“What is your 2025 prediction?” asked Relativity’s David Horrigan of the E-Discovery State of the Union panel alumni for his and Stephani Wilkins 2025 Predictions webinar (posted soon). I was under water photographing Bonaire’s amazing sea life and missed the response window. A moment’s reflection on the data source growth trends and bonfire cases I supported this year said, “Email is dead, long live chat!” All of the key determinative evidence I have extracted from bloated holds recently seems to come from cloud instant messaging sources.
Once upon a time (Enron discovery days) my team had a 5000/1 rule on email. For every 5,000 email reviewed, one violation was referred to HR. Email was the new informal communication platform, just like chat is today. Employees in non-regulated verticals were not monitored and inappropriate speech and attachments were common. Regulators and the DoJ demanded email because that is where the ‘real conversations’ resided. Those ‘real’ communications have now migrated to internal and external chat platforms.
Recent client data map engagements have revealed explosive growth in Teams, Slack and other external chat platforms. Preservation and collection features have lagged adoption and innovation, creating opportunities for 3rd party information governance solutions like Opus Guard and Actera. eDiscovery platforms like Relativity, Reveal, Exterro and Everlaw have improved their connectors, processing and review handling of collaborative chat streams.
How is chat different from email and how can corporate legal teams adapt to meet preservation and collection obligations? I am going to focus on M365 Teams as I have the most experience with it.
I think of collaborative channel chats as recordings of conversations, reactions and item exchanges that take place in a virtual ‘room’ over time. Participants join and leave multiple interwoven topics that can cover months. The room or channel is owned by the M365 Team site group and group messages are stored in that group mailbox. 1-1 chats are stored in participant mailboxes and are generally much easier to find and make sense of.
Sources: The first challenge is identifying the Teams sites/channels with potentially relevant conversations and content. The new Purview eDiscovery portal has enhanced the ability to search by site and channel names, but that is always problematic. The traditional approach is to interview key custodians. Custodians frequently forget the full names of channels and you may not have all the key players nailed down yet. I prefer to run test searches with unique terms/phrases or participants in Purview eDiscovery and export the reports to build location lists for counsel. Based on the location names and hit metrics counsel can confirm key Teams sites and use the lists in custodial interviews.
Conditions: Searching for Teams chat uses search conditions or KQL (kind:im AND kind:microsoftteams). You can use these in combination with participants condition as well. I like to use scoping reports to understand whether the hits are clustered or distributed over days. Time clustered hits can usually be collected in the new 12-hour chunks while occasional mentions scattered over days may require entire channel chat collection by broad time bands when your unique terms are not being used consistently. The point is to search and use the new metrics charts or exported reports to assess scope and get counsel’s informed consent.
Add to Review Set/Export: The new Purview eDiscovery portal has new options for collection chat content.
- Chat conversations can be collected in HTML transcript format. This definitely makes review much easier AND my quick test even found emoji reactions (prior gap). Many processing platforms may not handle the new HTML format well. It also may pose redaction/disclosure issues by collecting non-relevant conversation segments. I can also see the 12-hour cut off generating questions from opposing counsel, especially if privilege content is present.
- Chat cloud attachments from mailbox conversations (that is where chat is stored) can now be retrieved with same options as SPOD.
- File version retrieval option include latest version only, last 10, last 100 or all versions. This can make a huge impact on matter volume. I recommend establishing a default and updating request parameters so that counsel can call out versions where important. Most of the time I recommend reviewing the latest version and recollecting prior versions during review for important items unless versions are specified in the eDiscovery agreement.
Preview in Purview: While Purview is not a full featured review UX, it can be used for internal preview of search results when you need to dig into your scope definition. The display of chat chunks is pretty good and you can inspect the metadata fields to refine participant name formats and other conditions. Microsoft has improved the performance now that advanced indexing is done on hold destinations and searches. However, the review analytics (threading and adding other discovery metadata) still seem to take a long time. I have them off by default until I know that I need those fields populated.
External Processing: Depending on your eDiscovery platform, processing chat/IM is still a bit of an art form. There are lots of options that can have downstream and production impact. I recommend running test batches and starting with a firm understanding of the agreed production parameters before you kick off a giant set of chat content. Do you want to organize the production by channel or participant(s)? Does the requesting party consider the HTML chunk format native? Do they want individual messages in standard JSON, RSMF or other platform format? How are you going to handle deduplication of hyperlinked attachments that may show up in MANY other contexts?
As you can see, modern chat is not the same as email. This should be on your radar and you need to adapt your procedures and defaults to accommodate the new ‘water cooler’ conversations.
Greg Buckles wants your feedback, questions or project inquiries at Greg@eDJGroupInc.com. Book a free 15 minute ‘Good Karma’ call if he has availability. He solves problems and creates eDiscovery solutions for enterprise and law firm clients.
Greg’s blog perspectives are personal opinions and should not be interpreted as a professional judgment or advice. Greg is no longer an investigative journalist and all perspectives are based on best public information. Blog content is neither approved nor reviewed by any providers prior to being published. Do you want to share your own perspective? Greg is looking for practical, professional informative perspectives free of marketing fluff, hidden agendas or personal/product bias. Outside blogs will clearly indicate the author, company and any relevant affiliations.
Greg’s latest nature, art and diving photographs on Instagram.
[instagram-feed num=1 imageres=thumb showfollow=true