How Collaborative Tools Are Changing the Face of Ediscovery
Walking around a typical business office 20 years ago, you saw in-person meetings taking place around long tables. Insights from those meetings were documented in business memos. The hard copies were tucked into envelopes and distributed by messenger among different offices.
The water cooler was the place to come together casually to share updates, insights, or workplace gossip. For formal communication and collaboration, paper was king.
That’s all so 1999.
Modern technology has profoundly reshaped office life and the way we communicate and collaborate. A significant portion of work today happens in hybrid or remote environments, with colleagues connected through online services. Tools like Zoom, Slack, and Microsoft Teams have made information sharing more virtual, informal, and dynamic. Even in the office, people are as likely to instant message as to walk over for a chat.
This transition from formal to informal, in-person to virtual, verbal to electronically documented has had real-world ramifications for the legal and IT professionals in charge of protecting a company from the risks associated with information governance and ediscovery.
The move to cloud-based systems for video conferencing and instant messaging has enabled workers in the same office or in different countries to collaborate seamlessly, asynchronously, and in real time – leaving a digital trail with every keystroke. All that data from emails, chat messages, and other electronic records – today measured not in mega- or gigabytes but in terabytes – are logged, tagged, and potentially discoverable in an investigation or litigation. Electronically stored information, or ESI, rules.
But while corporate communications have evolved, the traditional discovery process many still use was designed for the individual document. When business memos yielded to emails, the ediscovery process changed to reflect the shift from paper to digital. That shift was largely linear, from the single paper document to the single electronic document.
Online collaboration tools are upending the traditional ediscovery paradigm. Today’s legal professionals are not searching for a single electronic document – a static snapshot frozen in time. Replacing it is something more fractured and fluid: cloud-based documents that continually morph as multiple users create updates and versions and add live links to other content.
Novel digital data – by its nature voluminous, varied, and vexing – is some of the most challenging to access, sort, and understand. Outmoded discovery workflows hamper legal professionals’ efficiency and accuracy, and laborious processes burn out overextended teams.
Until now.
As corporate communications evolve, so must the approach to discovery. Keeping up with the explosion of digital documentation and chat room chatter requires new thinking and new tools. Many software solutions have already emerged, and best practices are being identified. This paper looks at the rise of cloud-based communications technologies, and both the challenges and opportunities they represent for legal professionals.
Corporate Communications Move to the Cloud with Breathtaking Speed
In 2018, Slack and Zoom were barely known. That year, Okta reported, only 8% of knowledge workers used Slack and just 9% used Zoom. Since then, the two online collaboration tools have risen from near obscurity to become household names, ranking among the fastest-growing apps in corporate America. By late 2022, Slack was deployed by 36% of Okta’s customers and Zoom was used by 48%, according to the company’s annual Businesses at Work report.
The explosive growth in the use of enterprise collaboration applications – accelerated by the need to work remotely during the COVID-19 pandemic – shook up the workplace status quo. Those who weren’t using Zoom regularly quickly became familiar with it – practically overnight. Zoom became the go-to tool not only for office workers but also in places it had hardly been used before, including courthouses.
The Zoom Boom
The number of daily Zoom users between December 2019 and April 2020 increased by 2,900% as the pandemic sent workers from offices into their homes. The “Zoom boom” earned its name.
The Microsoft Teams Trajectory
While the rise of Microsoft Teams hasn’t been as dramatic, its popularity growth curve reflected a similar jump over a longer period – from 2 million users in 2017 to 270 million by 2022. In 2023, Microsoft reported more than 320 million global Teams users.
Collaboration software market revenue more than doubled from 2015 ($7.05 billion) to 2020 ($15.98 billion) and is expected to reach about $21 billion by 2026. The only reason that collaboration software revenue is not rising faster since 2020 is that so many corporations are already using these tools.
The Rise of Collaboration Solutions and Discovery Obstacles
Communications through collaboration tools have skyrocketed. Consider these daily increases in usage of some of the most popular platforms:
Zoom users: 10M to 200M, up 2,900% (December 2019 to April 2020)
Microsoft Teams users: 2M to 320M, up 15,900% (2017 to 2023)
WhatsApp messages sent: 1B to 140B, up 13,900% (2011 to 2023)
And the market has grown with these evolving habits. Collaboration software market revenue more than doubled between 2015 and 2020, from $7 billion to $16 billion. Regulators have tried to keep pace: in 2022, 11 banks paid $1.8 billion in fines for failure to preserve ephemeral messages.
This takes legal teams to a turning point. The rapid adoption of enterprise cloud solutions has enabled corporate teams to communicate and collaborate more seamlessly than ever before, no matter their physical location.
But because complex modern collaboration tools were not designed with ediscovery in mind, the challenges for legal teams are bigger than ever. The variety of ways information at work is continually shared, stored, and updated – and the hoops legal teams have to jump through to access, process, and analyze it – is piling on the costs and introducing new risks.
Modern ediscovery solutions leverage a range of powerful capabilities to match the complexities of today’s digital landscape. Artificial intelligence, machine learning, and natural language processing technologies automate once cumbersome and costly steps in the ediscovery process.
The following are among the most common types of digital communication that require advanced ediscovery tools and forward-thinking strategies:
Multichannel conversations
Messaging and chat solutions
Ephemeral chat solutions
Audio/video conferencing services
Collaboration solutions
Enterprise systems and cloud repositories
Multichannel Conversations
Employees today use a variety of devices and methods to communicate – including mobile phones, email, and collaboration and project management tools. The resulting multichannel conversations present new obstacles to fast and efficient ediscovery. Multichannel conversations may live in two, three, four, or more channels across platforms, making the piecing together of meaningful information a tall order for anyone without advanced tools.
Example Scenario: Following the Chat Crumbs
Jack emails his supervisor about a client issue with a link to a report in SharePoint. When his boss doesn’t respond, Jack texts her to confirm she saw the email.
She responds and tells him to post the document in the Slack channel for client troubleshooting and schedules a Microsoft Teams meeting to discuss the issue with the broader team.
The meeting is recorded because some team members are on vacation. That “conversation” includes five channels – email, SharePoint, text, Slack, and Microsoft Teams – all of which must be collected and addressed in discovery if the client issue turns into litigation.
Multichannel conversations are adding a level of complexity to ediscovery that has never existed before because the number of potential channels in a conversation has never been greater.
Messaging and Chat Solutions
The growing popularity of messaging and chat apps in the corporate setting is stretching legal teams’ discovery capacities to the max.
Most messaging and chat solutions are meant for personal use. Among the most popular are household names like WhatsApp, Facebook Messenger, and Google Chat.
A few dedicated chat apps provide a business version (such as WhatsApp Business).
Unlike emails that can be threaded to retain context, each communication within a chat app conversation is stored as a separate message. That means it’s impossible to treat individual chat messages as documents to assess their content for relevance in ediscovery. Reconstructing the back-and-forth exchanges in a chat conversation presents an obstacle that traditional ediscovery tools do not address.
Messaging and chat tools also contribute to the exponential growth of business data in continually evolving formats, from text to images to multimedia. Cataloging and reviewing it is tedious and resource-intensive. Often, the formats are incompatible – with each other and with a given ediscovery tool. Extracting and normalizing the contents of messages in JSON, or JavaScript Object Notation; XML; or other proprietary formats is no small challenge and requires advanced tools to translate code into meaningful context. Recovering deleted messages and retaining a complete chat history pose additional challenges.
Ephemeral Chat Solutions
Some chat solutions, such as Snapchat, Signal, and Telegram, are designed to automatically delete messages after a very brief time. These ephemeral communications are available in various forms on collaboration tools, in messaging apps, and on social media platforms – each with its own storage capabilities. Identifying and collecting data from these various sources requires technical expertise and specialized tools. Establishing context and meaning from the ephemeral message content is complicated by the fact that metadata, such as user information or timestamps, is often missing.
Their transient nature, disparate sources and formats, and fragmented structure make these communications especially difficult to handle in traditional ediscovery.
Audio/Video Conferencing
The rise of remote and hybrid work has also fueled a boom in the use of audio/video conferencing. More online meetings than ever before are being recorded. The volume of data generated by popular platforms like Zoom, Microsoft Teams, Google Meet, and Cisco’s Webex can be enormous and overwhelming for ediscovery teams. More than 3 trillion minutes are spent in Zoom meetings every year.
All that data can be subject to discovery – presenting unique challenges for legal and investigation professionals. Chief among them are preservation, collection, and review:
Preservation. Collaboration tools like A/V conferencing were not designed for ediscovery. Some don’t provide archiving or long-term retention features, raising the risk of accidental deletion of potential evidence.
Collection. The decentralized nature of A/V files makes collections tricky: each conferencing solution creates and stores files differently across various servers, sometimes in several regions. In some solutions, a user can select specific setting parameters, adding complexity.
Review. The sheer volume of A/V data presents human review challenges – whether it’s the exploration of the recordings themselves (which can’t be searched for keywords or phrases without being transcribed) or the manual creation of transcriptions. Both are impractical and costly.
All these offer compelling reasons that drive organizations to leverage technologies to help scale their discovery efforts.
The Rubik’s Cube That Is Zoom
Preserving, collecting, and reviewing Zoom data is challenging for a variety of reasons.
The online video conferencing platform creates a separate audio (.m4a) and video (.mp4) file for each recorded meeting. Those files can be stored in the cloud or on the meeting organizer’s personal desktop (depending on options selected for the meeting).
The location of chat messages can also vary: any participant in a Zoom meeting can save a text file of chat messages they sent or received during the meeting.
Understanding the options for how and where data is stored is essential to being able to preserve and collect relevant content.
Collaboration Solutions
Though the terms “chat apps” and “collaboration apps” are often used in the same breath, they are actually discrete services. Chat apps typically provide messaging only. Online collaboration solutions offer broader capability. Slack, which once sought to be a Searchable Log of All Communication and Knowledge, for instance, started out as a chat tool and evolved into an enterprise collaboration platform with capabilities that include video calling, message threading, and shared channels for teams from different companies to work together.
For many organizations today, daily collaboration takes place through online services like Slack and Microsoft Teams. Many corporations use more than one collaboration solution. A recent survey found that 91% of businesses use at least two solutions, and Slack and Microsoft Teams were present in 66% of the organizations surveyed.
These collaboration solutions tie together various forms of communication, including chat messages, audio/video conferencing, work product, and even apps management. Other solutions like Jira, Asana, Zendesk, and Trello enable collaboration on work as well as chat, though without offering integrated collaboration capabilities such as video conferencing.
Enterprise Systems and Cloud Repositories
Even our traditional electronic forms of communication have shifted, with cloud-based collaboration and productivity tools replacing traditional email and on-premises office solutions. Corporations are also using more cloud-based solutions than ever to support enterprise functions today, including customer relationship management, or CRM; solutions like Salesforce; and human resources systems. Data from these systems is used and analyzed, with much of it never being put into a document form.
In the legal world, ediscovery workflows are also moving to the cloud. Today’s legal and investigation teams can communicate and collaborate on document review, build timelines and narratives, and more within a unified cloud-native ediscovery solution. Many in the profession view the shift from on-premises ediscovery to the cloud as inevitable: 96% of respondents in Everlaw’s 2022 Ediscovery Innovation Report say cloud-based discovery is, or will soon be, the norm.
Challenges and Opportunities for Ediscovery
As the numbers show – and our work experience underscores – the digital age has ushered in an unprecedented information explosion. Corporations generate an unfathomable volume of electronic data at breakneck velocity. That means a whole lot of potentially discoverable videos, photos, emails, chat messages, and other ESI.
For legal professionals, this is both a boon and a bane. A boon for the wealth of potential insight into evidence that could be used to strengthen a company’s position in legal matters like litigation and internal investigations. A bane because those troves of facts are not at their fingertips or easy to grasp and stitch into meaningful insight – without the right tools for the task.
Until now, most legal technologies for discovery have been disappointing. To help legal teams quickly spot patterns, connect the dots, and zero in on the facts that matter the most, the focus of ediscovery methods and workflows has had to evolve beyond the individual document.
Today’s ediscovery tools are powerful and user-friendly, built to enable legal teams to capture novel data types directly from their disparate sources, quickly surface hidden connections between individuals and concepts, and weave together a fact-based story that gets to the heart of a legal matter.
Thanks to automation and artificial intelligence, modern ediscovery solutions free up overextended teams to focus more on higher-value work and strategy. Without having to become technical or forensics experts, members of legal teams can leverage these technologies to handle matters more efficiently and collaborate with internal and external partners even while retaining better control over company data. The right solutions can support the work of litigation and investigation professionals at every step of the ediscovery journey – from collection and processing to review, analysis, and production or reporting.
Taking Control of New Data Types
Locating and Collecting Data
Email is relatively straightforward. Stored in a single location, it’s simpler to collect. Data from online collaboration apps, by contrast, tend to live in several locations. Microsoft Teams, for instance, uses Azure to create and manage a “substrate” – an underlying storage layer that unifies data from all the different apps and services. Depending on the data type, ESI from Microsoft Teams can be housed in Exchange, OneDrive, SharePoint, or other locations.
That makes identification and collection complex – not to mention time-consuming and expensive for budget-conscious teams. It’s important to select an ediscovery solution that can support targeted collection from various locations to capture all relevant documents.
Tools like cloud connectors, which automate the lion’s share of collections, make it easier than ever to access corporate data siloed in various cloud data sources. Cloud connectors tie directly from sources such as Microsoft 365, Slack, and Microsoft Teams into a modern discovery solution. One of the keys to preventing spoliation is to lock down data in a single platform (with, for example, M365 preservation in place) to prevent accidental deletion or alteration of potential evidence that can happen while duplicating and exporting it out to other tools. With the right system in place, legal professionals gain far greater access to and control over data, speed to review, and value delivery throughout the litigation or investigation process.
Gone are the days teams had to wait until IT and forensics specialists located and retrieved data from individual devices. Today, discovery tools capture both video and potentially meaningful associated documents, such as in-meeting chats, with a few clicks of the mouse.
Teams leveraging advanced discovery technology see the payoff with cloud connectors:
Faster response time. Teams can get to the key documents for review within hours, not days. With just a few clicks, data and metadata is made available in context and ready for review.
Enhanced security. Cloud-to-cloud data collection ensures that data is secure in transit: data is ingested directly from the source and stored in the review platform, never having to leave your organization.
Cost containment. By collecting just the most relevant data from enterprise cloud apps, teams avoid overcollection and accidental production to contain the costs that can so easily balloon at this stage.
Processing Cloud Data
Legal professionals aren’t trained to deal with code. But that’s what they’re looking at when exporting data directly from a cloud source without ediscovery technology designed for collaboration apps. The delivery could just be code in HTML, JSON, or another computer language.
Some solutions capture pages as PDFs or screenshots, but this wipes out the dynamic nature of the pages. Information could be hidden or lost. And unlike document files and PDFs, which have been standard for decades, cloud tools all have their own particularities in how data is conveyed and represented.
Teams need solutions that can process these outputs and represent them to the reviewer in a way that captures as much information as possible, while still being readable to the average legal professional.
Ephemeral Data and the Duty to Preserve
Ephemeral data has a short life. Designed with an automatic expiration date that’s tied to an event or timeline, ephemeral data is challenging to preserve through traditional ediscovery methods, such as legal holds. Once an organization has a duty to preserve evidence, the auto-deletion properties of these chat solutions can be problematic.
Overcoming these challenges requires a combination of technical tools and expertise, legal strategies, and investigative techniques:
Prompt preservation and collection. It’s important to act quickly to access devices or accounts whose messages may expire imminently. Investigators may take screenshots or use specialized tools for forensics on ephemeral messaging applications.
Metadata analysis. Metadata sometimes persists after message content has been deleted. Timestamps, sender/recipient data, geolocation, and more may help identify patterns, timelines, and connections.
Device forensics. There are forensic tools and techniques to examine a device's storage or cache files to recover deleted content.
Third-party sources. Ephemeral messages may leave traces in areas like cloud backups and network metadata that legal teams can recover after the primary app has deleted the content.
Ephemeral Chat and Court Sanctions
Courts take the use of ephemeral chat solutions seriously when the duty to preserve is in place. But the use of an ephemeral chat solution before the duty to preserve can be questionable, too, as the corporation may have to suspend the use of the solution while it is under a duty to preserve. When using a chat solution that provides auto-deletion capabilities, it’s important to have the flexibility to turn auto-delete off to support litigation obligations.
Courts have sanctioned parties in three recent cases for using an ephemeral chat solution with a duty to preserve:
Federal Trade Commission v. Noland. The defendants received an adverse inference instruction sanction in connection with the use of Signal after they learned they were being investigated.
Fast v. GoDaddy.com. The plaintiff received an adverse inference instruction sanction, in part, for her use of Telegram for communications with a colleague after confirming her intent to sue the defendant.
WeRide Corp. v. Huang et al. The defendants received terminating sanctions, in part, for beginning their use of DingTalk after the case was filed.
Download the court rulings from this chapter in PDF.
Identifying and Redacting Sensitive Information
As communications tools evolve and grow in complexity, the process of sensitive data identification must also improve to handle that data efficiently and at scale. The proliferation of personally identifiable information, or PII, makes fast remediation within ediscovery workflows more important than ever.
Remediation can be accomplished in two ways. Teams can perform targeted collections that limit the amount of data from a collaboration solution (including sensitive data) that is ingested into the ediscovery platform in the first place. The other option is to redact sensitive and personal data that is ingested.
To address these challenges, legal practitioners need to be able to identify a variety of PII types and formats, including international PII types and formats; highlight PII data; and apply batch redactions. The right ediscovery solution can support redaction of audio/video files and alleviate the increased burden resulting from so many video conference recordings.
Automating Audio/Video Discovery
Audio/video discovery can be expensive and time-consuming. Reviewing audio/video files is far more time- and resource-intensive than reviewing text. And converting A/V files into searchable content carries a hefty price tag if it’s outsourced to a company that specializes in transcription. But with a modern ediscovery solution, legal professionals do not need to watch or listen to an entire recording and manually skip to sections for key information from a Zoom or Microsoft Teams meeting.
With features such as automatic transcription, speech recognition, advanced search, and annotation and redaction, modern ediscovery tools play a critical role in streamlining search, collection, and review of these complex files.
The following are advanced strategies that teams employ in ediscovery of A/V files:
Search. Once A/V files are uploaded to an ediscovery platform, conversion and transcription happen automatically during processing. This lets teams search for relevant information far faster than in video files, and get straight to review.
Review. Teams can search, review, and index the transcripts for relevant phrases, highlighting responsive passages to flag key areas for a more focused human review. Notes can be added to specific timestamps to identify important passages. These advanced features allow fast and efficient review.
Redactions. A/V files can contain confidential or sensitive information, triggering privacy risks. Transcription tools help identify potentially privileged or sensitive content, while redaction tools automatically detect and remove troublesome text or audio.
Whether A/V files live in email archives or the cloud, on collaboration platforms, or elsewhere, today’s tools substantially streamline the key steps in the discovery process.
Reconstructing Conversations Across Platforms
Each individual communication within a conversation in a chat or collaboration solution is stored as a separate chat message, so reconstructing the conversations requires reassembling the messages into a conversation – and deciding where the conversation begins and ends.
But that’s not all. In many cases, legal teams must also reconstruct the actual messages that make up the conversations. For example, Slack export files are created in JSON format. The exports contain no files from the workspace. What legal professionals get is a series of file links, found in the export file’s message history JSON files, which direct back to the workspace’s files. Without automation from an ediscovery provider for performing a targeted collection to upload and view Slack messages, assembling conversations is an all-too-familiar nightmare.
Advanced solutions for reconstructing conversations are already available:
Generalized linking. Teams gain a complete view of a conversation including related documents through links that are automatically created during data upload and processing. That gives users full context surrounding communications that meander between video meetings, emails, and chats – including access to linked cloud-based documents.
Chat message improvements. All information needed for search is contextualized, including file attachments, to mirror as closely as possible the original team chats for faster and easier review.
Communication visualization. With this advanced AI feature, users can surface key patterns of communication from thousands of messages, and quickly determine who was communicating with whom, when and how often, and see communications patterns play out over time.
The Decline of Attachments and the Rise of Links
Legal teams face a good amount of uncertainty around how hyperlinked documents – as opposed to traditional attachments – fit into existing ediscovery workflows. It is broadly understood that hyperlinked content within emails, chat applications, and cloud drivers is not considered an attachment and should not be treated as such in ediscovery.
An attachment represents a static file, with a clear parent-child relationship between the email and the attachment. All attachments should be collected, reviewed, and if needed, produced, as part of responsive ESI. That’s not at all the case with a hyperlink. A link is a reference to a live document – being continually updated or reproduced – that may or may not be in the producing party’s control. Recipients have varying levels of access. If the shared link connects to an entire folder of documents, it is not certain whether every item qualifies for collection and review.
Because the linked file is dynamic and not a static attachment within the email, its content may have changed when collection occurs, or the file may no longer even exist.
This issue came up in 2021 in the case Nichols v. Noom. The plaintiffs in early production learned that the defendant’s employees frequently linked from Gmail messages to internal documents stored in Google Vault, in lieu of attachments to emails or other documents, and the emails and linked files were not produced together in the traditional “family” grouping order. Because the requirement to do so wasn’t specifically addressed in the parties’ ESI protocol, the court denied the plaintiffs’ request to require the defendants to reproduce the files accordingly.
Following are some of the ediscovery obstacles legal teams face:
Collection. The linked file isn’t automatically collected when the email is collected, and it requires a different automated ediscovery workflow to gather linked files.
Review. Manual work may be needed to connect a message and its hyperlinked content. Technology assisted review, or TAR, was not designed to extract linked content and work out whether it’s relevant in the context of other documents.
Production: Delivery of responsive content in hyperlinks is complicated by varying levels of user access, potential time restrictions after which links expire (making preservation almost impossible), and version history considerations. How do you preserve and produce something that is so fluid?
With the increased use of cloud solutions and work-product files stored in the cloud, expect to see the use of “modern” attachments become much more common.
Discoverability of Collaboration Solution Data
It’s important for attorneys and legal professionals to arm themselves with the right tools to tame big data for discovery. Courts have recognized the importance and relevance of collaboration solution data for discovery in their rulings. Two recent cases where courts ordered the production of data from collaboration solutions:
In Benebone v. Pet Qwerks, et al., the court ordered the plaintiff to produce Slack communications, finding that “requiring review and production of Slack messages by Benebone is generally comparable to requiring search and production of emails and is not unduly burdensome or disproportional to the needs of this case.”
In Mobile Equity Corp. v. Walmart Inc., the court ordered the defendant to produce all relevant Jira documents and Slack channels in response to the plaintiff’s request.
It has become undeniable that many important business communications are taking place in collaboration solutions and the data from those solutions is discoverable in litigation.
Download the court rulings from this chapter in PDF.
Capitalizing on Today’s Wealth of Data for Better Outcomes
The pace of digitization in the business world – and in our personal lives – continues unabated.
Existing and emerging online collaboration and communication tools connect workers like never before. They also generate an unimaginable amount and assortment of data every minute of every day – inundating resource-strapped legal professionals with new challenges. Legal and investigation teams have to source, sort, and scrutinize that data for relevance in litigation, internal investigations, and other legal matters. In the era of big data, legacy and manual approaches to ediscovery are no longer sustainable.
To beat the odds, legal professionals are turning to advanced ediscovery tools that help scale their capabilities. Forward-thinking teams are rolling out modern tools like early case assessment and machine learning to reduce data sizes and unearth key insights. Powered by AI, today’s ediscovery solutions enable legal professionals to automate manual processes and speed up the culling, review, and analysis of data with the fraction of the head count and time needed with traditional methods.
With the right tools, legal teams can tame big data, turn an ediscovery problem into an opportunity, and pave a new path to success.
