Note: Words in Italics refer to entries in this Glossary.

Archived Electronic Sources: means Electronic Sources that are stored for a shorter or longer term for the purpose of preservation. Storage for the purpose of archiving (preservation) means that a copy of the Electronic Source is made and stored on a Data Carrier to preserve it in the actual state without subsequent alterations of its substance. Normally, Electronic Sources are archived on dedicated Data Carriers which are logically and/or physically kept separate from electronic information that is in use. Archived Electronic Sources are a 'snapshot' of the archived data in existence at the time the archive was created. Archived Electronic Sources may be a complete 'snapshot' of this data or incremental. Incremental means that, if compared to the last Back-up, only new or changed data is archived.

Authenticity, of electronic document: Archiving or backing up electronic data is mostly done by using dedicated Computer Programs that allow tracking the date and time of any modification to data included in the archive. Some of these programs comply with national legal requirements for preserving the data integrity, i.e. Authenticity.

Authenticity of an Electronic Document is a non-technical attribute ascribed to it in a communication context, here a dispute. An Electronic Document is considered as being authentic if (i) the author or creator who figures as such in the context of the information displayed in the document or identified by somebody as being the author/creator really is or is determined by the arbitrators to be the 'real' author/creator; (ii) that this author/creator did produce exactly this Electronic Document at the moment ascribed to it by him or a third party; and (iii) that the Electronic Document was not subsequently altered by anybody.

Back-up: means a copy of electronic data for the purposes of preservation. See also Archived Electronic Sources.

Client: refers to dedicated Software that is locally installed on a Computer linked to a Network within which a Server is accessed by the Client , to which it provides a service. For example an Email Client interacts with an Email Server, such as MS Outlook with MS Exchange or a Lotus Domino Server with a Lotus Notes Client. Therefore, Network System architecture using Servers and Clients is referred to as Server-Client -Architecture.

For the purpose of eDocument disclosure it is useful to know, that a Client may, but need not always locally and permanently store copies of ESD, and that certain Server-Client -Systems may store ESD permanently only in a Directory of the File System pertaining to a Server (this may be increasingly the case where web-based services are employed in the relevant sphere of control, especially if cloud computing is used). This may be relevant for identifying Custodians.

Cloud Computing: is a catch-all term essentially referring to Network based computing systems within which software applications are being provided to local Computers by remote Servers as a service on demand. Furthermore, Cloud Computing is generally characterized by exclusive permanent storage of ESI in Directories of the File Systems pertaining to Servers in the so called cloud. A further common feature of Cloud Computing is virtualization of Servers. Virtualization means that the Server software is dissociated from the Server -computer (also called Server) hardware and may move from one computer location to another.

The same applies to Directories of the File Systems pertaining to the Server-Software. Application service software is often provided by third parties on the basis of complex service providing or outsourcing agreements. This may be relevant for identifying Custodians and/or the identification of the physical location of hardware means for ESI storage.

Typically, the User may access Cloud Computing services from any computer in the network using a User -ID and password, if such computer is equipped with a web-front-end and software pertaining thereto (e.g. a web-browser such as Mozilla Firefox, Safari, MS Explorer, Java-Runtime). The front-end software may also be referred to as Client , which is rather general-purpose and not dedicated (specialized) software. However, Cloud Computing may also require dedicated software for certain services.

An example of Cloud Computing most people may know are the so called 'web-mailers' for managing personal email accounts.

Computer Forensics: refers to a branch of forensics dealing with (i) security threats to computing systems and intrusions, but also (ii) data recovery and verification of data integrity, which are relevant to eDisclosure. Computer Forensics is a service provided by experts and comprises inter alia:

  • Extraction of relevant data from computer systems and data carriers.
  • Recovery of deleted data.
  • Data analysis for establishing the 'history' of data and Authenticity.

Computer Hardware: refers to physically existing devices that generate, process, store and display any kind of data, such as inter alia: computers, displays, printers, network devices, disk drives and tape drives.

Computer Programs: refers to a recorded machine readable and executable code that is used to operate data processing devices and/or process data. Computer Programs usually consist of many Files that may also have different formats. Computer Programs are normally dedicated for a specific purpose, such as word-processing, spreadsheet calculation, visual presentations, data conversion, data back-up, voice- or video communication.

Computer Programs must be compatible with their environment, i.e. other programs such as the operating system (e.g. Windows, Linux, MacOS, Unix) and possibly other dedicated programs, since they use functions of these programs during operation, by exchanging data through software interfaces.

Computer Programs are normally protected by intellectual property rights, e.g. usually copyright and sometimes patents. Therefore, they may only be used in accordance with the terms and conditions of the licence of the holder of the rights.

Copy: is the reproduction of the original data. In relation to electronically recorded data, the problem is to distinguish copy from original. For example, if you send an email, a copy of which is stored in the (virtual) out-box of the sender's Email Client , the question may arise whether the copy of the message in the (virtual) in-box of the recipient's Email Client or the copy in the out-box of the sender's Email Client is the original,. When processing data, computer programs may create several virtually identical Files in the background that are stored in different places. Therefore, unlike a sheet of paper with text and signatures, it may be a futile to try to distinguish the original eDocument from a copy. The question then is whether the copy is authentic (see: Authenticity) . In our example one could compare the copy in the out-box with the one in the in-box.

Custodian, of electronic data: refers to a natural or legal person that has had or has control over electronic data, such as a specific word-processor file. Such control comprises physical access to a medium on which the electronic data is stored and the rights of access to the electronic data. Physical access means access to a computer or terminal that is technically enabled to access the storage medium on which the data is stored. This access may take place over a Network. Technically, access rights are controlled by computer software that is configured by the system operator (SysOp) according to the applicable policies. Access rights range from 'read' to 'read/write', 'delete', 'create' to 'change name'. Access rights are also defined by company policy or legal regulations to which natural persons who are Custodians may be subjected. Legal and natural persons who are Custodians may be subjected to contractual restrictions and/or legal rules that govern their rights of access to or authority over disclosed electronic data.

Data Mining: originally relates to the extraction of knowledge (information) from databases in a meaningful (intelligible) format for analysis for a specific purpose. Also useful is the context of the production of relevant ESD, since parties are required to produce not only ESD they know to exist but also which they happen to find by chance. Rather, they must extract and provide the existing ESD that falls under an agreed or ordered definition. The dispersion of ESD on Data Carriers, the variety of possible File Formats, and the sheer quantity of ESD that must be searched during the process, prevents this process from being carried out manually. Therefore, the use of Search Tools is required to extract potentially disclosable ESD at a first stage, which is followed by an analysis carried out by somebody at a second stage. This is followed by the extraction and organization of the ESD meeting the definition(s). Such ESD is mostly organized using Software that relies on relational databases. Finally, 'mined' ESD meeting the definition is disclosed in specified formats, unless ESD is privileged.

Data Carrier: means any tangible object on which electronic data is stored. (See: Electronic Means of Storing or Recording Information )

Data Deletion: refers to data, usually a File or Directory with regard to which somebody has completed the command 'delete'. Deletion will cause the relevant Computer Program, usually the operating system, to treat the data as non-existent, i.e. the File or Directory is no longer displayed (the logical pointers to the data in the File System and data disk sectors are removed). However, this does not mean that the relevant data has disappeared from the Data Carrier on which it was stored, unless the sections where bits and bytes of which it is composed are overwritten. Often, all or some deleted data can be recovered even after deletion. This requires dedicated recovery software and, possibly, special technical expertise (see: Computer Forensics).

Data Erasure: refers to more than Data Deletion, since erased data is overwritten and thereby completely destroyed on the storage medium on which the erasure is carried out.

Data Recovery: refers to the complete or partial reconstruction of deleted or erased data using dedicated recovery tools, i.e. programs that analyze and reassemble residual deleted or erased data on a Data Carrier (see: Computer Forensics).

Data Room: This term refers to a dedicated File Repository on a Server that uses advanced web technology.

Deleted eDocument: refers to a copy of an eDocument with regard to which somebody has performed the command 'delete'. Deletion will cause the relevant Computer Program, usually the operating system, to treat the eDocument as non-existent, i.e. the copy of the eDocument is no longer displayed. However, this does not mean that the relevant data has disappeared from the Data Carrier on which it was stored, unless the sections where bits and bytes of which it is composed are overwritten (see: Data Deletion, Computer Forensics).

Disaster Recovery System: refers to a system consisting of hard- and Software with procedures that allow the technological infrastructure, including data, to be recovered or resumed should that infrastructure be hit by a disaster. For this purpose, such system will include periodical Back-up of critical ESI contained in the primary system.

Directory: refers to a hierarchical system (the File System) for organizing and retrieving electronic data used by Computer Programs, including the operating system, which is or may also be made visible as a 'folder' or 'drawer' (icons) via the graphical User interface, i.e. the display. With the exception of the so-called 'desk top', Directories are always logically placed and visualized below one or more physical or logical Data Carriers. A Directory may contain Files or sub-directories. Sub-directories are Directories located in another Directory, i.e. at a lower point in the logical hierarchy. Each Directory has an identifier, i.e. name. Directories on the same level in the hierarchy may not have identical names.

eDisclosure: is a non-standardized term used herein. It refers to the process by which a party to an arbitration or any third entity extracts data in electronic format from the Data Carriers in its custody and provides one or more other parties to the arbitration with such data in a certain format under the control of the arbitral tribunal and/or in accordance with the terms these parties have agreed. eDisclosure also comprises disclosure of copies of physically existing material (e.g. documents, photographs) that have been reduced into digital format.

Electronic Document (eDocument): may, but need not necessarily be, a 'photographic' copy of a physical document that was digitized (scanned). Herein eDocument is understood as falling within the definition of 'Document' in the IBA Rules on the Taking of Evidence in International Arbitration [2010]. The term eDocument is a sub-category of ESI, which is the broader term.

Black's Law Dictionary defines the term 'Document' as meaning something tangible on which words, symbols or marks are recorded. In short, a document is something tangible on which information that is intelligible by humans is recorded. An Electronic Document is a document that is not tangible but may be displayed or printed with the aid of a computer and its peripherals.

In most instances Electronic Documents are recorded as Files. However, it is also possible that a document is assembled automatically from several Files or some information contained in a file by a Computer Program for the purpose of displaying or printing the Electronic Document.

Electronic Documents may also contain or consist of video or audio recordings.

Electronic Mail (email): is a means of communicating via computer Networks including the World Wide Web by using POP or SMTP protocols. email is the primary source of material for eDisclosure, since it is intensively used for intra-company communications. emails can be sent and received by any person or logical entity that has an email account, i.e. an email address and a system with the software required for sending and receiving messages pertaining to this address. To access or send emails, Users either use a locally installed dedicated program that is called email Client, or they access a Server with the required Software via their web browser over a Network.

Email is mainly a means for text-based communication. However, Files can and often are 'attached' to emails.

A sent email is normally locally stored by the Client or the Server behind the web-front-end and then forwarded by email computer Server systems in blocks (data segments) via Network (s) to the email Server of the domain to which the recipient's email address belongs. This Server stores the email and forwards it to the email Client that is configured for receiving emails sent to the email account to which the recipient's email address belongs, if this Client (automatically) sends a signal to the Server indicating that it 'wants' to or can receive messages.

Each copy of an email that was created during the process can be deleted by a person with the required access rights, or automatically (normally after a certain period of time) where the system is configured to allow automatic deletion. However, the existence of large numbers of copies, as happens when there are multiple recipients, increases the probability that one or more copies remain available somewhere.

Proving actual receipt of an email by an intended recipient, in the event the recipient denies receipt, may be difficult for technical reasons. However, the content of other available information (documents) may indirectly prove receipt. Computer Forensics may also be used to clarify the issue.

Issues relating to Authenticity or subsequent alterations of messages (technically easy) may be resolved by comparing copies of emails. Otherwise, Computer Forensics may also be used to clarify the issue.

Electronic Means of Storing or Recording Information: refers to dedicated computer hardware for storing data, such as hard disks, memory cards, diskettes, back-up tape machines, USB-sticks, CD/DVD/Blu-ray drives and the discs they use, as well as the software for carrying out read/write operations. Storing implies a certain duration; the random access memory (RAM) used by computers to store transient bits and bytes during processing is not included.

Electronic Sources: mean information of any kind stored in machine-readable electronic format that may be relevant for the outcome of the dispute in relation to disclosure.

ESD: is an acronym for eDocument (see: ESI, Electronic Sources, File).

ESI: is an acronym for electronically stored information or information stored in digital format (see: eDocument, Electronic Sources, File).

ESI, active: refers to ESI that is accessible to Custodians within a computer or a Network without any need to access Back-up ESI.

ESI, inactive: refers to ESI that is not accessible to Custodians within a computer or a Network and requires access to Back up ESI.

Extranet: see: Intranet.

File: refers to a finite sequence of bytes representing information that are flagged as pertaining to this file when used in relation to computing. Files are normally stored for a certain duration on a storage medium. Files are part of the File System. Each File has an identifier (e.g. File Name) that must be unique within the Directory where it is located. The name is followed by a suffix describing the File Type.

Unless a File is 'flagged' to restrict certain operations such as deletion, the operating system is enabled to carry out read/write, renaming and deletion or erase actions. Apart from Files executable program codes, the arrangement of the information in a File is defined for the File to be used by a program such as a word-processor or media player. The type of program to which the File pertains may in such case be seen from the suffix. Without the correct program, the information may not be extracted correctly from the File and information cannot be correctly written into the File without expert knowledge and special tools.

Although a File is treated within a computer system as single logical entity, this does not mean that it is stored as one single sequence on the storage medium. Depending on the way storage is organized on such a medium, a File may be stored in blocks of bytes at different logical locations on the storage medium. Logical flags and indices used by the operation software manage these blocks (see: File Fragment).

File, active: is not a technical term and refers to a File that is not archived and may be accessed by a User with the required rights during normal operations.

File, accessible: is not a technical term and refers to a File that is accessible to a Custodian. Unless there are legal impediments, active Files are accessible. Deleted Files are normally no longer accessible to programs, including search tools, or may only be accessible with unreasonable effort using dedicated recovery tools, since they have disappeared from the File System. Erased Files are inaccessible unless dedicated tools used by Computer Forensics can recover all or some fragments from a Data Carrier. The required effort may be unreasonable, especially if the purpose of the search is not defined. Finally, a File may be inaccessible to a certain person or entity because that person or entity no longer has physical access to or the legal right of access to the computer/system to which the Data Carrier on which the File is stored is related.

File, deleted / erased: see: Data Deletion, Data Erasure.

File Name: refers to a unique and arbitrary identifier for a File within a Directory of a File System. Depending on the operating system a File Name must comply with certain requirements. Certain applications, such as word-processors, allow Users to determine the prefix of the File Name. It is good practice to use a meaningful and systematic approach to naming Files. Automatically created Files are assigned prefixes consisting of strings in accordance with a programmed naming system. Today, the prefix is followed by a dot and a suffix (file extension/type) that is normally assigned automatically. This suffix indicates the File Format.

Active Files can easily be searched in a File System on the basis of their (truncated) File Name using available search tools.

File Format: refers to File type represented by the suffix. The suffix indicates to Users the programs and what kind of programs should be enabled to properly extract, use/manipulate, visualize or make audible the information in the File, since the structure and arrangement of the bytes in the File have been defined by the programmer to be used by that specific program or kind of programs. Certain File types have been subject to considerable standardization efforts but others are proprietary. If a User knows the file extension he or she can search the corresponding program(s) on the Internet (see: e.g. http://www.file-extension.com/, http://www.filext.com/, http://www.file-extensions.org/ ).

File Fragment: refers to a block of data pertaining to a File. When Data Recovery is carried out, file fragments are retrieved, identified and reassembled to the extent that this is technically possible (see: Computer Forensics),

File Repository: refers to a logical place, normally accessible via a Network, where Files are stored for retrieval. In most instances, the User accesses the File Repository through the interface of dedicated document management software (DMS) that is either locally installed (in part) or via the web browser and allows Files to be uploaded, downloaded, visualized and processed, depending on User rights, which can often be defined down to the level of a particular File. The DMS normally comprises relational data Software allowing additional information to be associated with any File and versions and User access to be tracked. In most cases the Files in the File Repository are presented to the User in a hierarchical structure of folders that resembles the structure of the File System, even if the actual visual representation may be more sophisticated. The DMS usually allows complex search operations and can include functions such as optical character recognition (OCR).

File Repositories may be particularly useful for disclosure of eDocuments and/or electronic filing.

File System: refers to a defined system by which electronic data in File Format is organized for access, processing and storage. On a PC the File System may be visualized by icons that are mostly arranged in a hierarchical structure comprising Directories, sub-directories and Files, which reside in physical Data Carriers.

However, there are also virtual File Systems that overlay more specific File Systems, each of which may have a different specification according to the interface provided by the virtual File System. Global File Systems are cluster-File Systems that comprise Directories and Files on a multitude of physical Data Carriers within a storage data area Network. Network File Systems support File sharing over a Network, mostly by using a Server.

Format, of submission for eDocument: refers to the File Format in which eDocuments are filed with the arbitral tribunal. eDocuments are often submitted to the arbitral tribunal as a print-out or, if provided in digital format, as a PDF copy, since it is reasonable to submit eDocuments in a format that any addressee (other parties, arbitrators) can open and read without needing to subscribe to special software, which may not otherwise be easily available on acceptable conditions. However, this approach may sometimes not be useful due to the particular nature of the eDocument or because the original version of the eDocument includes relevant Metadata that would not be preserved if the eDocument is produced in a different easily accessible Format.

Format, of disclosure of eDocument: refers to the File Format in which eDocuments are disclosed to the other side. The File Format for disclosure may, but need not necessarily be the same format which is used for submissions to the arbitral tribunal. Sometimes it is suggested that eDocuments be disclosed in their original format, so that all Metadata included in the 'original' eDocument is preserved. However, unless the recipients of disclosed eDocuments already have a licence to the Software to which the original format pertains, such party may have difficulty accessing the information in the File with reasonable effort.

Handheld Devices (Blackberry): refers to small data-processing units that are small enough to fit into a person's hand and are from time to time, or most of the time, connected to a Network (mobile telephone networks, WLAN, Bluetooth, USB, etc.) for communication purposes. Handheld Devices are extensively used for text messaging, email or instant messaging (SMS). In- and outgoing messages are stored on the mobile device for a variable duration, depending on the Data Carrier that may be built into the device, or may be exchangeable (see: Archived Electronic Source, Custodian).

Internet: refers to the global Network of computers consisting of a decentralized structure of Networks, comprising hard- and Software within which connected computers can exchange data, using the standard Internet protocol suite (TCP/IP). The Internet comprises various services/application types, such as the World Wide Web, Email, File transfer (e.g. using FTP).

Intranet: refers to a Network that is used to communicate and share information in electronic format among a defined group of Users related to an organization, normally a company or a group of companies. However, persons or entities that do not belong to the organization but interact with it, such as suppliers and customers, may have certain rights to access information within the Intranet. An Intranet usually interfaces with the Internet. Sometimes a distinction is made between an Intranet, whose Users are attached to the organization and an extranet which includes the aforementioned external Users.

In any event, virtualization removes the need to distinguish between Inter- Intra-, and extranets, since what matters is the access to the Networks defined by the User ID, password, and rights of access to a secure environment (data encryption) that has been defined as a Network.

Laptop: refers to a kind of portable Personal Computer.

Legacy Hard- and Software: refers to older hard- and Software that has become obsolete due to technical progress and is not fully compatible with the system now used by the organization in question. Such outdated hard- or Software may be kept available within organizations for the purpose of accessing Back-ups or other ESI.

Local Means of Storage: local refers to system devices or computers that are located at the workplace of the Custodian, e.g. a Laptop or Personal Computer. Means of storage refers to Electronic Means of Storing or Recording Information.

Mainframe Computer: refers traditionally to high-performance central computers run by big organizations that were accessed via terminals. Today, Mainframe Computers operate in Networks using Internet protocols and may host Network Servers.

Metadata: refers to data that is related to other data, such as Files, and describes attributes thereof. Certain Metadata provides book-keeping information within File Systems, such as file creation, modification, storage dates, File Format, access permission settings, and can often be easily visualized. Other Metadata depends on the File Format and/or the application Software environment. File Repositories, case management Software and other applications use database Software for creating, managing and storing arbitrarily defined categories of Metadata.

Network: 'also referred to as 'Computer Network') may refer to the cables and devices by which computers and peripherals are connected and can exchange data. Networks can be classified as Local Area Network (LAN), Wide Area Network (WAN), Virtual Private Network (VPN), etc. However, the relevant hardware and Network Software constitute only the Network infrastructure, since the devices relate to a specific Network only because they were arbitrarily made to do so. For this purpose each device has a unique identifier and defined access rights within the Network to which the User's rights correspond. A device that is not 'flagged' as being part of the Network does not belong to it.

Network Server: refers to a Server that is linked to a specific Network.

Original, of Electronic Document: see: Authenticity, Copy, File.

Personal Computer (PC): refers to 'stand-alone' computers, such as desktop computers, Laptops, etc. These computers are characterized by consisting of hard- and Software that allows them to be used independently of a Network connection. Prior to the advent of PCs, Mainframe Computers, to which Users connected via terminals without local storage capacity, were used. Today, PCs are nearly all permanently or temporarily connected to Networks, and the software they use is not always or not completely installed locally. More importantly, data processed on a PC may not be stored, or not permanently stored, on a local Data Carrier, but also be held on Network storage devices.

PDA: is the abbreviation for personal digital assistant and means a mobile hand held device. Technologically, PDA's merge into mobile communication devices such as smart phones like Blackberry's, iPhones and the like.

Search Tool: refers to Software for Data Mining. The technical sophistication of such tools for predictably reliable results is crucial, since the tool must allow complex (multi-criteria) search operations and be capable of using these on a maximum of File Formats or at least those formats in which the ESD that are searched will in all likelihood exist. It is important to know that while many File Formats contain information that is directly machine readable (i.e. using search words), bit map File Formats (digital photocopies) may not be searchable unless converted using optical character recognition (OCR).

However, the best Search Tool will provide only results of a quality that is determined by the quality of the search instructions. Thus, search methodology is crucial, and transparency in this regard is commendable.

Server: sometimes refers to a dedicated computer that is connected to a Network on which Server are running. However, the term essentially refers to Computer Programs providing services to other Computer Programs usually in a Network by using Network protocols. Server programs may run on Mainframe Computers.

In the context of eDisclosure it is important to know that much data exchanged inside or outside an organization is managed by a Server. The storage media where such data is held may be directly connected to the computer on which the Server runs. However, the trend is to have Servers run in virtual operating system environments, i.e. in an environment where devices are logical and to a certain extent disconnected from the actual hardware, allowing processed and/or stored data to move around or to be stored in several physical locations. The metaphor for this delocalized existence is 'Cloud'

Shared Server: is a Server, normally a Network Server, hosting ESI for defined groups of Users having defined rights with regard to the hosted data.

Software: see: Computer Programs.

User: is a logical entity possessing the access rights for using a computer or Software or accessing a Network. A User may have the right to carry out any operation (e.g. system administrator) or be assigned restricted rights (e.g. normal User) with regard to operations and/or access to ESI for which usage restrictions have been implemented. For managing User- rights, systems use User- names (User-ID) and access codes (e.g. passwords or biometrical data). A physical person possessing such access information will be treated by the system as the logical User with whom this set of data is associated and is also called User. Depending on the assigned rights, a person who is a User may be a Custodian.

Version history: refers to the different stages of 'existence' of data, especially Files, such as creation or modification dates. Certain basic historic information is nearly always stored as Metadata. Depending on the Format, or the Software used, historic information may be more complete. File Repositories and other dedicated Software systems (e.g. case-management systems) may store data including the complete version history of a File and, possibly, any different versions of such File.

WAN: is an acronym meaning Wide Area Network (see: Network, World Wide Web).

World Wide Web: refers to the global Network of hypertext pages served through Servers via the Internet according to agreed standards and includes small Software programs and services that enable a vast array of operations via the Internet.