Attachment_6_-_CPU_Procedures.pdf

Centralized Production Unit CPU Procedures

SEC Headquarters 100 F Street, NE

Washington, DC 20549 Office of Enforcement

3/17/2015

1) REVISION HISTORY

Date Revised Version Revised by Reason For Revision

3/17/2015 3.0 Kathy Stewart Sanitized for attaching to the SOW.

NOTE – All sensitive graphics or contents have been removed from this SOP.

Section 1: Overview and Receipt of Productions

Section 2: Analyzing Productions

Section 3: Forensic and Collections Productions

Section 4: Agency Tracking System Process

Section 5: Delivering Productions to Vendors

Section 6: Nexidia

Section 7: Recommind vs. Concordance FAQs

Section 8: Copy Procedures

Section 1

Overview The Enforcement Division (ENF) of the Securities and Exchange Commission (SEC) receives productions on a daily basis in response to subpoenas or voluntary requests issued during its investigations. The Centralized Production Unit (CPU) will track all incoming productions by centralizing the receipt of all productions, logging those productions, and generating a production log for all investigations.

Automatic email notifications will be sent to the attorney when a production has been received. After the production has been logged, it will be sent to a vendor for further processing or directly to the loading group for loading into ENF’s document retrieval package.

Concordance Vs. Recommind

The SEC is currently using two systems to store case materials. The first, Concordance, is the original software used by the SEC. The new software, Recommind, contains the majority of SEC cases.

Depending on the case, a production is either loaded into Concordance or Recommind. There are rare occasions when a case is loaded into both.

Priority of Productions

1. Rush Productions

• The CPU Lead or the Litigation Support Specialist (LSS) will alert the CPU Technician of the type of rush processing the production requires.

2. Productions sent directly from the Producing Party to CPU, via mail or email (Compliant).

3. Productions received from the Litigation Support Specialist or the Point of Contact (POC) on the case.

Receipt of productions Productions may arrive as hard copy documents or as electronic documents. Hard copy productions may arrive as physical paper documents. Electronic productions may be delivered on electronic media such as CDs, DVDs, thumb drives, hard drives (internal or external), by email, or by File Transfer Protocol (FTP). Please see the instructions for the receipt of productions via File Transfer Protocol (FTP), drop box, secure email, etc. below.

Productions will be delivered to the designated CPU mailbox, Mail Stop 5973. The CPU mailbox triage team will constantly monitor the shared CPU email account (ENF-CPU@sec.gov) for electronic productions under 10MB.

The CPU may also receive productions directly from the Litigation Support Specialists (LSS) to include:

Collections productions or from the Office of International Affairs (OIA).

Productions may also originate from the SEC IT Forensics Laboratory (ITFL). See section 3.

mailto:ENF-CPU@sec.gov

Receipt of productions via File Transfer Protocol (FTP), drop box, secure email, etc.

Electronic productions may be received by the SEC via File Transfer Protocol (FTP), drop box, secure email, etc. When productions are received via this method, a pure copy of the production needs to be maintained for authentication purposes. This does not apply to productions that are sent to the SEC as attachments to the email.

When a CPU Technician receives a production in this format they will follow the below procedures:

1. The folder structure for a FTP Download should include the following: Producing Party Production Date _SEC Documentation Form and Production Documents

2. The CPU Technician will download the production and save the data to a folder named Production Documents on the X

3. The CPU Technician will copy this data location into the CPU FTP Documentation Form:

X

4. The CPU Technician will take a screenshot of the website that shows the list of files and save the screenshot as a PDF to this J drive location under a folder named _SEC Documentation Forms:

Sample name for the screen shot is “FTP Screen Shot” or “Screen Shot”:

5. The CPU Technician will save a list of all the files downloaded from the website as a PDF to the _SEC Documentation Forms folder on the J drive. Sample name for this list is “List of Downloaded Documents” or “Files Downloaded”

6. The CPU Technician will fill out the CPU FTP Documentation Form and save a signed copy of this form to the _SEC Documentation Forms folder .

7. Please note, if you receive a production with the same date as another previously downloaded, please save your folder as (ex: Production Date_2) and etc.

FTP TEMPLATE FORM

Case Number

Date

Time

CPU Technician Name

Website Address

Login Used

Password Used

Files Downloaded (List the names of the files downloaded and provide a screenshot of the FTP site. Attach files/screenshot(s)).

Number of Files Downloaded

Size (MB) of Files Downloaded

Location of Data

Signature of CPU Technician

The Production Log Scanning and Logging a production should be the first thing you do when you are assigned a production.

All productions shall be logged and sent for loading/processing within 24 hours of receipt.

For each production that the CPU receives, they will first do the following:

Scan/Name Media and Cover Letters

1. Scan the cover letter and any attachments (e.g. FOIA letter, privilege logs, redaction logs) to a searchable PDF (ALWAYS OCR THE COVER LETTR).

a. Scan any documents requesting the SEC to confirm receipt of the production. Email the LSS with a copy of the cover letter if you receive documents requesting a read receipt.

b. Scan the invoice, if your production comes with one. Be sure to email a copy of this to the CPU Lead and designated CPU Invoice manager. Include in your email the Case Number, POC, Production Date, and request number.

c. Scan the envelope or shipping label.

d. Scan an image of each piece of media.

2. Combine items from above into a single document with the cover letter as the first document.

3. If your production came with an emailed password, please also PDF this email and combine it with your cover letter. This should be the last page of your cover letter PDF.

4. The filename of the combined files shall be Producing Party_Production Date_Cover Letter.PDF

(e.g. Citigroup_20110401_Cover Letter.pdf) or LastName_FirstName_ProductionDate_Cover Letter.PDF (e.g. Smith_John_20110401_Cover Letter.pdf)

5. If you receive a Document Index or Log, CPU will scan the index with the cover letter. If the index is in electronic format, CPU will electronically attach this to the PDF of the cover letter.

6. The file shall be saved to the J:\….Document Productions\Doc Productions Cover Letters\ folder on the J drive for that case number.

7. If a cover letter is non-substantive, it should be not be loaded or copied to but logged only.

8. If no cover letter is received but the original shipping label and media are included, the CPU will scan the Fed Ex label and the media and name the cover letter according to the standard. The first page will include a document (created by the CPU tech) that states “No cover letter provided. Scan of mailer and media follow this page.”

9. Never load a subpoena to the Recommind or Concordance Database. You should also not save the subpoena to the J drive as a cover letter file unless it is attached to a Wells Fargo FTP received electronically via email.

Logging Productions

1. After scanning the cover letter, the CPU technician should log the production into the

Production Log database. Each record in the database shall correspond to a single production.

CPU will enter certain information from the cover letter into the screen on this page:

a. Region: From the drop-down menu, select the appropriate region. The case prefix in the case number will indicate the region.

b. Case Number: The case number can usually be found in the subject of the cover letter.

Select the case number from the drop-down menu.

c. Global Case Status – will be automatically generated for Recommind or Concordance

d. Production POC: This is the addressee of the cover letter or email for productions transmitted via email. Select the appropriate POC from the drop-down menu.

e. Email History Sent to POC: These are additional POCs that have requested to be included in the production log. Anyone listed in the “Email’d To POC” and “EmailHistoryNewStaff” columns needs to be included unless otherwise specified. At this step please check to see if any POC listed has been removed with a special note section (please do not add a POC that has requested to be removed). ALSO please check to see if the last production was from Forensics and Bonnie Kurtzman or Greg Miller were added. If your production is NOT Forensics please do not add either of the two.

f. Production Date: This is the date of the cover letter. Populate this field with the date from the cover letter in MM/DD/YYYY format.

g. Received Date: This field is auto-populated with the current date; please change to reflect the actual date received, such as the date an email was received or the date the cover letter was stamped by CPU. If not date was stamped use the current date.

h. Producing Party: This is the party that is producing the documents. If companies are represented by counsel, the cover letter will state the party that they represent. List this as the party. Other productions may be sent directly from individuals, telephone carriers, accounting firms, brokerages, or the company. For these productions, the entity sending the documents is the producing party. If you are unable to discern the producing party, please ask the CPU Lead or LSS.

i. Cover Letter Link: After you have OCRed the cover letter, you should select the appropriate Regional J drive location to save the cover letter. Open the Browse option, find your J drive for this cover letter, ensure the same naming convention is used as the same name producing parties and copy and paste your cover letter to this location, select it for the production log.

j. Media 1: All productions will have at least two Media tabs in the Production Log database. The first tab will always be for the cover letter.

i. Media 1 Type. Pre-populated with Cover Letter.

ii. Quantity. Enter the number 1.

iii. Media Size. Leave blank for cover letters.

iv. Begin Bates Number. Enter the beginning Bates number of the cover letter. If there is no Bates number on the cover letter, leave this field blank.

v. Ending Bates Number. Enter the ending Bates number of the cover letter. If there is no Bates number, leave this field blank.

vi. Description. This field will summarize the contents of the production. Read the cover letter and provide a brief description of the production. *If there is a note from the POC/paralegal that a production is in litigation, make a note in the production log description that the case is in litigation.

vii. When logging productions for telco providers (e.g. AT&T, Verizon, or any other provider of telephone services) please include the phone number(s) in the description. If there are a large number of requested numbers (more than five), then there is no need to list all of them.

viii. If a POC includes his/her own description, CPU will write a description and then copy the POC’s description after the CPU description.

ix. Representation: Please also include which law firm a producing party is being represented by.

k. Database Name: Look up which Database this production will be loaded and copy and paste the name in this field

l. Database Path: If you have a production consisting of the following, they should be copied to the J drive: Bank Records, Account documents, Account Statements, phone records, any documents from an accounting company or subscriber information from a phone company. The location of the J drive should go in this field so the email submitted will alert the POC where the data is for their review

m. Label: If the CD/DVD/HD has a label on the outside representing bates numbers, please enter the label information here

n. Custodian: Leave this blank on Media 1 tab (see below for Media 2)

o. Password: If your production requires a password, please enter it here.

p. Vendor: Please enter the vendor that processed your request (drop down menu available.

q. Request Number: this is a mandatory field. If you are not loading the cover letter please enter 0.

If you receive any of these types of documents, please notify the CPU Lead or LSS immediately:

• Grand Jury documents

• Bank Secrecy Documents (BSA)

• Currency Transaction Report (CTR)

• Suspicious Activity Reports (SAR), SAR backup material or SAR supporting documentation

• Report of Cash Payments over $10,000 Received in a Trade or Business

• Report of International Transportation of Currency or Monetary Instruments

• Whistleblower Documents o Email enf-cpu@sec.gov an email with “Whistleblower Use_Restrict” in the subject line.

Attach the cover letter to the email (if there is a cover letter). List in the body of the email the: Producing Party, Production Date, POC name, Request # and Case Number.

a. Database Path. Populate with the name of the database.

b. Label. Leave this field blank.

c. Custodian. Leave this field blank.

d. Password. Enter the password to access the production in this field. This may arrive via email or under a separate letter.

r. Click on the Add Media tab to enter additional data corresponding to electronic media or paper.

i. Media Type. From the drop-down, select the appropriate type. Note that only one type of media may be selected at a time.

ii. Quantity. Enter the number of media.

iii. Media Size. Enter the total size in megabytes (MB) for the media of the media type specified. If the media arrived compressed please click the compressed button.

iv. Begin Bates Number. Enter the beginning Bates number of the documents. If there is no Bates number, leave this field blank.

v. Ending Bates Number. Enter the ending Bates number of the documents. If there is no Bates number, leave this field blank.

vi. Description. Leave this field blank.

vii. Database Name. Leave this field blank.

viii. Database Path. Leave this field blank.

ix. Label. Used primarily for electronic media. If the entire piece of media is Bates numbered, enter that number here. The media may also have an identifier such as

VOL 001.

x. Custodian. The cover letter may indicate the custodian(s) that are being produced.

List those custodians in this field, if applicable.

xi. Password. Leave this field blank unless you have more than one CD and each CD has a different password.

xii. Request Number: The number for each piece of media needs to be populated in the correct tab.

a. If there are other types of media included in the production, repeat step q.

2. In the section called Processing, please select the appropriate button for the documents.

a. Load to Concordance/Recommind. Select this option only if the production is

Load ready.

b. Additional Processing EDD. Select this option if the production is electronic and requires EDD.

c. Additional Processing (Scanning). Select this option if you have received a paper production that needs to be sent to the scanning vendor.

d. On-Hold. Select this option if you have emailed the LSS or Lead for additional information

e. Need Password. Select this option so your email to the POC will auto generate a password request. Please send an additional email to the password team.

f. Damaged Media. Select this option if your media arrived damaged and cannot be processed. Please send an additional email to the LSS to alert the POC media arrived damaged.

3. After all of the data has been entered, click on one of the following buttons:

a. Add Entry and Send E-mail. This button will save the data to the database and an email notification will also be sent to the attorney notifying him/her that the production has been received, where they can find the scanned cover letter on the J drive, and when they can expect to see the data in ENF’s document retrieval system. If the CPU tech is waiting on a password, the email will be edited accordingly to reflect this information (see Tab 5- “Contacting the LSS and Passwords”)

b. Please note – you are able to resend any email generated by using the email history tab in the production log and adding information to the log entry.

4. Repeat this process for all productions.

Section 2

Analyze productions For all productions, the database name will always be the producing party. Any new databases created should be in all capital letters and spaces are designated by an underscore. If the producing party is an individual, the database should be named as LASTNAME_FIRSTNAME (example: SMITH_JOHN). The database source will be the custodian of the documents. If no custodian information is provided, then the source will be the same as the database name. If the producing party is an individual, the source for the production should be LastName, FirstName (example: Smith, John). For documents that are assigned Bates numbers, the Bates prefix will be specific to the producing party.

Concordance Productions

Hard copy productions

1. All hard copy productions will be scanned by the in-house scanning vendor.

2. If the documents are not Bates numbered, a unique number shall be assigned to the documents.

The Bates prefix will be specific to the producing party (i.e. the producing party’s name or its initials), will always begin with “SEC”, and possess the following format SEC-[producing party]-P-seven digit numeric. In general, the producing party portion of the Bates number will be two to eight characters longFor whistleblower documents, do not use a prefix that could potentially identify the individual. These documents shall be numbered SEC-[Case number]-P-seven digit numeric. For example, SEC-HO-01234-P-#######.

3. For each hard copy production, the CPU will enter the agency tracking system and create a Paper Request (See Section 3).

4. The CPU will populate the request # field in the Production Log database with the corresponding Request ID.

Electronic Productions

Some productions may arrive in an encrypted format. Some of these file types include .ZIP, .RAR, .TC, .EXE, and PGP archives. Also, the producing party may use hardware encryption to deliver their productions such as a Padlock or RocSecure hard drive. The password(s) may be provided in the cover letter, a separate letter or email from the producing party, or sent to the POC directly. Passwords received via email are placed in the Region-specific folder in the shared Microsoft Outlook email account. If no password is provided and a commonly used password does not work, an email will be sent to enf-cpu@sec.gov with the following information:

Email Subject: Password needed – [Case Number]-[Production Date] Case No.:

POC:

Producing Party:

Production Date:

Type of Media:

* CPU should never contact POCs directly.

mailto:enf-cpu@sec.gov

1. Load-ready productions: must have one of the following

a. Concordance database (.DCB) and/or data file (.DAT). Field information will be present in the format of Concordance Database (.DCB) and/or data file (.DAT, .TXT, .CSV). The data file (.DAT, .TXT, .CSV) will contain the fields (Bates numbers, dates, author, addressee, etc) for the documents. This is a text file that will open in NotePad, WordPad or UltraEdit. The first row of this file should list the field names. The .DAT file, or data file, will contain the data (Bates numbers, dates, author, addressee, etc) for the documents. This is a text file and may be found in a folder called DATA or on the root directory of the media. The .DAT file may also be delivered as a .TXT or .CSV file. The first row of the .DAT file should list the field names. If provided as a .DCB, the Concordance database and its associated files may be on a folder called Database or on the root directory of the media.

b. Cross-reference file (.OPT, .LOG, .LFP, .DII). This file allows the Concordance database to display the images through the Concordance Image viewer by providing a link to the images.

Usually, this file will be delivered as either an .OPT for .LOG file. If you see an .LFP or .DII file, they are both acceptable.

c. Images in TIFF format (.TIFF/.TIF). These are the images. Images will usually be provided in a folder labeled Images. There may also be .JPG (color images) present.

d. OCR/TEXT (.TXT). The OCR (sometimes referred to as full-text, extracted text, or OCR text) allows the user to search the content of the documents. OCR may be delivered as single-page text files, document level text files, or included in the Concordance database (.DCB) or data file (.DAT, .TXT, .CSV).

• OCR may be provided separately in a folder called TEXT or OCRTEXT. These files will be named after the Bates number and will have the file extension .TXT.

• OCR may be provided in the Images folder with the TIFFs. These files will be named after the Bates number and will have the file extension .TXT.

• If there are no separate text files as outlined in (1) or (2) above, it is possible OCR may be provided as a field in the data file (.DAT, .TXT, .CSV) file. Open the data file (in NotePad, WordPad or UltraEdit). Look at the first row of the file. This is the header row which contains the field names. Look for an OCR-related field name. It may be called OCR, TEXT, OCRTEXT, FULLTEXT, or BODY. If one of these field names is present, then the data file should contain the OCR text for all of the records. To verify, look at the second row and see if it appears to contain the words from the document. If you’re unsure of what the words should be, you can look at the first TIFF image.

e. Natives. Sometimes producing party will include the native files with a production. They will usually be in a folder called Natives. Native files may or may not be provided.

2. Load-ready Native Productions: will consist of the following files

a. Concordance database (.DCB) and/or data file (.DAT)

b. Native files. These files will usually be in a folder called Natives and will consist of bates numbered files in Word, Excel, Adobe, PowerPoint, etc. format. Since this is a native production, images are not provided. If all of these files are present, the CPU will enter the info in the agency tracking system and create an E-media Request. Concordance ready files will be loaded into a database named after the producing party, followed by the word “natives”.

c. The CPU will populate the # field in the Production Log database with the corresponding Request ID.

d. If all of these files are not present, the CPU will email the LSS to resolve the issue(s). An email will be sent stating the following: (attach the cover letter), Enclosed is a production for (insert producing party) dated (production date) and the media received is missing the following: (insert what is missing), please let us know if we should proceed and load or if a replacement is needed?

e. Privilege and/or redaction logs may be provided natively on the media. They may also be produced in hard copy. If a privilege or redaction log is produced, it should be loaded the producing party’s database, followed by “priv log”

f. Searchable, Bates numbered PDFs. If the PDFs are searchable and have Bates numbers, then the production can be sent to the loading group. CPU will need to tell the loaders where to capture the bates numbers from (i.e. filename or document pages); please see “Special Instructions”, located in Section 3, for more clarification.

3. E-docs loads: An e-docs production is a production that contains electronic files in their native format i.e. Word, Excel, Adobe Acrobat (PDF).

a. When PDFs are submitted, they can be loaded to an E-docs database if they are:

i. Bates numbered

ii. Searchable (if you received a production that meets criteria i. and ii., you can ask the loaders to OCR your production if it is small. If your production is large, email the LSS- he/she may request EDD work).

b. For Word or Excel files, they can be loaded to an E-docs database if they are:

i. Bates numbered

c. In either of these instances, the CPU will enter the agency tracking system and create an E-media Request. These requests should be loaded into a database named with the name of the producing party followed by the word E-docs

d. For E-docs loads, CPU must tell loading where to capture the bates numbers from; please see “Special Instructions”, located in Section 3, for more clarification.

e. When both a PDF and an Excel file are received with the same Bates numbering, the excel is possibly the native of the pdf. CPU will ask ask the loaders to hyperlink both records in the E-docs database.

4. Loads that require EDD work: Any time we receive productions that are NOT bates numbered, this requires EDD work.

a. Examples of productions needing EDD work include:

i. Non-bates numbered, PDFs, Word files, Excel documents, PowerPoint files, etc

ii. Internet Files

iii. Trading records/blotters or instant messages (these will usually be in XLS, CSV, or TXT format)

iv. Email files such as.PST or .MSG files (even if these are bates numbered, they

STILL need EDD work. Other email types include MSG, DBX, EML, MBOX, and NSF (Lotus Notes).

v. .WAV or .VID files

b. Since the documents are not Bates numbered, a unique bates number shall be assigned. The

Bates prefix will be specific to the producing party (i.e. the producing party’s name or its initials), will always begin with “SEC”, and possess the following format SEC-[producing party]-E-seven digit numeric. In general the producing party portion of the Bates number will be two to eight characters long.

c. If your piece of media, such as a CD or hard drive, comes with a bates label, but the individual documents are not bates numbered, use this label number as the bates prefix.

d. For whistleblower documents, do not use a prefix that could potentially identify the individual. These documents shall be numbered SEC-[Case number]-seven digit numeric.

For example, SEC-HO-01234-E-#######.

e. The CPU will enter request and create an E-media Request.

5. Forensics Productions: See Section 3 for information on how to handle Forensics Productions.

6. Collections Productions: See Section 3 for information on how to handle Collections

Productions.

7. Special Productions: These are productions that CPU may or may not often come across. An example of these include:

a. Trading records/blotters or instant messages

i. These will usually be in XLS, CSV, or TXT format.

ii. These files may be loaded directly into Concordance.

iii. The CPU will create an E-media Request in BDMT instructing the loading group to convert the file to a delimited text file and use the header row as the field list in Concordance.

iv. If the files contain a significant amount of trading data (>1 million records), the CPU will give the media to the CPU Lead or LSS to load into SQL.

b. Bluesheets, Edgar Filings, or Web Captures

i. The CPU will be informed by the LSS if a production is considered Bluesheets, Edgar

Filings, or Web Captures.

ii. The producing party for these productions is the SEC.

iii. The CPU will create an E-media Request or Paper Request in BDMT. Bluesheets, Edgar Filings, and Web Captures will be loaded into a database named after the source (example: BLUESHEETS).

c. RFPA productions

i. The CPU will be informed by the LSS if a production is considered an RFPA production.

ii. The CPU will create an E-media Request or Paper Request in BDMT to load the documents into Concordance.

iii. RFPA documents will be loaded into a database named after the producing party followed by the word RFPA

iv. If the documents are not Bates numbered, a unique number shall be assigned to the documents. The Bates prefix will be specific to the producing party and the RFPA classification, will always begin with “SEC-RFPA”, and possess the following format SEC-RFPA-[producing party]-E-seven digit numeric (for electronic RFPA documents) and SEC-RFPA-[producing party]- (for paper RFPA documents).

v. The following language will be added to the Special Instructions: “Copy/Loaders:

Please populate the use_restrict field with RFPA.”

d. Whistleblower documents

i. Place this production on hold in the CPU production log.

ii. Create a request and name the database “OTHER_PARTY”. Use the following language for the Special Instructions:

“Copy/Loaders: Populate the USE_RESTRICT field with WB-witnesslastname_witnessfirstname” o If the whistleblower is anonymous, the USE_RESTIRCT field will be populated with WHISTLEBLOWER-ANONYMOUS-CounselName where CounselName is the name of the law firm representing the whistleblower.

o If there are multiple whistleblowers represented by the same counsel, USE_RESTRICT field will be populated with WHISTLEBLOWER- ANONYMOUS1-CounselName, WHISTLEBLOWER-ANONYMOUS2- CounselName, etc. In these situations, the SEC attorney will provide guidance on differentiating between the whistleblowers.

e. Audio files

i. These will usually be in WAV, MP3, MPG, or AIFF format. They may also be produced in a proprietary format.

ii. These files will be loaded into Concordance and possibly Nexidia. See Section 7 to determine if a Nexidia request should be created.

f. OIA Productions

i. When CPU receives materials from a foreign entity, they may or may not need OIA restrictions depending on how they were obtained. If the SEC puts a request to a foreign regulator through the Office of International Affairs, then it needs the appropriate OIA endorsements and use restrictions. There are a few ways to tell if these restrictions are applicable.

o A pink sheet (see below example). If you see anything like this, STOP and give it to the CPU lead.

o The foreign entity is some kind of regulatory authority—for example, Swiss FINMA, the United Kingdom Financial Conduct Authority (FCA) , the British Virgin Islands Financial Services Commission (FSC), the Spanish Comisión Nacional del Mercado de Valores (CNMV), etc. These are governmental entities, and almost always produce because of preexisting agreements with the US government and other national governments. If you have a production from any foreign governmental agency/regulator, you should always check to see.

o Any production whose cover letter mentions: a “Memorandum of Understanding,” the “IOSCO Multilateral Memorandum of Understanding,” or “Confidential pursuant to section 24(d) of the Securities Exchange Act.”

Unlike the usual “FOIA Confidential treatment requested” that almost all productions request, Section 24(d) protections prohibit how the documents may be disclosed, distributed, produced, or shared with other entities (including other government agencies) and how such documents can be used—for example, prohibiting disclosure to criminal authorities, or prohibiting use as evidence at trial.

Pink Sheet Example:

g. Time Zone Request Forms

i. Blank time zone request forms DO NOT have to be loaded. However, they need to be logged (per usual) and sent to the POC. Please email the blank time zone form to the LSS using the following template:

Subject: POC Response Required- [Case #] CPU has received a Time Zone Request form that needs to be completed by the POC and sent back to producing party. Please see the attached document and the relevant case information below.

Case: [Case #] POC: [POC Listed] Prod Date: [Prod Date] Prod Party: [Prod Party]

*Please note: if you receive a blank time zone form along with other produced documents, please follow the above procedure and process the rest of the production. The subpoena and the blank declaration form do not count as “produced documents” since they originated from the SEC.

ii. Completed Time Zone Request Forms should be processed.

8. Reproductions/Re-submissions: All replacement/reproductions that are received should be logged (as normal) and placed on hold, using the appropriate procedures.

Recommind Productions

Hard copy productions

1. All hard copy productions will be scanned by the in-house scanning vendor.

2. If the documents are not Bates numbered, a unique number shall be assigned to the documents.

The Bates prefix will be specific to the producing party (i.e. the producing party’s name or its initials), will always begin with “SEC”, and possess the following format SEC-[producing party]-P-seven digit numeric. In general, the producing party portion of the Bates number will be two to eight characters long.

3. For whistleblower documents, do not use a prefix that could potentially identify the individual.

These documents shall be numbered SEC-[Case number]-P-seven digit numeric. For example, SEC-HO-01234-P-#######.

4. For each hard copy production, the CPU will enter the agency tracking system and create a Paper Request (See Section 3).

5. The CPU tech will populate the # field in the Production Log database with the corresponding Request ID.

Electronic Productions

Some productions may arrive in an encrypted format. Some of these file types include .ZIP, .RAR, .TC, .EXE, and PGP archives. Also, the producing party may use hardware encryption to deliver their productions such as a Padlock or RocSecure hard drive. The password(s) may be provided in the cover letter, a separate letter or email from the producing party, or sent to the POC directly. Passwords received via email are placed in the Region-specific folder in the shared Microsoft Outlook email account. If no password is provided and a commonly used password does not work, an email will be sent to enf-cpu@sec.gov with the following information:

Email Subject: Password needed – [Case Number]-[Production Date] Case No.:

POC:

Producing Party:

Production Date:

Type of Media:

*CPU should never contact POCs directly.

1. Load-ready productions: must have one of the following

a. Concordance database (.DCB) and/or data file (.DAT). Field information will be present in the format of Concordance Database (.DCB) and/or data file (.DAT, .TXT, .CSV). The data file (.DAT, .TXT, .CSV) will contain the fields (Bates numbers, dates, author, addressee, etc) for the documents. This is a text file that will open in NotePad, WordPad or UltraEdit. The first row of this file should list the field names. The .DAT file, or data file, will contain the data (Bates numbers, dates, author, addressee, etc) for the documents. This is a text file and may be found in a folder called DATA or on the root directory of the media. The .DAT file may also be delivered as a .TXT or .CSV file. The first row of the .DAT file should list the field names. If provided as a .DCB, the Concordance database and its associated files may be on a folder called Database or on the root directory of the media.

b. Cross-reference file (.OPT, .LOG, .LFP, .DII). This file allows the Concordance database to display the images through the Concordance Image viewer by providing a link to the images. Usually, this file will be delivered as either an .OPT for .LOG file. If you see an .LFP or .DII file, they are both acceptable.

c. Images in TIFF format (.TIFF/.TIF). These are the images. Images will usually be provided in a folder labeled Images. There may also be .JPG (color images) present.

OCR/TEXT (.TXT). The OCR (sometimes referred to as full-text, extracted text, or OCR text) allows the user to search the content of the documents. OCR may be delivered as single-page text files, document level text files, or included in the Concordance database (.DCB) or data file (.DAT, .TXT, .CSV).

• OCR may be provided separately in a folder called TEXT or OCRTEXT. These files will be named after the Bates number and will have the file extension .TXT.

• OCR may be provided in the Images folder with the TIFFs. These files will be named after the Bates number and will have the file extension .TXT.

• If there are no separate text files as outlined in (1) or (2) above, it is possible OCR may be provided as a field in the data file (.DAT, .TXT, .CSV) file. Open the data file (in NotePad, WordPad or UltraEdit). Look at the first row of the file. This is the header row which contains the field names. Look for an OCR-related field name. It may be called OCR, TEXT, OCRTEXT, FULLTEXT, or BODY. If one of these field names is present, then the data file should contain the OCR text for all of the records. To verify, look at the second row and see if it appears to contain the words from the document. If you’re unsure of what the words should be, you can look at the first TIFF image.

• Natives. Sometimes producing party will include the native files with a production.

They will usually be in a folder called Natives. Native files may or may not be provided.

2. Load-ready Native Productions will consist of the following files:

a. Concordance database (.DCB) and/or data file (.DAT)

b. Native files. These files will usually be in a folder called Natives and will consist of bates numbered files in Word, Excel, Adobe, PowerPoint, etc. format. Since this is a native production, images are not provided. If all of these files are present, the CPU will enter the agency tracking system and create an E-media Request.

c. The CPU will populate the # field in the Production Log database with the corresponding Request ID.

d. If all of these files are not present, the CPU will email the LSS to resolve the issue(s). An email will be sent stating the following: (attach the cover letter), Enclosed is a production for (insert producing party) dated (production date) and the media received is missing the following: (insert what is missing), please let us know if we should proceed and load or if a replacement is needed?

e. Privilege and/or redaction logs may be provided natively on the media. They may also be produced in hard copy. If a privilege or redaction log is produced, it should be loaded the producing party’s database, followed by “priv log” (Ex: CITIGROUP_PRIV LOG)

f. Searchable, Bates numbered PDFs. If the PDFs are searchable and have Bates numbers, then the production can be sent to the loading group. CPU will need to tell the loaders where to capture the bates numbers from (i.e. filename or document pages); please see “Special Instructions”, located in Section 3, for more clarification.

g. When both a PDF and an Excel file are received with the same Bates numbering, the excel is possibly the native of the pdf. All documents should be loaded with instructions for bates capture.

3. Loads over 20 GB: Any production received that is over 20 GB gets sent directly to the loading team. No EDD instructions should be included.

4. Loads that require EDD work: Any time we receive productions that are NOT bates numbered, this automatically requires EDD work (unless over 20 GB).

a. Examples of productions needing EDD work include:

i. Non-bates numbered, unitized PDFs Word files, Excel documents, PowerPoint files, etc

ii. Internet Files

iii. Trading records/blotters or instant messages (these will usually be in XLS, CSV, or TXT format)

iv. Email files such as.PST or .MSG files (even if these are bates numbered, they STILL need EDD work if being loaded into Concordance. (Bates numbered .MSG files can be loaded into Recommind). Other email types include MSG, DBX, EML, MBOX, and NSF (Lotus Notes).

v. .WAV or .VID files

b. Since the documents are not Bates numbered, a unique bates number shall be assigned.

The Bates prefix will be specific to the producing party (i.e. the producing party’s name or its initials), will always begin with “SEC”, and possess the following format SEC- [producing party]-E-seven digit numeric. In general the producing party portion of the Bates number will be two to eight characters long.

c. If your piece of media, such as a CD or hard drive, comes with a bates label, but the individual documents are not bates numbered, use this label number as the bates prefix.

EX: CD labeled BOAF000123. You would ask the vendor to assign bates numbers beginning with BOAF000123-E-#######.

d. For whistleblower documents, do not use a prefix that could potentially identify the individual. These documents shall be numbered SEC-[Case number]-seven digit numeric. For example, SEC-HO-01234-E-#######.

e. The CPU will enter agency tracking system and create an E-media Request.

5. Forensics Productions: See Section 3 for information on how to handle Forensics Productions.

6. Collections Productions: See Section 3 for information on how to handle Collections Productions.

7. Special Productions: These are productions that CPU may or may not often come across. An example of these include:

a. Trading records/blotters or instant messages

i. These will usually be in XLS, CSV, or TXT format.

ii. These files may be loaded directly into Concordance.

iii. The CPU will create an E-media Request in the agency tracking system instructing the loading group to convert the file to a delimited text file and use the header row as the field list in Concordance.

iv. If the files contain a significant amount of trading data (>1 million records), the CPU will give the media to the CPU Lead or LSS to load into SQL.

b. Bluesheets, Edgar Filings, or Web Captures

i. The CPU will be informed by the LSS if a production is considered Bluesheets, Edgar

Filings, or Web Captures.

ii. The producing party for these productions is the SEC.

iii. The CPU will create an E-media Request or Paper Request in the agency tracking system. Bluesheets, Edgar Filings, and Web Captures will be loaded into a database named after the source (example: BLUESHEETS).

c. RFPA productions

i. The CPU will be informed by the LSS if a production is considered an RFPA production.

ii. The CPU will create an E-media Request or Paper Request in agency tracking system to load the documents into Concordance.

iii. RFPA documents will be loaded into a database named after the producing party followed by the word RFPA (example: CITIGROUP_RFPA).

iv. If the documents are not Bates numbered, a unique number shall be assigned to the documents. The Bates prefix will be specific to the producing party and the RFPA classification, will always begin with “SEC-RFPA”, and possess the following format SEC-RFPA-[producing party]-E-seven digit numeric (for electronic RFPA documents) and SEC-RFPA-[producing party]- (for paper RFPA documents). In general the producing party portion of the Bates number will be two to eight characters long.

v. The following language will be added to the Special Instructions: “Copy/Loaders:

Please populate the use_restrict field with RFPA.”

d. Whistleblower documents

i. Place this production on hold in the CPU production log.

ii. Create a request and name the database “OTHER_PARTY”. Use the following language for the Special Instructions:

“Copy/Loaders: Populate the USE_RESTRICT field with WB-witnesslastname_witnessfirstname” (e.g. WHISTLEBLOWER-SMITH_JOHN)” o If the whistleblower is anonymous, the USE_RESTIRCT field will be populated with WHISTLEBLOWER-ANONYMOUS-CounselName where CounselName is the name of the law firm representing the whistleblower.

o If there are multiple whistleblowers represented by the same counsel, USE_RESTRICT field will be populated with WHISTLEBLOWER-ANONYMOUS1- CounselName, WHISTLEBLOWER-ANONYMOUS2-CounselName, etc. In these situations, the SEC attorney will provide guidance on differentiating between the whistleblowers.

iii. Also create an entry and place in copy follow up with these instructions:

“This productions is a whistleblower production and requires manual redactions. It is being sent to X for redactions and CPU will then send to Loading for EDD to be performed.”

iv. Place data on the unitization share for X (on site scanning) and send an email with the below information:

“X, please manually redact every instance of the WB name “Whistleblower Name”. The location of the data is here: “XXX”. Please email me when redactions are complete.”

v. Once data is received back, update the entry, remove from Copy Follow up and copy complete with the redacted data.

e. Audio files

vi. These will usually be in WAV, MP3, MPG, or AIFF format. They may also be produced in a proprietary format.

vii. These files will be loaded into Concordance or Recommind and possibly Nexidia.

viii. If the production is 10 or more audio files, ask the CPU lead and LSS whether or not the production should be loaded to Nexidia. If not, nothing special needs to be done. If the answer is yes, go to the next step.

ix. The CPU will create a Nexidia request. See Section 7.

f. OIA Productions

i. When CPU receives materials from a foreign entity, they may or may not need OIA restrictions depending on how they were obtained. If the SEC puts a request to a foreign regulator through the Office of International Affairs, then it needs the appropriate OIA endorsements and use restrictions. There are a few ways to tell if these restrictions are applicable.

o A pink sheet (see below example). If you see anything like this, STOP and give it to the CPU lead.

o The foreign entity is some kind of regulatory authority—for example, Swiss FINMA, the United Kingdom Financial Conduct Authority (FCA) , the British Virgin Islands Financial Services Commission (FSC), the Spanish Comisión Nacional del Mercado de Valores (CNMV), etc. These are governmental entities, and almost always produce because of preexisting agreements with the US government and other national governments. If you have a production from any foreign governmental agency/regulator, you should always check to see.

o Any production whose cover letter mentions: a “Memorandum of Understanding,” the “IOSCO Multilateral Memorandum of Understanding,” or “Confidential pursuant to section 24(d) of the Securities Exchange Act.”

Unlike the usual “FOIA Confidential treatment requested” that almost all productions request, Section 24(d) protections prohibit how the documents may be disclosed, distributed, produced, or shared with other entities (including other government agencies) and how such documents can be used—for example, prohibiting disclosure to criminal authorities, or prohibiting use as evidence at trial.

g. Time Zone Request Forms

ii. Blank time zone request forms DO NOT have to be loaded. However, they need to be logged (per usual) and sent to the POC. Please email the blank time zone form to the LSS using the following template:

Subject: POC Response Required- [Case #] CPU has received a Time Zone Request form that needs to be completed by the POC and sent back to producing party. Please see the attached document and the relevant case information below.

Case: [Case #] POC: [POC Listed] Prod Date: [Prod Date] Prod Party: [Prod Party]

*Please note: if you receive a blank time zone form along with other produced documents, please follow the above procedure and process the rest of the production.

The subpoena and the blank declaration form do not count as “produced documents” since they originated from the SEC.

iii. Completed Time Zone Request Forms should be processed.

Pink Sheet Example:

8. Reproductions/Re-submissions: All replacement/reproductions that are received should be logged (as normal) and placed on hold, using the appropriate procedures.

Cover Letters All cover letters containing substantive information will be loaded to a Concordance E-docs database or directly into Recommind and NOT Bates numbered.

1. Substantive information is information that is directly responding to a request. This can also include letters that will be useful to the attorney’s investigation or letters that will be useful in interpreting the production documents. Substantive cover letters also include letters from a producing party saying that no documents are being produced.

a. Ex: Per request 1A, John Smith’s contact information is: ###-###-####

b. Ex: a key to a spreadsheet

2. If only a paper substantive cover letter is received, CPU will send a scanned PDF copy of the cover letter to loading. This PDF does not need to be bates numbered. If a substantive cover letter is received with a paper production, send the cover letter to scanning with the rest of the paper.

3. For Concordance Productions send the PDF of the cover letter directly to loading into a non-imaged E-docs DB. This PDF does not need to be bates numbered.

4. For Recommind productions, if the PDF is received with Load ready data, two separate request need to be made.

5. For electronic productions being sent to a vendor send the PDF of the cover with the electronic data.

6. If a cover letter is non-substantive, it should be not be loaded or copied to agency tracking system. It should be copied to the J drive and logged only.

7. If a cover letter is received bates stamped, load this cover letter to the database and bates capture.

8. Never load a subpoena to the Database. You should also not save the subpoena to the J drive as a cover letter unless it is attached to the Wells Fargo FTP received.

Section 3

Forensic Productions Forensics will deliver the non-privileged and potentially privileged data on separate media to CPU. The media will be clearly labeled identifying which media contains the privilege and non-privileged information. The media label should contain the following language:

• Non-privileged data

• Potentially privileged data identified by ENF Forensics

Once the data is received and the transmittal sent to the ENF-CPU@sec.gov an email should be sent to the appropriate LSS confirming the producing party and Database Requested for the production. This email is sent by the CPU Lead.

The instructions for CPU will be the following:

1. For the non-privileged media:

a. Log the media per the CPU logging instructions in Section 1.

b. Before you send the log email please add ENF Forensics (enfforensics@SEC.GOV) on the cc line

c. Please do not open this media, get the properties count from the transmittal letter

d. Process the media and send to NUIX. All non-priv productions received from the

Forensic Lab needs to be processed by NUIX.

e. If this production follows another please continue bates numbering.

2. For the potentially privileged media:

a. The media should have the language, “Potentially privileged data identified by ENF Forensics” clearly identified on the label.

b. Log the potentially privileged media as a separate record populating the fields accordingly (producing party, production date, etc).