“Modern Attachments” or “Pointers”- What is a Document? (Part IV)

“Navigating Social Media Discovery: Steps Counsel Can Take to Address Mass Deletion of Social Media History”
August 9, 2022
Suspect’s Haircut = Destruction or Concealment of Evidence Leading to “Missing Evidence” Jury Instruction
August 13, 2022


I have written a series of blogs on What is a Document? (Part III),  What is a Document? (Part II), and What is a “Document?” In those blogs, I pointed to issues that may be presented by, for example, text bubbles, spreadsheet cells, Excel workbooks with multiple worksheets, PDF Portfolios, and Slack “channels.”

Nichols v. Noom, Inc., 2021 WL 948646 (S.D.N.Y. Mar. 11, 2021), addressed whether hyperlinked documents are email attachments.  I also addressed the evidentiary concerns raised by Nichols.

A recent post by Staci Kaliner, Monica McCarroll and Ben Barnes, Redgrave LLP, Let’s Start by Calling Them What They Are for Discovery: ‘Pointers’ Not ‘Modern Attachments’ | Legaltech News (law.com) (Aug. 11, 2022), makes an interesting suggestion:

We will make a case for changing how our industry talks about these documents, why “pointer” is a more accurate term than the misleading “modern attachment,” and why that change in terminology should have a positive impact on how we approach discovery of this information. [emphasis added].

The article explains that: “Users in Outlook or Teams can send messages containing a link that points to content stored in a separate location within the same M365 tenant, often in SharePoint or OneDrive. Storing the document separately from the message allows for ongoing collaboration among multiple users while eliminating the need for continually circulating many duplicate versions of a file.”

The article points out that the “as sent” version may differ from the stored version:

Microsoft generally refers to the referenced content as “modern attachments” or sometimes “cloud attachments,” while others in the industry may refer to these as “linked files” or simply “attachments.” Unlike traditional email file attachments that are saved within the email .msg container with the associated message body and metadata, the files referenced in Outlook or Teams messages that are stored elsewhere may not be static. This means that the version of the file that is referenced from the sender’s message may have been edited or deleted when the recipient returns to the message and accesses the file, or may have been edited or deleted at a later time before the document is identified as subject to discovery. [emphasis added].

The authors conclude:

We posit that the term “pointer” is a far more apt description of the functionality here. Senders are pointing the recipient of the message to a location in the cloud where a specific document or file is stored. Pointers are one-directional, meaning the message references data stored in another source or location, but the source or location does not point back to the message. Stated simply, pointers are not attachments. Adopting the use of pointer for these documents may facilitate a more robust discussion within our industry as to whether it makes sense to treat the message and referenced content separately for discovery purposes. With this new terminology, we can develop meaningful strategies for defensible workflows, rather than simply defaulting to treating the message and referenced content like the traditional “parent/child” or “family” relationships that historically have been central to modern discovery practices.

There is much to be said in favor of the use of the term “pointers.”

Craig Ball has used the terms “link” and “target.”  Can a Producing Party Refuse to Produce Linked Attachments to E-Mail? | Ball in your Court (craigball.net) (Mar. 25, 2021).

Importantly, the suggestion of developing meaningful strategies is important.  In addition to the discovery issues, there may be evidentiary concerns. Fed.R.Evid. 106 and the “rule of completeness” may be implicated:

When only part of a “document” is produced under Noom, [a] foundational problem may arise.  Specifically, can part of a “document” be used to question a witness in depositions and at trial?

As I pointed out in the prior blog, assume that two years after an email with a pointer was sent, the email is used to question the recipient in a deposition.  The deponent may be unable to answer unless the “attachment” or “target” is provided.  However, because the target is in collaboration software, the “attachment” as sent may no longer exist.

Tom O’Connor has pointed to potential preservation or spoliation issues. Are Hyperlinks the same as Attachments? Judge Parker opinion Nichols v. Noom (digitalwarroom.com). Craig Ball has pointed to technological issues. Can a Producing Party Refuse to Produce Linked Attachments to E-Mail? | Ball in your Court (craigball.net) (“To paraphrase Abraham Lincoln, you cannot murder your parents and then seek leniency because you’re an orphan. The problem is solvable, but it will be resolved only when Courts supply the necessary incentive by ordering collection and production.”)

The potential evidentiary issues require early consideration.  “If internal linked documents are not deemed attachments, the parties may want to negotiate how the produced documents will be used in later testimonial proceedings and summary judgment practice.”  See What is a “Document?

For example, “[T]he Noom court stated … that it ‘appreciates that there may be… authentication issues that arise.’”  Id.  “If an internal hyperlink is not part of the ‘document’ for purposes of the duty to produce under Fed.R.Civ.P. 34, a receiving party needs to plan in advance for use of the produced fragment in deposition and at trial.   That is likely best accomplished during the Rule 26(f) conference of the parties.”  Id.  For examples of some issues that may arise in deposition or at trial, see What is a Document? (Part II).

UPDATE:  See Kelly Twigger, Episode 108: Is an individual Slack Message Considered a Document under FRCP 34? | eDiscovery Assistant.  “Read on to see whether a message on Slack is a document itself, or what the producing party was required to provide and focus on the takeaways provided from CEO Kelly Twigger….  Slack is set up to work in channels and there are really two ways to communicate. You can communicate via a channel in which you put multiple people on one channel — generally to communicate about a specific topic — or you can use direct messages which are from one person to another within Slack….  Lubrizol sought 1) the entire thread conversation for any conversation containing 20 total messages or fewer and hitting on one responsive message in that conversation, and 2) for any conversation with one responsive message where there are more than 20 messages in the conversation, IBM should be required to produce the 10 messages preceding and following any responsive message….  The Court states the issue as this: whether each individual Slack message should be treated as a discrete document under Rule 34, or whether a court should view an entire Slack channel as a single continuous document. This is an issue of first impression for the Court. This is an issue of first impression in case law….  The Court here agreed with Lubrizol and required IBM to produce surrounding messages, even if IBM believes that some or all of those messages are not relevant to its case. The court gives three reasons for that position.”  The decision was Lubrizol Corp. v. IBM Corp., 2023 WL 3453643 (N.D. Oh. May 15, 2023).

UPDATE: See Kelly Twigger, ESI Protocols Part X: Issues in Production from Collaboration Platforms | eDiscovery Assistant.  “The other significant issue with the technology of using pointers or links is which version of the document is produced with the corresponding message. Yes, you read that correctly. A pointer or link to a document that you sent six months ago points to the same place, but the document that lives there may have been updated ten times since you sent that link. Standard ediscovery protocol is that the version that existed at the time the pointer or link was sent should be the one that is produced with that message. After all, what the author of the responsive message intended to attach reflects their communication most accurately.

Most of the collaboration platforms store each version with a time stamp, so it IS possible to get the version sent at the time of the message, but it involves thinking about that before any work is done to identify the scope of data and it’s complicated depending on the platform.”