Lead story
Reported FTC instructions set TAR performance floors
A law-firm analysis says recent FTC compulsory-process instructions require at least 75% recall and 75% precision for TAR or AI-assisted review, along with workflow, validation, model, and prompt disclosures.
- What happened
- A law-firm analysis says recent FTC compulsory-process instructions require at least 75% recall and 75% precision for TAR or AI-assisted review, along with workflow, validation, model, and prompt disclosures.
- Why it matters
- Teams facing an FTC request may need to choose and document a review method before collection is complete. Counsel should confirm that platforms can export validation metrics, cutoff settings, prompt histories, per-document rationales, and reviewer-agreement data, while planning for possible work-product and confidentiality disputes over prompts.
- Watch
- The numeric requirements come from Arnold & Porter's account of nonpublic, matter-specific instructions. ComplexDiscovery found no public FTC copy, and the agency's posted model second request does not set minimum recall or precision. The scope and enforceability of the reported terms therefore remain fact- and matter-specific.
Sourcescomplexdiscovery.comarnoldporter.comftc.gov
Briefing item
Law-firm breach notices expose a matter-file review burden
A review of 10 law- and immigration-firm breach notices on California's public register found that seven described social engineering or impersonation, often involving files obtained through legal work.
- What happened
- A review of 10 law- and immigration-firm breach notices on California's public register found that seven described social engineering or impersonation, often involving files obtained through legal work.
- Why it matters
- A breach involving unstructured matter files quickly becomes a document-review project. Firms and service providers need tested personal-data taxonomies, defensible scoping workflows, preserved review decisions, and retention controls that support prompt notice without unnecessarily retaining sensitive client records.
- Watch
- The public register does not define its reported-date field or consistently disclose when each firm discovered its incident, so the filings alone do not establish whether any notice was timely. Counts and incident descriptions are limited to what organizations reported to regulators.
Sourcescomplexdiscovery.comoag.ca.govleginfo.legislature.ca.gov
Briefing item
Shared AI attack tools complicate attribution evidence
Microsoft says two North Korean groups are using ARTEX, an AI penetration-testing framework also tied to China-linked and financially motivated operations, making the tool an indicator rather than proof of identity.
- What happened
- Microsoft says two North Korean groups are using ARTEX, an AI penetration-testing framework also tied to China-linked and financially motivated operations, making the tool an indicator rather than proof of identity.
- Why it matters
- Incident-response findings should separate observed artifacts from attribution conclusions. Legal teams should preserve the underlying logs, prompts, commands, access records, and analyst reasoning, and should extend holds to HR and onboarding systems when an investigation involves suspected fake identities or remote-worker schemes.
- Watch
- The cited security companies sell defensive products, and Microsoft did not identify affected organizations or disclose its scoring method for AI adoption. An ARTEX artifact by itself does not establish who operated it or whether a particular organization was compromised.
Sourcescomplexdiscovery.commicrosoft.comcrowdstrike.com
Briefing item
Frozen crypto assets still require proof and process
More than 40% of assets from a reported multibillion-dollar Binance theft were frozen, but returning them may depend on ownership evidence, issuer procedures, cross-border orders, and sanctions analysis.
- What happened
- More than 40% of assets from a reported multibillion-dollar Binance theft were frozen, but returning them may depend on ownership evidence, issuer procedures, cross-border orders, and sanctions analysis.
- Why it matters
- Digital-asset recovery requires coordinated preservation across organizations and jurisdictions. Counsel should document valuation timestamps, chain-of-custody information, ownership assertions, sanctions screening, and the legal basis for any freeze, reissuance, or transfer rather than treating blockchain tracing as a complete recovery record.
- Watch
- Loss, freeze, and replenishment figures were changing rapidly and vary among Binance and tracing firms. Private firms attributed the theft to North Korean actors with differing confidence, while the FBI had not publicly confirmed attribution in the cited reporting.
Sourcescomplexdiscovery.comhome.treasury.govecfr.gov
Briefing item
AI demand renews investment in magnetic tape
Fujifilm reportedly plans a ¥10 billion investment to increase magnetic-tape production capacity fivefold by 2028 as AI data growth raises demand for high-capacity archival storage.
- What happened
- Fujifilm reportedly plans a ¥10 billion investment to increase magnetic-tape production capacity fivefold by 2028 as AI data growth raises demand for high-capacity archival storage.
- Why it matters
- Organizations should know which custodial and enterprise records remain on tape, what hardware and software can restore them, how long retrieval takes, and whether retention schedules are actually enforced. Those facts affect preservation scope, collection timing, accessibility arguments, and cost estimates.
- Watch
- The investment and capacity figures are reported from Fujifilm's announcement and were not independently verified during this run. Cartridge capacity is stated on a compressed basis, and actual usable capacity depends on the data and operating environment.
SourceseDiscovery Todaymyemail.constantcontact.com
Educational only. Not legal advice. Review sources and matter-specific obligations before relying on any workflow decision.