Lead story
Court orders a redo after failed ESI protocol talks
A California federal court found that both sides failed to follow an order requiring meaningful participation by litigation-support specialists in developing protocols for extracting, searching, and producing ESI from two databases.
- What happened
- A California federal court found that both sides failed to follow an order requiring meaningful participation by litigation-support specialists in developing protocols for extracting, searching, and producing ESI from two databases.
- Why it matters
- When a court requires technical experts to participate in an ESI conference, retaining them is not enough. Counsel must involve them in testing, documenting exceptions, resolving dataset limitations, and agreeing on a production method. AI-assisted review remains a tool within that process, not a substitute for compliance or cooperation.
- Watch
- The order was issued October 20, 2026, and the cited analysis was published October 22. The available analysis quotes the order extensively, but a freely accessible court-hosted copy was not located during source checking.
Sourcesedrm.netscholar.google.com
Briefing item
Court declines automatic waiver for late privilege claims
A California federal court declined to impose a per se privilege waiver where more than 700,000 search hits required review and the defendants' insurer disclaimed litigation-cost coverage as review was about to begin.
- What happened
- A California federal court declined to impose a per se privilege waiver where more than 700,000 search hits required review and the defendants' insurer disclaimed litigation-cost coverage as review was about to begin.
- Why it matters
- Late privilege assertions remain risky, but waiver analysis may account for extraordinary review volume and funding disruption. Teams facing those conditions should preserve a record of the burden, raise the issue promptly, and build a defensible logging plan rather than assume that cost alone excuses delay.
- Watch
- The order was issued September 28, 2026; the cited analysis was published October 22. The result turns on unusual facts and does not create a general exception to Rule 34 deadlines or privilege-log requirements.
Sourcesedrm.netscholar.google.com
Briefing item
Trade-fraud investigations link customs records to communications
New practitioner guidance explains how trade-fraud investigations combine customs filings, transaction data, enterprise systems, and cross-border communications under an expanding federal enforcement framework.
- What happened
- New practitioner guidance explains how trade-fraud investigations combine customs filings, transaction data, enterprise systems, and cross-border communications under an expanding federal enforcement framework.
- Why it matters
- Investigation teams should map customs, finance, shipping, supplier, and communications systems before collection begins. Joining those sources early can reveal whether a discrepancy is an isolated classification error or evidence of intent, while also reducing avoidable overcollection in a multinational review.
- Watch
- HaystackID first published the guidance October 21 and EDRM republished it October 22. It draws partly on a HaystackID webcast and services experience; enforcement totals cited by the government combine recoveries, penalties, forfeitures, and charged losses, and charged losses remain allegations.
Sourceshaystackid.comjustice.gov
Briefing item
Cloud-backup breach puts notification clocks ahead of complete logs
Current reporting on the ConnectWise Cloud Backup incident highlights a gap between fast-moving breach-notification duties and the Microsoft 365 logs needed to determine what an attacker accessed.
- What happened
- Current reporting on the ConnectWise Cloud Backup incident highlights a gap between fast-moving breach-notification duties and the Microsoft 365 logs needed to determine what an attacker accessed.
- Why it matters
- Legal, privacy, and discovery teams need incident workflows that preserve available sign-in, audit, Purview, and Graph activity records immediately, document known and unknown facts, and support phased regulatory notice. Vendor access and log-retention settings should be tested before an incident because missing historical telemetry cannot be recreated later.
- Watch
- The incident remained under investigation at the October 23 source check. ConnectWise said it cannot determine from its own environment whether an individual customer's tenant was affected, and Microsoft said its corporate systems, products, and services were not the cause of the activity.
Sourcescomplexdiscovery.comconnectwise.commicrosoft.com
Briefing item
Emergency PHP fixes carry preservation and security implications
PHP issued emergency updates for two critical remote-code-execution vulnerabilities discovered with advanced AI models, prompting organizations to patch internet-facing systems quickly.
- What happened
- PHP issued emergency updates for two critical remote-code-execution vulnerabilities discovered with advanced AI models, prompting organizations to patch internet-facing systems quickly.
- Why it matters
- Discovery and incident-response teams should coordinate patching with evidence preservation. Recording affected assets, versions, access logs, containment steps, and patch times can support later scope analysis, notification decisions, and defensibility without delaying critical remediation.
- Watch
- The fixes and vulnerability reporting were current as of October 22. AI's role in discovery does not establish how widely the flaws were exploited, and organizations should verify affected versions and remediation steps against the official PHP advisory and their vendors.
Sourcesphp.neteDiscovery Todaynytimes.com
Educational only. Not legal advice. Review sources and matter-specific obligations before relying on any workflow decision.