Mark Lyon

eDiscovery Attorney

July 14, 2016

Burndown Charts for Document Review

Accurately predicting the status and expected completion of a document population is no easy task. Communicating the results clearly is also often a challenge. Fortunately, there are tools available to help with this task. One of the most helpful is a simple burndown chart, showing the outstanding work versus time.

To make generating and tracking projections easier, I created a document review burndown chart in Excel format. It’s populated with test data so that you can visualize what it looks like when completed. This document has two tabs – one for collecting data and the other for displaying results. Once updated, the result chart can be pasted as an image into an email for easy review by case teams.

Surprisingly little information needs to be added in order for the burndown chart to be useful. The chart tab and most of the projections automatically update. Calculated fields are indicated in grey and should not be altered (the spreadsheet has protection applied to limit editing).

To begin, open a fresh copy of the spreadsheet and edit the values on the “Calculation Settings” box. Estimate, based on known speeds or complexity the average speed (in documents per hour) of the review. Enter the total team size and the number of hours that will be worked. Keep in mind the need to discount a full work day for breaks, recurring meetings and other needs. An option is provided to indicate whether the first and second day of review should be calculated at reduced speeds and whether the team will work on Saturday or Sunday. Finally, enter the first day for the chart. Using the day before review starts will ensure the “reviewed” number starts at zero.

Once the settings are applied, searching the database for the review population will give the total number of documents for review. Enter this number in the first “Total Population” box. Copy that value until the “Projected Remaining” reduces to zero. If the population changes, adjust the total population starting on the day documents are added or removed and repeat the copying process to ensure the “Projected Remaining” reaches zero.

Each day, at a consistent time (either the start or the end of the day is preferred) search the “Total Population” number and confirm its accuracy (make sure to copy changes to later days), then determine how many of those documents have been reviewed and enter that value in “Total Reviewed”. This will automatically calculate the number of documents reviewed for the day and the actual number remaining for review.

Once the data is updated, the “Chart” tab will show an updated progress tracker. Projected review completion is shown in blue, actual review is shown in orange and the number of documents completed each day is shown as a bar chart in the background.

The “Calculation Settings” can be adjusted as additional progress information is gathered to create different scenarios – adding team members, increasing or decreasing speed, or changing hours. These alterations are immediately reflected and can be studied to help inform decisions.

Hopefully this helps improve your ability to project project completion and monitor progress along the way!

Download: Burndown Chart Example

May 22, 2016

Refinancing Student Loans

Piggy Bank by Fabian Blank, via Unsplash -

Most people who went through law school in recent years are saddled with significant debt. If you’re not, be thankful. If you are, it’s often difficult to discuss how best to handle addressing this massive debt, particularly if making payments is difficult due to sporadic employment or low pay. Even with full time jobs along the way, I finished undergraduate and law school with more than $100,000 in outstanding student loans.

If you have a significant number of federal loans, Income Based Repayment may be a useful and attractive repayment option. There are some drawbacks and situations where it might not be appropriate, but it is certainly worth investigating. This is doubly important if you work for the government or a nonprofit, as Public Service Loan Forgiveness can dramatically reduce the amount you must repay, but forgiving the balance due after 120 payments. Ten years goes by faster than you might imagine.

In 2008, I consolidated my subsidized and unsubsidized student loans. All of my loans had been originated by or sold to the Missouri Higher Education Loan Authority (MOHELA), so I used them for the consolidation out of convenience. Not shopping around for the best deal at that time was unwise. I was unhappy with the billing, online payment tools and general customer service at MOHELA. Other servicers may have offered a better experience.

My private student loans could not be rolled into that consolidation, but most were already in a single payment at MOHELA. One random loan from undergrad – provided as emergency support when my scholarships were suddenly decreased – was the outlier. I worked as quickly as possible to pay off that loan, as the servicer was incredibly abusive, even though I was never delinquent.

Ultimately, the bulk of my outstanding debt was refinanced at 7%. My payments were close to $900 a month, but most of the money I paid went to interest. My final payment was scheduled for July 2, 2038. I’d be nearly 60 years old. That’s a really, really long time to be paying out a non-trivial amount of money each month.

In late 2015, I started looking at ways to tackle my student loans. New options for private financing were entering the market. I have a good credit score and understand that moving to a private lender causes me to lose some of the rights I might otherwise have with my federal loans.

First, I found SoFi. Then, searching brought me Earnest and several others like Citizens Bank and DRB.

SoFi seemed to be really on top of their advertising and SEO game. They offered a $500 signing bonus through my employer and had our HR department schedule a WebEx to tell us about their offerings. The others didn’t seem quite so polished, but my regret over not shopping my earlier consolidation caused me to seek out all the lenders I could find. I was also seriously troubled with my inability to find substantive “I hate SoFi” or “SoFi sucks” search results. Almost all the reviews I could find were positive, which seems unlikely. At a minimum, there should be delinquent customers unhappy with the collections process. Their SEO team seems to have no interest in allowing that, however. The company even bought to prevent some angry customer from nabbing that prime spot.

I was able to find a mix of positive, negative and mixed reviews for the other lenders. While I’d never rely on a single review to help steer my decision, the general sentiment seemed to make me feel comfortable with Earnest. Ultimately, I filed an application with SoFi and Earnest.

After completing a rather detailed application process (including linking Earnest into my online banking and credit card accounts), I received my loan paperwork.

  • SoFi offered (for $1,020/mo payment) a 5.00% fixed, ten year loan (including a -.25% autopay discount), along with some variable rate options I didn’t consider. They also offered a $500 bonus through my employer.
  • Earnest offered (for $1000/mo payment) a 5.24% fixed, ten year loan or 3.32% variable 9 year 3 mo loan (both rates include -.25% autopay discount);

I was tempted to ignore my concerns over the SEO and sign for the lower rate. Then, however, I learned that SoFi uses MOHELA as their servicer. While their platform as dramatically improved over the years, I was impressed that Earnest handled everything in-house. I reached out to their team and eventually emailed with Kai, who offered to resubmit my application along with the rate I’d been offered from SoFi to see if their team could make me a better offer.

A few days later, they came back with a revised offer. $1000 per month for ten years at a 4.71% fixed rate. Sold!

Earnest made the payoffs quickly and their website has been great for managing my payments – they send me notifications far in advance of the deduction, I have the ability to change my due date at will and they even allow skipping a monthly payment once a year, if desired. Extra payments are easily scheduled online. The loan documents were easy to understand and the billing process simple and clear. No more confusing bills laden with disclaimers and confusing formatting. They even offer a $200 signing bonus, similar to what SoFi offered, for anyone referred by a current customer (click here to claim).

Ignoring extra payments, my final autodraft will be in December of 2025. With just a little bit of work and a slight increase in my monthly payments, I’ve cut more than twelve and a half years off of my student loans. I couldn’t be happier.

If you have significant student loan debt, I highly recommend you consider a private refinancing. The savings can be dramatic.

February 24, 2016

The Basics of eDiscovery

The team at Exterro has assembled an incredibly helpful group of resources with their “Basics of E-Discovery” website.  They’ve broken the entire process into several chapters and even included a helpful list of external resources (including my site) for additional learning.

Each day, numerous attorneys find themselves facing new challenges as they work to address eDiscovery and the recent Rule changes. Helpful guides like this, combined with advice from experienced practitioners and vendors, can serve to ensure all critical issues are considered and that the process moves forward efficiently.

February 23, 2016

How Contract Attorneys Should Approach Downtime

Lake Louise, Canada by Roberto Nickson

Because of the project-based nature of the work, contract attorneys must constantly consider the potential for downtime, both planned and unplanned.

In the eDiscovery context, for example, preliminary searches may set expectations for a large, long-term project but skillful negotiation and adjustment of search terms (or the use of analytics), entire populations can disappear overnight. Suddenly, a recruiter is making a late-evening phone call to report that training will be delayed or that there will be no work tomorrow. Similarly, for contract attorneys working in more substantive roles, the ability to keep yourself constantly engaged may be at the mercy of someone else completing a necessary task or even for clients to approve a budget. Almost none of these issues are within the control of the individual who is most significantly impacted.

Whenever downtime occurs there are a few critical steps that, if taken, can help keep your utilization high and stress levels low.

First, evaluate the cause of the downtime. Depending on the source of the delay, the actual cause may not be clear to you, but consider the information you have been given. If, for instance, a new project is delayed, has your recruiter or agency provided you with a clear indication of when training will occur? Using this knowledge, consider first whether it is wise to remain committed to the matter. Often, a short delay will have little impact in the context of the larger relationship, but if your project is repeatedly delayed, sometimes it is necessary to move on.

Second, always be looking for new opportunities. I have Posse List emails directed to my phone and check new Craigslist postings each evening in my RSS reader. If a better project comes along and you’re not actively engaged in a project (or if it’s clear your current matter is winding down) make certain to quickly submit your application materials. Stay in regular touch with your recruiters at each agency; I typically email an availability update each Wednesday, but if you’ve just been released from a project, make certain to update them immediately. The need to maintain a pipeline of work should be apparent; don’t trust one recruiter or agency to keep you fully utilized at all times. Build relationships with every agency active in your area and seek to move between matters with as little downtime as possible.

Third, identify opportunities for self-improvement. I like to learn new skills, so downtime is always a welcome opportunity to attend a virtual training, take an online course or maybe attend a CLE. I’ll find a comfortable place to work and drill into learning a new skill. Perhaps you’ve been putting off running some errands, deep-cleaning your apartment or searching for a new soulmate. You’ve got some free time. Take advantage of it.

Fourth, determine whether you’re eligible for unemployment or to use any banked vacation time with your agency. This is highly dependent on your individual situation, but many people needlessly abandon accrued hours at one agency when moving between projects.

Fifth, don’t neglect planned downtime. Everyone needs to take some personal time and relax. As a project-based worker, the temptation is often to try and schedule vacations and events around your work, but I’ve often found that doing so is nearly impossible. The planning timelines involved in scheduling a relaxing trip or even a really stressful wedding rarely align with those of your workflow, outside of major holidays (and, even then, often Holiday plans are blown apart by emergency, last-minute tasks). Instead, I find it easier to set aside time far in advance with clear notice to anyone who might be impacted. With limited exception, I’ve encountered very little push-back when I’ve given advance notice of my plans.

Finally, a critical component to being able to weather unexpected downtime is having at least some savings or access to credit. When projects are offering high rates and significant overtime, it can often be tempting to splurge, but it’s critical to set aside at least a month or two of expenses in the event that work dries up. I recall, as a reviewer, getting extremely close to the bottom of my emergency fund when a large number of my projects settled. I’d been working exclusively for one client for a number of months, but suddenly, with multiple matters ending, there was no more work to be done and a number of new attorneys on the market, looking for every available position.  Having a small amount of savings helped ensure I paid my rent on time, kept food in the fridge, that Sallie Mae was paid and that I felt confident enough to take the train to another city for an interview.

It is incredibly easy, particularly on long-term projects, to become complacent and ignore the risk of downtime, but it can occur at any time. Never forget that the nature of our work is temporary. Having a reasonable plan for handling the unexpected can dramatically limit the stress of temporary work and enable your continued success.

December 3, 2015

Getting Staffed

Frustrated Man - Picture by Ryan McGuire -

Over the Thanksgiving holiday, an angry DC document reviewer posted the following ad to Craigslist, a popular source of information about upcoming document review projects. I’ve redacted the agency’s name from the text, as it is not important for the discussion – similar situations can exist with almost any agency.

To All Contract Attorneys,
I have just spent the past month trying to work with [Redacted], LLC. They contacted me for a job on October 27th, with the expected start date of that Thursday. Then, I did not hear anything from them for almost two weeks. Finally, they contact me and tell me that that project wasn’t going to start at all, but they had another due to start the next week. So, I went through the conflicts check for a second time. This time they did not contact me again for three weeks. Eventually, though they contacted me again with an offer for a third project. Naturally, I asked what had happened with the second project, and I was told that I was ineligible for it (despite having told me that I cleared conflicts). It turns out that I had been ineligible for both projects because I also represent clients in small matters in Virginia, a fact which they had known the entire time. In other words, they kept me waiting for a month to work on projects that they knew I was ineligible for.
They are incompetent and they will lie to you about the project start date and keep you waiting for weeks.
As a final thought, it is worth noting that these postings cost money ($35). Now, if you are thinking about working for [Redacted], ask yourself if you really want to work with a company that makes former employees angry enough to spend money to tell the world about how bad that company is.

As a neutral observer, I suspect the agency tried quite hard to get this individual placed on multiple matters, but something in either the outside representation or another factor caused the law firms making the final selection to decline. Many firms simply balk at not having exclusive access to a contract attorney’s time during the review project, generally because their in-house conflicts departments have no existing mechanism for handling someone who may be taking on new cases during the course of their project. Some project managers are unwilling to staff team members who will have an unusual schedule – attorneys maintaining a private practice are quite often in this group, with constant outside meetings, court appearances and the client-handling minutiae of an active practice invading on time that could otherwise be dedicated to their matter.

The long lead times for staffing some projects are often a direct result of clients with significant involvement in the staffing process. In some matters, the firm and end client trust the agency to make wise selections before reviewing and approving a well-curated group of reviewers. In others, there are multiple steps of approvals, resume reviews, conflict forms and other administrative tasks that must be completed before the ultimate team is assembled.

Many times, the specific decision-making criteria being used are unclear to the recruiter working to staff the project – what initially looks like a good prospect is struck for seemingly no reason and with little explanation. Some of the most common reasons for rejecting a candidate that I see, though, are poorly drafted resumes (either providing no relevant experience or, in the opposite direction, disclosing far too much client confidential information for a public document) or poorly-completed required forms. If the law firm requires a special form that lists every matter on which you’ve worked, they will often reject a candidate who fails to complete the information or simply references their resume. While, in an ideal world, the recruiter would contact a candidate and ask they correct these issues before submission, time constraints often limit the ability to do so.

Ultimately, when you’re unstaffed and are looking for a new project, a prepared contract attorney needs to be looking for projects in parallel; applying for multiple projects and waiting to see which best fits their individual needs once they solidify. Use sources like Craigslist and Posse List to follow new leads and regularly check in with your existing agencies. When not working, be constantly applying for new projects until you’re fully staffed. Then, keep your relationship with other agencies open, being clear about your expected availability.

Do not, however, gain a reputation for bailing on one project for another before the announced duration of your matter is reached. There’s nothing more frustrating than spending time training and getting someone up to speed only to have them bail when the first tranche of batches are finished. Communicate with the project management to get an idea of the workflow. Most will give you as much advance notice as possible when they’re able to predict a project’s end.

Cultivating a relationship with multiple agencies is critical. When I was working as a contact attorney, I primarily worked for one agency, but found great value in keeping a relationship with several others. Each Wednesday, I’d update all the recruiters on my availability for upcoming projects. More than one that weekly update helped secure additional work in the form of weekend, last-minute projects for an agency other than the one where I’d just completed a 40-hour week and would return on Monday. In other cases, a recruiter knew I would be available in two weeks, so when staffing his next matter he could include me in the submission and I’d be able to move from one matter to another with minimal downtime.

Don’t spend a month waiting for a single lead to mature. Keep hunting.

November 30, 2015

Black Friday eDiscovery Training Deals


This year several eDiscovery vendors have extended Black Friday / Cyber Monday / #eDiscoveryDay deals.

The most attractive of the offerings is FTI’s offer of free Ringtail 8.5 certification, a value of up to $250.  The programs offered are Reviewer I (for users who primarily review and code documents) and Reviewer II (for users who oversee reviews, perform searches, conduct quality control and generate reports).  There are numerous training session opportunities listed and the process to sign up was quick and easy.

iCONECT is offering “Buy One Get One Free” training on XERA.  They offer three training programs, System Administrator, Project Manager and Client Administrator.

ACEDS is offering a 30% discount on a number of products using the coupon code “MONDAY30“.

NUIX is also offering a “Buy One Get One Free” eDiscovery specialist training in Sydney on December 8.  The code “Nuix BOGO” will unlock the deal.

Several vendors are offering training sessions through the e-DiscoveryDay website on December 1.

Finally, for a quick update on predictive coding, Ralph Losey is offering a free webinar.

Take advantage of free training offers when they’re available – it’s always good to brush up on your skills or get exposure to new platforms and tools whenever time permits.

January 4, 2015

Training a Review Team

River Region Health Center Training Room photo courtesy of Jason Wohlford ( - CC BY-SA 2.0)

The success of a document review project depends heavily on a successful training day. While the core members of the case team have likely been actively working on the matter for weeks or months, new team members will not start with the same level of knowledge and need to be quickly and efficiently brought up to speed on the law, known facts and relevant case details in order to properly and fully perform their review task.


Like many other tasks, the key to a successful training begins with proper preparation. While it’s tempting to give an off-the-cuff opening statement and walk through the coding choices that have been configured, having a written protocol provides important reference material for the team as the review progresses. This protocol can contain many things, but at a minimum, it should involve:

  1. An overview of the facts surrounding the case;
  2. An overview of the industry or other general information;
  3. An overview of the law surrounding the case; and
  4. Instructions on the use of the coding layout, including:
    1. an explanation of what is responsive;
    2. an explanation of what is hot/key;
    3. an explanation of the various issue codes and how they are to be used;
    4. an explanation of the privilege standards to be used during review (including case-specific privilege concerns like those of inventors, banking examiners or other special situations); and
    5. an explanation of related (family) document handling.

Supplemental material provided should be useful and designed not to overwhelm the review team. For example, providing a massive listing of every attorney within a large company may be counterproductive, as some reviewers will feel the need to consult it for every name they encounter. Instead, utilize technology to highlight relevant attorneys and firms, calling attention to those entries for the review team and providing a more strategic list of known attorneys and firms involved in the case.

In some situations, it may be important to provide copies of the specific requests to which the case team will be responding, but do not use these as a substitute for fully-developed training materials. For example, the discussion of issue codes should have full explanations of the topics covered under that code, with references to the underlying request, but not direct a reviewer to apply Issue Code X if the document is responsive to Request #17, 19 or 34. Sometimes, supplemental material can be provided as an electronic reference (particularly if searching is helpful), but paper copies of the actual review protocol (and legal pads for notes) should be provided to the team – they’ll be consulting the protocol frequently and quick access is essential.

Don’t hide information – beneficial or negative – from the review team. Alerting the team to known strengths and weaknesses will put them on the alert for documents that support or disprove the case team’s existing understanding. I’m reminded of one matter where the attorney conducting training with a large team noted, in an offhand way, a particularly troubling obstacle in defending the case. For months, the case team had accepted that the client failed to obtain a necessary certification and planned to concede same. On the third day of review, however, a team member stumbled across a document (the importance of which wasn’t immediately evident and would simply have been marked responsive) indicating that the certification had been obtained by an employee no longer with the company. Additional collections revealed that this employee, who had only been involved in a few planning meetings, knew of the certification requirement and obtained it while also obtaining the certification for another item. The records had been misfiled as belonging to the other item. Finding them greatly simplified the issues.

Training Day

When training day arrives, ensure the review team has an opportunity to settle into their workspace before the training session and review the written materials. Examining the materials in advance will allow the team to better digest the training and dramatically improves the quality of the questions asked once training is complete. Generally, review teams who do not have time to review in advance will ask a large number speculative of “what if” type questions, but a prepared team will be more focused on the facts and the process of coding, digging deeper into any inconsistencies or ambiguous portions of the protocol.

To begin the training, make certain to introduce the members of the case team, even if they will not be regularly participating in the review. In a review managed by an outside vendor, there is not generally a need to provide contact information (the vendor should have an established process for funneling communication between the case team and the reviewers) but making certain to identify the attorneys involved will help the reviewers feel engaged and potentially avoid the embarrassing missed privilege call on a document that mentions a senior partner or the general counsel (“oh… ‘Judy’ is THAT Judy”). If utilizing a vendor, make certain that the vendor has introduced their personnel and explained the communication process – surprisingly, this step is often forgotten and reviewers who have not worked for that vendor before may be unclear.

Following introductions, walk through the review protocol, starting with the overviews and moving toward the more detailed coding instructions. It may be helpful to show important documents or other visual aids, particularly in cases involving subject matter that may be somewhat obscure. The more the review team understands about the case and the underlying business, the better their work product. Don’t assume that everyone starts with the same level of understanding. For example, if your case involves computer software, it is not safe to assume that everyone understands general principles of programming. It’s also helpful to explain known industry jargon – while many members of the case team may specialize in an area and have great exposure to a specific industry, many document reviewers are generalists. Their experience may not have involved exposure to the subject before. Ensuring everyone leaves the session a basic level of knowledge will prevent many questions and/or misunderstandings.

It can be difficult to find the perfect balance of providing relevant information and overwhelming the team with unnecessary detail. Generally, I’ve found that most training sessions can be completed in one to two hours. Where a significant level of detail is needed and training must run longer, make certain that the team is prepared in advance for the expected duration.

Take breaks at natural pauses in the materials. While these breaks need not be long (and sometimes simply involve pausing for questions or allowing a new speaker to provide a short digression), well-timed interruptions allow the team to absorb the material, grab a fresh cup of coffee or run to the restroom without missing the presentation. Keep an eye on the audience; if it appears that concentration is waning, take steps to keep them engaged. Question periods are important and, in a long training, it is important that the team not hold all questions for the end.

Some case teams prefer to stay onsite after training to answer questions. When working at a remote review site, it is important to make certain that the onsite management team is aware and has provided a space to work (preferably with a phone, internet and an adequate amount of privacy) so that those remaining at the review site remain productive when not answering questions. If questions are to be answered directly, make certain to implement appropriate protocols to ensure answers reach all members of the review team. Many vendors will have an existing process for documenting and relaying questions and answers for the entire group.

At times, it is impractical for the case team to attend an in-person training session. When training remotely, utilize video conferencing if available, but successful trainings can be accomplished by audio conference as well. During such trainings, however, make certain that the speaker can be clearly heard by all participants. Maintaining attention and concentration can be far more difficult without a live speaker, so audio conferences often benefit from the use of presentations and exhibits.

After Training

Once the training materials have been covered and all questions answered, I prefer to allow the review team to take a long break – usually thirty minutes or so – to attend to personal needs and re-settle at their workstation. When a vendor is involved, this break will also allow the case team time to meet with the vendor’s project management team to address any last-minute questions or concerns.

Depending on the complexity of the case, it may be desirable to test the review team following training to help identify any areas that need additional explanation. There are many methods available, but I favor those that provide simple, quick feedback from the team, either through computer-based testing or having the team raise their hands to vote on choices. If testing is not utilized, ensure that the QC process has a reliable method for ensuring that team members are uniformly coding in their initial assignments. It is critical that any misunderstandings be identified quickly to prevent the need for re-review.

While there are some exceptions (usually due to case team scheduling or platform issues), I try to ensure there are at least 2-4 hours remaining in the day for the review team to begin actual review following the training session. Examining real documents and using the coding panel will generate a number of questions. Waiting till the next day (or worse, the next week after a Friday training) wastes this opportunity to cement the new material in the minds of the review team and delays the identification of potential issues. The review team should be encouraged to ask questions (citing example documents, where possible) and the case team must be prepared to provide quick responses to prevent any wasted effort or delay. Generally, the number of questions will drop after the first few days of review, but be prepared for the number of questions to increase when significant changes occur with the review population (for example, moving from engineering custodians to marketing custodians or when shifting from email to electronic documents and paper files).

In Conclusion

The time you spend training a review team can provide significant value. Review team training is an excellent opportunity to hone the presentation of your case on a large group of previously-uninvolved team members. When preparing your materials and when making your presentation, you will likely find new opportunities to better understand your case. Providing effective tools for the review team equips them for success. Ultimately, the time you invest in ensuring a successful training translates into better productions, better questions and a more consistent and accurate review.

River Region Health Center Training Room photo courtesy of Jason Wohlford
September 30, 2014

Keep Responsive and Privilege Separate

Redaction Image courtesy of Jack Zalium - CC BY-NC 2.0

I’ve encountered a number of reviews recently where combining incompatible tags and enforcing (sometimes with automatic propagation) family coding resulted in mass confusion at production time.

For example, responsiveness and privilege are separate logical concepts. Faced with a single-choice field containing Responsive, Non- Responsive, Privileged, Redact, and Unreadable, reviewers are uncertain how to code a non-responsive but privileged document. Should the more important call prevail?  Which call is more important?

In one recent review, that’s exactly what occurred when several associates began second level review. They wanted to make absolutely certain that thousands of privileged (but irrelevant) documents never saw the light of day and, in error, changed a number of non-responsive documents to privileged, pushing them into a workflow that ultimately generated unnecessary work for the priv log team.

Instead of mixing concepts, I prefer to keep responsiveness and privilege as logically separate concepts and require accurate coding for all tags on every document, based on the content and context of the actual document.

Most modern review platforms don’t require family coding in order to properly produce full families. Instead, they are quite capable of allowing each document to be coded individually for responsiveness, privilege, issues and any other coding needs while still making it possible to pull full families into a production set (or any other arbitrary search). I build my searches for doing so like this:

  • Admin 1: All Privileged plus Family
  • Admin 2: All Redaction plus Family
  • Admin 3: All Special Withhold plus Family
  • Production 1: All Responsive plus Family, NOT in Admin 1, 2 or 3

The resulting set will contain only those documents where at least one document is responsive, but no documents are in special categories that should be withheld. I also gain the benefit of having easy access to searches that always contain special document categories for my case, so I can quickly exclude, for instance, the privileged documents from any other search simply by adding an additional criteria to my search.

Note, though, that simply searching for Not Privileged won’t have the same result, since you’re not guaranteed to have a privileged tag in every family member. The safest way is to exclude a search that contains all the privileged documents AND their family members.

By keeping coding on a document level, determining an individual document’s importance is greatly simplified. Now, when searching for a document with a specific tag, you’re not forced to also see every family member. This can greatly improve quality, as you can search for terms on documents with (or without) specific tags, ensuring that your coding accurately reflects the content. Additionally, reviewers aren’t constantly backtracking to make family adjustments based on the content of that fifth attachment.

The increase in complexity of production set assembly is greatly offset by the time savings to the case team.

Redaction image courtesy of Jack Zalium.
May 29, 2014

TrueCrypt Security

TrueCrypt is one of the standard encryption tools used in eDiscovery to transport data – both coming from source material and in outgoing productions. It’s an incredibly easy-to-use, free, cross-platform tool that presents encrypted “containers” as drives that can be accessed on a local system. On Wednesday, May 28, 2014, the TrueCrypt SourceForge page was updated with an abrupt and ominous warning.

WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues
This page exists only to help migrate existing data encrypted by TrueCrypt.
The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.

Instructions were provided for using Microsoft’s BitLocker encryption, along with a new release of TrueCrypt containing warnings about its insecurity and removing the ability to do anything other than decrypt existing volumes. The new 7.2 release contains warnings substantially similar to the SourceForge page, and it’s cryptographically signed with a good key for the developers. The differences between the 7.1a code and the 7.2 code include the addition of warnings, removal of encryption capabilities and the odd conversion of “U.S.” in several strings to “United States”. Interestingly, they also removed the licensing restriction that required derivative versions to provide reference back to TrueCrypt, almost seeming to invite a fork of the existing codebase, something their earlier licensing strongly attempted to discourage.

Many are currently speculating that this announcement is a “Warrant Canary” designed to alert users that future versions, even if cryptographically signed, could contain intentionally-placed vulnerabilities likely as the result of a forced disclosure of the private TrueCrypt code signing keys. The developers remain anonymous and have been silent since making the changes to the SourceForge page and updating the new version.

At this time, there do not seem to be known exploits for TrueCrypt; concerns over its security are solely based on the information presented by the developers. The end of life for Windows XP does not seem to be a valid reason to cease development, as even the suggested replacements are poor substitutes for the existing functionality. An active audit of the 7.1a codebase is underway and its initial results were promising. Initial reports are that the audit will continue.

BitLocker is not an appropriate solution for eDiscovery file transport. First, it is included as part of only certain versions of Microsoft Windows. Unlike TrueCrypt, it’s not compatible with other operating systems. Its security is also highly questionable – Microsoft clearly explains that in a non-domain environment, copies of the keys necessary to decrypt the container are sent to and stored by Microsoft.

The choice of an encryption tool is not one that should be taken lightly, nor should that decision be rushed. While many are going to urge an immediate change, with what is known about 7.1a at this point, it is likely safe to continue its use for a short period of time until an accepted alternate can be determined.

May 19, 2014

Hot Terms

In 2010, Anton Valukas at Jenner and Block issued a massive report in his capacity as examiner in the Lehman bankruptcy. The report was an incredibly in-depth review of the business and its failure, but also included a significant amount of detail about his methods and sources. The report disclosed that from three petabytes of available data, approximately five million documents were selected through various methods and loaded into either Stratify or CaseLogistix (a significant culling).

One of the more important parts of the report outlines the search terms used to identify important documents. The terms suggested served as a seed set for a list of terms I’d identify from important communications in numerous other reviews. Most are not case or subject-matter specific, instead they’re terms that help find communications conveying bad news, disappointment or surprise.

Using this personal “hot terms” list, it’s often easy to drill down into the most important (or at least revealing) documents. I continue to add and remove terms from this list to this day. Some, like “huge mistake”, “highly sensitive”, “sneak around”, “too late”, “uncomfortable”, “shocked”, “dumb” and “toxic” have provided incredibly interesting results.

Over the weekend, the WSJ reported The 69 Words You Can’t Use at GM. The list comes from a presentation included in the settlement documents. They are (I’ve highlighted a few that are either already on my list or that I will soon test):

always, annihilate, apocalyptic, asphyxiating, bad, Band-Aid, big time, brakes like an “X” car, cataclysmic, catastrophic, Challenger, chaotic, Cobain, condemns, Corvair-like, crippling, critical, dangerous, deathtrap, debilitating, decapitating, defect, defective, detonate, disemboweling, enfeebling, evil, eviscerated, explode, failed, flawed, genocide, ghastly, grenadelike, grisly, gruesome, Hindenburg, Hobbling, Horrific, impaling, inferno, Kevorkianesque, lacerating, life-threatening, maiming, malicious, mangling, maniacal, mutilating, never, potentially-disfiguring, powder keg, problem, rolling sarcophagus (tomb or coffin), safety, safety related, serious, spontaneous combustion, startling, suffocating, suicidal, terrifying, Titanic, unstable, widow-maker, words or phrases with a biblical connotation, you’re toast

Not all of these terms are generally applicable and some would likely result in too many false hits, but terms like these allow you to step into the daily lives of the custodians and see the things that are of concern to them. It’s far too easy for individuals to forget that work email might later be reviewed, looking for emotion or personal opinion can often be incredibly enlightening.

If you frequently work with specific industries or clients, it would be worthwhile to build a personal search term list relevant to your specific recurring data. While these terms would likely never be used for document promotion, they may help find “the good stuff” at the beginning of a new project. Every case team enjoys finding important information at the outset of a review; it makes decision-making much easier.

Car Fire image courtesy of Nick Fisher.
Older Posts