What is a “Document?”

When Does a Litigation Hold End?
August 12, 2021
Defendant Unsuccessfully Argued that Plaintiff Could Not Show That Data on Cell Phone That Defendant Destroyed Was Relevant
August 18, 2021

Back in the days of paper-based litigation, it was rare to argue over the definition of a “document.”[1]  Usually, it was clear where a letter, memo, or contract began and ended.  But, ESI is much different than paper and recent cases bring that issue to the forefront.

In Sandoz v. Un. Therapeutics Corp., 2021 WL 2453142 (D. N.J. Jun. 16, 2021), the question arose in the context of text messages.  There, the producing party wanted to produce only the narrow text message that “hit” on a specific search term.  It proposed a bubble-by-bubble definition of “document.”

Unsurprisingly, the requesting party suggested a different definition.  It argued that the “document” included surrounding messages that provided the context.  The Special Master agreed and directed production of the contextual texts.

In my words, the context was part of the “document.”  Information that preceded and followed the bubble that the keyword “hit” was part of the requested “document” and it had to be produced with the “hit.”

In Nichols v. Noom, Inc., 2021 WL 948646 (S.D.N.Y. Mar. 11, 2021), the question arose in the context of internal linked documents in Gmail and Google Drive.  The producing party argued that internal linked information was not an attachment to the email and need not be produced with the email.  The court agreed writing that it “does not agree that a  hyperlinked document is an attachment.”

That is the functional equivalent of a bubble-by-bubble definition of “document.”  In my words, the court held that the hyperlinked information was not part of the “document.”[2]  Noom asserted that it was producing all of the relevant documents “separately,” i.e., not with the email that linked to the documents.  Id. at *3.

Generally, children and attachments are part of an email “document.”  For example, in email productions, parent-child emails and information for email threading is routinely produced.  It is also routine to produce attachments with emails under Rule 34(b)(2)(E)(ii).  See, e.g., Nguyen v. Roth & Rau AG, 2009 WL 10682036 at *2 (D. Md. Jul. 28, 2009) (Gesner, J.) (“Since e-mails are ordinarily stored with their attachments, and since an e-mail typically needs to be paired with its attachment in order for either to be fully comprehensible, those courts that have addressed this issue have held that e-mails and their attachments must be produced together.”).

However, Noom applied a different rule to internal links.  The Noom court concluded that, combined with its order giving the requesting party the ability to ask for some linked documents, the court had achieved a proportional balance.  It wrote:  “And, as reported at the most recent conference, the parties have already successfully utilized the Court’s procedure.”  Id. at *5.

However, Noom is likely far from the last word.  See, e.g., Doug Austin, “This May be the Biggest Looming Issue in eDiscovery That few People Are Talking About” (writing that there will be further dispute over this issue).  Noom has sparked substantial disagreement.

Definitional, technological, logical, and procedural flaws have been pointed out and they are discussed, below.

Here, I suggest that Noom may pose evidentiary concerns. 

Specifically, it may present problems in depositions and at trial.

Definitionally, Brad Harris wrote: “Personally, I believe that the court took a view of ‘attachments’ that was too literal and restrictive….”  “Case Law Summary: Are Hyperlinked Documents the Same as Attachments?” (Hanzo Apr. 16, 2021).

Another reason to disagree with Noom is the existence of technological solutions.  Hanzo offers a “follow the link” collection and Mr. Harris wrote that Noom “might turn out to be rapidly outdated.”  Id.  Mr. Austin reports that other vendors provide similar services. Tom O’Connor points to a parallel technological feature in Microsoft 365.  Thomas O’Connor, “Are Hyperlinks the same as Attachments? Judge Parker opinion Nichols v. Noom” (Digital War Room May 21, 2021).

In addition to definitional and technological criticisms, Tom O’Connor has pointed to logical flaws in Noom:

Imagine, if you will, that Boris Badenov, VP of Sales for the Acme Spyware Company, sends an internal email to Natasha Fatale, VP of Human Resources for the same company. The email says, “Natasha, take a look at this internal memo to my sales team for Q3. That old guy in the S’East sector is 25% below all my other sales reps and I let him know in the memo that old timers are nothing but dead wood and he better get up to speed or I’ll fire him like I’ve fired every other dead wood grey hair over the age of 60 in my unit.” The memo is “attached” via a hyperlink to Acme’s One Drive storage network.

Natasha replies by saying, “Boris, I agree. Take a look at my report on all the people over 60 we have let go in the past 5 years.” That report is also “attached” via a link to OneDrive.

A year later, these emails were preserved in a litigation hold pursuant to an age and sex discrimination lawsuit filed by several former employees of Acme. A year after that they were produced in the litigation.

Is anyone going to contend that the documents referenced in the hyperlinks should not also have been preserved and produced?


Craig Ball has pointed to additional technological flaws in the hyperlink decision.  “Can a Producing Party Refuse to Produce Linked Attachments to E-Mail?(Ball in Your Court Mar. 25, 2021).  Starting from the point of view that production is required, he notes the objections that the link may be broken, or the linked document may have been subsequently changed. However, Craig persuasively argues that neither justifies non-production.

For example, Craig said: “If a link to a third-party target file is dead before the duty to preserve attaches, it’s dead.…  But we cannot break live links to evidence carelessly and belatedly, then expect there will be no costs or consequences….  Linking to dynamic documents is always going to be a hard problem to resolve because it goes to the authenticity of the evidence.  By what theory are linked items only discoverable as they existed at a past moment in time?”  “Craig Ball Also Weighs in on Links to Files in Emails: eDiscovery Best Practices” (eDiscovery Today by Doug Austin, Nov. 16, 2020).

Noom also appears procedurally flawed.  Tom points to Rule 34(b)(2)(E).  As I have also noted in a recent blog, Rule 34(b)(2)(E)(ii) governs production of ESI.[3]  Tom and I agree that this provision mandates production in the form or forms in which ESI is ordinarily maintained or reasonably usable form or forms.

Noom’s production of documents without links does not appear to conform to Rule 34(b)(2)(E)(ii)’s procedural mandate.  For example, one click on the actual Gmail will open the link (unless it was already broken).  That is how it is ordinarily maintained.  Under a Noom production, however, the link is dead.  Nor is an email reasonably usable if, as in Noom, the requesting party must ask the producing party for more discovery to determine what was linked.

While I agree with everything said and written above, I also offer a different perspective based on potential evidentiary problems and complications that may arise under Noom.

In the words of the Hon. Paul W. Grimm, “considering the significant costs associated with discovery of ESI, it makes little sense to go to all the bother and expense to get electronic information only to have it excluded from evidence or rejected from consideration during summary judgment because the proponent cannot lay a sufficient foundation to get it admitted.”  Lorraine v. Markel Amer. Ins. Co., 241 F.R.D. 534, 538 (D. Md. 2007).  Judge Grimm wrote that “[w]henever ESI is offered as evidence,… evidence rules must be considered….” [Emphasis added].

When only part of a “document” is produced under Noom, that foundational problem may arise.  Specifically, can part of a “document” be used to question a witness in depositions and at trial?

In “Use of ESI in Depositions,” Chap. 23 in M. Berman, et al., eds., “Managing E-Discovery and ESI” (ABA 2011),  I addressed this issue, specifically, what is a “document” that an interrogating party must show to a deponent in a deposition?

If the interrogating party shows the deponent a paper representation of the ESI, without metadata, is that the functional equivalent of showing only page one of a three-page letter? Or, is it different because some metadata, although available, is not generally visible on the computer monitor? Should a deponent have the right to view the comments and other embedded information before answering questions about a “document” in a deposition? Consider the situation where a deponent is being asked questions regarding the negotiating history of a commercial document that was prepared using the “track changes” option. Is it fair to permit questioning based on a paper document that obscures those changes? Is each version of the document a single document? How would an “object linked and embedded”  document be handled?….  Is it fair to divide up an email “string” or thread when questioning a deponent? Assume that an email was sent from Mr. A to the deponent, and the deponent replied to Mr. A. Assume further that the events occurred six years ago. Is it fair to show the deponent the email from Mr. A to the deponent, without also showing at the same time the deponent’s reply to Mr. A? Or, using a paper analog, is that parallel to separately marking, and using, a letter and a reply letter?

These unanswered questions present issues:

How must attachments to email be handled [in depositions]? At the time the email was transmitted, the sender or recipient saw the email message with the unopened attachment on the screen. Nevertheless, is it fair to show the deponent an email that had attachments… without simultaneously showing the attachments to the deponent?


These questions suggest that the Sandoz “context approach” may be preferable to the Noom “no hyperlink solution.”  The form of what was produced in discovery may have impacts later on.

Let’s fast-forward Noom to the deposition stage.  Let’s assume that Noom produced a document without the hyperlink.  At Noom’s deposition, the interrogating party hands it to the deponent and asks, “do you recognize what has been marked as Deposition Exhibit no. 55?”

Immediately, Noom asks that the deponent be excused from the room and makes the following “speaking objection”:

Under the rule of completeness, Fed.R.Evid. 106, it is not fair to question the deponent on Exhibit 55.  It is only part of the document.  The document is one of hundreds that the deponent saw while working on this project and it is hyperlinked to other important information that gives it context.  Your questions are much like showing a deponent only the first page of a fifteen-page letter or one part of an email chain.  That is impermissible.  Further, the partial document is dated five years ago, and the deponent has not seen it since then.  The passage of time makes it doubly unfair to ask questions using only part of a document while taking away the context.

The interrogating party replies:

Wait a minute.  I’m using what you produced to me.  You said that the hyperlink wasn’t part of the document.  You asserted that it was not an attachment. You can’t object now and assert that your production was so defective that I can’t ask questions based on it.

Noom responds:

No, you’re comparing apples and oranges.  That form was chosen to avoid undue burden in a document production.  This deposition is far different.  Here, we are talking about testimony under oath and fairness to a testifying deponent.  It’s not fair to question someone under oath on a complex, five-year-old document using only your cherry-picked part of it.  We produced the hyperlinked document to you separately.  You could have presented it to the deponent with the email. And, alternatively, if the missing information was an internal link, you could have asked for a copy of it, as the Judge ruled.  Of course, if it was an external link, you could have gotten it.

The interrogating party retorts:

You would have objected and refused to produce it if was internal. And, a five-year-old internal or external link can’t be authenticated.  You’re hiding the ball.  Let’s bring the deponent back in to answer the question.

The deponent returns to the deposition room and is asked:

Please take your time and look at Deposition Exhibit 55.  Do you recognize it?

The deponent responds:

I’m not sure.  It’s been a long time.  I can’t answer “yes” or “no.”  I don’t remember.  All of the linked information that came with it is missing.  That’s what I would remember – the links.  See, there was a spreadsheet called “how_I_got_the_answer.xlsx.”  And, there was a memo named “here_is_my_thought_process.docx.”  If I could see them, maybe I could answer your question.  But with only this fragment, I just don’t recall.

Since the earliest days of e-discovery, parties have been advised to discuss the form or forms of production.  Sandoz and Noom give additional force to this approach.  “[C]omplexities with collecting and producing linked documents … may lead to motion practice and delays if parties do not establish a process for handling this information at the outset of discovery.”  Philip Favro, “Dispute Over Linked Google Drive Documents Highlights Discovery Challenges with Information Systems” (Driven Apr. 27, 2021).

Sandoz and Noom point to related issues that may be the subject of a conference of the parties.  At a minimum, Sandoz suggests discussion of production of text messages with their context.  Parties may wish to include that type of provision in their Rule 26(f) ESI negotiations.

Noom raises more complex issues that, in addition to the scope of disclosure, may impact on later testimonial uses.  If internal linked documents are not deemed attachments, the parties may want to negotiate how the produced documents will be used in later testimonial proceedings and summary judgment practice.

In that regard, the Noom court made two relevant observations.  First, the parties’ ESI protocol was silent about hyperlinked documents.  Second, Rule 34 permits a party to request the form or forms of production.  Requesting parties often specify, for example, the metadata fields that are requested.  It is interesting to speculate whether the court would have reached a different result if the request had defined internal linked documents as attachments.[4]

At bottom, Noom was a discovery decision.  It addressed “the changing nature of how documents are stored and should be collected,” as well as the form of production.  See id. at *2.

As to evidentiary issues, the Noom court stated only that it “appreciates that there may be… authentication issues that arise.”  Id. at n. 4.  Likely because it viewed them as “a very small percentage… that can be dealt with later in discovery,” id., it did not address evidentiary issues.  Those issues may also need to be discussed.

So, what is a document?  If an internal hyperlink is not part of the “document” for purposes of the duty to produce under Fed.R.Civ.P. 34, a receiving party needs to plan in advance for use of the produced fragment in deposition and at trial.   That is likely best accomplished during the Rule 26(f) conference of the parties.[5]

UPDATE: For a subsequent related post, please see What is a Document? (Part II) – E-Discovery LLC (ediscoveryllc.com)


[1] There were often arguments about overly broad definitions of “document” in a request for production.  A body of decisional law addresses that issue.  See generally Appendix D to Local Rules, D. Md., citing Diversified Products Corp. v. Sports Center Co., 42 F.R.D. 354, 358 (D. Md. 2008) (Watkins, J.), and Mancia v. Mayflower Textile Servs. Co., 253 F.R.D. 354, 358 (D. Md. 2008) (Grimm, J.), to address unreasonable definitions in such requests.  But cf.  Shannon M. Curreri, “Defining ‘Document’ in the Digital Landscape of Electronic Discovery,” 38 Loy. of Los Angeles L. Rev. 1541, 1561-65 (2005).

[2] Notably, however, the producing party in Noom agreed to produce “a reasonable number of linked documents at Plaintiffs’ request….”  In those instances, the hyperlinked information was part of the “document.”

[3] See, Blog, “Does Rule 37(E)(i) Mandate ‘Document Correlation’ When ESI is Produced and, If So, Does Metadata Provide a ‘Work-Around’ to Avoid the Costs of That Correlation Process?” (Jul. 20, 2021).

[4] Of course, the producing party might then have objected.

[5] Tom O’Connor points out that objections to the cited Noom decision were overruled by the District Judge, citing Order Overruling Plaintiff’s Objections, Nichols v Noom, Case 1:20-cv-03677-LGS-KHP, Document 324, Filed 04/30/21 at page 3; accord Philip Favro, “Dispute Over Linked Google Drive Documents Highlights Discovery Challenges with Information Systems” (Driven Apr. 27, 2021).


Sept. 3, 2021, update:

See Doug Austin, “Putting Context into Discovery of Messages” (Ipro) for a discussion of the broader implication of Sandoz in connection with collaboration apps.  “[M]essages in collaboration apps are individually stored just like text messages; hence, the contextual issue applies to them as well. Just like with text messages, you need to apply context to collaboration app messages to fully understand the conversation.”