Threats and concerns associated with spoliation
Depending on the applicable federal and state laws, you or your attorney can request various sanctions for the loss or damage of evidence. Multiple states have spoliation laws that give counsel the ability to request remedies for the loss of prospective evidence. Rule 37 of the Federal Rules of Civil Procedure prescribes substantial sanctions for any party’s failure to make disclosures and/or participate in discovery. Oftentimes, data must be deemed “relevant” to the case and its spoliation must result in some damage. Remedies that the court can impose include:
- Holding the at-fault person or party in contempt of legal order
- Blocking the involved party from engaging or raising any argument in the case
- Presuming that the destroyed pieces of evidence had adverse information for the involved party
- Striking all or part of the pleadings
- Issuing additional sanctions that the court feels are reasonable
Steps to avoid possible spoliation
Courts require that all parties properly preserve and submit evidence that is substantively relevant to the matter at hand. The methods in which data is stored, preserved, collected and transferred all have a direct impact on its admissibility. The Federal Rules of Evidence require that digital evidence be authenticated, meaning that the data captured, analyzed and shared must be proven to be an exact duplicate of the original data. Often, this is proven by comparing file hash values and metadata. Improper collection efforts or data storage directly impact file hash values and metadata, thus possibly adversely affecting admissibility. Tips to avoid spoliation claims:
1. Preserve all crucial pieces of evidence
After an incident and investigations, be sure to keep all key pieces of evidence safe. Physical evidence, such as computers, cell phones, servers or external devices, should be taken out of circulation immediately and forensically imaged. Forensic images are crucial to the ability to authenticate and verify that data is a true representation of the original. Forensic imaging captures data from a device while maintaining the sanctity of the original information. These images also have built-in verification and authentication mechanisms that can prove originality of data and help defend against spoliation claims.
2. Formulate evidence-handling protocols
Collection logs and chain of custody documentation is crucial to proving proper protections of original physical evidence and ultimately the originality of the associated data on these devices. Protocols should outline who can handle, preserve and access data from which devices and the formats in which data will be collected, stored and transferred. It is not uncommon for parties to revisit or create additional protocols as additional systems and data sources are determined. Safe and secure evidence handling and storage practices are crucial to proper evidence tracking and experts’ ability to authenticate evidence.
3. Save and secure any electronic pieces of evidence
During the collection and analysis phases of eDiscovery, notes should be kept that detail how data was collected, by whom and when. Notes can help understand what steps were taken or not taken to properly preserve evidence. It is also important to keep in mind that, in some jurisdictions, communications can be discoverable and can help explain or determine the extent of spoliation issues. Security/IT teams, counsel and custodians must all know their responsibilities in the preservation process. It is also important to interview each of these parties to understand where additional data may exist and be preserved “in-state.”
4. Provide prior notice to the opposing parties
In today’s evolving world, remote collections and imaging on site are much more common than removing devices from a scene and confiscating them. However, it is sometimes necessary to remove devices to avoid exposure to certain actors or access that may prove to be detrimental. In these cases, it is crucial that all parties be notified that physical evidence will be moved prior to it occurring and that documentation properly reflects these events. It is also sometimes necessary to allow opposing experts and/or counsel to review physical evidence or data prior to or during analysis. Accommodations must be made before actions are taken so as to avoid the litigants claiming that the evidence was altered.