In an earlier article, we discussed the practice of remote collection — a data collection method that allows the e-discovery practitioner or forensic expert handling the collection to do so from a location other than where the data is physically stored. The article covered the various methods for remote collection and its key benefits over on-site collection for e-discovery.
The most frequently cited benefit is cost savings. On-site collection requires an expert to travel to and from the site. Not only does a remote process save on airfare, hotel and incidentals, there is no bill for an outside consultant’s travel time. This, combined with the fact that e-discovery deadlines are often challenging to meet, has led to an increase in legal teams leveraging remote collections. Despite the many benefits, there are potential pitfalls that must be carefully considered. This article will discuss some of these considerations and outline the types of cases that are often best suited for remote collections.
A recent matter at a national restaurant chain required collection of data from computers at numerous restaurants across the U.S. Remote collection saved the client from sending professional forensic experts to remote locations to image a single computer at each restaurant. Instead, collection kits comprising of encrypted hard drives, return labels and basic instruction were shipped to each of the restaurants. While there were significant cost savings on travel, the absence of a forensic expert on site meant that the process took longer and involved extra work back in the lab to ensure that the collections were completed successfully. In those instances where the collection was not completed properly, new hard drives were sent to the restaurants to repeat the process, which increased both the costs for shipping the hard drives back and forth and the time the forensic experts were billing for the re-work. On-site, a forensic specialist can collect from multiple computers simultaneously and easily collect from six or more custodians in a single day — however, time and costs increase when the experts must piecemeal together collections implemented by individuals without experience in this area.
There are a number of technical requirements that are necessary in order for remote collection to work effectively, and legal teams should understand these factors before moving forward with this approach. Some of the most common potential roadblocks include the following.
- Custodian cooperation: A custodian must be willing to help with the collection. Someone else within the company may be able to step in, but it is essential that the individual is able to execute the process. Any combination of a custodian with minimal technical knowledge or the wrong hardware can render the collection unfeasible.
- Chain of custody: In criminal or highly sensitive matters, it may not be appropriate or even legally defensible to have the custodian self-collect. A remote collection relies on a custodian to fill out a chain of custody form, which often leads to mistakes or errors that are easily avoided when a trained professional performs the collection. Some legal teams may opt to use alternative collection methods if there is any potential for opposing counsel to question the chain of custody on relevant data.
- Room for error: Even with an automated remote collection kit, it is very easy for a layman to miss something. Forensic collection is a specialized practice, and without an expert on hand, there is more room for error, which further complicates and delays the overall process.
- Security: Encryption protocols within the network can cause headaches as well. In some cases, companies automatically encrypt any data that is written to an external device, which will render the data that has been collected unreadable when received by the collector. In these cases, it is crucial for the legal team to be prepared and obtain the decryption key for collection specialists beforehand or otherwise have IT disable the encryption feature. In other instances, companies block USB device connections altogether, making a remote collection more challenging.
- Mobile devices: Remote collection typically does not work on co-located servers (unless special provisions are made) or on mobile devices. If the collection requires data from smart phones or iPads, for example, some arrangement must be made for the expert to have direct access to the device. Typically these types of collections require the involvement of an outside specialist to consult on the matter.
- Connectivity: In some forms of remote collection, the target device must be attached to a reliable Internet connection; this can especially be an issue if the device is in a home office or if the employee is remote (for example in a hotel room) during the collection. The custodian also must have a baseline technical knowledge to set up a connection (e.g. via LogMeIn) and/or connect the collection kit.
- Regulatory issues: A remote collection procedure must not obviate data regulations, such as local P.I. licensing requirements, international data privacy regulations or Chinese State Secrecy Laws, to name a few. In these instances, the legal team needs to take a holistic look at what regulations come into play for the matter and secure involvement from experts to navigate the collection.
Key use cases
With the above potential pitfalls in mind, some matters are better suited for remote collection than others. Factors such as the size, complexity and timeline of a case, in addition to what types of data sources are involved are all important to consider when looking at remote collection options. Below are some common circumstances that often make the most sense for remote collections.
- Hart-Scott-Rodino (HSR) Second Requests, where timelines are tight and custodians are typically invested in working toward a successful outcome
- Remote sales teams and/or other home based employees
- A group that includes a relatively small number of custodians across a large number of offices
- A senior executive who will not take the time for an in-person collection and is not willing to be without his or her device
- International or other expensive-to-reach locations
- Server collections where it may be possible to collect multiple custodians’ “group shares” at a single data center or cloud-based environment
- Locations where third parties (i.e. experts) are not allowed, such as secure data centers
Generally speaking, remote collections can be less time consuming and less intrusive than on-site collections, which can be a key selling feature for senior executives who must cooperate with a collection but have limited time to do so. IT and legal can work together to manage the potential pitfalls as well as security concerns regarding access to devices and shipping of data. Having a well-informed team and understanding the nuances of the various approaches available for data collection should be a key part of a legal department’s overall e-discovery strategy. With ongoing budget concerns, remote collection is a valuable approach to consider for reigning in growing e-discovery costs.