Kelly Twigger on Modern Data, Ephemeral Messaging and eDiscovery Case Law

I really appreciate being here.

You know, Daniel, sometimes there's too many things. And when you've been doing it as long as I have, you just stop counting. It's like birthdays, right? You just stop adding to the list. One thing I will add, and that is that I'm teaching at the University of, I should say, the University of Colorado at Boulder at the law school. So I'm teaching their eDiscovery section there, and that has been very illuminating. In terms of. Bringing the conversation down to a level that everyone can relate to. So it's been a good experience for me and I love teaching. Love that. Well, Kelly, I hate to dive right into the deep ugly and right away.

The courts are kind of all over the map as to whether or not hyperlinked files, which is what I call them, what we call them in Minerva 26 is our issue tag, whether or not hyperlinked files are, in fact, discoverable. And I think that's a really interesting legal analysis. Judge Cisneros, who is one of the judges in the Northern District of California on the In re Uber text class action, has issued a number of decisions on hyperlinked files. And personally, I find her analysis to be the most thoughtful. I don't understand why information that was physically attached to an email is now different than information that's physically attached via a link, why that should be considered separately from a legal perspective. That's the position that Judge Cisneros takes.

So there's a legal issue. Are hyperlinked files considered attachments for purposes of discovery, meaning that they are discoverable, right? Then there. There are the technical issues. So we don't have an answer to the legal question. As in all eDiscovery case law, the judges are all over the map. And quite frankly, a lot of the times, if the judge is not doing the job that Judge Cisneros is doing, then it depends on the parties bringing experts to the table who can adequately explain what the technological capabilities are of the entities that are having to produce documents from hyperlinked files. Sometimes the legal question of are hyperlinked files attachments gets modeled up with that question of the technical. And I think they are two separate issues. So I would like for them to be two separate issues.

On the technical side, there are a number of issues with hyperlinked files. One is who shared the hyperlink and is that person still at the organization? Two, does the person who you're collecting data from have access to the linked file? Three, what's the version? of the hyperlinked file that you're trying to collect? Do you want to collect the contemporaneous version, meaning the version that was sent at that link at the time the email was sent or the message was sent? And how do you do that? And all of those things are technical problems. So the case law sorts out. There are some tools out there that have worked to solve this hyperlink problem. Some of them are specific to service providers. Some of them, like the FEC tool, Forensic Examiner Collector Collection.

I'm getting the name wrong. I apologize.

And that's the tool that's mentioned in the Nichols v. Noom case, which really kicked off our hyperlinked files discussion from Judge Catherine Parker back in March of 2021. And so the question is, what can the tool do with the software that you have? Now, we're wading into some weird territory in this area. Because in the Uber case, Judge Cisneros said to Uber, hey, you guys knew about this hyperlink issue. You're in litigation all the time and you chose to use Google Vault and you knew or you should have known that Google Vault doesn't allow for you to collect hyperlink contemporaneous versions of hyperlink files out of it. Google Drive, the active version of the Google Box, does. So by virtue of you choosing that technology, you made a choice and now you have to expend the effort that's required to provide that information.

So it's kind of a really weird place we're finding ourselves in where we haven't had a situation that courts have started to say the choices that you're making as an organization about the technology that you choose impose these additional obligations on you and you therefore still have to meet those obligations. A lot of the pushback from corporations, defendants, and rightly so, has been, wait a minute, we have proportion. here, and the cost of us going and manually finding these hyperlinks is too much. So there has to be a balance. The courts are trying to find it. It's a difficult one, and not every judge is as educated on the issues as they need to be when they're making decisions. So there are a lot of technical challenges.

My view is that we're going to continue to see this issue be a problem until, the services that we use to create, store, send, and receive information provide the ability for us to collect contemporaneous hyperlinked documents with the documents as attachments. My understanding from Microsoft Teams or from Microsoft is that, and this was back from I think December or January when Stephanie, whose last name I've suddenly forgotten, and Rocky Messing did a talk with Tom O'Connor on his channel, and they specifically discussed how if a company sets a retainer, it's going to be a problem. It's going to be a problem. It's going to be a problem. It's going to be a problem. It's going to be a problem. policy in Microsoft that from that moment, that retention policy set, those contemporaneous.

versions will be stored with or can be captured from the message that's sent. But when that retention policy is set is when that comes into play. So if you have a duty to preserve today and the email is from the last two years and you set the retention policy today for preservation, it will not preserve those hyperlinks retroactively. So it's very much a technology issue of how does your technology work? What are the capabilities that you have in-house to deal with that? And what are your legal obligations to spend money to make that happen? And I think. the other really crucial point out of all of this is that counsel have to be very aware of the hyperlink issue and they have to understand at the outset what the technologies are that their client has and how they're going to be able to deal with the issue, what the technologies are that they're going to be able to deal with the issue, and what the technologies are that the other side has and how they're going to be able to deal with the issue.

they're going to be able to deal with the issue and how much it's going to cost, how many documents you're talking about. And then you have to come up with a plan for the court. And that's something that I thought that lawyers in the Enright Uber tax decision did very well. And I did talk about. that on our case of the week episodes that deal with those cases. But what just came up in that case recently is another issue. And that is that in their ESI protocol, they wrote about, hyperlink files. They didn't call them hyperlink files, but that's what they wrote about. They wrote a section on it. It was very well worded. And I had put it out to people like, hey, this is a great way to handle this.

It has to be with your case. But what they did is they specifically limited hyperlinks to Google Drive. And now the plaintiffs have discovered that there are. hyperlink files in other sources of ESI that weren't provided for in the ESI protocol. And so then the defense tried to say, hey, no, no, we. limited this to Google Drive. And the court said, you can't do that. Kelly, I, so you, you provide all of that, but it's, it's just a huge, it's, it's a really big.

That's exactly right. And the other issue is if the litigation is about the scope of the document that we signed and who intended what in the language of that document, all of those comments and the red line changes on each of the versions that we exchanged via email or via link are relevant. And so then the question becomes, instead of getting every version of the document, can I get a log from the software that shows who made what changes to what paragraph on what date? And who made what comments and how the comments were resolved? You know, what does that log look like? So, yes, you're articulating it spot on.

Yes, I would take it one step further. And that is, we talk a lot about what we call information governance consulting, where we're talking about really planning for mitigating the risk of costs of ESI and litigation. And look, the hyperlinks thing is, it's a bear, there's no question about it. But there's a really, there's a big, like you said, talk to IT. And the reason that my sort of, I don't know, red flags or whatever went up is because. IT in an organization builds the bookshelves of your IT infrastructure. And they allow all of the different pieces of software and all your virtual machines and all your databases and everything to integrate together and to work so that as a user, you just sit at your desktop, and you access, whatever information you need to do your, job, right?

There's a million things behind the scene, much like maybe the listeners can relate to setting up an eDiscovery database, right? When you're setting up a review database, there's so. many details that you have to pay attention to that the lawyers never even think about, right? But IT is meant to build those bookshelves. Now, when you want IT to go and get the red book on the fourth shelf on page 41, because that's the one document that you need for litigation, that's not IT's job. And so when you say go talk to IT, as long as the conversation is this, Daniel, thanks so much for your time today. I really appreciate it. I need to talk to you. because in legal, we have this issue now of our employees transmitting documents via hyperlinks.

And we need to understand what is currently being maintained, what our options are to change those settings. What, the ramifications are for the business if we change those settings, whether we can change those settings at a time and place today and have them apply retroactively. You need to have that conversation so that you really understand how the tools that are. being used by your client work, and then you have to have an additional understanding as counsel as to what the capabilities are to use additional outside tools to come into the company's systems and find what you need if the company's systems can't provide it. So it's not that different to what we did before we had all these things from Microsoft and Purview that folks use now, right?

You have to bring external tools in. So there's a balance of, one, understanding IT, two, understanding what else exists in. the marketplace to go and get what you need.

may be a question more for a lot of legal ops people. So, our job at ESI Attorneys is to act as that liaison between the business and the organization. And I think that's a really good and legal and IT. So, we have, Kind of in our little logo, we have four arrows, right? Legal, business, IT, you know, and that's the goal is that we're at the table. So oftentimes my job is to act as that liaison to understand these risks of when you're implementing things. And for our clients, what I do is attend whatever the quarterly meeting is where IT is having, where they're talking about, here's what our plan is for 2025, for 2026. Here's what we're going to be looking at rolling out, or here's what the things are on the table.

In order to identify areas of risk and understand where we need to consider policy implementation. I'm never going to say put a policy in place because there are pros and cons to having policies in place. And so the question is strategically identifying those risks, understanding where they are, and how you want to plan for them going forward. Most of the time, for most clients, right, not the super litigious, the men. The Uber or those folks. But for most clients, a proactive thought process is really important to save money down the road because they don't have such tremendous litigation burdens that they have a lot of systems in place specifically to address those. A lot of clients have an average number of litigations or they have, you know, maybe three or four a year or one a year.

Right. And so what are you going to tell them? You want them to spend that much money? No. You want to be able to come in and have, like I said, know what the tools are, know what externally you need to be able to meet your obligations under the rules. So there is a lot of planning to answer your question more directly. I don't know of a lot of folks that have that in place. My hope is. My hope is that legal operations is starting to fill that role and the growth of legal operations over the last five, six years has been tremendous for our clients. We fill that role.

Well, there absolutely are. I mean, that's really kind of a no brainer in terms of can you are you breaching your legal ethics if you present citations to a court that don't exist? Of course you are. I mean, that's kind of a no brainer.

Sure. Yeah. So there have been several cases that the case from a couple of years ago was probably the most widely cited one. But there's a new one every week, it seems like where lawyers are using some gen AI tool, whether it's a chat GPT or something else to identify, create arguments and identify legal precedent. So, you know, I could go into chat GPT right now and write a prompt that says. Make up something, you know, I have an employment discrimination case and. I need to write an argument about age discrimination with this set of facts. Write me an argument and make that we've met the standard here and include all the legal citations that are relevant for us to draw analogous case arguments. And it will draft for you an entire argument.

And a lot of folks are, as you mentioned, cutting and pasting it and putting that into a brief. And the problem is, is that chat GPT is not a legal research tool. It's it's not a tool that has access to all of the case law from all over the country, from all over the courts. There are specific tools that do. Our Minerva 26 only has access to eDiscovery related decisions. So it's a very niche tool. But you've got to find an actual dedicated legal research tool in order to be able to rely on those. If you're going to use the A.I. to make that argument for you, just check the sites against a legitimate research tool. And if you're going to use the A.I. to make that argument for you, just check the sites against a legitimate research tool in order to be able to rely on those.

Now, why are lawyers doing that? One, time. Two, money, because a lot of clients don't have money. And we talked last week at the Masters Conference about the access to justice and about how everything has gotten so expensive, and ESI has only made it more expensive, that it prevents a lot of people from going to the courthouse. So time and money, I think, are two reasons. The third reason is the cost of legal research tools. I mean, legal research tools are incredibly expensive, and some law firms just don't use them often enough to be able to justify the cost. And then you've got to remember that law firms are usually partner-driven corporate structures, so the more money they spend in expenses, the less money goes into the partner's pockets, and that's always an issue.

fresh lawyers? You know, Brandon, that's a great question. One, I think they have to learn it, right? I mean, that's where we are, and it's changing every day, and it's adapting every day. I just got the latest from OpenAI talking about how much more exponentially great their latest reasoning model is, right? And I mean, the changes just in a year are insane. I mean, insanely amazing what these tools can do. And this is the future of where lawyers are going to be. So. I think they need to use the tools. Do they need to learn the old school way of doing it? Well, I guess I would answer that this way. When I was, in law school, we learned how to do research in books and books don't exist anymore.

So do they need to learn how to use books? No, because they don't exist. Do they need to learn how to use and do research before that? I don't know the answer because I'll tell you the most effective researcher is the one who knows the issues and what they're looking for and understands the language of the case law. And so I think that AI can actually help with that because if I'm a young. lawyer and I put in a terminology, like, let me think, something that would easily be confused with another term, right? So let's say I put in undue burden, but really what I'm talking about is proportionality. Now, the AI tool may suggest proportionality. I mean, that's part of what Armin or of a platform does is if you try to argue, if you try to look for one thing, we're going to tell you that's proportionality.

And we use AI to do that. So I think there's, I think. the students are going to be able to do that. I think the students are going to be able to do that. I think the students have to learn the AI. But I think they've got to learn how to use it the right way. I will tell you that I had one student in my class ask, why can't I use ChatGPT for legal research? To which my response was, don't you have Westlaw and Lex for free in law school? But, you know, I had to explain to these 20-something-year-olds that you can't use it, and here's why. Because I think there's not enough education out there on what ChatGPT really is, on what Claude is, on what Gemini is, whatever these – all these tools, Grok, et cetera.

I'm with you, Daniel.

I think two things. I think one thing, the first thing is to recognize that lawyers never don't have too much to do ever. Ever. Right. I mean, we always have way more to do than we have hours in the day. And but more to your question of are there skills that they should be learning? I do worry about even using just online. Let's just say old skill legal research online. Right. Old school, not old skill. Sorry. I can Google. I can search, do whatever search I'm going to look for and find the cases that I want to use. Right. But I also. But I also. need to find the cases that are going to be bad for me, and I need to know how to distinguish them.

And I will say that most of the briefs that I read today, both in my capacity as counsel, as an expert, doing some special masterwork, they're all advocating for their position, but there's no distinguishing existing case law that's out there. And that's a huge piece of. lawyering, is to say, well, judge, yes, the judge from you down the hall found this, but there are three key facts that weren't present in that case that are present in our case. And therefore, I need you to look at this decision from this judge in California. And I'm saying that because eDiscovery spans the whole country. And this decision from this judge in California is much more in line with our case factually. And so this is the one you should follow.

And here's why. Here's what we're going to ask you to do as a result of that. I'm not seeing. that initial part where they're distinguishing the other cases. I'm just seeing we cite to what we think supports our case. And I think in part that's because we find what we want to on an online platform and we use that, right? I don't know that there's a conscious decision not to, address the other cases, but there's, and then how much looking do you do, right? How much digging do you do? So I think AI is going to help you get to that. But I think one of the bigger problems. we have in the law is lawyers generally learn trial by fire. They don't generally get taught how to do things, right?

I mean, they get access to legal research tools, but does anyone really teach them how to learn how to do legal research? I mean, in my legal research and writing class, we had to do legal research and write a paper. And we were graded on those papers, but nobody ever came and sat with you and said. Here's how you use this platform most effectively. We had free trainers at the law firm to teach us and every once in a while at the law school. But are they really learning how to do that such that they can adapt to the Gen A.I. world? That's more my concern than the Gen A.I. alone piece of it.

That's a softball.

types of functions built in? Yeah. So I'm going to take a page from Daniel's book and I'm going to step back for a second and just define ephemeral data for anyone who's listening. And that is essentially data that disappears on a given schedule. So if you're a Snapchat user, you know that after you send a snap, it's available for a certain amount of time and it's really small, like a few minutes or 30 seconds, depends what your settings are. And then it's gone, right? And a snap has changed its mind year to year about whether they retain information. on a given schedule or not. And so I'm going to take a page from Daniel's book and I'm going to or whether they don't. I think we're currently at don't.

So that information. Right. Unless the user takes action to save it physically to their thing or the or the recipient has the ability to change to their thing. So this the issues with ephemeral data kind of take us back to the issues of hyperlink. And the question is, what's the platform that's being used and how is it set up by the user? And so, again, you have to know and understand the technology and to be effective as a litigator. You have to have a broad, at least broad understanding of the applications that do have ephemeral settings and whether they are ephemeral by nature or whether they have a disappearing message setting. So Snapchat is ephemeral by nature. Right. Can't turn it off. It's it's soon as someone watches it, the information disappears.

Other platforms like Signal, Slack, Telegram. I had a couple others that I looked up before we got on. Maybe Wicker. They have disappearing message settings, message settings, excuse me. So what you need to understand, and it almost needs to be part, not almost, it needs to be part of your custodian interview is when people are using those applications to transmit information, you need to understand what are their settings and are their settings going to keep that information when they're under a duty to preserve. But ephemeral messaging just has to be layered together with the federal rules just like everything else, and that is until you have a duty to preserve, you can continue to maintain your information in the way that you normally do as a business.

And if that means disappearing message settings on Signal, then that's what it means. Should you have policies? I don't know if I would have a policy around ephemeral messaging. It's very fraught, right? How are you going to enforce it? How are you going to audit it? Those kinds of things. So ephemeral messaging is hard because the data disappears. Every application treats it differently. to what residual remains on the device or the computer that the message was sent from. There are tools out there that can capture some of that information, but if you need to capture. that information, you need to understand what tools are available to be able to do that. And so it's a bit like the hyperlinks issue in that from a technical perspective, you need to understand what the challenges are, and then you need to have a plan for dealing with them as soon as possible when you get a new case.

Ephemeral data is something that you almost need to talk about.

There are. I knew you were going to ask me about specific cases, Sam, just to put me on the spot. There are a few of them. And one of them we covered on the case of the week. Thank you. And that was the FTC versus Amazon case. I'll give you the Westlaw site for that one in case anyone wants it. That's 2024 Westlaw 3342701. And in that particular case, the plaintiffs wanted ephemeral messages and where they existed, they were required to produce them. And I think that is the first and most important question is where you use an ephemeral messaging application. Does the information still exist? Is it relevant to the case? Can it be produced? Right. In Signal, Signal is a hard one, right?

Because Signal was built into end of encryption. And my understanding is that Celebrite just rolled something out that allows it to be to capture messages from Signal. We were having this discussion on a Women in eDiscovery panel yesterday. And someone from Consumers. Consilio mentioned that Celebrite has that capability. So that's an. important one. Other tools that are just collecting mobile device data can't necessarily get to signal data. And so you need to, again, have the technical tool that you need to get to the issue. I don't want to get too far off the ephemeral question or the case law question. Most of the case law on ephemeral messaging really follows the rules. If the data still exists, then you have to provide. it. If you can't provide it technologically, then you've got to find a way to compromise with the other side about what's there.

But when it comes to the loss of data that was ephemeral, the question then becomes, when did your duty to preserve attach? When was the data created? What were the settings on the device that housed the data? Should you have changed the settings because you were under a duty to preserve? Those that analysis is what happens. So the analysis for ephemeral data is really. the analysis for everything else. And I liken it to hyperlinks because it's a technology issue, right? TikTok doesn't keep their data. Snapchat doesn't keep their data. So you have to know and understand these things if those are the platforms that are implicated in the type of cases you're handling or you need to be working with someone who does. Kelly, you mentioned that when you're.

Yeah, one of the things that we do with our clients is a lot of, organizations, corporations, I guess I should say, but a lot of organizations have what they call annual affirmations where clients sign, you know, they agree, here's what the policies are related to data that's created as a result of my employment every year. And as a result of that process, we create videos to explain to them how these applications work and what kind of risk is associated with those from a legal perspective. There are, in most organizations, a couple of. handfuls of people who are always the custodians who are on legal hold. And you can educate those people. So what you need to do for your organization depends on a number of factors within the organization.

You know, what kinds of litigation are you subject to? What are the actual applications that you're thinking about? What does legal really know, right? Because we know in the SaaS world that employees at organizations are setting up SaaS products all the time, that IT has no way of doing that. And so we need to be able to educate those people. We have no idea what are happening, right? I mean, If IT is rolling out WhatsApp to the organization and monitoring it, if IT is doing that with Signal, which they're not, that makes a big difference, right? Because then you can go through IT, work with the bookshelves, but you can't if it's on an individual-by-individual basis. I've had cases where we had Signal chats between executives.

We had WhatsApp messages between executives. We had text messages between executives because, and I think that the pandemic escalated this exponentially, we communicate in the method that most directly gets our message to the person the fastest when we need a response. If I don't need Daniel to respond to me for a couple days, I'm going to send him an email. If I need an answer right now, I'm going to text him. If my colleague is overseas, I'm going to send him a WhatsApp message or a Signal message. If I don't want anyone else to be able to see it, I'm going to send him a Signal message. What's the what are you doing and what's the intent behind things? I think one of the challenges we have still in eDiscovery is when companies go out to hire lawyers, they do these very involved, really important RFP processes to find the right lawyers for the right piece of litigation.

Right. We used to just hire law firms and they did everything right. We just called the right lawyer at the law firm to handle it. Now they do RFPs for just about everything. And I don't know if one of the components of those RFPs is making sure that they have the knowledge in eDiscovery to identify these issues immediately. So I almost think if someone calls me to put in an RFP, we don't do very often, to be honest. But if they call me, I immediately send them a list of here's all the questions that you need to ask to make sure that you don't lose any data before you get involved in this process. And that's because we have so many cases. This is where the data is just gone.

go back to Daniel's question earlier about WeChat. There was the two canoes case that we did on Case of the Week a while ago, which was a WeChat instance where it was an issue about buying. masks during the pandemic. And the owner of one of the companies was communicating with the Chinese supplier on WeChat and the messages were gone. And it was a spoliation issue in the scope of the litigation. And so and the owner never had any notion that he should be preserving that information. Couple that with the most recent decision that we had on Case of the Week, not yesterday's, but last week's, I think, in which the judge said that a verbal legal hold to a client. is not sufficient. And when you say that and then you start saying everything has to be in writing, you're creating this.

Absolute cascading waterfall of stuff that. at the outset of a litigation. And it's a lot. It's a lot to deal with. So ephemeral data is hard to deal with technically and legally, because if it's there, you have to preserve it and you.

far ahead and will always be far ahead. We need a change. We need some updates, Daniel. We need.

That's exactly right.

Well, I think as the reasoning capabilities of Gen AI grows, that we're going to start to see a lot more tools and a lot more technology around those. You're going to start having to understand, the inner workings of those tools in the same way that sometimes we've had to have understanding of the way that the TAR process works. We started to incorporate Gen AI into document review. So you're going to have to start being able to explain how that is working and how you're using it if that's required. I think there's an argument to be made that it's not. required under Rule 34 right now. I think some things need to be addressed about whether or not the rules need to be a bit more in line with technology.

And this hyperlinks issue is a big one. I think it's a big one. I think it's a big part of it, right? There's nothing in the rules and we don't get... rules is to say that hyperlinks are attachments. But the problem we have with the discovery case law is it's at the district court level or it's at the state court level, and it doesn't go up on appeal. Those are not appealable decisions. And when things do go up on appeal, they're few. and far between. And it depends on the judge you get and the level of education that they have. So I think that Gen AI is going to continue to impact things because it's going to create new technologies that are then going to bring us more issues like hyperlinks, right?

So the hyperlinks issue evolved because technology evolved in a way for us to better collaborate. And so as technology continues to evolve, which it's going to, and it constantly is, we need the rules to better adjust. us to those existing technologies. We also need better education all the way across the board for all litigators, for law students, for judges. We need more for people to stay in touch with. What's happening on these issues so they can have the level of education they need to make consistent decisions? The other the big issue that we have right now, and I was talking about this yesterday on the with women in the discovery is the possession, custody or control issue of doesn't employer have control over an employee's personal phone?

That issue is, you know, that's where the policy issue comes in. And Brandon, when you asked me about that and I was like, well, I don't know if I want a policy, you know, in two cases where companies had BYOD policies, the courts have found that the employer didn't have access over the mobile phone. There are more specifics to it than that. So don't please don't take that general statement as a if you have a BYOD policy, you won't have control. In another case, a judge said in the Miramontes case, the judge said, hey, this practical ability and legal right test for possession, custody or control under. Rule thirty four, it doesn't work with mobile phones. The way that we use mobile phones now, the way that we communicate for business, especially since the pandemic, means that analysis just doesn't fit modern society.

And that's where I think the rules really need some updating. So I don't know if I got off track there. Sorry, guys. It's my soapbox.