Stopping Privilege Items from being Exported

[markjrouse]

If I have an email with 4 attachments, but only 1 is privilege, even if I exclude privilege items, when I export the parent email it will still export the privilege item.  Is there a way of stopping this?  I only want to export the email and the 3 non privilege items.

 

I can't make the parent email privilege as it's not and I can't excluded it.

 

As it stands at the moment, I would have to manually remove that 4th privilege attachment from the exported eml file.  There must be a way of stopping privilege emails from being exported without having to tag the parent email privilege as well!!  I would say this is a fundamental option for an eDiscovery tool.

 

Does anyone have any suggestions, or workflows that I can adopt so that I can ensure only the parent email and the 3 attachments are exported.  Really need some help with this.  Thanks.

[admin]

Hi Mark,

 

Only way to do this is manually. Intella will not redact at an item level. Note that in many jurisdictions if the email has a privileged attachment the entire email and family is privileged. The lawyers then redact. 

[markjrouse]

Are there any plans to change this functionality? Or allow the user to choose?

[admin]

This is not a simple task to do. The corner case goes something like this. 

 

 

PST
-- Email
--- Attachment zip file containing a PST, other privileged items and some relevant items
---- PST from zip

----- Email

-------Privileged docs mixed with others relevant items

--------  relevant doc with embedded privileged items. 

 

What does your export end up looking like when this happens. This form of redaction is best left to the lawyers lest you get accused of failing to produce. 

[markjrouse]

-- Email

    --- attachment 1

    --- attachment 2

    --- attachment 3

    --- attachment 4

 

Attachment 4 gets tagged as privilege. So when I export email as part of a concordance load file, it not only exports the Email and attachment 1-3, but also 4.  Even if I say, Privilege Tag exclude, obviously the parent email is still present so when it's exported it exports all 4 attachments.  In my case we have IE9 through out our coporation and Redaction doesn't work in IE9.  The lawyers have flagged attachment 4 as privileged so I must be able to exclude it as the need to disclose the email and attachments 1-3, but not 4.

 

If it's manual, then I've got to identifiy the privilege item in the load file, delete the native, text and tiffs, and some how update the .dat file.

[admin]

Manual is the only way at the moment I am afraid. We may look at this in later versions but that will be sometime. 

 

I know the user Jonnyp has a lot of experience with this (and load files) he may be able to let us know his process and what the lawyers he works with want.  

[Jonnyp]

Hi markjrouse and Administrator, I have completed some testing on this issue.

 

I have base the testing on the following assumptions:

• The export dataset is made up of an email message with 4 attachments (word, excel, PDF etc)
• That the export dataset is being exported as a load file
• The load file contains native documents and images
• The load file should contain the email and only 3 of the attachments

Process:

I located an email that had 4 attachments and tagged all items into a tag named 'Dataset'. I selected 1 of the attachments and tagged this attachment as 'Exclude'.

I searched on the Dataset tag which returned the email and 4 attachments. I also ran an exclude search on the Exclude tag and the 1 attachment in the Exclude tag was removed from the items in the Details pane.

I created a load file from the email and 3 attachments remaining in the Details pane.

 

Output:

The load file created correctly and contained 1 email message and 3 attachments in the 'Natives' folder. Similarly images for the email and 3 attachments were created.

 

Findings:

As you would expect, there were no native files for the attachment that was excluded. This is the case because when creating a load file, only the selected item in the Details pane are included in the load file.

 

I have to mention that the native email actually contains all 4 attachments within it. This is something I was not aware of and poses an issue if markjrouse wants to remove one of the attachments of an email for privilege purposes.

 

The only work around I can think of at this stage is to not include native documents when creating the load file. This will leave you with images for the email and only the 3 attachments.

 

Discussion:

In my view, this is a tricky issue to fix. What should be included in discovery will depend on your discovery and disclosure laws/rules and I would certainly leave this up to the lawyers.

 

If Vound add functionally to remove 1 attachment from a native email, that email is no longer the same as the original email, would this cause another problem? It is possible that there are other consequence involved in removing attachments.

 

JP

[markjrouse]

Thanks JP. Very useful.

 

To me this seems to represent a serious issue with the load file process because yes the load file does not make reference to the 4th attachment, but as the 4th attachment is still there in the parent native, then surely the load file is not accurate in terms of what it says is the production!

 

I would have thought that if something is to be excluded, then it should be excluded.

 

What should be included in eDiscovery is responsive documents, privilege items should not be!!!

 

Unfortunately, I now have to go through large productions to remove these items.  I'm affraid the regulator has requested natives, so leaving them out is not an option.

[admin]

In this situation I would want a written instruction from the lawyer. 

 

A. So I protect myself from any action as I changed the evidence

B. So they know how much extra work is needed

C. So that they have formally instructed me in the process lest I carry the can later on " We never realized  you were doing that" 

D. So I can explain why if something is missed as this is a big job

 

Note there is still the case of evidence items such as Word doc's that may have both privileged and relevant in the same doc. Are you doing the text redaction also? 

[Jonnyp]

Markjrouse, for discovery we use Intella as a processing engine. We ingest the data and run date filters and search terms to identify items that are respondent to the search criteria.

 

When it comes to review we provide a load file to our lawyers to review for privilege and relevance. Once the review is complete the lawyers produce a dataset from their review tool (Summation is used in NZ) with the privileged material removed or redacted to the over party.  

 

Our discovery rules in NZ required us to produce PDF files to the other party. This can be done relatively easily in Summation where redactions are "burned in" on the PDF files.

 

Your situation is a bit different to ours. If you are required to provide native emails with any privileged attachments removed, I can only see this being a manual process unfortunately.

 

How do other tools deal with this type of situation? I cant say I have heard of any discovery tools that will remove selected attachments from native emails.

 

JP 

[markjrouse]

Thanks guys for your response. 

[markjrouse]

Hi All,

 

Have noticed that this doesn't just apply to privilege items I've excluded this also applies to duplicates. I've just discovered an email with 8 attachments, 4 gif files, 4 MS office files. Looking in the load file the 4 MS office attachments are not referenced, nor have they been tiff'ed, and they haven't been extracted as separate natives. The reason for this is the 4 MS Office files are infact duplicates. So naturally when I click to dedup the population for export, these 4 MS Office attachments disappear as expected. Unfortunately, these 4 duplicate MS Office files are still being exported in the parent eml file when I do my load file export.

 

It seems that any attachment I want to exclude from the load file export process doesn't get totally excluded because my excluded items, i.e. privilege, duplicates etc. are still being exported within their parent emails.

 

I really hope this issue with the load file export can be address, because if I've got hundreds of thousands of duplicates, I can't go through each .eml parent file to remove them manually.

 

If we had Internet Explorer 10 then redacting privilege documents would solve privilege exports, but it doesn't resolve duplicate attachments that are still being exported in their parent emails, even though I've clicked deduplicate