eDiscovery and holds are technically the same; the only difference is the implications. eDiscovery implies legal-related matters, and holds refer to internal or compliance-related audits. For example, someone will usually use the term eDiscovery to mean retrieval of content related to a litigation or petition. However, a records manager might use the term hold to refer to content being put on hold for audit purposes or related to compliance, such as the Freedom of Information Act or public disclosure in local government, where anyone can request documents related to a particular subject.

For purposes of this book, we will use eDiscovery to define the process, and we will use hold to define the mechanism. A hold is exactly the same as declaring a document a record and noting the hold by some name, such as the matter name, and having a process for releasing the hold. When a record manager refers to a hold, they will refer to it by some name. Often this is the date of the hold, the name of the matter, a code name, or some other relevant identification.

Only large organizations in compliance-driven spaces, often government, will have several holds going on at the same time. The following are three common reasons for using eDiscovery features in SharePoint:

Early case assessment is a term that is used to describe preparing for a matter as soon as possible. In early case assessment, the process of finding and culling content happens as soon as the topic of the matter has been identified, to prevent massive losses due to fines and sanctions related to a matter.

Previously, organizations would send 100 percent of their physical and electronic content to an organization specializing in eDiscovery. The service provider would then charge a per-page processing rate to convert the physical documents to electronic and review the results. After all content was converted to an electronic format, the service provider charged a processing fee per gigabyte to locate content by using search algorithms, predictive coding, and text analytics technology. There was also a substantial setup fee to configure the software tools for the particular job. This also included painstaking configuration of the document imaging hardware and capture software to support the highest image quality and accuracy.

It would not be unheard of for organizations to spend 1–2 million dollars on this process. If this sounds familiar, you know the costs and are preparing for the future. Because you are going down the path of ECM, this should greatly reduce the time spent with external service providers, or ideally, you won’t need them at all.

The ECM system, in conjunction with eDiscovery, isolates a subset of content for discovery, and organizations well established in this process might need to contract with a third-party vendor only for validation processes, not the whole outsourced eDiscovery process.

eDiscovery processes

We have outlined the steps that are used to support an eDiscovery process. Each organization is unique; specific industries or jurisdictions can require additional steps, so make sure that you work with your legal team to identify any special circumstances or requirements that might differ from the following stages, outlined in Figure 9-1:

1. Content creation / chain of custody activated

2. Information management

3. Trigger of a matter

4. Content identification

5. Content preservation and collection

6. Content processing, review and analysis

7. Matter hearing and decision

8. Content release or archive

Figure 9-1. eDiscovery stages.

Steps 4 and 5 are the actual eDiscovery process as it relates to the ECM solution. And it is the hold process that identifies the content based on search criteria or other filters. The next step is to collect the content, by noting its location and associating it with the hold and, in some cases, moving it to another location. During a matter, which can take months or even years, the content associated with the matter is typically exempt during that time from any information management policies / retention. In addition, the content must be preserved as a record and not altered or spoiled in any way.

Content is then delivered to the tools or the people who will process it, reduce it to its most refined dataset, review and annotate, and finally analyze and make decisions about the content and its influence or impact on a matter.

Note

Governance in the world of legal discovery has a slightly narrower focus then the governance topic outlined in Chapter 7. If you speak to a lawyer, the purpose of governance is to protect content and prepare it for legal matters, whereas the governance we are encouraging the reader to embrace not only manages the ECM solution, but it also ensures good adoption and future extension.

The risks associated with not being prepared and not understanding eDiscovery are notable and should be clear. We have outlined the following key risk factors for your consideration:

• Inflated data volumes, which impose a burden if legal matters arise

• Inability in a legal matter to prepare for Rule 26, to meet and confer with all parties

• Advantages to opposing counsel because of inaccurate and incomplete collection of content

• Dramatically increased review costs

• Risk of producing privileged or sensitive information to opposing counsel that is not covered under a protective order

• Monetary sanctions by the court, including punitive damages and attorney’s fees

• Negative inference and adverse effects on jury and judge

• Dismissal of case or summary in favor of opposing counsel

As the use of eDiscovery processes continues to mature, we would expect that more improved early case assessment is achieved by providing ECM as the system of record that can identify content related to a matter even before the matter happens. In essence, this means locating high-risk activities or content in advance, alerting records and content managers so that legal matters might be reduced or avoided all together.

Most of the time, SharePoint is not going to be the only system of record. Discovery usually includes email, social media, backups, and archives. If your organization is new to ECM and does not have a solution of any kind, you can add to this list all the local and shared drives, legacy databases, and other physical media or paper records.

Prior to configuring SharePoint for eDiscovery, it’s important to plan for the discovery process. This includes listing all electronic repositories that are used to store content, including the location for both electronic and physical records. Determine and document the process for notifying users in the organization that content has been put on hold. For specific users or groups involved in the review process, make sure that the process is well defined for how content will be accessed during the hold. If your organization is also using Exchange as a mail server, you will benefit tremendously from the recent additions in eDiscovery functionality for SharePoint 2013.

At minimum, your organization will have SharePoint and a mail server as locations where discoverable content can reside. The legal and records teams will, in conjunction with all parties in the matter, decide what discoverable means. Content most likely is discoverable if it is reasonably accessible, current, and not considered confidential. Confidential records can include documents that contain personally identifiable information such as Social Security numbers or healthcare records. In addition, there could be trade or intellectual property rights to consider. Most litigation processes will provide a protective order to prevent opposing parties from seeing sensitive content that could compromise competitive advantages; this content would be subject to attorneys’ eyes only.

In an ideal scenario, you will have moved all your content to SharePoint, including archived email, although any email that is more recent is still discoverable in most cases.

After you have identified all the systems and physical content needed to satisfy discovery on the matter, you will need to define a process for collecting the information. This includes all steps in the discovery process from notifications and collection to release of holds. For each activity, you should list who does it, in what time frame, and where the results go.

Ultimately, all collected information is put in a central location for review. For most organizations, it becomes extremely complex to reconcile content from various systems. In some cases, it might be necessary to isolate a location in each system of record where collected content is stored during the hold period.

In SharePoint, you have two ways to hold content: You can hold it in-place, or you can hold and move. We recommend, unless your legal team advises otherwise, to hold and move the content in SharePoint 2010, and in SharePoint 2013, we recommend that you issue in-place content holds.

Holding the content in-place will keep the content where it originated and declare it as a record. The hold mechanism will then track pointers to the content’s location. The reason that we recommend holding and moving the content in SharePoint 2010 is due to limitations in eDiscovery functionality. Discovery in SP2010 is more ad hoc in terms of the steps taken to process. In SharePoint 2013, eDiscovery is set up as more integrated and real-time process, with tracking and reporting. In-place holds are required to maintain the integrity of the content during the discovery process.

If your organization does choose to use the hold and move method, it needs to consider, as part of its IA planning, a location where content should be moved.

This will also include considerations and estimations about the size and the amount of content that will be a part of a typical hold. Most organizations include a specific library in each site collection that is accessible by records managers and legal. In some cases, a subsite is created where the content marked for hold is moved to.

Special consideration needs to be given to who can run eDiscovery and who can view collected content. Consult with your legal department to make sure that their requirements are met. We have found that in most organizations, records managers will have the ability to run eDiscovery and holds, but only legal will have the ability to review the content.

At this point, the differences between SharePoint 2010 and 2013 eDiscovery functionality are clearly illustrated. In SharePoint 2010, eDiscovery was a feature on the site collection level. It amounted to a combination of the search functionality in SharePoint and the ability to create holds based on search criteria. You could search for content and then hold in-place or move it to a different library in the farm.

In SharePoint 2013, many new features are introduced, including a new site collection called the eDiscovery Center, built specifically for eDiscovery. This gives the added benefit of centralized discovery. The site provides integration with Exchange mailboxes, the ability to run discovery on shared drives, support for exporting the results of a hold, and finally, an API for automating discovery with external applications or third-party discovery tools.

From here on, we will reference the functionality found in SharePoint 2013. To start using the eDiscovery functionality, a site collection must be created by using the following steps, outlined in Figure 9-2:

Figure 9-2. eDiscovery site collection.

In the configuration of the site collection, make sure that the proper records managers and legal groups have access to the site collection. In most organizations, not even IT administrators are added to the security group of this site collection. This will be a one-time setup in conjunction with your IT team, and it should happen as a part of your core ECM deployment.

Having a separate site collection for eDiscovery allows for legal teams to organize multiple holds in a more comprehensive manner. This is a tremendous benefit because matters are broken into cases. A case technically is created as a subsite of the eDiscovery site collection created with the eDiscovery Case template. This will be the location of all held content associated with a matter. To create a case, on the root page of the eDiscovery Center site, click the Create New Case button shown in Figure 9-3, to the right of the welcome message.

Figure 9-3. eDiscovery Center home page.

Next, provide a title, description, and website URL, and then select a template for the new case site, as shown in Figure 9-4.

Figure 9-4. New eDiscovery case site.

After you have created the site for the case site, you will have many options for acquiring content, as shown in Figure 9-5. You will have the ability to create eDiscovery sets, perform queries, identify sources, configure exports, review documents, and browse site contents.

Figure 9-5. New case home page.

We recommend not making any modifications to the configuration, to the look-and-feel of the eDiscovery Center template, or to the eDiscovery case templates after they are created. The eDiscovery functionality is tied closely to platform-level features such as search, and modifications to the configuration of these sites might impact their ability to function.

There are four custom lists in the eDiscovery case site template:

While there are various ways to perform eDiscovery with the eDiscovery Center, we recommended the following process:

To create an eDiscovery set, add sources, create filters, and preview results, use the following nine steps, also referring to Figure 9-6, Figure 9-7, and Figure 9-8.

Keep in mind that you can create multiple eDiscovery sets per case. There is no standard practice for when to choose to create multiple sets, but it will be directly related to the size of your farm, your IA, and the ability to easily create understandable queries that produce the desired results.

The larger the farm, the more likely it is that you will need to separate queries based on different sources so that validation of results is possible in the preview and so that you are validating information in smaller consumable chunks.

The more complex the IA is due to the number of site collections and sites, the easier it is to create an eDiscovery set per site collection. You might create a library per functional group or department, rather than trying to encompass all functions and departments in the same location. If you try to incorporate all site collections together, remember that the preview results will show predominantly locations instead of documents.

And finally, if your queries start to become complex, most notably if you have to use exclude logical operators, it could be a good opportunity to break your filters into separate eDiscovery sets, as shown in Figure 9-9.

Figure 9-9. Separating by eDiscovery sets.

The nice thing about this division of labor when it comes to the searches associated with the matter is that the lists provide you a complete guide on the places you have looked for information and the results you have found. This dashboard approach process is also useful when presenting the information and showing how it was discovered during litigation.

Exporting content

Now that you have the specific locations that you collect content from and their broad category of results, you will want to export the content. To perform the export of the content, you must first create a query. This can be confusing because you are essentially querying content twice: once for identification and hold, and then querying that subset for export. The reason this is done is because of the litigation and matter process; you might not want to expose all discoverable content all at once. So although you have identified and held all possible content related to a matter, what you want to export and expose at any given time is a subset of that content that is related to an even more specific topic or discovery request.

To create a query, you will follow the following four steps:

1. Navigate in the eDiscovery case site to the Queries custom list. Here you will see the history and details of all the queries you have already run. This includes the number of results and the size of the results. Click the list New Item button.

2. You can enter a search query here, as illustrated in Figure 9-10. You can limit by criteria including date periods, author, email sender, and now in SharePoint 2013, even the type of document. Before saving your query, click the Search button to see the results in the Query Statistics section and, below that, on the Exchange and SharePoint tabs.

   

   Figure 9-10. Creating a new custom query.

   Note

   In the query creation processes, you want to be as specific as possible and get broad only when needed. In contrast, when you are working with the filter creation process, you want to be as broad as possible and more specific when needed.

3. When you have finished creating your query and are satisfied with the results, you can initiate an export immediately, or you can save and close the query. If you choose to save and close, a new item will be created in the export custom list as a record of an export that is ready to be run.

4. If you choose to initiate export immediately, you will see a new dialog box with export options. We recommend always selecting the following options: Include Versions For SharePoint Documents and Include Items That Are Encrypted Or Have An Unrecognized Format. The export processes will copy the physical files and their metadata from its original location to the location specified in the export. This is done using an ActiveX control called the eDiscovery Download Manager. The results found will be exported to the file location specified in a folder structure that mimics the IA of where the content was found. It will also include a cache folder with system level information used for audits and chain of custody, a reports folder including specific reports, a summary file for the results of the export, and a manifest XML file. This XML file is in the standard Electronic Data Reference Model (EDRM) load file format, which is a standard format for eDiscovery systems. This shows how important the governance of whom, why, and where exported content can be placed is so critical.

A progress bar in the eDiscovery Download Manager dialog box is displayed after you initiate an export, as illustrated in Figure 9-11.

Figure 9-11. eDiscovery Download Manager dialog box.

Security

Before any export can happen, the organization must decide the location of exported content and who can run and view it after export. The exported content will take on the security of the location it is exported to; any item-level security or IA-level security will be ignored. This will expose the content to anyone or any workflow process that has access or is otherwise associated to the network share or content export destination location. This could be an immediate security risk for the organization. Most organizations will set up a special network share that is accessible only by legal counsel. This location could have a separate backup system and sometimes is performed using external or mobile drives.

In the exports library will be a history of all exports run and their status. It is easy to get confused between sources in the custom list and sources in eDiscovery sets. The custom list uses a special tracking mechanism for sources, where you can include additional metadata such as custodians and description. When added, you will be given status of the various sources, but they are different sources than in eDiscovery sets. A source added to an eDiscovery set will not show up in the sources custom list and vice versa. It is possible for an organization to never use the sources custom list.

Note

The eDiscovery process is very reliant on proper search configuration for the farm. If your organization is facing any issue with SharePoint search, these should be addressed prior to configuring eDiscovery functionality.

The home page of the case site, as shown in Figure 9-12, will have a complete picture of the number of sets associated with the case, the current status of in-place holds and the amount of content associated with those holds, the status of exports, and finally, the queries used for the exports. Within 15-minute intervals, this dashboard should be accurate for the current status and should be a good indicator of how the content collection associated with a matter is being processed, how long it might take, and whether it is progressing as expected.

Figure 9-12. Case site home page.

The process can vary if the content of the matter is not clear or is in a state of flux. If so, this is an indicator that discovery and culling of content needs to happen in phases. Your legal counsel should make determinations about how eDiscovery will be run, given the functionality established in the various systems, prior to any matter arising.

We have taken you across the spectrum of governance and control. From general Enterprise Content Management, through creation of governance policies for good user adoption and proper usage, to the stricter records management features and principles, and finally to what happens to content when it is associated with a legal or compliance matter.

Not all organizations will incorporate all components of these topics. In fact, the vast majority of organizations fail to take advantage of the general ECM features of SharePoint and, unfortunately, have to deal with eDiscovery from time to time. However, understanding all the features and principles is important to help your organization to understand what could be looming in the future, and things they should consider adopting to be better prepared, to increase efficiency, and to reduce cost if these issues arise.

In an ideal world, all SharePoint farms will have the beginnings of all the functionality we mentioned, but we know this is not the case. For the sake of taking a step forward, if your organization does not fully adopt the records management and eDiscovery functionality of SharePoint 2013, make sure to document in your governance plans the options for these components and at which point in time you will consider taking them on.