the “personal property” theory of domain name ownership.  In Kremen v. Cohen, the Ninth Circuit treated a domain name as analogous to a document.[31]  Gary Kremen lost his domain, <sex.com>, when a bankruptcy lawyer sent a fraudulent letter to Network Solutions claiming that Kremen wished to abandon the domain.[32]  Kremen subsequently filed suit against Network Solutions in the Northern District of California.[33]  The district court granted summary judgment in favor of Network Solutions, holding, in part, that the domain was “intangible property” to which conversion does not apply.  Kremen appealed to the Ninth Circuit.[34]

[11]      On appeal, the Ninth Circuit reversed the district court and held that California case law allowed a claim of conversion for any species of property, including domain names.[35]  Network Solutions argued that no property right existed because the domain is refreshed every twelve hours as the information is broadcast online.[36]  The Ninth Circuit rejected this argument by an analogy to shares of stock, reasoning that “[w]hether a document is updated by inserting and deleting particular records or by replacing an old file with an entirely new one is a technical detail with no legal significance.”[37]  This rule allowed Kremen to successfully argue that his domain was his personal property and thus within the scope of California conversion law.[38]

[12]      Because domain names are personal property, each domain name must have an owner.  However, before any ownership rights will attach, the domain name must be registered.[39]  To register a domain name, an interested party must submit an application containing a potential top-level and second-level domain to a registrar.[40]  If the application is registered, it is added to the registry’s WHOIS database.[41]  ICANN defines the “registered name holder” as the person whose name appears in the WHOIS domain database.[42]  Courts have also considered the issue of domain name ownership, and have generally followed the ICANN definition.[43]

C.  Physical Location of Domain Names and Dispute Mechanisms

[13]      With the addition of numerous generic top-level domains, it is increasingly important to understand how domain owners can protect their trademarks online.  After accepting the theory that domain names are personal property, the next question to be answered is where domains are located for lawsuit purposes.  Congress answered this question through legislation interpreted by the courts.  The Anti-Cybersquatting Consumer Protection Act (“ACPA”)[44]  provides evidence of Congress’ acceptance for the “personal property” theory of domain name rights while also establishing the location of domain names.[45]  Under the ACPA, a person is liable for improper domain registration if that person registers a domain that infringes a valid trademark under certain conditions.[46]  First, the alleged infringer must have a bad faith intent to profit from the trademark.[47]  Second, the alleged infringer must register, traffic in, or use a domain name that is identical or confusingly similar to the trademark, or dilutive of the trademark if the mark is famous.[48]

[14]      The ACPA provides for in rem jurisdiction of domain names “in the judicial district in which the domain name registrar, domain name registry, or other domain name authority that registered or assigned the domain name is located.”[49]  The Second Circuit interpreted this language as showing Congress’ intent for domain names to exist as intangible property located in two locations: (1) at the location of the domain name registrar, and (2) at the location of the registry.[50]

[15]      The ACPA provides one mechanism for resolving domain name disputes, while the alternative option is an administrative action brought under ICANN’s Uniform Domain-Name Dispute-Resolution Policy (“UDRP”).  The UDRP requires parties to submit to a mandatory administrative hearing when the following three conditions are met: (1) the respondent’s domain name is identical or confusingly similar to the complainant’s trademark; (2) the respondent has no legitimate rights or interests in respect to the domain name; and (3) the respondent’s domain name has been registered and is being used in bad faith.[51]  First, UDRP resolution is faster (and likely cheaper) than litigation under the ACPA.[52]  There is no discovery process and a large percentage of URDP complaints go unanswered.[53]  Complainants are additionally advantaged by the fact that the UDRP panels have not allowed the assertion of equitable defenses.[54]  If successful, the only remedy provided by the UDRP is cancellation of the respondent’s domain name and transfer to the complainant.[55]

[16]      While litigation pursuant to the ACPA affords complainants much broader remedies than the UDRP, it also requires the costs and difficulties of traditional litigation.  A successful ACPA plaintiff will have the option of statutory damages and temporary or permanent injunctions.[56]  In certain cases, a court may also award costs and reasonable attorney’s fees.[57]  However, an ACPA complainant must first establish in personam jurisdiction.[58]  Defendants can also raise the equitable defenses otherwise not allowed under the UDRP.[59]  The ACPA and UDRP are not mutually exclusive options; a concurrent ACPA suit is permissible with a UDRP action.[60]

 

III.  The Arguments For and Against New gTLDs

[17]      Now that ICANN is delegating new generic top-level domains, the stage is set to analyze their positive and negative effects.  ICANN champions the introduction of new generic-top level domains, claiming that widespread expansion of generic top-level domains will benefit businesses and consumers.  It has ignored, however, many real concerns expressed by its own advisory board, the United States Federal Trade Commission, and interested parties from around the world.

[18]      This section examines the positive and negative implications of introducing new generic top-level domains.  First, this section examines the policy rationales supporting ICANN’s introduction of new generic top-level domains.  Then, it discusses the potential benefits of introducing new top-level domains based on economic and trademark rationales.  Finally, an analysis of the negative implications of introducing new generic top-level domains demonstrates why these negative effects outweigh any benefits.

 A.  Policy Rationales for Expansion

[19]      ICANN offers five policy justifications for offering new generic top-level domains.  For the reasons set forth below, these policy rationales are lackluster at best.

[20]      According to ICANN, the expansion is consistent with all prior expansions of generic top-level domains.[61]  In essence, the expansion is happening because all prior expansions have been successful.  Additionally, ICANN claims that “[t]here are no technical impediments to the introduction of new top-level domains as evidenced by the most recent addition of the two previous rounds.”[62]  In other words, because the new top-level domains were introduced smoothly, the introduction of 2,000 more top-level domains will also work smoothly.

[21]      ICANN also claims that expanding the domain name space to accommodate more scripts and symbols in top-level domains will give end users more choices about the nature of their presence on the Internet.[63]  For example, Chinese users will now be able to use Chinese symbols in their domain names.[64]  This will allow the domain owner to create a web address that is targeted only towards users who can understand the language.

[22]      Further, ICANN asserts that “[t]here is demand for additional top-level domains as a business opportunity.”[65]  As I will discuss in detail in Part B below, the <.com> domain is almost monopolistic with its dominance online.  ICANN assumes that by introducing more top-level domains, the additional choices for domain registrants will decrease the power of the <.com> top-level domain and lower prices for consumers.

[23]      “No compelling reason has been articulated to not proceed with accepting applications for new top-level domains.”[66]  While the accuracy of this statement is subjective to say the least, ICANN believes that new top-level domains will do nothing but good for the Internet as a whole.  It will also fill ICANN’s pockets with roughly $30 million in surplus application fees; an issue discussed in detail in Part C below.

B.  The Benefits of New gTLDs

[24]      New generic top-level domains will have some benefits as they are added to the Internet.  Prior to the expansion, the Internet had only twenty-two generic top-level domains.[67]  ICANN and supporters of the new generic top-level domains advocate for new generic top-level domains for four reasons.  First, it will give companies increased brand control and presence online.  Second, it will increase top-level domain competition by spreading market power.  Third, it will allow for the creation of niche marketplaces, thus lowering consumer search costs.  Finally, the difficult application process will ensure high-quality applicants administer new generic top-level domains.

1.  Brand Control

[25]      One reason ICANN advocates for new generic top-level domains is that it will increase brand control for companies.[68]  A company’s branding could benefit from new generic top-level domains in a few different ways.  For example, a company with the financial strength and capability can operate its own <.brand> generic top-level domain and control all usage of its trademark in domain names.[69]  By owning its own top-level domain, a company can reduce the amount of characters needed to find certain products within a brand’s website.  Rather than <www.amazon.com/kindle>, Amazon could direct its users to <kindle.amazon>.  It could do the same for each product its offers within its <.amazon> top-level domain.  Additionally, consumers from any country could potentially find a company with its own top-level domain more easily because as long as the consumer knows the brand name, a consumer can type <.brand>.  According to ICANN, both of these benefits to trademark owners outweigh any potential risk of increased cyber-squatting.[70]

2.  Increased Competition

[26]      ICANN advocates for new generic top-level domains because it will spread market power away from the <.com> top-level domain and thus increase competition.[71]  In a letter to the United States Department of Commerce, the Department of Justice’s Antitrust Division advised that as of 2008, VeriSign, the owner of the <.com> generic top-level domain had significant market power.[72]  The DOJ was concerned that because the <.com> domain was so powerful, it raised concerns of whether Verisign had developed a monopoly on domain names.[73]  The DOJ concluded that the introduction of new generic top-level domains would shift some of that market power away from <.com>.[74]  By doing so, consumers and potential registrants would see the benefits through more competitive pricing and increased variety.[75]  Whereas previously companies such as Verisign have been able to set prices for domains within the <.com> top-level domain, now successful applicants can offer lower prices and help decrease Verisign’s market power.  Therefore, it is plausible that new generic top-level domains will help increase competition and decrease the price of domain names online.

3.  Creation of Niche Marketplaces

[27]      ICANN claims that new generic top-level domains will allow for new online business models by creating niche marketplaces that decrease consumer search costs.[76]  For example, as more companies began selling digital copies of music online, the top-level domain <.music> could plausibly become the domain under which all companies offer their services.  Apple could use <itunes.music>, Google could use <google.music>, and Amazon could use <amazon.music>.  This arrangement would benefit both the user and business because the user would be able to find multiple online music sellers more quickly, and the visibility of each music seller would be greater as well.  Smaller companies who only offer services in a single market would also benefit from the creation of new niche marketplaces their exposure to consumers would be increased.  By searching for the specific top-level domain like <.music>, a user will not only find Apple’s music store, but can also shop for lesser known music stores which may have previously been too difficult to find within the broad <.com> domain.  With niche marketplaces, both consumers and businesses can benefit by decreased search costs.

4.  Qualified New Registrars

[28]      Because the application process is so grueling, ICANN is ensuring that only qualified applicants will administer new generic top-level domains.  ICANN’s “gTLD Applicant Guidebook” contains directions to apply for a new generic top-level domain.[77]  The period in which to apply for a generic top-level domain was January 12 through April 12, 2012.[78]  After submission, applications are reviewed in three stages.

[29]      The first stage of the review process requires the applicant to meet a set of administrative requirements before any substantive review of the application commences.[79]  The application is then posted on ICANN’s website for a public comment period lasting sixty days.[80]  During this comment period, the Government Advisory Committee may also notify the applicant that the generic top-level domain may be problematic, either because it violates international law or concerns other sensitive issues.[81]

[30]      Next, the “Initial Evaluation” period begins in which the application is reviewed to determine: (1) if it will cause any problems with the structure of the DNS, and (2) if the applicant is capable of managing the generic top-level domain.[82]  These two requirements will help ICANN determine whether a potential generic top-level domain will crash the Internet.

[31]      Besides its own review of each applicant, ICANN also created formal public objection period for approximately seven months after it posts the list of completed applications that occurs during the initial evaluation.[83]  If an objecting party meets the standing requirement, ICANN will hear objections.[84]  This will allow the public to voice any concerns that ICANN may have missed.

[32]      Finally, if the applicant survives the preceding periods, the application moves into a “transition to delegation” period.[85]  During the transition to delegation, the applicant must enter into a registry agreement with ICANN.[86]  At this time, ICANN and the applicant will contract to operate the top-level domain in the same manner that all current top-level domains operate.  The applicant must also perform a “technical set-up,” where it shows that it can operate a functional top-level domain before the domain is entered into ICANN’s database.[87]  If the applicant meets all of these requirements, the domain becomes eligible for entry into ICANN’s generic top-level domain database.[88]

C.  The Negative Implications of New gTLDs

[33]      While there are positives, the negative implications of introducing new generic top-level domains far outweigh these positives.  The following subsections discuss four distinct reasons that ICANN should not introduce more new generic top-level domains at this time.  First, ICANN’s own Government Advisory Committee has questioned the necessity and likelihood of success for new generic top-level domains.  Second, by issuing new generic-top level domains to private companies, a core principle of trademark law is violated.  Third, the FTC has warned ICANN that new generic top-level domains will greatly increase the difficulty of prosecuting cases of online fraud.  Finally, ICANN’s actions regarding the introduction of new generic top-level domains, thus far, have raised serious ethical concerns about the organization’s ability to fairly oversee the project.

1.  Doubts of Necessity

[34]      Many doubts have been raised about whether the new generic top-level domains are even necessary.  ICANN advocates for the new generic top-level domains out of a business necessity due to scarcity of second-level domains within the current generic top-level domains.  This necessity is questionable and regardless of the fact that ICANN has offered no evidence to support this claim, two counter arguments significantly undercut the validity of the claim.  First, ICANN’s own Government Advisory Committee (“GAC”) chairman openly questioned the necessity for new generic top-level domains in a letter to ICANN’s Chairman of the Board in 2007.[89]  Second, the Supreme Court rejected a similar argument with regard to colors as trademarks in Qualitex Co. v. Jacobson Products. Co., an argument that also can apply to domain names.[90]

[35]      In a letter to ICANN’s former Chairman of the Board, the former GAC Chairman raised apparently continuing concerns by the GAC about the introduction of new generic top-level domains.[91]  At the outset, the chairman noted that the “threshold question has not been answered whether the introduction of new gTLDs provides potential benefits to consumers that will not be outweighed by the potential harms.”[92]  The GAC chairman noted that in 2006 the ICANN Board of Directors requested an economic benefit analysis study of new generic top-level domains, which at the time of the letter had yet to occur.[93]  He was also concerned that the introduction of new generic top-level domains would lead to a creation of monopolies rather than an increase in competition.[94]  The GAC warned that a likelihood of “end user confusion” could result from the introduction of new generic top-level domains, which I further discuss in the “Trademark Concerns” section below.[95]  The GAC chairman criticizes ICANN for its failure to address the lack of awareness of the new generic top-level domains by many smaller businesses and Internet users as a whole.[96]  The GAC chairman urges ICANN to simplify the application and objection process, and also be more transparent about how it intends to the spend the predictably large surplus earned from application fees.[97]  Based on all of these issues, it becomes clearer that ICANN has not established a necessity for new generic top-level domains.

[36]      ICANN fails to make a valid argument that the new generic top-level domains are running out of space for new second-level domains when it is compared to a similar argument made about trademarks.  In 1995, the Supreme Court rejected an argument that scarcity should bar colors from trademark protection.[98]  The respondent in Qualitex argued that the array of colors is limited and therefore colors should not be afforded trademark protection to prevent any unfair competition.[99]  The Court dismissed the argument, noting that the mixing of colors could produce nearly limitless choices for competitors to use in their own products.[100]  Compared to the color argument in Qualitex, ICANN’s concern of second-level domain scarcity should be questioned.  Second-level domains are composed of both numbers and letters.  The potential combinations of numbers and letters in second-level domains are nearly limitless.  While a random assortment of numbers and letters may not make a good domain, ICANN cannot claim that the domains are running out.  Moreover, unless trademarks themselves are running out, it does not logically follow that <.com> cannot be added to each newly registered mark.  While the same trademark is sometimes issued for completely separate products, in that situation the trademark owner could use the trademark name and product type as its domain name.  For example, Delta is a trademark for both faucets and airlines.  While <delta.com> can only be used for one company, the other could merely adopt the domain <deltaairlines.com> or <deltafaucets.com>.  Under this scrutiny, ICANN’s claim of scarcity should be given little credence.

2.  Conflict with Trademark Law

[37]      ICANN’s introduction of new generic top-level domains conflicts with the well-established trademark doctrine that prevents ownership of generic terms.  Domain names are treated under the law as extensions of trademark rights, but are even more exclusive in the sense that once the domain is issued, no one else can use it.[101]  The rationale behind excluding generic marks is that if one person owned the rights to a generic term, it would prevent a competitor from using the term that identifies its product.[102]  Examples of generic terms include lamps, cars, etc.  Because of this similarity, trademark rights are a prerequisite for suit under ACPA or the UDRP to remove infringing domain names.[103]

[38]      Courts use a “levels of distinctiveness” test to determine if a mark is eligible for trademark protection.[104]  There are four levels of distinctiveness.[105]  Generic marks are terms used to identify a particular type of product, and are never available for trademark protection.  Trademarks lower consumers’ search costs, allow the owner to develop goodwill in his company, and provide marketing advantages.  An important notion of trademark law is that trademarks identify a producer of goods or services, not a type of goods or services.[106]  Trademark rights exist through use, but only distinctive marks are available for trademark protection.[107]  Both the UDRP and ACPA require trademark ownership for a complainant to succeed in a domain name dispute,[108] and with this fact in mind, the next section will explain why the new generic top-level domains violate these principles.

[39]      ICANN accepted applications for hundreds of generic terms as new generic top-level domains.[109]  These new domains include <.art>, <.computer>, <.pizza>, and <.restaurant>, just to name a few.[110]  While most of the new generic top-level domains have not yet been opposed, seven generic top-level domains are being hotly contested by Amazon and Google, exemplifying why generic terms should not be sold to private companies.  By allowing these companies to own generic terms as part of generic top-level domains, the company will have an online monopoly on a generic term and could lead to serious issues of unfair competition.

[40]      For example, if Amazon operates the <.app> top-level domain and refuses to allow Google to register a domain under <.app>, Google is unable to compete in the <.app> marketplace.  Google and Amazon have both bid on the domains <.app>, <.cloud>, <.game>, <.movie>, <.music>, and <.play>.[111]  All of these terms would fall within the generic category of Zatarains’ levels of distinctiveness test.[112]  The Zatarains court was worried about disadvantaging competitors by allowing generic terms to be trademarked, but ICANN seems to have done the complete opposite.  Both Google and Amazon make legitimate use of the term “apps.”  Either one would be significantly disadvantaged if they were no longer allowed to use the term.  If Amazon were given trademark protection in the term “app,” Apple would likely be an infringer unless it shut down its “App Store.”  Luckily, Zatarains foresaw this result, and courts across the United States followed this example to set the boundaries of trademark rights.  While a trademark on a generic term is not identical to ownership of a generic titled top-level domain, the economic effects would be quite similar.

[41]      ICANN announced that the creation of niche’ marketplaces as one of its objectives in creating new generic top-level domains.  Assuming this becomes common practice, the generic top-level domain owner would presumably license a second-level domain to any interested companies offering products in the niche.  But take Amazon for example, who is asserting itself as the only permissible user of the <.app> top-level domain.[113]  Amazon is only one of many companies who provide “apps,” yet it intends to own the entire <.app> registry and prevent any other company from using it.  Specifically, Amazon claims in its application that<.app> may not be delegated or assigned to third party organizations, institutions, or individuals.[114]  Amazon is purporting to own the <.app> top-level domain and prevent others who offer “apps” from participating in the new marketplace.  Amazon is claiming a trademark right, vis-à-vis its exclusion from others in using a generic term and in effect will have a monopoly in the <.app> marketplace as warned by the GAC in 2009.[115]

3.  Enforcement Concerns

[42]      The Federal Trade Commission (“FTC”) offers a third opposition to the new generic top-level domains because new domains will magnify the already difficult challenge of protecting consumers from online fraud.[116]  In a letter to the CEO and Chairman of ICANN’s Board of Directors, the FTC addressed its concern over the effects new generic top-level domains will have on FTC enforcement of online fraud prevention.[117]  The FTC warned that “[f]raudsters will be able to register the misspellings of businesses, including financial institutions, in each of the new gTLDs, create copycat websites, and obtain sensitive consumer data with relative ease before shutting down each site and launching a new one.”[118]  The FTC also expressed concerns that the potential for bad actors to obtain and operate top-level registries will significantly increase, even with ICANN’s background check procedures.[119]  ICANN has already proven to be negligent in its management of the WHOIS database, in turn obstructing FTC investigations into the owners of fraudulent websites.[120]  The FTC suggested that ICANN make certain changes to protect the public from the dangers of new generic top-level domains.  It urged ICANN to implement the new generic-top level domain program as a pilot program and only approve a small number of the initial generic top-level domains.[121]  The FTC encouraged ICANN to hire more compliance staff to strengthen its contractual compliance program.[122]  It also recommended that ICANN develop a new program to monitor the consumer issues bound to arise from the implementation of the first round of new generic top-level domains.[123]  Additionally, the FTC requested that ICANN assess its application’s risk of consumer harm as part of the application review process.[124]  Finally, the FTC advised ICANN to improve the accuracy of its WHOIS databases, potentially including a registrant verification procedure to help the FTC locate and prosecute bad actors.[125]  I will advocate for some of these recommendations in Section IV of this article.

4.  Ethical Concerns

[43]      Beyond the substantive concerns of the introduction of new generic top-level domains, advocates have raised serious ethical concerns about ICANN’s Board of Directors.  In 2011, two members of the ICANN Board joined for-profit domain holding corporations within a month of leaving ICANN.[126]  Because the ICANN bylaws have no restrictions on the Board members after they leave, their employees are more susceptible to conflicts of interests when moving to private companies.[127]  Criticisms of ICANN’s ethics policies are worldwide and continuing, and are evidenced by a letters sent to ICANN from many new generic top-level domain applicants.

[44]      Applicants for the <.africa> top-level domain have continually notified ICANN of a conflict of interest between a competing applicant and ICANN’s Government Advisory Committee.  On July 18, 2012, DotConnectAfrica (“DCA”) advised ICANN as to this conflict.[128]  DCA noted that a member of ICANN’s GAC also sat on the Board of Directors for KeNIC, a corporation competing with DCA for the <.africa> top-level domain.[129]  DCA provided evidence that the GAC Board member has publicly opposed the DCA in various discussions about the <.africa> top-level domain, and it requested that she remove herself from the GAC where she played a role in determining what new generic top-level domains applications are accepted.[130]  Even more troubling is the attachment to the DCA email—a prior email dated April 7, 2011 raising the same concerns about the same GAC Board member.[131]  If this conflict was an isolated incident it would be less severe, but the problem is more widespread.

[45]      On July 6, 2012, the CEO of BRS Media exposed another conflict of interest on the GAC with regards to the <.radio> top-level domain.[132]  According to the letter, the European Broadcasting Union (“EBU”) was admitted to the GAC while it has a pending application for the <.radio> top-level domain.[133]  The BRS CEO requested that the EBU step down from its position on the GAC Board immediately to resolve the glaring conflict of interest.[134]  In light of all of these problems, ICANN should implement certain remedial measures to help alleviate these concerns.

 

IV.  Remedial Measures for New gTLDs

           [46]      As it seems unlikely that ICANN will heed the advice of the FTC and its own GAC, this section offers three remedial measures that ICANN could take now to address some of the concerns expressed in Section III above.  First, ICANN should implement a small pilot program rather than continue its plan of examining the roughly 2000 applications it received for new generic top-level domains.  This proposal is supported by evidence of success in similar pilot programs created by the United States Patent and Trademark Office, and suggestions by the Federal Trade Commission.  Second, ICANN should increase the transparency of the organization in two ways.  ICANN should release publicly a detailed plan that explains how ICANN plans to spend its expected $30 million surplus from the new generic top-level domain applications.  Additionally, ICANN should expand its conflicts of interest policy to include related committees and organizations participating in the application process.  Finally, ICANN cancel the Uniform Rapid Suspension mechanism, which creates an even higher likelihood of trademark bullying without any new protections for domain users.  These proposals are discussed in detail below.

 A.  Implementation via a Pilot Program

[47]      ICANN needs to implement the new generic top-level domain through a pilot program to minimize any negative effects, rather than hastily introduce thousands of top-level domains.  ICANN noted in the “gTLD Applicant Guidebook” that it can add a maximum of 1000 new generic top-level domains per year.[135]  During its four-month application period, ICANN received 1,930 applications.[136]  With 2,000 applications to review, a perfect implementation of these new generic top-level domains would take two years.[137]  This two-year period, however would be assuming that ICANN is actually able to add 1000 new generic top-level domains per year.  During this time, ICANN will presumably accept more applications and develop a backlog of new generic top-level domains.

[48]      ICANN should narrowly implement the new generic top-level domains.  To mitigate the risks noted above in Section III, ICANN should begin by implementing only a small number of uncontested generic top-level domains owned by experienced registries.  By choosing uncontested generic top-level domains, it will lessen the possibility of legal action.  Experienced registries will likely have fewer growing pains while administering a new generic top-level domain.  The resources ICANN planned to use implementing mass new generic top-level domains can instead be spent on analysis of the pilot generic top-level domains and use this knowledge to better craft the full-scale new generic top-level domain program.  If the results of the pilot program are promising, ICANN will already have thousands of applications to review and implement.  At the same time, it can accept new applications in good faith, with the pilot program serving as a model for the likely success of further expansion.  If the pilot program proves unworkable, ICANN will have saved an enormous amount of resources by limiting its implementation to the piloted generic top-level domains.

[49]      ICANN should use The United States Patent and Trademark Office (“PTO”) as a model for implementing the new generic top-level domains as a pilot program.  The PTO constantly introduces changes to its procedures through pilot programs and its efforts have been successful.[138]  For example, The PTO introduced the “Enhanced First Action Interview Pilot Program” in October of 2009.[139]  Because of the program’s success, the PTO has extended the program three times and now expanded the program to all technologies.[140]  Based on these expansions, the PTO has proved the workability of pilot programs on large-scale technological applications, and ICANN should follow the PTO’s lead.

B.  Increased Transparency

[50]      ICANN must also address the ethical concerns of various interested parties by increasing the transparency of its operations.  It can do so in the following ways.  Regarding its surplus applications profits discussed above in Section III, ICANN should issue a detailed public statement explaining how it will allocate the funds earned from the new generic top-level domain program.  Additionally, ICANN should conduct a full-scale review of all parties with any say in the new generic top-level domain application process, and remove anyone with even tenuous conflicts of interest.

1.  Allocation of Funds from the new gTLD Applications

[51]      ICANN expects to net $140 million from the new generic top-level domain program according to its budget that it released for the fiscal year of 2012-13.[141]  As a non-profit, ICANN receives special tax treatment in exchange for it not earning a profit for its owners.[142]  However, in its budget, ICANN only forecasted revenues based on the assumption that it would receive 500 new generic top-level domain applications.[143]  In fact, the application number is closer to 2,000.[144]

[52]      Because of the greater number of applications, ICANN’s budget must be adjusted upward to account for those numbers.  Based on ICANN’s budget methodology for the 500 applications, the 2,000 applications will net ICANN of $337 million, while predicting a likely operating cost of $156 million.[145]  It budgets another $150 million in operating costs, leaving a surplus of roughly $30 million on this single round of new generic top-level domain applications.[146]  Obviously, ICANN cannot make $30 million in profit and continue to remain a non-profit business.  According to the budget, ICANN plans to “initiate a policy development process to define with the community the purpose and mechanism of administration of such excess” with any surplus that remains.[147]  This statement is vague so I suggest the following as to how ICANN should spend its surplus and remain a non-profit.

[53]      With a conservative estimate of $30 million in surpluses, the time has come for ICANN to define the mechanism of administration of such excess.  First, ICANN should analyze how best to lower costs for applicants.  As a non-profit, ICANN should not be charging more for its services than required to recoup costs.  After recouping its costs, ICANN should use some of the surplus to initiate a cost-effectiveness study for the first round of applications and use the findings to lower application costs.

[54]      ICANN should also use some of the surplus to strengthen the WHOIS database and hire more compliance staff, as recommended by the FTC is its letter to the Board.[148]  The FTC noted in its letter to ICANN that both the WHOIS database and the amount of work for the compliance staff will change dramatically as a result of the 2000 new top-level domain applications.[149]  The WHOIS database will have to be updated constantly to add all of the new second-level domain registrant information under each new generic top-level domain.[150]  This job will be handled by the compliance staff.  Therefore, ICANN will clearly need to hire many more compliance staff members if it hopes to add the new generic top-level domains efficiently and effectively.[151]

 2.  Conflicts of Interest Program

[55]      ICANN needs to develop a comprehensive ethics review program to address the persistent issues raised by various interested parties.  On August 20, 2011, the Washington Post published an article exposing a “revolving door” conflict of interest problem with two members of the ICANN Board of Directors.[152]  The article detailed the quick transition from an ICANN board-member to a director of a private-sector company with active applications for new generic top-level domains.[153]  This board-members move was questioned as a conflict of interest because he had previously had direct access to the success of his new company’s top-level domain application.[154]  Further, his former colleagues at ICANN are more likely to choose his company’s application with all else being equal.

[56]      In response to the Washington Post article, Oregon Senator Ron Wyden wrote a letter to the United States Department of Commerce and National Telecommunications and Information Administration calling for stricter regulations on the ethical obligations of ICANN.[155]  The Senator has raised concerns about the lack of oversight regarding former ICANN employees transitioning to private firms with generic top-level domain applications.[156]

[57]      As a likely result from the mounting governmental and media pressures, ICANN announced a new conflict of interest policy on May 6, 2012.[157]  The policy is comprehensive in theory, mirroring standard corporate conflict of interest policies.  The policy encourages all members of any ICANN affiliated organization to disclose any conflicts of interest it has with current top-level domain applications.[158]  This policy is ineffective, however as evidenced by the two conflicts of interest noted subsequent to the May 6, 2012 adoption of the policy and discussed in Section III above.  At least two separate Advisory Committee conflicts of interest have been discovered subsequent to ICANN’s new conflicts of interest policy.[159]  Both of these conflicts involved members of the GAC also having an interested stake in new gTLD applications.[160]

[58]      To rectify the more recent conflicts of interest, ICANN needs to require members of its Government Advisory Committee to adhere to a strict conflict of interest policy, rather than merely “encourage” it.[161]  Exemplifying ICANN’s failure to remedy this issue, ICANN held an ethics and conflicts of interest panel in June of 2012 and failed to address any concerns about GAC.[162]  Note that this date is after the letter from Senator Wyden and after the DotConnectAfrica scandal discussed above in Section III.  ICANN must address the GAC concerns immediately if it plans to continue reviewing the remaining applications.  To address this ethical concern, ICANN should institute a mandatory background check of all GAC members and cross-reference those findings with every applicant for the new generic top-level domain.  Under this simple approach, the issues addressed by DotConnectAfrica and Senator Wyden will happen without a bad faith act from an individual.  Therefore, at the very least, ICANN will not be turning a blind eye to the shady dealings happening legally within its own organization.

C.  Removing the Rapid Uniform Suspension Mechanism

[59]      Finally, ICANN should restructure the Trademark Clearinghouse procedure to balance protection of trademarks with usability of the Internet for both providers and users.  To best balance the interests of trademark owners and without overburdening registrars or users, ICANN should remove the Rapid Uniform Suspension mechanism.

[60]      The Trademark Clearinghouse is a database of trademarks from all over the world for use in the new generic top-level domain program.  The Trademark Clearinghouse is designed to protect the rights of trademark owners.[163]  Currently, the Clearinghouse offers one adversarial dispute proceeding for trademark owners called the Rapid Uniform Suspension mechanism.[164]

[61]      The Uniform Rapid Suspension (“URS”) mechanism is unnecessary and gives too much power to trademark owners.  Because the UDRP already serves the same function as the URS, albeit at a slower pace, the URS serves no other purpose than to allow a trademark owner to bully domain registrants who cannot afford to quickly respond to the complaints.

[62]      According to ICANN, the URS was created to compliment the UDRP by providing trademark owners with a quick resolution to clear-cut trademark infringement by suspension of the infringing domain.[165]  Filing a URS complaint will cost a trademark holder $500 dollars.[166]  The complainant must allege in his complaint entitlement of relief based upon: (1) the registrant’s domain is identical or substantially similar to the complainant’s valid trademark that is in current use; (2) the registrant has no legitimate right or interest in the domain name; and (3) the domain was being registered and used in bad faith.[167]  The complaints are reviewed by an administrative review to determine if it meets the above threshold requirements.[168]  If the panel determines that the complaint satisfies the requirements, it will issue “Lock Notice” with the registrar of the domain within two days of the complaint’s filing.[169]  Within twenty-four hours, the registrar will lock the domain and notify both parties.[170]  The registrant has fourteen days to respond to the complaint and, similar to a UDRP response, no affirmative defenses or discovery requests are permitted.[171]  Unlike the UDRP, the remedy for a URS complaint is a suspension of the website for the remainder of its registration period but not a transfer of the domain to the complainant.[172]

[63]      ICANN has not offered any convincing reasons to add the URS and it should not be implemented for the following reasons.  The UDRP complainants already have a 90% success rate.[173]  With this much success, it is hard to argue that a more trademark-friendly mechanism is needed for even faster resolutions.  Moreover, as the UDRP thresholds are easy to meet and without allowing respondent’s the ability to raise affirmative defenses, a defendant has even less of a chance of success.[174]

[64]      The quick and cheap process of URS will only decrease the chances even further for any successful defense.[175]  The URS complaints will cost approximately $500 to file, as opposed to the $4000 or more under the UDRP and will not require an attorney to prosecute the complaint.[176]  The lesser cost of URS complaints will likely lead to an increase of URS filings as compared to UDRP filings.

[65]      To make matters worse, the two-day review period will increase the likelihood of administrative error.  More errors will lead to more appeals and a greater waste of resources.

[66]      Based on ICANN’s URS Update presentation in October 2012, the main objective of the URS is to give trademark owners quicker remedies for infringement.[177]  While the URS will clearly promote that goal, it will also waste resources that could be better spent improving transparency or implementation of the new generic top-level domain program itself.

[67]      Overall, the URS does not offer enough benefits to outweigh the negative implications of giving trademark owners such a powerful adversarial option for domain disputes.  Without any statistics to justify the addition of a quicker dispute mechanism, ICANN should continue to direct complainants to the UDRP or ACPA for dispute resolution.

 

V.  Conclusion 

[68]      The Internet has afforded businesses and consumers the ability to interact with unbelievable speed and convenience.  Domain ownership allows businesses to take their storefront directly to the consumer, whether at home or anywhere else with an Internet connection.  The original generic top-level domains undoubtedly help users immediately identify whether the site they are visiting is for-profit, non-profit, educational, or part of the government.  However, the introduction of thousands of new generic top-level domains will likely blur the distinctions of these top-level domains and cause much more detriment than any potential benefit they could provide.

[69]      New generic top-level domains will have some benefits for Internet users.  They could lead to increased brand control and better marketing opportunities for businesses.  New generic top-level domains could increase competitiveness by spreading the market power of the <.com> domain, likely affording consumers more options at better prices.  They may also create niche marketplaces for products and community groups, which could lead to lower search costs for consumers and increased visibility for smaller businesses.

[70]      The negative implications are more concrete, however, and far outweigh any of the potential benefits to new generic top-level domains.  ICANN’s own Government Affairs Committee doubts the necessity or economic benefit of introducing new generic top-level domains.  The private ownership of generic terms as top-level domains creates a conflict with existing trademark law and could lead to unfair competition.  The FTC warns that new generic top-level domains will increase the already difficult task of policing and prosecuting online fraud.  Evidence also shows unethical actions taken by ICANN officials that raise serious questions about the fairness of new generic top-level domain applications.

[71]      Regardless of the potential consequences, new generic top-level domains are coming in droves.  New generic top-level domain applicants should expect a slow and expensive process throughout their pursuit.  New domain registrants should expect trademark owners to have more power than ever in suspending registered domains if the domain is similar to a registered trademark.  ICANN should expect to earn much more money than allocable under its proposed budget to remain a non-profit.  The media should expect at least a few more conflicts of interest to arise between ICANN advisory board members and new generic top-level domain applicants.  Above all else, everyone should expect a tangled web as the intricacies of thousands of new generic top-level domains are introduced to the Internet. 

---

DownloadPDF

Cite as: Philip J. Favro, Getting Serious: Why Companies Must Adopt Information Governance Measures to Prepare for the Upcoming Changes to the Federal Rules of Civil Procedure, 20 Rich. J.L. & Tech. 5 (2014), http://jolt.richmond.edu/v20i2/article5.pdf.

Philip J. Favro*

“[W]ithout a corresponding change in discovery culture by courts, counsel and clients alike, the proposed rules modifications will likely have little to no effect on the manner in which discovery is conducted today.”[1]

 

 

I.  Introduction

[1]        It has been over seven years now since the so-called e-Discovery amendments to the Federal Rules of Civil Procedure (“Federal Rules,” “Rules,” or individually, “Rule”) went into effect.[2]  When they were implemented, various commentators reasoned those amendments would facilitate a more efficient and cost-effective resolution of discovery issues.[3]  This, in turn, would free parties to focus on the merits of claims and defenses, “teeing matters up for disposition through settlement, summary judgment, or trial.”[4]  The reality, of course, is far from this Pollyannaish vision.  Instead of simplifying the process, the 2006 amendments seem to have generated more satellite litigation than ever before about preservation and production issues.[5]

[2]        Beyond the issues spawned by the 2006 amendments, the costs and complexity of discovery are increasing due to digital age advances that have caused information to proliferate exponentially.[6]  For example, mobile devices such as smartphones and tablet computers have provided users with new methods that facilitate a more rapid and user-friendly exchange of information.[7]  Users now share that information with increasing frequency through short message service and social networks.[8]  Because users do so in far greater quantities than they did with e-mail, the number of communications potentially subject to discovery has been substantially augmented.[9]  Moreover, users have an unlimited virtual warehouse in which to store those conversations due to the popularity of low cost cloud computing services.[10]

[3]        Given these factors and the challenges they present to the discovery process, there should be little doubt as to why the Judicial Conference Advisory Committee on the Civil Rules (“Committee”) has proposed another round of Rules amendments.[11]  The draft amendments are generally designed to streamline the federal discovery process, encourage cooperative advocacy among litigants, and eliminate gamesmanship.[12]  The proposed changes also tackle the continuing problems associated with the preservation of electronically stored information (“ESI”).[13]  As a result of its efforts, the Committee has produced a package of amendments that could affect many aspects of federal discovery practice.[14]

[4]        To date, most of the debate on the proposals has focused on the draft amendment to Rule 37(e).[15]  That amendment would raise the standard of culpability required to impose sanctions for any failure to preserve relevant information.[16]  Such attention is understandable given the proposal’s likely impact on organizations’ defensible deletion efforts.[17]  Nevertheless, there are several other noteworthy changes that are no less important for litigants and lawyers.[18]  Among these are the amendments that would usher in a new era of adversarial cooperation, proportionality standards, and active judicial case management.[19]  The collective impact of these proposals could result in decreased burdens and costs for courts, clients, and counsel alike.[20]

[5]        For organizations to meet the challenges these proposed changes pose, they will need to take actionable measures to satisfy those provisions.[21]  Such measures generally fall under the umbrella of an enterprise’s information governance plan.[22]  For many companies, information governance remains an elusive concept.[23]  Nevertheless, an intelligent information governance plan offers a more enlightened approach for companies to comply with the proposed Rules changes.[24]  Moreover, it is perhaps the only way for clients to realistically reduce the costs and burdens of discovery.[25]

[6]        In this Article, I will consider these subjects. In Part II, I provide an overview of the newly proposed amendments and discuss the impact the Rules proposals will likely have on organizations. In Part III, I offer five practical suggestions that, if followed, will help enterprises meet the information governance challenges posed by the proposed Rules amendments.

 

II.  The Newly Proposed Amendments

[7]        The overall thrust of the Committee’s proposed amendments is to facilitate the tripartite aims of Federal Rule 1 in the discovery process.[26] To carry out Rule 1’s lofty yet important mandate of securing “the just, speedy, and inexpensive determination” of litigation,[27] the Committee has proposed several modifications to advance the notions of cooperation and proportionality.[28]  Other changes focus on improving “early and effective judicial case management.”[29]  In addition, the Committee has proposed revising Federal Rule 37(e) in an attempt to create a uniform national standard for discovery sanctions stemming from failures to preserve evidence.[30]  The draft amendments that address these concepts are each considered in turn. I will then conclude this Part by generally discussing the effects the Rules changes will likely have on organizations.

A.  Cooperation—Rule 1

[8]        To better emphasize the need for adversarial cooperation in discovery, the Committee has recommended that Rule 1 be amended to specify that clients share the responsibility with the court for achieving the Rule’s objectives.[31]  The proposed revisions to the Rule (in italics with deletions in strikethrough) read in pertinent part as follows: “[These rules] should be construed, and administered, and employed by the court and the parties to secure the just, speedy, and inexpensive determination of every action and proceeding.”[32]

[9]        Even though this concept was already set forth in the Advisory Committee Notes to Rule 1, the Committee felt that an express reference in the Rule itself would prompt litigants and their lawyers to engage in more cooperative conduct.[33]  Perhaps more importantly, this mandate should also enable judges “to elicit better cooperation when the lawyers and parties fall short.”[34] Indeed, such a reference, when coupled with the “stop and think” certification requirement from Federal Rule 26(g), should give jurists more than enough procedural basis to remind counsel and clients of their duty to conduct discovery in a cooperative and cost effective manner.[35]

B.  Proportionality—Rules 26, 30, 31, 33, 34, 36

[10]      The logical corollary to cooperation in discovery is proportionality.[36]  Proportionality standards, which require that the benefits of discovery be commensurate with its burdens, have been extant in the Federal Rules since 1983.[37]  Nevertheless, they have been invoked too infrequently over the past thirty years to address the problems of over-discovery and gamesmanship that permeate the discovery process.[38]  In an effort to spotlight this “highly valued” yet “missing in action” doctrine,[39] the Committee has proposed numerous changes to the current Rules regime.[40]  The most significant changes are found in Rules 26(b)(1) and 34(b).[41]

1.  Rule 26(b)(1)—Tightening the Scope of Permissible Discovery

[11]      The Committee has proposed that the permissible scope of discovery under Rule 26(b)(1) be modified to spotlight the limitations proportionality imposes on discovery.[42]  Those limitations are presently found in Rule 26(b)(2)(C) and are not readily apparent to many lawyers or judges.[43]  Rule 26(b)(2)(C) provides that discovery must be limited where requests are unreasonably cumulative or duplicative, the discovery can be obtained from an alternative source that is less expensive or burdensome, or the burden or expense of the discovery outweighs its benefit.[44]  The proposed modification (in italics) would address this problem by placing them in Rule 26(b)(1) and by more clearly conditioning the permissible scope of discovery on proportionality standards:

Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case, considering the amount in controversy, the importance of the issues at stake in the action, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.[45]

By moving the proportionality rule directly into the scope of discovery, counsel and the courts may gain a better understanding of the restraints this concept places on discovery.[46]

[12]      Rule 26(b)(1) has additionally been modified to enforce the notion that discovery is confined to those matters that are relevant to the claims or defenses at issue in a particular case.[47]  Even though discovery has been limited in this regard for many years, the Committee felt this limitation was being swallowed by the “reasonably calculated” provision in Rule 26(b)(1).[48]  That provision currently provides for the discovery of relevant evidence that is inadmissible so long as it is “reasonably calculated to lead to the discovery of admissible evidence.”[49]  Despite the narrow purpose of this provision, the Committee found many judges and lawyers unwittingly extrapolated the “reasonably calculated” wording to broaden discovery beyond the benchmark of relevance.[50]  To disabuse courts and counsel of this practice, the “reasonably calculated” phrase has been removed and replaced with the following sentence: “Information within this scope of discovery need not be admissible in evidence to be discoverable.”[51]

[13]      Similarly, the Committee has recommended eliminating the provision in Rule 26(b)(1) which presently allows the court—on a showing of good cause—to order “discovery of any matter relevant to the subject matter involved in the action.”[52]  In its proposed “Committee Note,” the Committee justified this excision by reiterating its mantra about the proper scope of discovery: “Proportional discovery relevant to any party’s claim or defense suffices.”[53]

2.  Rule 34(b)—Eliminating Gamesmanship with Document Productions

[14]      The three key modifications the Committee has proposed for Rule 34 are designed to eliminate some of the gamesmanship associated with written discovery responses.[54]  The first change is a requirement in Rule 34(b)(2)(B) that any objection made in response to a document request must be stated “with specificity.”[55]  This recommended change is supposed to do away with the assertion of general objections.[56]  While such objections have almost universally been rejected in federal discovery practice, they still appear in Rule 34 responses.[57]  By including an explicit requirement for specific objections and coupling it with the threat of sanctions for non-compliance under Rule 26(g), the Committee may finally eradicate this practice from discovery.[58]

[15]      The second change is calculated to address another longstanding discovery dodge: making a party’s response “subject to” a particular set of objections.[59]  Whether those objections are specific or general, the Committee concluded that such a conditional response leaves the party who requested the materials unsure as to whether anything was withheld and, if so, on what grounds.[60]  To remedy this practice, the Committee added the following provision to Rule 34(b)(2)(C): “An objection must state whether any responsive materials are being withheld on the basis of that objection.”[61]  If enforced, such a requirement could make Rule 34 responses more straightforward and less evasive.[62]  This, in turn, would obviate needless meet-and-confer efforts and motion practice undertaken to ferret out such information.[63]

[16]      The third change is intended to clarify the uncertainty surrounding the responding party’s timeframe for producing documents.[64]  As it now stands, Rule 34 does not expressly mandate when the responding party must complete its production of documents.[65]  That omission has led to delayed and open-ended productions, which can lengthen the discovery process and increase litigation expenses.[66]  To correct this oversight, the Committee proposed that the responding party complete its production “no later than the time for inspection stated in the request or [at] a later reasonable time stated in the response.”[67]  For so-called “rolling productions,” the responding party “should specify the beginning and end dates of the production.”[68]  Such a provision should ultimately provide greater clarity and increased understanding surrounding productions of ESI.[69]

3.  Other Changes—Cost Shifting in Rule 26(c), Reductions in Discovery under Rules 30, 31, 33, 36

[17]      There were several additional changes the Committee recommended that are grounded in the concept of proportionality.  The new cost shifting provision in Rule 26(c) is particularly noteworthy.[70]  While several courts have implied cost-shifting authority presently exists in Rule 26(c) and have issued orders accordingly, the proposed changes would eliminate any ambiguity on this issue.[71]  Courts would be expressly authorized to allocate the expenses of discovery among the parties.[72]

[18]      The Committee has also suggested reductions in the number of depositions, interrogatories, and requests for admission.[73]  Under the draft amendments, the number of depositions would be reduced from ten to five.[74]  Oral deposition time would also be cut from seven hours to six.[75]  As for written discovery, the number of interrogatories would decrease from twenty-five to fifteen and a numerical limit of twenty-five would be introduced for requests for admission.[76]  That limit of twenty-five, however, would not apply to requests that seek to ascertain the genuineness of a particular document.[77]

C.  Case Management—Rules 4, 16, 26, 34

[19]      To better ensure that its objectives regarding cooperation and proportionality are achieved, the Committee has introduced several Rules changes that would augment the level of judicial involvement in case management.[78]  Most of these changes are designed to improve the effectiveness of the Rule 26(f) discovery conference, to encourage courts to provide input on key discovery issues at the outset of a case, and to expedite the commencement of discovery.[79]

1.  Rules 26 and 34—Improving the Effectiveness of the Rule 26(f) Discovery Conference

[20]      One way the Committee felt it could enable greater judicial involvement in case management was to require the parties to flesh out specific issues in the Rule 26(f) conference.[80]   The renewed emphasis on conducting a meaningful Rule 26(f) conference is significant as courts generally believe that a successful conference is the lynchpin for conducting discovery in a proportional manner.[81]

[21]      To enhance the usefulness of the conference, the Committee recommended amending Rule 26(f) to specifically require the parties to discuss any pertinent issues surrounding the preservation of ESI.[82]  This provision is calculated to get the parties thinking proactively about preservation problems that could arise later in discovery.[83]  It is also designed to work in conjunction with the proposed amendments to Rule 16(b)(3) and Rule 37(e).[84]  Changes to the former would expressly empower the court to issue a scheduling order addressing ESI preservation issues.[85]  Under the latter, the extent to which preservation issues were addressed at a discovery conference or in a scheduling order could very well affect any subsequent motion for sanctions for failure to preserve relevant ESI.[86]

[22]      Another amendment to Rule 26(f) would require the parties to discuss the need for a “clawback” order under Federal Rule of Evidence 502.[87]  Though underused, Rule 502(d) orders generally reduce the expense and hassle of litigating over the inadvertent disclosure of ESI protected by the lawyer-client privilege.[88]  To ensure this overlooked provision receives attention from litigants, the Committee has drafted a corresponding amendment to Rule 16(b)(3) that would specifically enable the court to address Rule 502(d) matters in a scheduling order.[89]

[23]      The final step the Committee has proposed for increasing the effectiveness of the Rule 26(f) conference is to amend Rule 26(d) and Rule 34(b)(2) to enable parties to serve Rule 34 document requests prior to that conference.[90]  These “early” requests, which are not deemed served until the conference, are designed to “facilitate the conference by allowing consideration of actual requests, providing a focus for specific discussion.”[91] This, the Committee hopes, will enable the parties to subsequently prepare Rule 34 requests that are more targeted and proportional to the issues in play.[92]

2.  Rule 16—Greater Judicial Input on Key Discovery Issues

[24]      As mentioned above, the Committee has suggested adding provisions to Rule 16(b)(3) that track those in Rule 26(f) so as to provide the opportunity for greater judicial input on certain e-Discovery issues at the outset of a case.[93]  In addition to these changes, Rule 16(b)(3) would also allow a court to require that the parties caucus with the court before filing a discovery motion.[94]  The purpose of this provision is to encourage the disposition of these matters without the expense or delay of motion practice.[95]  According to the Committee, various courts have used similar arrangements under their local rules that have “prove[n] highly effective in reducing cost and delay.”[96]

3.  Rules 4 and 16—Expediting the Commencement of Discovery

[25]      The Committee has also recommended the time for the commencement of discovery be shortened after the filing of the complaint so as to expedite the eventual disposition of a given case.[97]  In particular, Rule 4(m) would be revised to shorten time to serve the summons and complaint from 120 days to sixty days.[98]  In addition, the Rule 16(b)(2) amendment would reduce by thirty days the time when a court must issue a scheduling order.[99]

D.  Preservation and Sanctions under a Revised Federal Rule 37(e)

[26]      The Committee has separately considered issues regarding the over-preservation of evidence and the appropriate standard of culpability required to impose sanctions for any failures to preserve relevant information.[100]  Even though the current iteration of Rule 37(e) is supposed to provide guidance on these issues, amendments were deemed necessary given the inherent limitations with the Rule.[101]

[27]      As it now stands, Rule 37(e) is designed to protect litigants from court sanctions when the good faith, programmed operation of their computer systems automatically destroys ESI.[102]  Nevertheless, the Rule has largely proved ineffective as a national standard because it does not apply to pre-litigation information destruction activities.[103]  As a result, courts often used their inherent authority to bypass the Rule’s protections and punish clients that negligently, though not nefariously, destroyed documents before a lawsuit was filed.[104]  Moreover, the Rule applied only to ESI and did not address issues surrounding the preservation of paper documents or other forms of evidence.[105]  All of which has caused confusion among parties over what needs to be maintained for litigation, resulting in the over-preservation of information.[106]

[28]      The amendments to Rule 37(e) are designed to address these issues by “provid[ing] a uniform standard in federal court for sanctions for failure to preserve.”[107]  They do so by removing the possibility that courts could impose the so-called doomsday sanctions from Rule 37(b)(2)(A) for either negligent or grossly negligent conduct in connection with preservation obligations.[108]  Instead, the proposal would shield pre-litigation destruction of information from sanctions except where “the party’s actions” resulted in either of the following: “(i) caused substantial prejudice in the litigation and were willful or in bad faith; or (ii) irreparably deprived a party of any meaningful opportunity to present or defend against the claims in the litigation.”[109]

[29]      In making a determination on this issue, courts would no longer just rely on their inherent powers.[110]  Instead, they would employ a multifaceted analysis to examine the nature and motives underlying the party’s information retention decisions.[111]  Such factors include:

(A) the extent to which the party was on notice that litigation was likely and that the information would be discoverable;

(B) the reasonableness of the party’s efforts to preserve the information;

(C) whether the party received a request to preserve information, whether the request was clear and reasonable, and whether the person who made it and the party consulted in good faith about the scope of preservation;

(D) the proportionality of the preservation efforts to any anticipated or ongoing litigation; and

(E) whether the party timely sought the court’s guidance on any unresolved disputes about preserving discoverable information.[112]

[30]      By ensuring the analysis includes a broad range of considerations, the proposed Rule appears to delineate a balanced approach to preservation questions.[113]  Such an approach may very well benefit organizations, which could justify a reasonable document retention strategy on best corporate practices for defensible deletion.[114]  The Committee contemplates as much, observing that “[t]his subdivision [proposed Rule 37 (e)(1)(B)(i)] protects a party that has made reasonable preservation decisions in light of the factors identified in Rule 37(e)(2), which emphasize both reasonableness and proportionality.”[115]

[31]      While the draft amendments to Rule 37(e) provide some key protections for enterprises, the proposed Rule also addresses some of the lingering concerns from the plaintiffs’ bar.[116]  For example, the Rule specifically empowers the court to order “additional discovery” or other “curative measures” when a litigant has destroyed information that it should have retained for litigation.[117] Under these provisions, an aggrieved party can ferret out the circumstances surrounding the destruction of that data.[118]  If the party uncovers evidence suggesting the destruction was sufficiently grievous, it could ultimately justify the imposition of sanctions under either of the above tests.[119]

E.  The Instant Rules Proposals Will Impact Organizations

[32]      To be sure, the amendments the Committee has proposed will have a direct impact on organizations.  For example, the draft revisions to Rule 37(e) clearly emphasize the need for companies to develop reasonable information retention policies, along with a workable litigation hold procedure.[120]  The enterprise that does so could simultaneously eliminate large amounts of information and reduce its discovery costs and legal exposure.[121]

[33]      Another effect of the proposed changes is that they will force companies to address discovery matters on an expedited timeframe.[122]  The truncated time periods for the service of a complaint and the issuance of a scheduling order mean parties would have less time to prepare for the commencement of discovery.[123]

[34]      In addition, the proposals spotlight the need for litigants to be prepared to address substantive discovery issues early in the case.  This is evidenced by the draft requirement that litigants discuss ESI preservation and Rule 502(d) orders at the Rule 26(f) conference and the Rule 16(b) scheduling conference.[124]  The proposed advent of early Rule 34 document requests is also exemplary of this substantive discovery issue as it would require litigants to more thoroughly vet discovery issues at the Rule 26(f) conference.[125]  The elimination of open-ended, rolling document productions under a revised Rule 34(b)(2)(B) also underscores the need for better discovery preparations and expedited compliance.[126]

[35]      The proportionality changes to Rule 26(b)(1) will also impact organizations.[127]  Companies seeking to stave off overly broad requests will need to better understand the nature of their relevant data if they are to articulate with the necessary precision the burdens associated with production.[128]  Otherwise, disproportionate production orders will continue to be issued.[129]  In contrast, companies that have a grasp of their relevant information stand a greater chance of making the case to narrow the scope of the requests or having the costs of discovery shifted under the proposed amendment to Rule 26(c).[130]

[36]      In summary, there should be little dispute that the proposed amendments will affect litigants.  The question for organizations, however, is whether they will take the necessary measures to improve their information governance so they are prepared for the Rules changes once they are enacted.

 

III.  Practical Suggestions for Meeting the Information Governance Challenges Posed by the Draft Rules Changes

[37]      If enterprises expect to address the likely effects of the proposed Rules amendments, they will need to take proactive steps to ensure they can do so.[131]  While there are no quick or easy solutions to these problems, an increasingly popular method for effectively dealing with them is through an organizational strategy referred to as information governance.[132]  At its core, information governance is a comprehensive approach that companies adopt to satisfy the challenges associated with information retention, data security, privacy, and e-Discovery.[133]  Organizations that have done so have been successful in addressing the costs and risks associated with these formerly distinct disciplines.[134]

[38]      While there are many steps that enterprises can take to implement an effective information governance program, the five that I discuss in this Part are essential for those companies seeking to satisfy the draft Rules changes and thereby decrease the costs and delays associated with the discovery process.  They include developing reasonable information retention policies; preparing an effective litigation hold process; creating policies governing employee mobile device use; deploying technologies for ESI collection, search, and review; and developing a more coordinated and better managed relationship with outside counsel.  I consider each of these steps in turn.

A.  Develop Reasonable Information Retention Policies

[39]      If a company is really intent on obtaining more cost-effective results in discovery under the proposed Rules, it should examine its strategy for information retention.[135]  The time to conduct this examination is not in the crisis atmosphere of complex litigation.[136]  Instead, it should be part of the business plan for the organization.[137]  Effective information retention requires each business unit to identify the records that it creates, why it creates them, whether to retain them and for how long, who gets access to these records, and where the records are stored.[138]  The organization that can easily determine whether relevant records exist and where they should be located will clearly be ahead when litigation inevitably arises.[139]

[40]      This, in turn, should lead to the development of top-down information retention policies.[140]  Enterprises can hardly hope to decrease their discovery spending if their retention policies are antiquated, inadequate, or arbitrarily observed.[141]  Indeed, the casebooks are replete with examples of companies whose discovery costs skyrocketed because they failed to properly manage their data with reasonable retention protocols.[142]  The case of Northington v. H&M International is particularly instructive on this issue.[143]

[41]      In Northington, the court issued an adverse inference instruction to address the defendant company’s destruction of key e-mails and other ESI.[144]  The company failed to preserve those records because it did not think to implement a pre-litigation information retention strategy.[145]  For example, the company neglected to establish a formal document retention policy.[146]  Instead, “data retention . . . was evidently handled on an ad hoc, case-by-case basis.”[147]  This lack of organization eventually led to the loss of key data, costly motion practice, and the court’s sanctions award.[148]

[42]      To avoid these negative consequences, companies should insist that their in-house counsel work with IT professionals, records managers, and business units to jointly decide what data must be kept and for what length of time.[149]  By so doing, companies can spearhead the development of retention policies that are reasonable in relation to the enterprise’s business needs and its litigation profile.[150]  This should eventually lead to the systematic elimination of useless, superfluous, and/or harmful data in an organized and reasonable fashion.[151]  If performed in this manner, it is unlikely that such document destruction would be viewed as spoliation under the draft revisions to Rule 37(e) or much of the existing case law on this issue.[152]

B.  Prepare an Effective Litigation Hold Process

[43]      If information retention policies are to be effective for purposes of the draft revisions to Rule 37(e), they must be accompanied by a workable litigation hold process.[153]  Without a workable approach to litigation holds, the entire discovery process may very well collapse.[154]  For documents to be produced in litigation, they must first be preserved.[155]  Documents cannot be preserved if the key players or data source custodians are unaware that they must be retained.[156]  Indeed, employees and data sources may discard or overwrite ESI if they are oblivious to a preservation duty.[157]  This would leave organizations vulnerable to data loss and court sanctions, regardless of the proposed changes to Rule 37(e).[158]  No recent case is more instructive on this than E.I. du Pont de Nemours v. Kolon Industries.[159]

[44]      In Du Pont, the court issued a stiff rebuke against defendant Kolon Industries for failing to issue a timely and proper litigation hold.[160]  That rebuke came in the form of an instruction to the jury that Kolon executives and employees deleted key evidence after the company’s preservation duty was triggered.[161]  The jury responded by returning a $919 million verdict in favor of DuPont.[162]

[45]      The destruction at issue occurred when Kolon deleted e-mails and other records relevant to DuPont’s trade secret claims.[163]  After being apprised of the lawsuit and then receiving multiple litigation hold notices, various Kolon executives and employees met together and identified ESI that should be deleted.[164]  The ensuing data destruction was staggering: nearly 18,000 files and e-mails were destroyed.[165]  Furthermore, many of these materials went right to the heart of DuPont’s claim that key aspects of its Kevlar formula were allegedly misappropriated to improve Kolon’s competing product line.[166]

[46]      Surprisingly, however, the court did not blame Kolon’s employees as the principal culprits for spoliation.[167]  Instead, the court criticized the company’s attorneys and executives, reasoning they could have prevented the destruction of information through an effective litigation hold process.[168]  This was because the three hold notices circulated to the key players and data sources were either too limited in their distribution, ineffective since they were prepared in English for Korean-speaking employees, or were too late to prevent or otherwise alleviate the spoliation.[169]

[47]      The Du Pont case underscores the importance of developing a workable litigation hold process as part of the company’s overall information governance plan.[170]  As Du Pont teaches, organizations should identify what key players and data sources may have relevant information.[171]  Designated officials who are responsible for preparing the hold should then draft the hold instructions in an intelligible fashion.[172]  Finally, the hold should be circulated immediately to prevent data loss.[173]  It is only by following these suggestions that organizations can ensure that information subject to a preservation duty is actually retained and thereby avoid sanctions under the proposed amendments to Rule 37(e).[174]

C.  Create Policies Governing Mobile Device Use

[48]      Another aspect of information governance that can help companies address the impact of the Rules proposals is the development of policies governing the use of mobile devices.[175]  These devices—especially smartphones and tablet computers—are at the forefront of digital age innovations affecting businesses today.[176]  While these mobile devices have revolutionized the way in which business is conducted, they have also introduced a myriad of security, privacy, and e-Discovery complications for enterprises.[177]

[49]      In particular, mobile device use lessens the extent of corporate control over confidential business information.[178]  Whether that information consists of trade secrets, proprietary financial data, or attorney-client privileged communications, mobile devices allow employees to more easily disclose and misappropriate that information than they otherwise could have with traditional computer hardware.[179]  With a single touch of a smartphone screen, an employee can direct sensitive company data to personal cloud providers, social networking sites, or Wikileaks pages.[180]  Any of these scenarios could prove disastrous for an organization.[181]

[50]      Furthermore, an enterprise has the challenge of preserving and producing information maintained on a mobile device.[182]  The logistical challenges of locating, retaining, and turning over that data—all while trying to observe employee privacy—present complications for satisfying the proposed Rules amendments, among many other things.[183]

[51]      To address these and other problems associated with these devices, organizations will need to develop workable use policies.[184]  Such policies will need to address how employees should handle company data on mobile devices, regardless of whether those devices are work-issued or whether they belong to the employee.[185]  They should also delineate the nature and extent of the enterprise’s right to access data on the employee device, particularly for discovery purposes.[186]  To address inevitable privacy concerns that arise when trolling through an employee device for discoverable data, technologies could be downloaded on to that device to segregate and encrypt company information from personal materials.[187]  Such a measure would also help prevent an employee’s family or friends from accessing confidential ESI.[188]

[52]      Another best practice for enabling more rapid preservation and production of mobile device ESI is to eliminate any notion that the employee has a reasonable expectation of privacy in the device.[189]  While this can likely be done by policy for work-issued devices, it should probably be secured by separate agreement from an employee who is using a personal device under a “bring your own device” policy.[190]  The organization that has an unfettered right to obtain relevant ESI from a mobile device will more likely satisfy the preservation, proportionality, and accelerated compliance expectations of the proposed Rules amendments.[191]

D.  Deploy Technologies for ESI Collection, Search, and Review

[53]      Just as technology can facilitate compliance with company mobile device policies, ESI collection, search, and review technologies can help companies satisfy the expedited discovery objectives of the Rules proposals.[192]  This undoubtedly includes cutting edge innovations such as predictive coding and visualization tools.[193]

[54]      Predictive coding employs machine-learning technology to more readily pinpoint relevant ESI than would be possible for human reviewers.[194]  If properly utilized, predictive coding can also reduce the staff required to conduct document reviews.[195]  On the other hand, visualization tools use analytics and machine learning to provide companies with a better understanding of the nature of their relevant information.[196]  This allows for the detection of trends, relationships, and patterns within the universe of that information; all of which can expedite the search and review process.[197]

[55]      Enterprises would also be well served to familiarize themselves with traditional e-Discovery technology tools such as keyword search, concept search, email threading, and data clustering.[198]  With respect to keyword searches, there is significant confusion regarding their continued viability given some prominent court opinions frowning on so-called blind keyword searches.[199]  However, most e-Discovery jurisprudence and authoritative commentators confirm the effectiveness of certain keyword searches so far as they involve some combination of testing, sampling and iterative feedback.[200]

[56]      Regardless of the tools that a litigant selects for collection, search, and review, some form of technology is ultimately necessary to meet the proposed Rules changes.  It is not difficult to envision the problems that companies will have litigating under the revised Rules without using some combination of these tools.[201]  For example, enterprises will find it difficult to intelligently discuss discovery matters at the Rule 26(f) conference or the Rule 16(b) scheduling conference.  Nor will they be able to establish—much less meet—good faith production deadlines required by proposed Rule 34(b)(2)(B).  While various other scenarios similar to these abound, it is sufficient to observe that e-Discovery in 2014 and beyond will require help from technology.[202]

E.  Better Management of Outside Counsel

[57]      A final measure that companies should consider is developing a more carefully managed relationship with their retained outside counsel.[203]  More of an outgrowth of information governance, such a well-managed relationship has the potential to keep client discovery costs more reasonable while guiding counsel to litigate within the bounds of the proposed Rules changes.[204]

[58]      The first step that companies can take in this regard is to state their expectations for how discovery should be conducted at the time of retention or at the commencement of a suit.[205]  A realistic budget and staffing, considering those expectations, must be addressed.[206]  Companies should also emphasize to their engaged lawyers the importance of satisfying the requirements of the proposed Rules, particularly proportionality standards.[207]  While these requirements may be overlooked or even unknown to many attorneys, clients are bound—under penalty of sanctions—to ensure that their discovery efforts meet these standards.[208]  Moreover, company efforts to insist on proportional discovery may be rewarded with decreased preservation and collection costs.[209]

[59]      It is also crucial that organizations communicate with their outside lawyers regarding pertinent aspects of their information governance plan.[210]  To decrease the possibility for misunderstandings, companies should provide ready access to appropriate information technology personnel and relevant business leaders (the owners of the relevant information) to outside counsel.[211]  Outside counsel cannot be effective—and may inadvertently stumble into a costly e-Discovery sideshow—if they are unfamiliar with the company’s information governance and retention policies.[212]  In contrast, having such information will enable outside counsel to more easily negotiate key issues surrounding the discovery of ESI at the Rule 26(f) conference and Rule 16(b) scheduling conference.[213]  Moreover, open communication regarding this matter will facilitate strategy and logistics regarding the preservation and collection of relevant information.[214]

[60]      By taking these steps, organizations will increase their likelihood of compliance with the Rules proposals.  In addition, having such an organized strategy and partnership will reduce discovery delays and related legal fees that typically result from poor planning.[215]

 

IV.       Conclusion

[61]      Compliance with the proposed Rules amendments does not need to be an elusive concept.  Organizations can prepare for the Rules amendments by taking the initiative to implement or update their information governance strategy.  By following the suggestions that I delineate in this Article, along with other best practices, enterprises can satisfy the new requirements under the draft Rules revisions.  In so doing, they will likely reduce the costs and burdens associated with discovery—both now and in the future.

---

DownloadPDF

Cite as: Bennett B. Borden & Jason R. Baron, Finding the Signal in the Noise: Information Governance, Analytics, and the Future of Legal Practice, 20 Rich. J.L. & Tech. 7 (2014), http://jolt.richmond.edu/v20i2/article7.pdf.

 

Bennett B. Borden* and Jason R. Baron**

 

Introduction

[1]        In the watershed year of 2012, the world of law witnessed the first concrete discussion of how predictive analytics may be used to make legal practice more efficient.  That the conversation about the use of predictive analytics has emerged out of the e-Discovery sector of the law is not all that surprising: in the last decade and with increasing force since 2006—with the passage of revised Federal Rules of Civil Procedure that expressly took into account the fact that lawyers must confront “electronically stored information” in all its varieties—there has been a growing recognition among courts and commentators that the practice of litigation is changing dramatically.  What needs now to be recognized, however, is that the rapidly evolving tools and techniques that have been so helpful in providing efficient responses to document requests in complex litigation may be used in a variety of complementary ways to the discovery process itself.

[2]        This Article is informed by the authors’ strong views on the subject of using advanced technological strategies to be better at “information governance,” as defined herein.  If a certain evangelical strain appears to arise out of these pages, the authors willingly plead guilty.  One need not be an evangelist, however, but merely a realist to recognize that the legal world and the corporate world both are increasingly confronting the challenges and opportunities posed by “Big data.”[1]  This Article has a modest aim: to suggest certain paths forward where lawyers may add value in recommending to their clients greater use of advanced analytical techniques for the purpose of optimizing various aspects of information governance.  No attempt at comprehensiveness is aimed for here; instead, the motivation behind writing this Article is simply to take stock of where the legal profession is, as represented by the emerging case law on predictive coding represented by Da Silva Moore,[2] and to suggest that the expertise law firms have gained in this area may be applied in a variety of related contexts.

[3]        To accomplish what we are setting out to do, we will divide the discussion into the following parts: first, a synopsis of why and how predictive coding first emerged against the backdrop of e-Discovery.  This discussion will include a brief overview of predictive coding with references to the technical literature, as the subject has been recently covered exhaustively elsewhere.  Second, we will define what we mean by “Big data,” “analytics,” and “information governance,” for the purpose of providing a proper context for what follows.  Third, we will note those aspects of an information governance program that are most susceptible to the application of predictive coding and related analytical techniques.  Perhaps of most value, we wish to share a few “early” examples of where we as lawyers have brought advanced analytics, like predictive coding, to bear in non-litigation contexts and to assist our clients in creative new ways.  We fully expect that what we say here will be overrun with a multitude of real-life use cases soon to emerge in the legal space.  Armed with the knowledge that we are attempting to catch lightning in a bottle and that law reviews on subjects such as this one have ever decreasing “shelf-lives”[3] in terms of the value proposition they provide, we proceed nonetheless.

A.  The Path to Da Silva Moore

[4]        The Law of Search and Retrieval.  In the beginning, there was manual review.  Any graduate of a law school during the latter part of the twentieth century who found herself or himself employed before the year 2000 at a law firm specializing in litigation and engaged in high-stakes discovery remembers well how document review was conducted: legions of lawyers with hundreds if not thousands of boxes in warehouses, reviewing folders and pages one-by-one in an effort to find the relevant needles in the haystack.[4]  (Some of us also remember “Sheparding” a case to find subsequent citations to it, using red and yellow booklets, before automated key-citing came along.)  Although manual review continues to remain a default practice in a variety of more modest engagements, it is increasingly the case that all of discovery involves “e-Discovery” of some sort—that the world is simply “awash in data”[5] (starting but by no means ending with email, messages and other textual documents of all varieties), and that it will increasingly be the unusual case of any size where documents in paper form still loom large as the principal source of discovery.

[5]        At the turn of the century, the dawning awareness of the need to deal with a new realm of electronically stored information (“ESI”) led to burgeoning efforts on many fronts, including, for example, the creation of The Sedona Conference working group on electronic document retention and production, members of which drafted The Sedona Conference Principles: Addressing Electronic Document Production (2005; 2d ed. 2007) and its “prequel,” The Sedona Guidelines: Best Practice Guidelines and Commentary for Managing Records and Information in the Electronic Age (2005; 2d ed. 2007).  These early commentaries, including a smattering of pre-2006 case law,[6] recognized that changes in legal practice were necessary to accommodate the big changes coming in the world of records and information management within the enterprise.  Subsequent developments would constitute various complementary threads leading to the greater use of analytics in the legal space.

[6]        First, part of that early recognition was that in an inflationary universe of rapidly expanding amounts of ESI, new tools and techniques would be necessary for the legal profession to adapt and keep up with the times.[7]  By the time of adoption of the revised Federal Rules of Civil Procedure in 2006, which expressly added the term “ESI” to supplement “documents” in the rule set applicable to discovery practice, the legal profession was well aware of the need to perform automated searches in the form of keyword searching within large data sets as the only realistically available means for sorting information into relevant and non-relevant evidence in particular engagements, be they litigation or investigations.  So too, it was recognized early on in commentaries[8] and followed by case law[9] that keyword searching, as good a tool as it was, had profound limitations that in the end do not scale well.  At the end of the day, even being able to limit or cull down a large data set to one percent of its original size through the use of keywords leaves the lawyer with the near impossible task of manually reviewing a very large set of documents at great cost.[10]

[7]        Second, in evolving e-Discovery practice after 2006, a growing recognition also occurred around the idea that e-Discovery workflows are an “industrial” process in need of better metrics and measures for evaluating the quality of productions of large data sets.  As recognized in The Sedona Conference Commentary on Achieving Quality in E-discovery (Post-Public Comment Version 2013):

The legal profession has passe
d a crossroads: When faced with a choice between continuing to conduct discovery as it had “always been practiced” in a paper world—before the advent of computers, the Internet, and the exponential growth of electronically stored information (ESI)—or alternatively embracing new ways of thinking in today’s digital world, practitioners and parties acknowledged a new reality and chose progress.  But while the initial steps are completed, cost-conscious clients and over-burdened judges are increasingly demanding that parties find new approaches to solve litigation problems.[11]

 [8]        The Commentary goes on to suggest that the legal profession would benefit from greater

awareness about a variety of processes, tools, techniques, methods, and metrics that fall broadly under the umbrella term “quality measures” and that may be of assistance in handling ESI throughout the various phases of the discovery workflow process.  These include greater use of project management, sampling, machine learning, and other means to verify the accuracy and completeness of what constitutes the “output” of e-[D]iscovery.  Such collective measures, drawn from a wide variety of scientific and management disciplines, are intended only as an entry-point for further discussion, rather than an all-inclusive checklist or cookie-cutter solution to all e-[D]iscovery issues.[12]

 [9]        Indeed, more recent case law has recognized the need for quality control, including through the use of greater sampling, iterative methods, and phased productions in line with principles of proportionality.[13]  Still other case law has emphasized the need for cooperation among parties in litigation on technical subjects, especially at the margins of, or outside the range of, lawyer expertise if not basic competence.

[10]      Active or supervised “machine learning,” as referred to here in the context of e-Discovery, refers to a set of analytical tools and techniques that go by a variety of names, such as “predictive coding,” “computer-assisted review,” and “technology assisted review.”  As explained in one helpful recent monograph:

Predictive coding is the process of using a smaller set of manual reviewed and coded documents as examples to build a computer generated mathematical model that is then used to predict the coding on a larger set of documents.  It is a specialized application of a class of techniques referred to as supervised machine-learning in computer science.  Other technical terms often used to describe predictive coding include document (or text) “classification” and document (or text) “categorization.”[14]

 [11]      And as stated in The Sedona Conference Best Practices Commentary on the Use of Search and Information Retrieval Methods in E-Discovery (Post-Public Comment Version 2013):

Generally put, computer- or technology-assisted approaches are based on iterative processes where one (or more) attorneys or [Information Retrieval] experts train the software, using document exemplars, to differentiate between relevant and non-relevant documents.  In most cases, these technologies are combined with statistical and quality assurance features that assess the quality of the results.  The research . . . has demonstrated such techniques superior, in most cases, to traditional keyword based search, and, even, in some cases, to human review.

 The computer- or technology-assisted review paradigm is the joint product of human expertise (usually an attorney or IR expert working in concert with case attorneys) and technology.  The quality of the application’s output, which is an assessment or ranking of the relevance of each document in the collection, is highly dependent on the quality of the input, that is, the human training. Best practices focus on the utilization of informed, experienced, and reliable individuals training the system.  These individuals work in close consultation with the legal team handling the matter, for engineering the application. Similarly . . . the defensibility and usability of computer- or technology-assisted review tools require the application of statistically-valid approaches to selection of a “seed” or “training” set of documents, monitoring of the training process, sampling, and quantification and verification of the results.[15] 

A discussion of the mathematical algorithms that underlie predictive coding is beyond the intended scope of this Article, but the interested reader should refer to references cited at the margin to understand better what is “going on under the hood” with respect to the mathematics involved.[16]

[12]      The Da Silva Moore Precedent.  The various threads in search and retrieval law, including the need for advanced search methods applied to document review in a world of increasingly large data sets, were well known by 2012.  In February 2012, drawing on recent research and scholarship emanating out of the Text Retrieval Conference (TREC) Legal Track[17] and the 2007 public comment version of The Sedona Conference Search Commentary,[18] Judge Peck approached the Da Silva Moore case as an appropriate vehicle to provide a judicial blessing for the use of predictive coding in e-Discovery.  In doing so, however, Judge Peck’s opinion may also be viewed as setting the stage for greater use of analytics generally in the information governance practice area, beyond “mere” e-Discovery.

[13]      Plaintiffs in Da Silva Moore brought claims of gender discrimination against defendant advertising conglomerate Publicis Groupe and its United States public relations subsidiary, defendant MSL Group.[19]  Prior to the February 2012 opinion issued by Judge Peck, the parties had already agreed that defendant MSL would use predictive coding to review and produce relevant documents, but disagreed on methodology.[20]  Defendant MSL proposed starting with the manual review of a random sample of documents to create a “seed set” of documents that would be used to train the predictive coding software.[21]  Plaintiffs would participate in the creation of the “seed set” of documents by offering keywords.[22] All documents reviewed during the creation of the “seed set,” relevant or irrelevant, would be provided to plaintiffs.[23]

[14]      After creation of the seed set of documents, MSL proposed using a series of “iterative rounds” to test and stabilize the training software.[24]  The results of these iterative rounds would be provided to plaintiffs, who would be able to provide feedback to further refine the searches.[25]   Judge Peck accepted MSL’s proposal.[26]  Plaintiffs filed objections with the district judge on the grounds that Judge Peck’s approval of MSL’s protocol unlawfully disposed of MSL’s duty under Federal Rule of Civil Procedure 26(g) to certify the completeness of its document collection, and the methodology in MSL’s protocol was not sufficiently reliable to satisfy Federal Rule of Evidence 702 and Daubert.[27]

 [15]      Judge Peck found the plaintiffs’ objections to be misplaced and irrelevant.[28]  With respect to Federal Rule of Civil Procedure 26(g), Judge Peck commented that no attorney could certify the completeness of a document production as large as MSL’s. Moreover, Federal Rule of Civil Procedure 26(g) did not require the type of certification plaintiffs described.[29]  Further, Federal Rule of Evidence 702 and Daubert are applicable to expert methodology, not to methodologies used in electronic discovery.[30]  Judge Peck went on to note that the decision to allow computer-assisted review in this case was easy because the parties agreed to this method of document collection and review.[31]  While computer-assisted review may not be a perfect system, he found it to be more
efficient and effective than using manual review and keyword searches to locate responsive documents.[32]  Use of predictive coding was appropriate in this case considering:

 (1) the parties’ agreement, (2) the vast amount of ESI to be reviewed (over three million documents), (3) the superiority of computer-assisted review to the available alternatives (i.e., linear manual review or keyword searches), (4) the need for cost effectiveness and proportionality under Rule 26(b)(2)(C), and (5) the transparent process proposed by MSL.[33]

 [16]      In issuing this opinion, Judge Peck became the first judge to approve the use of computer-assisted review.[34]  He also stressed the limitations of his opinion, stating that computer-assisted review may not be appropriate in all cases, and his opinion was not intended to endorse any particular computer-assisted review method.[35]  However, Judge Peck encouraged the Bar to consider computer-assisted review as an available tool for “large-data-volume cases” where use of such methods could save significant amounts of legal fees.[36]  Judge Peck also stressed the importance of cooperation, or what he called “strategic proactive disclosure of information.”  If counsel is knowledgeable about the client’s key custodians and fully explains proposed search methods to opposing counsel and the court, those proposed search methods are more likely to be approved.  To sum up his opinion, Judge Peck noted that “[c]ounsel no longer have to worry about being the ‘first’ or ‘guinea pig’ for judicial acceptance of computer-assisted review. . . . Computer-assisted review now can be considered judicially-approved for use in appropriate cases.”[37]  In the two years since Da Silva Moore, in addition to cases in which the parties have agreed upon a predictive coding methodology,[38] courts have confronted the issue of having to rule on either the requesting or responding party’s motion to compel a judicial “blessing” of the use of predictive coding (however termed).  In Global Aerospace,[39] the responding party asked that the court approve its own use of such technique; in Kleen Products, the requesting party made an ultimately unsuccessful demand for a “do-over” in discovery, where the responding party had used keyword search methods and the plaintiffs were demanding that more advanced methods be tried.[40]  In the EOHRB case, the Court sua sponte suggested that the parties consider using predictive coding, including the same vendor.[41]  And in the In re Biomet case,[42] the court approved a predictive coding methodology over the objections of the requesting party.  These cases represent only some of the reported decisions to date, and we suspect that there will be dozens of reported cases and many more unreported ones in the near term.

[17]      As recognized in these cases (implicitly or explicitly), as well as in a growing number of commentaries,[43] predictive coding is an analytical technique holding the promise of achieving much greater efficiencies in the e-Discovery process.  Notwithstanding Da Silva Moore’s call to action, it needs to be conceded, however, that the research has not proven that active machine learning techniques will always achieve greater scores than keyword search or manual review.[44]  Additionally, we bow to the reality that in a large class of cases the use of predictive coding is currently infeasible or unwarranted, especially as a matter of cost.[45]

[18]      Nevertheless, it seems apparent that the legal profession finds itself in a new place—namely, in need of recognizing that artificial intelligence techniques are growing in strength from year to year—and thus it appears to be only a matter of time until a much greater percentage of complex cases involving a large magnitude of ESI will constitute good candidates for lawyers using predictive coding techniques, both as available currently and as improved with future technological progress.  As William Gibson once put it, “the future is here, it’s just not evenly distributed.”[46]

 B.  Information Governance and Analytics in the Era of Big Data

[19]      We are now in a post-Da Silva Moore, “Big data” era where lawyers are on constructive (if not actual) notice of a world of technology assisted review techniques available at least in the sphere of e-Discovery.  The proposition being advanced is that the greater revelation of Da Silva Moore is how similar the techniques being put forward as best practices in e-Discovery fit a larger realm of issues familiar to lawyers, many of which fall within what is increasingly being recognized as “information governance” practice.  It is here where we can break new ground in our legal practice by recommending the use of these advanced techniques to solve real-world problems of our clients.  First, however, some definitions are in order to better frame the legal issues that will follow in Section C.

[20]      Big data.  It has been noted that “Big data is a loosely defined term used to describe data sets so large and complex that they become awkward to work with using standard statistical software.”[47]  Alternatively, “Big data” is a term that “describe[s] the technologies and techniques used to capture and utilize the exponentially increasing streams of data with the goal of bringing enterprise-wide visibility and insights to make rapid critical decisions.”[48]

[21]      The fact that the data encountered within the corporate enterprise increasingly is indeed “big” means, at least according to Gartner, that it not only has volume, but velocity and complexity as well.[49]  As Bill Franks has put it, “What this means is that you aren’t just getting a lot of data when you work with big data.  It’s also coming at you fast, it’s coming at you in complex formats, and it’s coming at you from a variety of sources.”[50]  These elements all significantly contribute to the challenge of finding signals in the noise.

[22]      These definitions seem to get us closer to what makes Big data a new and interesting phenomenon in the world: it is not its volume alone, but the fact that we are able to “mine” large data sets using new and advanced techniques to uncover unexpected relationships, patterns and categories within these data sets, that makes the field potentially exciting.  Indeed, “it is tempting to understand big data solely in terms of size. But that would be misleading. Big data is also characterized by the ability to render into data many aspects of the world that have never been quantified before; call it ‘datafication.’”[51]

[23]      Analytics.  Second, we need to place “predictive coding” as one form of active machine learning in the context of the broader realm of “analytics.”  In their book, Keeping Up With the Quants: Your Guide To Understanding and Using Analytics,[52] authors Thomas Davenport and Jinho Kim provide a useful construct in categorizing the newly emergent field of “analytics”: they define analytics to mean “the extensive use of data, statistical and quantitative analysis, explanatory and predictive models, and fact-based management to drive decisions and add value,” going on to say that “[a]nalytics is all about making sense of big data, and using it for competitive advantage.”  The authors divide the world of analytics into three categories:

 (i)             descriptive analytics – gathering, organizing, tabulating and depicting data;

(ii)              predictive analytics – using data to predict future courses of action; and

(iii)             prescriptive analytics – recommendations on future courses of action.[53]

 
[24]      To the extent that “predictive coding” has been used to date to have machines “predict” relevancy in large ESI data sets, the term comfortably can be said to fall within category (ii).   But the world of analytics is a larger universe, encompassing a greater number of mathematical magic tricks,[54] and this should be kept in mind as we choose to limit our discussion here to a few examples of how predictive coding as one form of analytics may be usefully applied in non-traditional contexts.[55]

 [25]      Corporations (much ahead of the legal profession) have rushed headlong during the past half-decade to use a variety of analytics to understand the Big data they increasingly hold, to add value, and to improve the bottom line.[56]  A 2013 AIIM study indicates that corporations find analytics to be useful in a variety of settings.[57]

[26]      Information Governance.  “Information governance,” as defined in The Sedona Conference’s recently published Commentary on the subject, means:

 an organization’s coordinated, interdisciplinary approach to satisfying information legal and compliance requirements and managing information risks while optimizing information value.  As such, Information Governance encompasses and reconciles the various legal and compliance requirements and risks addressed by different information focused disciplines, such as records and information management (“RIM”), data privacy, information security, and e-[D]iscovery.[58]

 Or, as highlighted by the seminal law review article devoted to information governance written by Charles R. Ragan who quotes Barclay Blair in defining information governance as a “‘new approach’ that “builds upon and adapts disciplines like records management and retention, archiving business analytics, and IT governance to create an integrated model for harnessing and controlling enterprise information . . . [I]t is an evolutionary model that requires organizations to make real changes.”[59]

[27]      As the Sedona IG Commentary highlights, “many organizations have traditionally used siloed approaches when managing information.”[60]  The “core shortcoming” of this approach is “that those within particular silos are constrained by the culture, knowledge, and short-term goals of their business unit, administrative function, or discipline.”[61]  This leads in turn to key actors within the organization having “no knowledge of gaps and overlaps in technology or information in relation to other silos. . . .”[62]  In such situations, “[t]here is no overall governance or coordination for managing information as an asset, and there is no roadmap for the current and future use of information technology.”[63]

[28]      The Sedona IG Commentary goes on to provide eleven principles of what constitutes good IG practices, of which Principle 10 is of special relevance to our discussion here: “An organization should consider leveraging the power of new technologies in its Information Governance program.”[64]  As stated therein,

         Organizations should consider using advanced tools and technologies to perform various types of categorization and classification activities. . . such as machine learning, auto-categorization, and predictive analytics to perform multiple purposes, including (i) optimizing the governance of information for traditional RIM [records and information management]; (ii) providing more efficient and more efficacious means of accessing  information for e-discovery, compliance, and open records laws, and (iii) advancing sophisticated business intelligence across the enterprise.[65]

 With respect to the latter category, the Commentary goes on to specifically identify areas where predictive analytics may be used in compliance programs “to predict and prevent wrongful or negligent conduct that might result in data breach or loss,” as a type of “early warning system.”[66] It is precisely this latter type of conduct that we wish to primarily explore in the next section, along with a few final words on using analytics with auto-categorization for the purpose of records classification and data remediation.

C.  Applying the Lessons of E-Discovery In Using Analytics for Optimal Information Governance: Some Examples

 [29]      Advanced analytics are increasingly being used in the e-Discovery context because the legal profession has begun to realize the limitations of manual and keyword searching, while at the same time seeing how advanced techniques are at least as efficacious and far more efficient in a wide variety of substantial engagements.  But more efficient and at least as equally effective at doing what, precisely?  In e-Discovery, the primary information task involves separating relevant from non-relevant, and to a secondary degree, privileged from non-privileged information, in documents and ESI.  Indeed, lawyers are under a duty to make “reasonable”—not perfect—efforts to find all relevant documents within the scope of a given discovery request.[67]  The illusiveness of this quest in an exponentially expanding data universe is becoming increasingly apparent to many.[68]

[30]      Moreover, the degree of success in being able to either find or demand substantial amounts of relevant information is not (nor should it be) the fundamental goal or point of engaging in e-Discovery.[69]  Rather, the liberal discovery rules that at least U.S. lawyers operate within have as their underlying purpose the ferreting out of important, material facts to the case at hand.  The increasingly overwhelming nature of ESI poses clear technological obstacles to a lawyer en route to efficiently engaging in developing facts from all those relevant documents to determine what happened and why.[70]  The promise of using an advanced analytical method such as predictive coding is its ability to quickly find and rank-order the most relevant documents for answering these questions.  For once we determine how something happened and why, it is relatively straightforward to figure out the parties’ respective rights, responsibilities, and even liability.  That is precisely the point of litigation, and the purpose of the Rules that govern it.[71]  And, facts drive it all.

[31]      Given our increasing ability in litigation in finding the most relevant needles (i.e., facts) in the Big data haystack, it stands to consider whether similar methods may be successfully applied in non-litigation contexts.  Somewhat paradoxically, however, experience indicates that there are advantages to dealing with larger volumes of data when applying analytical tools and methods to solve corporate legal issues.  That is, while a vast amount of data residing in corporate networks and repositories admittedly poses complex information governance challenges, the volume of Big data also may be a boon to the investigator simply trying to figure out what happened.  This is the case because there are simply many more data points from which to derive facts.  One can liken the phenomenon to the difference in quality of a one-megapixel versus a ten-megapixel picture: the difference in the quality of the image is a function of the greater density of points of illumination.

[32]      Big data is more data, and more data means the potential for a more complete picture of what happened in a given situation of interest, assuming of course that the facts can be captured efficiently.  The problem is not one of volume, but of visibility.  In the era of Big data, the investigator with the more powerful analytical methods, who can search into vast repositories of ESI to draw out the facts that are critical to the question at hand, is king (or queen).  This is where the skillful application of advanced analytics to Big data can bring about some remarkable results.  The true strategic advant
age of advanced analytics is the speed with which an accurate answer can be ascertained.[72]

[33]      True Life Example #1.[73]  A corporate client is being sued by a former employee in a whistleblower qui tam action.[74]  Because of the False Claims Act allegations, the suit represented a significant threat to the company.  The corporation retains counsel to understand the client’s information systems as well as its key players, and to assist in the implementation of a litigation hold.  Counsel strategically targets the data most likely to shed light on the facts.  The law firm’s Fact Development Team applies advanced analytics to 675,000 documents, and within four days knows enough to defend the client’s position that the allegations are indisputably baseless.  All of this is done before the answer to the Complaint was due.

[34]      Armed with this information, counsel for the corporation approached plaintiff’s counsel and asked to meet.  Prior to the meeting, the corporation voluntarily produced 12,500 documents that laid out the parties’ position precisely.  Counsel then met with plaintiff’s counsel and walked them through the evidence, laying out all the facts.  The case ended up being settled within days for what amounted to nuisance value based on a retaliation claim—without any discovery, and at a small fraction of the cost budgeted for the litigation.

[35]      This example indicates that the real power of advanced analytics is not merely in potentially reducing the cost of vexatious litigation, but rather the strategic advantage that comes with counsel getting to an answer quickly and accurately.  This precise strategic advantage has many applications outside of litigation, each of which involves an aspect of optimizing information governance.

[36]      Only a short step away from the direct litigation realm is using advanced analytics for investigations, either in response to a regulatory inquiry or for purely internal purposes.  As we have already seen, corporate clients are often faced with circumstances where determining whether an allegation is true, and the scope of the potential problem if it is, is critically important.  Often, management must wait, unsure of their company’s exposure and how to remediate it, while traditional investigation techniques crawl along.  However, with the skillful application of advanced analytics upon the right data set, accurate answers can be determined with remarkable speed.

[37]      True Life Example #2.  A highly regulated manufacturing client decided to outsource the function of safety testing some of its products.  A director of the department whose function was being outsourced was offered a generous severance package.  Late on a Friday afternoon, the soon-to-be former director sent an email to the company’s CEO demanding four times the severance amount and threatened to go to the company’s regulator with a list of ten supposed major violations that he described in the email if he did not receive what he was asking for.  He gave the company until the following Monday to respond.

[38]      The lawyers were called in.  They analyzed the list of allegations and determined which IT systems would most likely contain data that would prove their veracity and immediately pulled the data.  Applying advanced analytics, the law firm’s Fact Development Team analyzed on the order of 275,000 documents in thirty-six hours.  By that Monday morning, counsel was able to present a report to the company’s board indisputably proving that the allegations were unfounded.

[39]      True Life Example #3.  A major company received a whistleblower letter from a reputable third party alleging that several senior personnel were involved with an elaborate kickback scheme that also involved FCPA violations.  If true, the company would have faced serious regulatory and legal issues, as well as major internal difficulties.  Because of the extremely sensitive nature of the allegations, a traditional investigation was not possible; even knowing certain personnel were under investigation could have had immense consequences.

[40]      The lawyers were tasked with determining whether there was any information within the company’s possession that shed any light on the allegations.  If there were, the company would proceed to take whatever steps were required.  The investigation was of such a secret nature that no one was authorized to involve the internal IT staff.  Fortunately, counsel knew the company and its information systems well.  Over a weekend, they were able to pull 8.5 million documents from relevant systems using the law firm’s personnel.  This turned out to be a highly complex investigation involving a number of potential subjects, where the task involved tracking the subject’s travel, meetings with suppliers, subsequent sales orders and fulfillments, rebates and promotions, all across several years.

[41]      Again, applying advanced analytics, the law firm’s Fact Development Team analyzed the 8.5 million documents in ten days.  They were able to prove that the allegations were largely baseless, and precisely where there were potential areas of concern.  Counsel also was able to make clear recommendations for areas of further investigation and for modifying compliance tracking and programs.  The company was able to act quickly and with certainty.  These real-life use cases illustrate how the power of analytics enhances the ability of lawyers to provide legal advice under conditions of “certainty” previously unobtainable, at least in the past few decades of the digital era.  “Certainty” is a somewhat foreign concept in the law—lawyers tend to be a conservative and caveating bunch, largely because certainty has historically been hard to come by, or at least prohibitively expensive.  With advanced analytics and good lawyers who know how to use these new tools, that is no longer necessarily the case.  There is so much data that if one cannot, after a reasonable effort, find evidence of a fact in the vastness of a company’s electronic information (as long as you have the right information), the fact most likely is not true.  Such has been illustrated, proving a negative is particularly useful in investigations.

[42]      Using advanced analytics (and good lawyering) for investigations is not that far removed from using it for litigation: one is still attempting to find the answer to the question of what happened and why. But there are many other questions that companies would like to ask of their data.  And indeed, both the analytics tools and the fact development techniques used in litigation and investigations can be “tuned” to solve a variety of novel issues facing our clients.

[43]      For example, analytics can be used to vet candidates for political appointments as well as candidates for senior leadership positions.  Due to the candid nature of the medium, providing access to corporate email coupled with using analytic capabilities allows for an accurate picture to be drawn before a decision is made with regard to making a candidate your next CEO or running mate.  Analytics can be used to analyze business divisions to identify good and bad leaders, how decisions are made, why a division is more successful than another, and many more similar applications.

[44]      Quite simply, a company’s data is the digital imprint of the actions and decisions of all of its managers and employees.  Having insight into those actions and decisions can be immensely valuable.  That value has lain largely fallow, hidden in plain sight because the valuable wheat could not effectively be sifted from the chaff.  With the proper application of advanced analytics, that is no longer the case.  The answers we can obtain are limited only by the creativity of management in asking the right questions.

[45]      True Life Example #4.  Advanced a
nalytics used upon the major acquisition of another company by a corporate client.  As with most acquisitions, the client undertook traditional due diligence, gathering information from the target regarding its financial performance, customers, market share, receivables, potential liabilities, and came up with a valuation, an appropriate multiplier, and a final purchase price.  Also as is typical, the acquisition agreement contained a provision such that if the disclosures made by the target were found to be off by a certain margin within thirty days of the acquisition, the purchase price would be adjusted.

[46]      The moment the acquisition closed, the corporate client then owned all of the target’s information systems.  Having some concern about the bases for some of the target’s disclosures, at the client’s request counsel proceeded to use analytics on those newly acquired systems to determine what we could about those disclosures.  Preparing a company for sale is a complicated affair, with many people involved in gathering information to present to the acquirer to satisfy due diligence.  This gathering and presentation of information is done primarily through electronic means—and leaves a trail.

[47]      Using advanced analytics, the law firm’s Fact Development Team traced the compilation of the target’s due diligence information, including all of the discussion that went along with it.  They were able to understand the source of each disclosure, the reasonableness of its basis, and any weaknesses within it.  They uncovered disagreements within the target over such things as what the right numbers were, or how much of a liability to disclose.  Using this information, counsel prepared a claim in accord with the adjustment provision seeking twenty-five percent of the purchase price totaling millions of dollars.  The claim was primarily composed using quotes from their own documents.  It is difficult to argue with yourself.

[48]      As demonstrated, using advanced analytics in the form of predictive coding and similar technologies can accomplish some notable aims.  But each of the prior examples uses data to look back to determine what has already occurred: the descriptive use of analytics.[75]  This is extremely valuable.  But for many of a law firm’s clients, it would be even more useful to be able to catch bad actors while the misconduct was occurring, or even to predict misconduct before it happens.

[49]      Based on the anecdotal experience gathered from many past investigations, the authors believe that certain kinds of misconduct follow certain patterns, and that when bad actors are acting badly, they tend to undertake the same kinds of actions, or are experiencing similar circumstances.  For example, in our experience the primary factors that pertain to a person committing fraud are personal relationship problems, financial difficulties, drug or alcohol problems, gambling, a feeling of under appreciation at work, and unreasonable pressure to achieve a work outcome without a legitimate way to accomplish it (and so they attempt illegitimate ways to do so).  These factors are often detectable in the electronic information the subject creates.  Similarly, a person who is harassing or discriminating against others also tends to undertake specific actions and use particular language in communications.  All of these indicia of misconduct are detectable using advanced analytics and skillful strategy.

[50]      Lawyers have gotten quite good at finding this information when looking back in time.  We thought, then, that it should not be too difficult to find this information while the misconduct is unfolding, or to identify warning signs that misconduct is likely to occur, and seek to provide relief of certain factors where possible or take corrective action when needed and as early as possible.  So, we put this to the test, developing Early Warning Systems (“EWS”) for some of our clients.

[51]      The idea for an EWS first occurred to one of the authors when working on a pro bono matter with the ACLU in a case against the Baltimore Police Department (“BPD”) alleging unconstitutional arrest practices in its Zero Tolerance Policing policies.[76]  As a result of the case, the BPD agreed to, among other things, implement a tracking system whereby certain data points were collected regarding police officer conduct and arrest practices that research had proven were warning signs of potential problem officers.[77]  The accumulation of certain data points with respect to an officer triggered a review of the officer’s conduct, with various remediation outcomes.[78]  We thought that a similar approach could be used for our clients.

[52]      An EWS is a tricky thing to implement, and requires careful consideration of many factors, employee privacy at the forefront.  However, with careful planning, policy development, and training, an effective EWS can be designed and implemented.  Predictive analytics applications can be trained to search for indicia of the conduct, language, or factors across information systems.  The specific systems to be targeted will vary depending on what is being sought and the systems most likely to contain it and will vary greatly from company to company.  But, when properly trained and targeted, we have found these systems to be very effective in detecting and even preventing misconduct.  We believe that this use of predictive analytics will become one of the most powerful applications of this technology in the near future.

[53]      Moving from the business intelligence aspects of information governance to the arguably more prosaic field of records and information management, the authors also count themselves as true believers in the power of analytics to optimize traditional RIM (records and information management) functionality.  A full discussion of archival and records management practices in the digital age is beyond the scope of this Article, but the interested reader will find a wealth of scholarly literature in the leading journals discussing how the traditional practice of records management is being transformed in the digital age. One of the authors has argued that predictive coding and like methods are the most promising way to open up “dark archives” in the public sector, such as digital collections of data appraised as permanent records (mostly consisting of White House email at this point), that for reasons of privacy or privilege will be otherwise inaccessible to the public for many decades to come.[79]

[54]      In the authors’ experience, email archiving using auto-categorization for recordkeeping purposes is available using existing software in the marketplace.  In such instances, email is populated in specific “buckets” in a repository depending on how it is characterized, based on either the position of the creator or recipient of the email, the subject matter, or based on some other attribute appearing as metadata.[80]  In the most advanced versions of auto-categorization software, the system “learns” as it is trained using exemplars in a seed set selected by subject matter experts (i.e., records managers or expert end users), via a protocol highly reminiscent of the methods adopted by the parties in Da Silva Moore and similar cases.  It is only a matter of time before predictive analytics is more widely used to optimize auto-classification while reducing the burden on end users to perform manual records management functions.[81]

[55]      In similar fashion, the power of predictive analytics to reliably classify content after adequate training makes such tools optimal for data remediation efforts.  The problem of legacy data in corporations is well known, and only growing over time with the inflationary expansion of the ESI universe.[82]  Using advanced analytics to classify low value data, the chaos that is the reality of most shared drives and other joint data repositories, may potentially be reduced by
orders of magnitude.  The challenge of engaging in defensible deletion is one important aspect of optimizing information governance.[83]

 

Conclusion

 [56]      As was made clear at the outset, it is the authors’ intent merely to scratch the surface of what is possible in the analytics space as applied to matters of importance for corporate information governance.  No one has a one hundred percent reliable crystal ball, but it seems evident that as computing power increases, those forms of artificial intelligence that we have referred to here as analytics will themselves only grow in importance in both our daily and professional lives.  By the end of this decade, we would be surprised if the following do not occur: pervasive use of business intelligence software; the use of more automated decision-making (also known as “operational business intelligence”); the use of alerts in the form of early warning systems including the type described above; much greater use of text mining and predictive technologies across a variety of domains.[84]

[57]      All of these developments dovetail with the expected demand on the part of corporate clients for lawyers to be familiar with state of the art practices in the information governance space, as already anticipated by the type of technology that Da Silva Moore and related cases suggest.  As best said in The Sedona Commentary on Achieving Quality in E-Discovery, “[i]n the end, cost-conscious firms, organizations, and institutions of all types that are intent on best practices . . . will demand that parties undertake new ways of thinking about how to solve e-[D]iscovery problems. . . .” [85]  The same holds true for the greater playing field of information governance.  Lawyers who have embraced analytics will have a leg up on their competition in this brave new space.

 

DownloadPDF

Cite as: Dennis R. Kiker, Defensible Data Deletion: A Practical Approach to Reducing Cost and Managing Risk Associated with Expanding Enterprise Data, 20 Rich. J.L. & Tech. 6 (2014), http://jolt.richmond.edu/v20i2/article6.pdf.

 

Dennis R. Kiker*

 

I.  Introduction

[1]        Modern businesses are hosts to steadily increasing volumes of data, creating significant cost and risk while potentially compromising the current and future performance and stability of the information systems in which the data reside.  To mitigate these costs and risks, many companies are considering initiatives to identify and eliminate information that is not needed for any business or legal purpose (a process referred to herein as “data remediation”).  There are several challenges for any such initiative, the most significant of which may be the fear that information subject to a legal preservation obligation might be destroyed.  Given the volumes of information and the practical limitations of search technology, it is simply impossible to eliminate all risk that such information might be overlooked during the identification or remediation process.  However, the law does not require that corporations eliminate “all risk.”  The law requires that corporations act reasonably and in good faith,[1] and it is entirely possible to design and execute a data remediation program that demonstrates both.   Moreover, executing a reasonable data remediation program yields more than just economic and operational benefits.  Eliminating information that has no legal or business value enables more effective and efficient identification, preservation, and production of information requested in discovery.[2]

 [2]        This Article will review the legal requirements governing data preservation in the litigation context, and will demonstrate that a company can conduct data remediation programs while complying with those legal requirements.  First, we will examine the magnitude of the information management challenge faced by companies today.  Then we will outline the legal principles associated with the preservation and disposition of information.  Finally, with that background, we will propose a framework for an effective data remediation program that demonstrates reasonableness and good faith while achieving the important business objectives of lowering cost and risk.

 

II.  The Problem: More Data Than We Want or Need

 [3]        Companies generate an enormous amount of information in the ordinary course of business.  More than a decade ago, researchers at the University of California at Berkeley School of Information Management and Systems undertook a study to estimate the amount of new information generated each year.[3]  Even ten years ago, the results were nearly beyond comprehension.  The study estimated that the worldwide production of original information as of 2002 was roughly five exabytes of data, and that the storage of new information was growing at a rate of up to 30% per year.[4]  Put in perspective, the same study estimates that five exabytes is approximately equal to all of the words ever spoken by human beings.[5]  Regardless of the precision of the study, there is little question that the volume of information, particularly electronically stored information (“ESI”) is enormous and growing at a frantic pace.  Much of that information is created by and resides in the computer and storage systems of companies.  And the timeworn adage that “storage is cheap” is simply not true when applied to large volumes of information.  Indeed, the cost of storage can be great and come from a number of different sources.

[4]        First, there is the cost of the storage media and infrastructure itself, as well as the personnel required to maintain them.  Analysts estimate the total cost to store one petabyte of information to be almost five million dollars per year.[6]  The significance of these costs is even greater when one realizes that the vast majority of the storage for which companies are currently paying is not being used for any productive purpose.  At least one survey indicates that companies could defensibly dispose of up to 70% of the electronic data currently retained.[7]

[5]        Second, there is a cost associated with keeping information that currently serves no productive business purpose.  The existence of large volumes of valueless information makes it more difficult to find information that is of use.  Numerous analysts and experts have recognized the tremendous challenge of identifying, preserving, and producing relevant information in large, unorganized data stores.[8]  As data stores increase in size, identifying particular records relevant to a specific issue becomes progressively more challenging.  One of the best things a company can do to improve its ability to preserve potentially relevant information, while also conserving corporate resources, is to eliminate information from its data stores that has no business value and is not subject to a current preservation obligation.

[6]        Eliminating information can be extremely challenging, however, due to the potential cost and complexity associated with identifying information that must be preserved to comply with existing legal obligations.  When dealing with large volumes of information, manual, item-by-item review by humans is both impractical and ineffective.  From the practical perspective, large volumes of information simply cannot be reviewed in a timely fashion with reasonable cost.  For example, consider an enterprise system containing 500 million items.  Even assuming a very aggressive review rate of 100 documents per hour, 500 million items would require five million man-hours to review.  At any hourly rate, the cost associated with such a review would be prohibitive.

[7]        Even when leveraging commonly used methods of data culling to reduce the volume required for review, such as deduplication, date culling, and key word filtering, the anticipated volume would still be unwieldy when even a 90% reduction in volume would require review of 50 million items. Moreover, studies have long demonstrated that human reviewers are often quite inconsistent with respect to identifying “relevant” information, even when assisted by key word searches.[9]

[8]        Current scholarship also shows that human reviewers do not consistently apply the concept of relevance and that the overlap, or the measure of the percentage of agreement on the relevancy of a particular document between reviewers, can be extremely low.[10]  Counter-intuitively, the result is the same even when more “senior” review attorneys set the “gold standard” for determining relevance.[11]  Recent studies comparing technology-assisted processes with traditional human review conclude that the former can and will yield better results.  Technology can improve both recall (the percentage of the total number of relevant documents in the general population that are retrieved through search) and precision (percentage of retrieved documents that are, in fact, relevant) than humans can achieve using traditional methods.[12]

[9]        There is also growing judicial acceptance of parties’ use of technology to help reduce the substantial burdens and costs associated with identifying, collecting, and reviewing ESI.  Recently, the U.S. District Court for the Southern District of New York affirmed Magistrate Judge Andrew Peck’s order approving the parties’ agreement to use “predictive coding,” a method of using specialized software to identify potentially relevant information.^[13]

[10]      Likewise, a Loudon County, Virginia Circuit Court judge recently granted a defendant’s motion for protective order allowing the use of predictive coding for document review.[14]  The defendant had a data population of 250 GB of reviewable ESI comprising as many as two million documents, which, it argued, would require 20,000 man-hours to review using traditional human review.[15]  The defendant explained that traditional methods of linear human review likely “misses on average 40% of the relevant documents, and the documents pulled by human reviewers are nearly 70% irrelevant.”[16]

[11]      Similarly, commentary included with recent revisions to Rule 502 of the Federal Rules of Evidence indicate that using computer-assisted tools may demonstrate reasonableness in the context of privilege review: “Depending on the circumstances, a party that uses advanced analytical software applications and linguistic tools in screening for privilege may be found to have taken ‘reasonable steps’ to prevent inadvertent disclosure.”[17]

[12]      Simply put, dealing with the volume of information in most business information systems is beyond what would be humanly possible without leveraging technology.  Because such systems contain hundreds of millions of records, companies effectively have three choices for searching for data subject to a preservation obligation: they can rely on the search capabilities of the application or native operating system, they can invest in and employ third-party technology to index and search the data in its native environment, or they can export all of the data to a third-party application for processing and analysis.

 

III.  The Solution: Defensible Data Remediation

[13]      Simply adding storage and retaining the ever-increasing volume of information is not a tenable option for businesses given the cost and risk involved.  However, there are risks associated with data disposition as well, specifically that information necessary to the business or required for legal or regulatory reasons will be destroyed.  Thus, the first stage of a defensible data remediation program requires an understanding of the business and legal retention requirements applicable to the data in question.  Once these are understood, it is possible to construct a remediation framework appropriate to the repository that reflects those requirements.

 A.  Retention and Preservation Requirements

 [14]      The U.S. Supreme Court has recognized that “‘[d]ocument retention policies,’ which are created in part to keep certain information from getting into the hands of others, including the Government, are common in business.”[18]  The Court noted that compliance with a valid document retention policy is not wrongful under ordinary circumstances.[19]  Document retention policies are intended to facilitate retention of information that companies need for ongoing or historical business purposes, or as mandated by some regulatory or similar legal requirement.  Before attempting remediation of a data repository, the company must first understand and document the applicable retention and preservation requirements.

[15]      It is beyond the scope of this Article to outline all of the potential business and regulatory retention requirements.[20]  Ideally, these would be reflected in the company’s record retention schedules.  However, even when a company does not have current, up-to-date retention schedules, embarking on a data remediation exercise affords the opportunity to develop or update such schedules in the context of a specific data repository.  Most data repositories contain limited types of data.  For example, an order processing system would not contain engineering documents.  Thus, a company is generally focused on a limited number of retention requirements for any given repository.  There are exceptions to this rule, such as with e-mail systems, shared-use repositories (e.g., Microsoft SharePoint), and shared network drives.  Even then, focusing on the specific repository will enable the company to likewise focus on some limited subset of its overall record retention requirements.  Once a company has identified the business and regulatory retention requirements applicable to a given data repository, information in the repository that is not subject to those requirements is eligible for deletion unless it is subject to the duty to preserve evidence.

[16]      The modern duty to preserve derives from the common law duty to preserve evidence and is not explicitly addressed in the Federal Rules of Civil Procedure.[21]  The duty does not arise until litigation is “reasonably anticipated.”[22]  Litigation is “reasonably anticipated” when a party “knows” or “should have known” that the evidence may be relevant to current or future litigation.[23] Once litigation is reasonably anticipated, a company should establish and follow a reasonable preservation plan.[24]  Although there are no specific court-sanctioned processes for complying with the preservation duty, courts generally measure the parties’ conduct in a given case against the standards of reasonableness and good faith.[25]  In this context, a “defined policy and memorialized evidence of compliance should provide strong support if the organization is called up on to prove the reasonableness of the decision-making process.”[26]

[17]      The duty to preserve is not without limits: “[e]lectronic discovery burdens should be proportional to the amount in controversy and the nature of the case” so the high cost of electronic discovery does not “overwhelm the ability to resolve disputes fairly in litigation.”[27] Moreover, courts do not equate reasonableness with “perfection.”[28] Nor does the law require a party to take “extraordinary” measures to preserve “every e-mail” even if it is technically feasible to do so.[29]  “Rather, in accordance with existing records and information management principles, it is more rational to establish a procedure by which selected items of value can be identified and maintained as necessary to meet the organization’s legal and business needs[.]”[30]

[18]      Critical tasks in a preservation plan are the identification and documentation of key custodians and other sources of potentially relevant information.[31] Custodians identified as having potentially relevant information should generally receive a written litigation hold notice.[32]  The notice should be sent by someone occupying a position of authority within the organization to increase the likelihood of compliance.[33] The Sedona Guidelines also suggest that a hold notice is most effective when it:

 1)      Identifies the persons likely to have relevant information and communicates a preservation notice to those persons;

2)      Communicates the preservation notice in a manner that ensures the recipients will receive actual, comprehensible and effective notice of the requirement to preserve information;

3)      Is in written form;

4)      Clearly defines what information is to be preserved and how the preservation is to be undertaken; and

5)      Is regularly reviewed and reissued in either its original form or an amended form when necessary.[34]

 [19]      The legal hold should also include a mechanism for confirming that recipients received and understood the notice, for following up with custodians who do not acknowledge receipt, and for escalating the issue until it is resolved.[35]  To be effective, the legal hold should be periodically reissued to remind custodians of their obligation and to apprise them of changes required by the facts and circumstances in the litigation.[36]

[20]      Experience has also shown that legal holds that are not properly managed and ultimately released are less likely to receive the appropriate level of attention by employees. Thus, the legal hold process should also include a means for determining when litigation is no longer reasonably anticipated and the hold can be released, while ensuring that information relevant to another active matter is preserved.[37]

 B.  The Remediation Framework

 [21]      Against this backdrop, it is possible to outline a framework for data remediation that is compliant with legal preservation requirements.  The following describes a high-level data remediation process that can be applied to virtually any data environment and any risk tolerance profile.  The general process is described in Figure 1 below:

Figure 1: Data Remediation Framework

1.  Assemble the Team

 [22]      A successful data remediation project depends on invested participation by at least three constituents in the organization: legal, information technology (“IT”), and records and information management (“RIM”).  In addition, the project may require additional support from experts experienced in information search and retrieval and statistical analysis.  In-house and/or outside counsel provides legal oversight and risk assessment for the project team, as well as guidance on legal preservation obligations.  IT provides the technological expertise necessary to understand the structure and capabilities of the target data repository.  RIM professionals provide guidance on business and regulatory retention obligations.  The need for information search and retrieval experts and statisticians depends on the complexity of the data remediation effort as described below.  Finally, including business users of the information may be necessary as required to fully document retention requirements applicable to a particular repository if not adequately documented in the organization’s document retention policy and schedule.

 2.  Select Target Data Repository

 [23]      Selecting the target data repository requires consideration of the costs and benefits of the data remediation exercise.  Each type of repository presents unique opportunities and challenges.  For example, e-mail systems, whether traditional or archived, are notorious for containing vast amounts of information that is not needed for any business or legal purpose.  Similarly, shared network drives tend to contain large volumes of unused and unneeded information.  Backup tapes, legacy systems, and even structured databases are other possible targets.  IT and RIM resources are invaluable in identifying a suitable target repository.  For example, IT can often run reports identifying directories and files that have not been accessed recently.

 3.  Document Retention and Preservation Obligations

[24]      As discussed above, it is critical to understand the retention and preservation obligations that are applicable to the data contained in the target repository.  Retention obligations include the business information needs as well as any regulatory requirements mandating the preservation of data.  Ideally, these are incorporated into the document retention policy and schedule for the organization.  If not, it will be important to document those requirements applicable to the target repository.

[25]      Preservation obligations are driven by existing and reasonably anticipated litigation.[38]  In some cases this may be the most challenging part of the project, particularly for highly litigious companies, because, unlike business needs and regulatory requirements, preservation obligations are constantly changing as new matters arise and circumstances evolve in existing matters.  Successful completion of the remediation project will require a detailed understanding of, and constant attention to, the preservation obligations applicable to the target repository.  As discussed below, some of the risk associated with this aspect of the project can be ameliorated through selection of the appropriate repository and culling criteria.  Nevertheless, the scope and timing of the project will be driven in large part by the preservation obligations applicable to the target repository.

4.  Inventory Target Data Repository

[26]      After selecting the target data repository, the team must inventory the information within that repository.  This does not involve creating an exhaustive list or catalog of every item within the repository.  Rather, inventorying the repository involves developing a good understanding of the types of information that are contained there, the date ranges of the information, and other criteria that will enable identifying information that must be retained and that which can be deleted.  The details of the inventory will vary by data repository.  For example, for an e-mail server, the pertinent criteria may include only date ranges and custodians, whereas for a shared network drive, the pertinent criteria may include departments and individuals with access, date ranges, and file types.

 5.  Gross Culling

 [27]      The next step is to determine the “gross culling” criteria for the data repository.  In this context, “gross culling” refers to an initial phase of data culling based on broad criteria as opposed to fine or detailed culling criteria that may be used in a later phase of the exercise.[39]  The nature of the information contained within the repository will determine the specific criteria to be used, but the objective is to locate the “low-hanging fruit,” the items within the repository that can be readily identified as not falling within any retention or preservation obligation. These are black-and-white decisions where the remediation team can definitively determine without further analysis that the items identified can be deleted.

[28]      For example, in most cases, dates are effective gross culling criteria.  Quite often, large volumes of e-mail and loose files (data retained in shared network drives or other unstructured storage) predate any existing retention or preservation obligation for such items.  Similarly, in repositories that are subject to short or no retention guidelines, the business need for the data can be evaluated in terms of the date last accessed.  In the case of shared network drives, for example, it is not uncommon to find large volumes of information that has not been accessed by any user in many years.[40]  Such information can be disposed of with very little risk.

 6.  Fine Culling

 [29]      Sometimes, the process need go no further than the gross culling stage.  Depending on the volume of data deleted and the volume and nature of the data remaining, the remediation team may determine that the cost and benefit of attempting further culling of the data are not worth the effort and risk.  In some cases, however, gross culling techniques will not identify sufficient volumes of unneeded data and more sophisticated culling strategies must be employed.

[30]      The precise culling technique and strategy will depend on the specific data repository, its native search capabilities, and the availability of other search tools.  For example, many modern e-mail archiving systems have fairly sophisticated native search capabilities that can locate with a high degree of accuracy content pertinent to selected criteria.  Other systems will require the use of third-party technology.  In either case, the fine culling process will require selection of culling criteria that will uniquely identify items not subject to a retention or preservation obligation and be susceptible to verification.  Depending on the nature of the data and the complexity of the necessary search criteria, the remediation team may need to engage an expert in information search and retrieval.

 7.  Sampling and Statistical Analysis

[31]      Regardless of the specific fine culling strategy employed, the remediation team should validate the results by sampling and analysis to ensure defensibility.  Generally, it will be advisable to engage a statistician to direct the sampling effort and perform the analysis because both can be quite complex and rife with opportunity for error.[41]  Moreover, in the event that the company’s process is ever challenged, validation by an independent expert is compelling evidence of good faith.  It is important to realize that the statistical analysis cannot demonstrate that no items subject to a preservation obligation are included in the data to be destroyed.  It can only identify the probability that this is the case, but it can do so with remarkable precision when properly performed.[42]

 8.  Iteration

[32]      Fine culling and validation should continue until the remediation team achieves results that meet its expectations regarding the volume of data identified for deletion and the probability that only data not subject to a preservation obligation are included in the result set.

 

 IV.  Conclusion

[33]      The enormity of the challenge that expanding volumes of unneeded information creates for businesses is difficult to understate.  Companies literally spend millions of dollars annually to store and maintain information that serves no useful purpose, funds that could be directed to productive uses such as hiring, research, and investment.  Facing this challenge, on the other hand, is a challenge of its own, perhaps due more to the fear of adverse consequences in litigation than any other factor.  It is possible, however, to develop a defensible data remediation process that enables a company to demonstrate good faith and reasonableness while eliminating the cost, waste, and risk of this unnecessary data.