The importance of contextual metadata in email eDiscovery

16
Nov
2015

Katie Cullen Montgomerie

There has been some noise in the past months regarding email read receipts and whether or not they are admissible in court. In the North Carolina case, Fox v. Leland Volunteer Fire/Rescue Department Inc., 7:12-CV-354-FL. (E.D.N.C. Mar. 10, 2015), email read receipts were contested by the defense as unauthenticated hearsay. Judge Flanagan countered this argument, saying that read receipts amount to a party admission rather than hearsay.

Joshua Gilliland has raised some interesting points regarding this case on his Bow Tie Law Blog:

 “I would argue the auto-generated message is not hearsay, because there is no statement from a human being. However, one could argue with a straight face such messages are statements, because the data generated from the time it was read and the sending of the message is an assertion of fact. That being said, finding the “read receipt” message was a party admission was a very clever argument.”

However, there was still the issue of this data being unauthenticated. The ruling by Judge Flanagan was that, as the read receipt was sent from the defendant’s email account to the plaintiff’s, and there was no question regarding the reliability of the defendant’s account, this is an admissible piece of evidence.

This case brings into focus the requirement for contextual data in regards to email evidence. It is very difficult to assert an email as proof of receiving information, or of recognizing its importance, without some form of data proving that the recipient has, at the very least, read the email. 

However, in many email clients, sending a read receipt is optional. In Outlook you can choose to never send read receipts. In Gmail you can do the same. Because of this, the ability to export email status information becomes more important. 

Email status information identifies, for example, whether an email was opened, unread, forwarded or flagged. As this information is stored as part of the email’s metadata, and can be exported by software applications, status information from metadata can be assumed to be more reliable than read receipts. 

For eDiscovery, email status information is potentially crucial as it can provide a window into the behavior of whomever is being investigated. The difficulty lies in the fact that email clients and services store email status information in different ways. Some store this information in the standard SMTP header, others in index files, and still others in separate properties tied to the email.

Despite this difficulty, it’s important for eDiscovery vendors to have the ability to export this information, particularly from the major email clients and services, such as Gmail. In the 2014 Litmus report, Gmail has surpassed a combined market share of Microsoft Outlook and Outlook.com by 2%, with a 16% share. 

Gmail offers many advantages, not the least of which is the ability to export its data using Google Takeout or Google Apps Vault. Yet despite this, our solution Aid4Mail is currently the only email conversion solution able to export email status information from Google Takeout and Google Apps Vault mbox files. 

Perhaps it’s because this information isn’t yet widely used in cases today. Or are you already using email status information in your evidence? We’d love to hear your thoughts in the comment section below.