Corporate investigations, whether related to workplace issues, financial frauds, or regulatory matters, often entail using e-discovery tools and techniques to gather crucial information.
Electronic discovery is the electronic aspect of identifying, collecting and producing electronically stored information (ESI) in response to a request for production in a litigation or investigation. ESI includes, but is not limited to, emails, documents, presentations, databases, voicemail, audio and video files, social media, and websites.
The ESI data are likely to be voluminous in scale and potentially to be diverse in type and source. Those materials will need to be preserved, collected, processed, managed, analyzed, and reviewed in an efficient and effective way. Whether assessing the internal risk or facing a regulatory probe, time and accuracy is of the essence. Investigations potentially involve uncovering individuals’ misconduct, therefore controlling the dissemination of information about the investigation is important. Investigation scenarios carry a strong possibility of formal litigation later, which means process decisions must balance investigation needs against being prepared for that potential litigation.
As soon as a detailed hold notice (in the case of an agency-directed investigation) is issued, or as soon as active collection begins, there are chances of destruction of evidence. Therefore, certain collection steps may need to be taken before the hold notice is issued to all subject employees.
Mobile devices are a growing challenge for both litigation and investigations. Smartphones are more difficult, more costly, and more time-consuming to collect and process than computers, and the difficulty, cost, and time can vary from model to model, from maker to maker, and from operating system to operating system. Unlike your enterprise systems, these mobile devices may have automatic janitorial functions that you cannot control or suspend. Moreover, employees may feel more tempted to delete informal messages from their personal devices than they would to delete organization files from an organization computer.
For all of these reasons it is crucial to consider early in an investigation whether mobile devices belonging to key players may be sources of relevant ESI. If they are, performing those collections should become an immediate priority, both to allow the extra time that will be needed for them, and to reduce the risk of accidental loss or intentional deletion. Beyond the growing importance of smartphones and other mobile devices, new communication channel alternatives are multiplying and growing in popularity. For example, messaging services like WhatsApp with the new auto-delete messages function. Usage of alternative communication channels is growing inside companies too. Uber made headlines in November 2017 when an employee testified about the company’s internal use of ephemeral messaging app Wickr.
Despite the incentives to cut procedural corners during an investigation, the need to be prepared for potential litigation later means that preservation, forensic soundness, and process documentation should not be overlooked as you proceed. The list of sources and source types to consider in investigations must evolve over time as your organization evolves in its official software offerings and as its employees evolve in their day-to-day behavior. This is particularly important in investigations in which you suspect intentional employee misconduct because bad actors may use unsanctioned alternative channels in an attempt to hide their actions.