IRJET-Block Chain based Cyber Security System for Data Transfer
Leveraging Metadata in Electronic Discovery
1. 39OCTOBER 2015www.ocbar.org
by CHRISTINA LINCOLN
LEVERAGING METADATA
IN ELECTRONIC DISCOVERY
H
ow many times has the modern lawyer been informed, and even warned, of his or her obligation to preserve
clients’ electronically stored information (ESI)? Countless. In this day and age, every lawyer has heard of the latest
Sedona Principles, Rules of Civil Procedure, and Rules of Professional Conduct pertaining to ESI—not to mention
the eminent Zubulake opinions that jumpstarted it all. See The Sedona Principles—Second Edition: Best Practices
Recommendations and Principles for Addressing Electronic Document Production, The Sedona Conference Working
Group Series (June 2007), www.thesedonaconference.org; Cal. Civ. Proce. Code §§ 2019.040, 2031.030, 2031.280;
Fed. R. Civ. Proc. 26, 34; Zubulake v. UBS Warburg LLC, 217 F.R.D. 309 (S.D.N.Y. 2003) (Zubulake I); Zubulake
v. UBS Warburg LLC, 216 F.R.D. 280 (S.D.N.Y. 2003) (Zubulake III); Zubulake v. UBS Warburg LLC, 220 F.R.D. 212
(S.D.N.Y. 2003) (Zubulake IV); Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y. 2004) (Zubulake V).
As emphasized by one court, “[I]gnorance of technology is simply an inadequate excuse for failure to properly carry out
discovery obligations.” Small v. Univ. Med. Ctr. of S. Nev., No. 2:13-cv-00298-APG-PAL, 2014 WL 4079507, *29 (D. Nev.
Aug. 18, 2014). Because of this, we have been conditioned to simply worry about our ESI obligations. We shouldn’t. Rather,
we should turn our focus toward the opportunities it provides, namely, with ESI metadata.
2. 40 ORANGE COUNTY LAWYER
Types of Metadata
Metadata covers the oodles of additional
information that automatically attach to
electronic documents; officially, it is “data
that provides information about other data,
‘hidden’ or ‘embedded’ information that is
stored in electronically generated materi-
als, but which is not visible when a docu-
ment or other materials are printed.” Ellis v.
Toshiba Am. Info. Sys., Inc., 218 Cal. App.
4th 853, 859 n.5 (2013). Simply put, meta-
data is “data about data.” Id. For this reason,
when compared to electronic documents,
hard copies rise to the level of “amputated
paper print-outs”—“akin to traditional
memoranda with the ‘to’ and ‘from’ cut off
and even the ‘received’ stamp pruned away.”
Armstrong v. Exec. Office of the President,
Office of Admin., 1 F.3d 1274, 1285 (D.C.
Cir. 1993). Hard copies, thus, are no more
than “kissing cousins” (and distant ones at
that) with electronic versions of the same
document, not “copies” (i.e., identical
twins). See id. at 1283.
Despite the rules and ethical obligations
governing ESI, the discovery process should
not be viewed as only a negative obligation
lawyers need to fulfill to avoid sanctions.
See, e.g., Krumwiede v. Brighton Assocs.,
L.L.C., No. 05 C 3003, 2006 WL 1308629,
at *10 (N.D. Ill. 2006) (sanctioning former
employee for his “egregious attempt to ‘hide
the ball’” with ESI stored on his laptop). It
should be embraced as a goldmine of new
information, providing extra details never
before available. However, to effectively
leverage this new source of information in
litigation proceedings, one first must under-
stand the different types of metadata.
As described in the seminal Aguilar
decision, three types of metadata exist: (1)
substantive, (2) system, and (3) embed-
ded. Aguilar v. Immigration and Customs
Enforcement Div. of the U.S. Dep’t of
Homeland Sec., 255 F.R.D. 350, 354-55
(S.D.N.Y. 2008). “Substantive (or applica-
tion) metadata” reflects “changes made by
the user,” including “prior edits or edito-
rial comments . . . .” Id. at 354. It also
“instructs the computer how to display the
fonts and spacing.” Id. Substantive metadata
is typically “embedded in the document it
describes and remains with the document
when it is moved or copied.” Id.
Next, “system metadata” logs data relat-
ing to “author, date and time of creation,
and the date a document was modified.” Id.
It “may not be embedded within the file it
describe[d],” but is retrievable from the oper-
ating system maintaining it. Id.
Finally, “embedded metadata” (also
known as hidden metadata) involves “text,
numbers, content, data, or other informa-
tion . . . [that] is not typically visible to the
user . . . .” Id. at 354-55 (internal quotation
marks omitted). Examples include “spread-
sheet formulas, hidden columns, externally
or internally linked files (such as sound
files), hyperlinks, references and fields, and
database information.” Id. at 355. Like
substantive metadata, embedded metadata
is “embedded” within the document itself.
See id. at 354-55.
These definitions raise the question: How
can lawyers leverage these different types of
metadata in litigation? Before jumping into
this, practitioners need to remember that
case law on metadata “is a new and largely
undeveloped area of the law.” Williams v.
Sprint/United Mgmt. Co., 230 F.R.D. 640,
656 (D. Kan. 2005). Because “[t]here is little
California case law regarding discovery of
electronically stored information . . . ,” we
are required to turn to federal decisions as a
“persuasive” reference. Ellis, 218 Cal. App.
4th at 862 n.6.
Metadata as a Means of Authentication
With that, one must consider the first
and obvious use for metadata: authenti-
cation of the underlying document. Like
paper records, “one must demonstrate that
the record . . . is the same as the record that
was originally placed into the file.” In re Vee
Vinhnee, 336 B.R. 437, 444 (B.A.P. 9th Cir.
2005) (considering metadata as foundation
for business records). Both California and
federal standards require evidence that is
sufficient to uphold a finding that the writ-
ing is what it purports to be. See Cal. Evid.
Code § 1400 (“evidence sufficient to sustain
a finding”); Fed. R. Evid. 901 (“support a
finding”). The Federal Rules of Evidence
expressly allow for authentication through
“distinctive characteristics,” which substan-
tive and system metadata can provide with
dates, times, and identity of the creator,
along with edits made to the document
since inception. See Fed. R. Evid. 901(b)(4);
Lorraine v. Markel Am. Ins. Co., 241 F.R.D.
534, 547-48 (D. Md. 2007) (analyzing use
of metadata to authenticate evidence under
Rule 901(b)(4)). Though the California
Evidence Code does not contain the same
provision, it does acknowledge that “[n]
othing . . . shall be construed to limit the
means by which a writing may be authen-
ticated or proved.” Cal. Evid. Code § 1410.
Unfortunately, using metadata to authen-
ticate ESI is not “foolproof.” Lorraine, 241
F.R.D. at 548. “An unauthorized person
may . . . obtain access to an unattended
computer . . . [,] persons on the network . .
. may modify it . . . [and] network adminis-
trators . . . [may] override an individual pass-
word identification number to gain access
when necessary.” Id. Regardless, “metadata
certainly is [still] a useful tool for authenti-
cating electronic records . . . .” Id.
Metadata as a Source of Substantive
Information
But metadata’s utility is not limited to
authenticating documents. It also is a source
for substantive information. The key is find-
ing the right type of metadata to support an
ultimate fact in your case. For example, in
a lawsuit in which an employer is imputed
with the knowledge of its employees, indi-
vidual employee knowledge of certain facts
will be critical. As such, by analyzing the
system metadata for key email correspon-
dences, anyone could confirm whether or
not employees were blind copied (bcc’d).
See, e.g., Aguilar, 255 F.R.D. at 359 (plain-
tiffs seeking metadata to show that defen-
dants were bcc’d on core emails, and, thus,
condoned a pattern and practice of uncon-
stitutional home searches). This information
could have a substantial impact on trial and
settlement negotiations with the employer,
as knowledge of bcc’d employees is now
imputed to the employer.
Another example involves actions in which
an author’s intent is at issue with respect to
certain Microsoft Word documents. Like
emails, system metadata can track “who
knew what when” through creation dates,
author, and dates modified. Id. at 361; see,
e.g., Chevron Corp. v. Stratus Consulting, Inc.,
No. 10-cv-00047-MSK-MEH, 2010 WL
Embedded metadata
involves text,
numbers, content,
data, or other
information that
is not typically
visible to the user.
3. 41OCTOBER 2015www.ocbar.org
3489922, at *4 (D. Colo. Aug. 31, 2010)
(employment lawsuit in which the timing
documents were authored “was a critical
issue”). But more importantly, substantive
metadata will provide a thorough record of
precise edits made by the author since creation.
Id. Once again, this is powerful information
in the hands of any litigator, as his or her
discovery of information is no longer limited
to the visible words on the page. Counsel now
has a thorough record of the author’s thought
process from start to finish. This same data also
can confirm whether anything was “fraudu-
lently modified after the fact . . . .” Aguilar, 255
F.R.D. at 362.
As a final example, in the instance of a
criminal defendant providing an alibi, he or
she could introduce system metadata of digi-
tal photographs taken at the time in question.
See, e.g., People v. Marian, No. G045620,
2013 WL 325341, at *3-4, *7 (Cal. Ct. App.
2013) (considering photographic metadata).
The metadata not only can confirm the date
and time of each photograph, but also can
identify which camera took them. See id. at
*3-4. This information is then coupled with
content from the photographs to establish
an irrefutable alibi (e.g., a defendant stand-
ing in front of an identifiable location).
Metadata Provides Further
Understanding
In addition to having substantive and
authenticating qualities, metadata also
serves the practical purpose of providing the
reader a “thorough understanding” of the
underlying document. Aguilar, 255 F.R.D.
at 362. For example, embedded metadata
in Excel spreadsheets can reveal the math-
ematical formula used in each field. See
id. Though not particularly helpful with
basic inputs or hard numbers, it may be
critical for complex calculations. See, e.g.,
id. Likewise, system metadata for emails
may be necessary to identify the name of
sender(s) and recipient(s), especially in the
instance of directories and distribution lists.
Armstrong, 1 F.3d at 1280. “For example, if
a note is sent to individuals on a distribu-
tion list already in the computer, the hard
copy may well include only a generic refer-
ence to [a] distribution list (e.g., ‘List A’)
. . . .” Id. Individual email addresses would
not be “reproduced when users print out the
information . . . .” Id.
Metadata and the Internet
Finally, despite the focus of the above
discussion, metadata is not confined to elec-
tronic documents. It exists in other elec-
tronic sources as well, including Internet
websites. A helpful example is from the Fifth
Circuit Court of Appeals, where a plaintiff
recording company used system metadata
from the defendant’s “share folder” on a
peer-to-peer file-sharing network to iden-
tify the artist and song title for each of
the 544 songs the defendant ille-
gally downloaded. Maverick
Recording Co. v. Harper,
598 F.3d 193, 194 (5th Cir.
2010). By cross-referencing
the metadata, the plaintiff
quickly identified which of
the 544 songs infringed its
copyright. Id.
Practice Tips
At the end of the day, it is obvious
why metadata has become “the new black”
in discovery proceedings; unfortunately,
enthusiasm has increased to the point where
parties are starting to seek its production in
every case, regardless of size or complexity.
See U.S. ex rel. Carter v. Bridgepoint Educ.,
Inc., 305 F.R.D. 225, 246 (S.D. Cal. 2015).
To avoid some common pitfalls, it is impor-
tant for the modern practitioner to keep
in mind several tips when requesting or
producing metadata.
First, when seeking metadata, ask for
it upfront. Id. As explained by the United
States District Court for the Southern
District of California, “courts have generally
only ordered the production of metadata
when it is sought in the initial document
request and the producing party has not yet
produced the documents in any form.” Id.
at 245.
Second, when making requests, the
requesting party should be prepared to show
“a particularized need for the metadata,” not
simply a generalized view of its importance
(e.g., assistance with searching). Id. at 246.
Third, metadata also should be requested
alongside demands under the Freedom
of Information Act or California Public
Records Act, given that “metadata forms
part of the document as much as the words
on the page.” Lake v. City of Phx., 218 P.3d
1004, 1007-08 (Ariz. 2009) (any public
record maintained in electronic format is
subject to disclosure); see also 5 U.S.C. § 552
(FOIA); Cal. Gov. Code §§ 6250-6276.48
(PRA); Irwin v. Onondaga Cnty. Res.
Recovery Agency, 72 A.D.3d 314, 322 (N.Y.
App. Div. 2010) (metadata for photographs);
O’Neill v. City of Shoreline, 240 P.3d 1149,
1157 (Wash. 2010) (email metadata).
Fourth, from the production side, it is
important to produce ESI and correspond-
ing metadata in the form in which it is “ordi-
narily maintained” or “reasonably usable.”
Cal. Code Civ. Proc. § 2031.280; Fed. R.
Civ. Proc. 34. Common methods for doing
this are by producing documents:
(i) in “native format,” or (ii) in
a tagged image file format
(“TIFF”) or portable docu-
ment file (“PDF”) format
with an accompanying
“load file” for metadata.
See Irwin, 72 A.D.3d at
321. The former is a live
document that still has the
metadata intact, whereas the
latter “is basically a ‘picture’
or ‘static’ form,” making a separate
load file necessary. Id.
Fifth, because all electronic documents
generate metadata—whether we like it or
not—consider scrubbing (or removing)
metadata from all letters or other documents
containing privileged or work-product infor-
mation. Software is available to assist with
this. Digitally converting a Word document
into a PDF is not sufficient; some metadata
will still survive and will be accessible to
opposing counsel.
Much is to be gained by attorneys who
understand and respect metadata for what it
is, knowing it is not foolproof, but realizing
it can be leveraged to create a much needed
layer of “accountability in recordkeeping.”
Williams, 230 F.R.D. at 656. Metadata is
the new frontier for information, available to
those pioneers with the creativity and fore-
sight to start using it in our California courts.
Christina Lincoln is a business litigation
associate with the law firm of Newmeyer &
Dillion LLP in Newport Beach, California.
She can be reached at christina.lincoln@
ndlf.com.
This article first appeared in Orange County
Lawyer, October 2015 (Vol. 57 No. 10), p.
39. The views expressed herein are those of the
Author. They do not necessarily represent the
views of Orange County Lawyer magazine,
the Orange County Bar Association, the
Orange County Bar Association Charitable
Fund, or their staffs, contributors, or
advertisers. All legal and other issues must be
independently researched.
ON TOPIC
System metadata logs
data relating to author,
date and time of creation,
and the date a document
was modified.