What’s the Hype about Hyperlinked Documents?

Cloud Storage Made Hyperlinks Easy

Cloud storage services like OneDrive, SharePoint, Google Drive, and others have allowed users to easily share files, enhancing collaboration in an increasingly global workplace. Sharing links allows for quick distribution without worrying about email attachment limits or physical transfers.

By sharing links, users can go in and edit the file in real time. They can continue making changes and adjustments to the file over time and can choose for the recipients to always see the latest version when they use the link to access it. While convenient, hyperlinked documents pose challenges for eDiscovery.

Following are the answers to the most frequent questions ProSearch clients ask about hyperlinked documents in eDiscovery.

What is a hyperlinked document?

A hyperlinked document is a document shared via a link or URL in an email or chat. The underlying file is not physically transmitted from the sender to the recipient(s) in the traditional sense of a file attachment. The underlying file must be under the possession, custody, or control of the sender; a link to the general internet is not considered a “hyperlinked document” for the purposes of eDiscovery.

When recipients click on the link, they are directed to the file, which is stored on a cloud server. If you have ever done any of the following, you have shared a hyperlinked document:

• Microsoft: Select Share, then Copy Link, and paste the link where desired.
• Google Docs: Click the bookmark icon, right-click Link, and select Copy link address.
• Box: Hover over a file or folder, click Create and Copy Shared Link, click Send Shared Link, enter the collaborator’s email or name, type a message, and click Send.

Hyperlinked documents are increasingly used in collaborative applications or chat platforms, where they function as pointers to referenced electronic documents. They offer advantages such as reduced email storage and the ability to collaborate on documents in real time.

Is a hyperlinked document the same as a “modern attachment”?

This is new terrain for eDiscovery professionals, so the terminology isn’t standardized yet. Some eDiscovery experts suggest that hyperlinked documents now be referred to as “modern attachments.” Others debate the term and suggest using “pointer” or “embedded file” as a more accurate description.

How is a hyperlinked document different from a traditional attachment?

The choice to send a link or attachment is not always in the hands of the user. For example, Gmail automatically creates links to emailed files over 25MB, rather than sending the file itself. Slack eDiscovery exports include links to files shared, rather than the files themselves. Microsoft Teams does not allow users to send traditional attachments; the only option in that platform is to send a hyperlinked document.

When planning ESI collections and processing, the eDiscovery team must consider the apps custodians use, the habits of communications among custodians, and the nature of linked content.

What challenges do hyperlinked documents pose in eDiscovery?

Hyperlinked documents can present several challenges in eDiscovery, including:

• ECA/early search and filtering tools often cannot check the content of hyperlinked files for search criteria. Hyperlinked files can only be searched locally after they’ve been downloaded.
• The status of a linked document can change over time. When producing an email with a hyperlinked file, the link may no longer be accessible, as the underlying file may have been deleted, moved, or renamed.
• Document families. In some cases, it’s difficult to relate a hyperlinked document to the chat or message containing the hyperlink. Reconstructing a “family” poses challenges.
• Content changes. The content of the target document may have changed after the pointer email was sent, which can present preservation issues. In collaborative apps the content of a document can evolve daily.
• Because of their collaborative nature, the final copy of a linked document can look quite different than the original. “Who knew what and when?” is often an important question in eDiscovery matters. Depending on the tool(s) that you are using, you may not be able to collect the contemporaneous version of a document – that is, the version of the file that existed at the time it was shared. While available in some tools, collecting every version of a linked document is generally not practical, as it can significantly increase collection and hosting costs.
• Capabilities vary across platforms. Google only introduced hyperlinked attachment collection to Google Vault in December 2023 but has no versioning abilities. Output also varies across platforms. For example, Microsoft Purview eDiscovery Premium gives a load file to marry up parents to attachments. Google requires users to employ metadata and file names to associate links. Slack does not export the attachments at all – the JSON export file includes download links to retrieve the attachments.
• Licensing varies. Some platforms have different capabilities depending on licensing level. For Microsoft 365, users with an E3 license only have access to Microsoft Purview eDiscovery Standard, which does not include modern attachment collection capabilities. Users with an E5 license (required on a per-custodian basis) have access to Microsoft Purview eDiscovery Premium, which does have the ability to retrieve modern attachments within a collection. Slack Business+ only allows export of public messages; users with that license must ask Slack for private channel/direct message exports. Enterprise Grid provides access to eDiscovery features as well as the Slack API. Google requires Business Plus or Enterprise to access eDiscovery tools (not included with Business Standard). Licensing capabilities change over time, so follow vendor announcements closely.

Where do the courts stand on hyperlinked documents in discovery?

Case law continues to evolve on the subject. The various decisions on hyperlinks highlight the unsettled question of hyperlinks as attachments.

“Hyperlinked documents are not attachments.”

In the case of Nichols v. Noom, Inc., No. 20-CV-3677 (LGS) (KHP) (S.D.N.Y. Mar. 11, 2021), the court ruled that hyperlinks are different from physical document attachments for the purpose of eDiscovery production. In their ESI protocol, the parties had agreed to use Google Vault to collect data that defendants stored in Gmail and Google Drive. During review, plaintiffs discovered that a common practice was to include hyperlinks to internal files instead of physically attaching documents to their emails. Plaintiffs asked the court to have defendants use an outside vendor that could re-collect and produce hyperlinks as part of the document family, as this could not be accomplished with Google Vault.

This is often viewed as the case that started the debate on whether hyperlinks should be viewed as attachments. U.S. Magistrate Judge Katharine Parker stated that the court does not agree that a hyperlinked document is an attachment:

“While the Court appreciates that hyperlinked internal documents could be akin to attachments, this is not necessarily so. When a person creates a document or email with attachments, the person is providing the attachment as a necessary part of the communication. When a person creates a document or email with a hyperlink, the hyperlinked document/information may or may not be necessary to the communication. For example, a legal memorandum might have hyperlinks to cases cited therein. The Court does not consider the hyperlinked cases to be attachments.”

“Hyperlinked documents ARE attachments.”

In re StubHub Refund Litig. (April 2023): California Magistrate Judge Thomas S. Hixson granted the plaintiffs’ motion to compel and ordered the defendant to produce the linked documents as agreed to in the ESI protocol or “produce for deposition within 14 days after the deadline to complete document production a Rule 30(b)(6) witness with full knowledge of everything StubHub and its vendors did in attempting to produce linked documents as attachments as required by the ESI Protocol.”

“Requirement to produce contemporaneous version”

In re: Uber Technologies, Passenger Sexual Assault Litig. (April 2024): U.S. District Court Judge Lisa Cisneros ordered Uber to produce “to the extent feasible on an automated, scalable basis . . . the contemporaneous document version” of Google Drive documents sent via URL or hyperlink. Judge Cisneros further agreed that where no automated solution exists, Uber was required to manually produce “up to 200 hyperlinks” identified by plaintiffs.

“Hyperlinks are not the same as traditional attachments.”

In the case In re Insulin Pricing Litig., No. 3:17-cv-0699 (BRM) (RLS), MDL No. 2080 (D.N.J. May 28, 2024), New Jersey Magistrate Judge Rukhsanah L. Singh ruled on several contested ESI issues related to the parties’ respective proposed ESI Protocols, including hyperlinks, where she agreed with the defendants that “hyperlinks are not the same as traditional attachments.” Judge Singh further stated, “Defendants have sufficiently proffered that such tools are either not feasible whatsoever or unduly burdensome to apply to their respective data environments,” and denied the plaintiffs request for additional meet and confers.

Best Practices

• Understand your technology, its capabilities + limitations.
• Clearly negotiate handling of hyperlinked documents in ESI protocols.
• Be flexible and tailor solutions to the specifics of each matter.

Facing an eDiscovery project involving hyperlinked documents? Talk to ProSearch early.

We can help your team explore your enterprise data and understand how these files can be collected across different technology platforms, including Microsoft 365 and Google Workspaces, and offer practical insights for your eDiscovery workflow.