“Modern Attachments” or “Pointers”- What is a Document? (Part IV)

“Navigating Social Media Discovery: Steps Counsel Can Take to Address Mass Deletion of Social Media History”
August 9, 2022
Suspect’s Haircut = Destruction or Concealment of Evidence Leading to “Missing Evidence” Jury Instruction
August 13, 2022


I have written a series of blogs on What is a Document? (Part III),  What is a Document? (Part II), and What is a “Document?” In those blogs, I pointed to issues that may be presented by, for example, text bubbles, spreadsheet cells, Excel workbooks with multiple worksheets, PDF Portfolios, and Slack “channels.”

Nichols v. Noom, Inc., 2021 WL 948646 (S.D.N.Y. Mar. 11, 2021), addressed whether hyperlinked documents are email attachments.  I also addressed the evidentiary concerns raised by Nichols.

A recent post by Staci Kaliner, Monica McCarroll and Ben Barnes, Redgrave LLP, Let’s Start by Calling Them What They Are for Discovery: ‘Pointers’ Not ‘Modern Attachments’ | Legaltech News (law.com) (Aug. 11, 2022), makes an interesting suggestion:

We will make a case for changing how our industry talks about these documents, why “pointer” is a more accurate term than the misleading “modern attachment,” and why that change in terminology should have a positive impact on how we approach discovery of this information. [emphasis added].

The article explains that: “Users in Outlook or Teams can send messages containing a link that points to content stored in a separate location within the same M365 tenant, often in SharePoint or OneDrive. Storing the document separately from the message allows for ongoing collaboration among multiple users while eliminating the need for continually circulating many duplicate versions of a file.”

The article points out that the “as sent” version may differ from the stored version:

Microsoft generally refers to the referenced content as “modern attachments” or sometimes “cloud attachments,” while others in the industry may refer to these as “linked files” or simply “attachments.” Unlike traditional email file attachments that are saved within the email .msg container with the associated message body and metadata, the files referenced in Outlook or Teams messages that are stored elsewhere may not be static. This means that the version of the file that is referenced from the sender’s message may have been edited or deleted when the recipient returns to the message and accesses the file, or may have been edited or deleted at a later time before the document is identified as subject to discovery. [emphasis added].

The authors conclude:

We posit that the term “pointer” is a far more apt description of the functionality here. Senders are pointing the recipient of the message to a location in the cloud where a specific document or file is stored. Pointers are one-directional, meaning the message references data stored in another source or location, but the source or location does not point back to the message. Stated simply, pointers are not attachments. Adopting the use of pointer for these documents may facilitate a more robust discussion within our industry as to whether it makes sense to treat the message and referenced content separately for discovery purposes. With this new terminology, we can develop meaningful strategies for defensible workflows, rather than simply defaulting to treating the message and referenced content like the traditional “parent/child” or “family” relationships that historically have been central to modern discovery practices.

There is much to be said in favor of the use of the term “pointers.”

Craig Ball has used the terms “link” and “target.”  Can a Producing Party Refuse to Produce Linked Attachments to E-Mail? | Ball in your Court (craigball.net) (Mar. 25, 2021).

Importantly, the suggestion of developing meaningful strategies is important.  In addition to the discovery issues, there may be evidentiary concerns. Fed.R.Evid. 106 and the “rule of completeness” may be implicated:

When only part of a “document” is produced under Noom, [a] foundational problem may arise.  Specifically, can part of a “document” be used to question a witness in depositions and at trial?

As I pointed out in the prior blog, assume that two years after an email with a pointer was sent, the email is used to question the recipient in a deposition.  The deponent may be unable to answer unless the “attachment” or “target” is provided.  However, because the target is in collaboration software, the “attachment” as sent may no longer exist.

Tom O’Connor has pointed to potential preservation or spoliation issues. Are Hyperlinks the same as Attachments? Judge Parker opinion Nichols v. Noom (digitalwarroom.com). Craig Ball has pointed to technological issues. Can a Producing Party Refuse to Produce Linked Attachments to E-Mail? | Ball in your Court (craigball.net) (“To paraphrase Abraham Lincoln, you cannot murder your parents and then seek leniency because you’re an orphan. The problem is solvable, but it will be resolved only when Courts supply the necessary incentive by ordering collection and production.”)

The potential evidentiary issues require early consideration.  “If internal linked documents are not deemed attachments, the parties may want to negotiate how the produced documents will be used in later testimonial proceedings and summary judgment practice.”  See What is a “Document?

For example, “[T]he Noom court stated … that it ‘appreciates that there may be… authentication issues that arise.’”  Id.  “If an internal hyperlink is not part of the ‘document’ for purposes of the duty to produce under Fed.R.Civ.P. 34, a receiving party needs to plan in advance for use of the produced fragment in deposition and at trial.   That is likely best accomplished during the Rule 26(f) conference of the parties.”  Id.  For examples of some issues that may arise in deposition or at trial, see What is a Document? (Part II).