Could an Email Stub Be the Downfall of Your Next Legal Case?

Question: Do you know what an email message “stub” is or that they can pose a serious risk when responding to an eDiscovery request, if not taken into consideration?  Not sure?  Then, you are in good company – today, most lawyers and IT professionals alike remain dangerously unaware of the legal implications and risks when dealing with electronically stored information (ESI).

So what is an email stub? An important feature of email archiving (i.e., long-term retention and protection of emails) is a feature called “stubbing.”  This is a process by which an entire email or just the attachment is removed from Exchange and replaced with a “stub” placeholder.  Later, when the user clicks on the message in Outlook, the stub retrieves the archived email and/or attachment from the archive.  In other words, the email stubs allow the email archiving solution to remove live emails from the Exchange system, while still maintaining their accessibility to the end user. Over time this stubbing capability – or shortcutting – creates millions of pointers (hyperlinks) within the Exchange live mailboxes pointing back at messages in the legacy archive.

When responding to an eDiscovery request, you have likely experienced clients that have on premises email archives. The standard discovery process that the email archive vendors suggested you follow was no doubt to pull up the archive-wide search capability and perform a global search against the archive based on keywords. Once that results-set was available, you could perform some first pass culling and export the results set to external counsel or to a standalone eDiscovery platform for further processing. This procedure makes a great deal of sense… except for the overlooked fact that this process does not take into account the email stubs in the live email system.

You may be asking yourself: So what?  All I need for discovery response is the original archived email.  Why should I care about email stubs? The problem is this: those email stubs can contain additional metadata that could be relevant to the case. For example, an end user can assign a flag to an email stub, prioritize it, categorize it, mark it as read or unread, assign a retention policy to it, move it to another folder, or delete it. All of those user actions add metadata to the stub that could be relevant to the lawsuit. So if your discovery process does not include “rehydrating” the stub and its metadata with the archived email message, then you are possibly missing potentially responsive data in your production. Consider the following hypothetical scenario:

Attorney: Mr. Neery, does your company utilize an email archive?

Defendant (Mr. Neery): Yes

Attorney: Did you search it in response to this discovery request?

Defendant: Yes

Attorney: Did you find any potentially responsive data during this search of the email archive?

Defendant: Yes, we found 73 emails in the archive during the time period in question.

Attorney: And how did you export copies of those emails out of the email archive?

Defendant: Using the archive’s built-in export capability, we exported the 73 emails to a PST file and immediately loaded the PST into our eDiscovery platform for further processing.

Attorney: Does your email archive platform utilize a “stubbing” capability?

Judge: Before you answer that question specifically Mr. Neery, can you briefly explain to the best of your knowledge what email stubbing actually is?

Defendant:  Absolutely your Honor. One of the many benefits that legacy email archives provide is the ability to manage Exchange mailbox sizes by automatically moving an email message and/or attachment from the user’s Exchange live mailbox to the email archive replacing the actual email message with a stub pointing to the message in the archive. When the end-user clicks on the stub in their mailbox, the system goes and fetches a copy of it from the archive.

This stubbing process is used to reduce the size of a given mailbox to save on storage and also to help increase the performance of the Exchange server. This process is commonly referred to as “stubbing” or “shortcutting”. Over time this stubbing or shortcutting capability creates millions of pointers within live Exchange mailboxes pointing at messages in the legacy archive. One of the main advantages of stubbing is that the end-user usually can’t tell the difference between a stubbed and actual email message.

Attorney: Thank you Mr. Neery. So to get back to my question, does your email archive system utilize this stubbing capability?

Defendant: Yes, we do.

Attorney: Did any of the 73 emails you copied from the archive for your eDiscovery response have stubs associated with them?

Defendant: I don’t really know specifically however our policy is to stub all email after they have aged 2 weeks in the Exchange server so based on the timeframe searched, I would say that all most likely had stubs associated with them.

Attorney: I need a little clarification on this. When you exported the responsive emails from the email archive, did you also include or recombine the archived emails with their associated email stubs in the live Exchange server?

Defendant: No we did not, why would we, they are just pointers…?

Attorney: I beg to differ. In fact, message stubs can include metadata which could be relevant in a case. Because email stubs look like any other non-stubbed email to an end user, they tend to treat them the same way. For example, an end-user can assign or change the category, assign or change a flag designation, move the stub to the Clutter folder (or another folder), mark the message read or unread, or even assign a retention policy to the stub. These actions, under certain circumstances, could be relevant to the case. If these stubs are not recombined with the associated archived email in a legally defensible manner, I would suggest to the Judge that you have failed to make disclosures or to cooperate in discovery (FRCP Rule 37)…

The above scenario is hypothetical yes, but it demonstrates that attorneys and their technical consultants need to be aware of all sources of potentially relevant data in an enterprise when responding to a discovery request.  In all likelihood, opposing counsel will be.

The above example also highlights the fact that merely copying potentially responsive emails from your email archive for an eDiscovery response does not fully address your eDiscovery responsibilities. Legal representatives must ask themselves the following questions before starting the discovery process:

1. Does the client have an email archive?
2. Is there a possibility that potentially relevant content could be present in the archive?
3. Did the email archive installation include enabling the “email stubbing” feature?
4. If yes, can you recombine the stubs with the archived messages in a legally defensible manner?

The bottom line is live email stubs can contain responsive metadata. Ignoring or deleting stubs and their metadata should never be done without fully understanding the legal consequences. IT personnel should always ask for advice and written permission from their legal department when responding to a discovery request. And both IT and Legal should be fully educated on all aspects of the organization’s data systems.