Technology Advantage

Collection Best Practices - How Multifaceted Software Has Changed E-Discovery

Amy Catton October 19th, 2021
Social Network

As our work force has shifted to mobile and remote working practices (a trend in place before COVID, which only accelerated during the pandemic), businesses have turned to collaborative messaging tools such as Slack and various versions of Teams to manage communications. On the positive side, by using these messaging tools, organizations are able to more efficiently discuss ideas and brainstorm solutions. However, when an organization becomes involved in a dispute and those communications are potentially relevant to the dispute and need to be preserved and collected, the process may not be as straightforward as a simple email collection.

My colleague, Dave Welch, previously wrote a blog about structured data and messaging platforms in e-discovery, called “The Growing Source of ESI: Structured Data and Messaging Platforms.” I highly recommend that you read his blog as well. In this blog, we’ll take a deeper dive into how best to collect from Slack and Teams.

What is Slack?

Slack is an intricate, multifaceted tool that essentially serves as a company-wide chat room. It allows you to communicate in real-time rather than through the delayed back and forth of email chains. Slack’s website indicates that since September of 2019 over 12 million people have been actively using the tool every day.

There are three primary ways to communicate using Slack:

  • Workspaces - This is the company’s Slack environment. Typically a small to mid-sized organization may have one workspace although larger organizations might have the Enterprise Slack Grid option, which allows for more multiple workspaces.
  • Channels - These are public or private forums. All members of an organization may have access to certain public channels and a specific department, such as Human Resources, may have its own private channel for communications.
  • Direct Messaging - Individuals or groups of individuals may communicate using direct messaging.

Slack also allows for integration with 2,000+ third party applications.

What is Microsoft Teams?

Microsoft’s website indicates that in 2020, the user base for Teams grew from 40 million to 145 million daily active users.

Microsoft Teams also has several means of communication:

  • Chat Features - Teams allows for chatting between one or more parties. It also allows users to search and save those chats for future reference.
  • Call - Teams supports conference call technology.
  • Meetings - Teams allows for video conferencing across multiple parties.
  • Collaboration - Teams integrates with Dropbox and OneDrive to allow for seamless sharing of information.

What are Best Practices for Collecting Slack and Teams Data?

Although Slack and Microsoft Teams applications present new challenges to both organizations and e-discovery professionals, the standard e-discovery practices still apply: work with IT to ensure potentially relevant data is preserved; communicate with stakeholders to understand how they utilize the platforms and identify potentially relevant data for collection; develop a collection plan; and document your steps throughout.

Step 1:  Meet with the client’s IT resources and ask some of the following questions:
  • What messaging applications are used by employees working on this project/issue? If Slack, what Slack plan is utilized at the company (Pro, Business + or Enterprise Grid)?
  • What is the company’s policy regarding retention of Slack and Teams data?  Can employees delete messages or communication strings? Are attachments retained as well? 
  • Is there any third party integration in place in the Slack and Team environments? Data deleted from the front end may still exist in these third party tools and thus collection from those may be key.
  • What are the users’ rights in the Slack utility? Owners, Admins, Members or Guests. What are the users’ rights in the Teams application? Owners or Members.
Step 2:  Determine your custodians for collection and gather the following information from them:
  • How do they utilize Slack and Teams?
  • Do they use Private or Public channels?
  • Do they utilize the collaboration features of Team or just video and calling?
Step 3:  Determine your method of collection:

Slack has varying types of exports. 

  • Standard/Corporate exports will export all public channel content. 
  • Corporate exports will export all public and private channels and direct messages. 
  • Both of these exports will produce a .json file (JavaScript Object Notation, sample shown below).

As you can see, the export is not in any kind of format that can be readily reviewed by a legal team. Most of the time, .json files can be re-formatted but there is another option.

  • Collection via the Discovery API is a much better solution. This is a third party application that will collect all resources in multiple workspaces in the environment. Using this collection method and utilizing trusted e-discovery review tools will allow for the processing and review of Slack data in a way that is meaningful for the case team.

Microsoft Teams also has various methods for exporting data. 

  • Content Searching: Content searching is the basic Teams e-discovery tool and allows simple searching by keywords and various queries; however, data in Teams is stored in various applications such as Sharepoint and OneDrive so searching the Azure backend of the product can present some indexing and exporting limitations. 
  • Core eDiscovery: Core eDiscovery in Microsoft 365 allows the user to run more detailed searches  and export content.
  • Advanced eDiscovery: Microsoft’s Advanced eDiscovery collection tool allows the user to target the data collection to specific applications and custodians and then export the data in a format that is compatible with e-discovery processing tools..
Step 4:  Document the process:
  • While conducting steps 1-3, the e-discovery professional will gather very valuable information that should all be documented, including custodian names, interview notes, organizational practices, collection channels and third party applications. It is important to track all of this information from start to finish so that you have a reliable reference for the process you followed to identify and collect the relevant information.

This is a very exciting time in the workforce. Need will continue to drive ingenuity and we will continue to see new tools be used in the marketplace. The e-discovery world will certainly continue to learn ways to efficiently collect and manage this data to meet ever growing client needs.

 

DISCLAIMER: The information contained in this blog is not intended as legal advice or as an opinion on specific facts. For more information about these issues, please contact the author(s) of this blog or your existing LitSmart contact. The invitation to contact the author is not to be construed as a solicitation for legal work. Any new attorney/client relationship will be confirmed in writing.

 

 

 

 

 

Topics: Data Collection E-Discovery Best Practices Instant Messaging Platforms Collecting from Instant Messaging Platforms Slack Microsoft Teams JSON file Effective E-Discovery Project Management LitSmart KTLitSmart Data Preservation Data Identification EDRM E-Discovery ediscovery

Subscribe to the E-Discovery Newsletter

Related Posts

  • Data Mapping - Why is it Important for Successful E-Discovery?

    A data map is usually something that is generated along with a data retention plan and is a great starting point if and when an organization becomes involved in litigation and discovery. Long before litigation and discovery, however, it is important to understand the relevant data sources that may be in play and where those can be found within the organization’s various data systems. This blog explains what a data map is, what it contains and how it is helpful.

  • Pitfalls of Complex Search Protocols in ESI Agreements

    ESI Agreements cover the full gambit of e-discovery issues, from preservation expectations to production specifications. Sometimes, these agreements include an overview of the process by which the parties will identify the universe of potentially responsive documents by using specific date ranges, identifying priority custodians and developing proposed search terms. Adding another layer of complexity, this discussion is often had in a vacuum before the parties even know how much data their clients have. Coming up with criteria that identifies the relevant documents, but is not overly broad, in this vacuum can be difficult. However, the process is important because the date range, custodians and terms will inevitably dictate how much data is collected, processed and reviewed, which can significantly affect any litigation budget.

Newest Posts

  • PLAY IT AGAIN, SAM . . . BUT WAIT – WHAT IS HE PLAYING, AND WHO IS SAM?: Website Session Replay Software and Wiretapping

    The trend of class action cases alleging wiretap statute violations against website operators for the use of session replay software to collect information of website users continues to be a concern for companies in 2024.  While many of these cases have turned on whether website operators disclosed and obtained consent from website users prior to deploying any session replay software, a recent decision in a pending class action brought under the Pennsylvania Wiretap Act indicates that consent alone may not be the end of the story in these cases.

  • Utilizing E-Discovery Tools in Innovative Ways

    As part of the e-discovery process, we use digital means to identify relevant information for use in a legal proceeding. The proceeding may be a large-scale medical malpractice lawsuit, a patent infringement case, a government investigation, or countless other legal actions. However, the skills and resources used in those types of matters can also be used in other areas.

  • The Pitfalls of Negotiated Preliminary Injunction Orders

    Sunlight Financial L.L.C. v. Hinkle, et al., 2022 WL 17487686 (S.D.N.Y. Dec. 7, 2022) highlights the importance of negotiating strong stipulation orders that protect your client's interests. In this case, the Stipulated Amended Preliminary Injunction Order was overly broad and failed to carve out information that the defense believed to be the confidential, proprietary, or trade secret information of third parties. As a result, the corporate defendant was required to produce documents for forensic examination that had questionable relevance to the specific allegations of the Plaintiff and exposed the defendant to potential future litigation.