Five Initial Steps to Meet the Governance, Risk and Compliance Obligations Brought on by Today's Big Data File Stores

The accelerating increase in the amount of unstructured Electronically Stored Information (ESI) is leaving IT organizations struggling with how to store and manage all of this new information. Aside from just providing the underlying storage infrastructure to host this amount of data, companies are also faced with the task of properly managing their Big Data file stores to meet existing governance, risk and compliance obligations. To do so, there are five steps they can take now to position their organization to meet them.

Labels: Big Data, Compliance, eDiscovery, FISMA, FRCP, Governance, GRC, HIPPA, Information Governance, Legal, Litigation, Risk, Sarbanes-Oxley

posted by Charles Skamser @ 10:50 AM 0 Comments

The Perfect Storm: eDiscovery and Cloud Service Providers

The market for Cloud Service Providers (CSPs) is very sunny.  Forrester Research predicted in a research report published earlier this year titled, “Sizing the Cloud” that the global cloud computing market would reach $241 billion in 2020 compared to $40.7 in 2010.  And, Gartner Predicts that the eDiscovery market will reach $1.5 Billion by 2013.  However, based upon the research that I have completed over the past sixty (60) days, Cloud Service Providers (CSPs) and their clients are ignoring eDiscovery as an important component of a standard cloud service offering.

I have some theories in regards to why this is the case:

CSPs DON'T UNDERSTAND eDISCOVERY
Over the pat five (5) years Cloud Service Providers (CSPs) have been busy focusing on their core offerings of Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS), honing their value propositions and trying to figure out how to differentiate themselves from the pack.  Overwhelmed with the rudimentary issues of what to offer and how to make a profit , eDiscovery has not been a requirement that has reached the road map of any CSPs that I have interviewed.

Most of the reasons behind this is the fact that eDiscovery is actually a "latent pain" that the CSP's clients and prospects are not asking for (I will cover this in more detail in the next section).  However, part of the reason may be just plain semantics.  I have found that when you ask a CSP business development executive if their clients are asking about eDiscovery, the answer will be no.  However, if you change the question and ask if their clients are asking about information governance, compliance, business analytics or something even simpler like universal or federated search, the answer may be yes.  This subtle difference is confusing to most in the eDiscovery market and therefore it is no wonder that it is very confusing to the CSP market.As In indicated in my Blog post on September 15, 2011,titled, "Evolving from Information Governance to eDiscovery", I believe that eDiscovery is actually part of a larger market called information governance (IG).  And, as Sunil Soares, the Director of Information Governance within the IBM Software Group indicated in a blog post on April 11, 2011 titled, Why Information Governance is a Market, Not Just a Process, “information governance is like the blind man and the elephant. Depending on which part of the elephant you touch, people define information governance to include master data management, data stewardship, data quality management, metadata management, business glossaries, information lifecycle management and security and privacy.” 

I would actually include several other components as integral parts of IG in pursuit of my premise that if Gartner predicts that the eDiscovery market is going to reach $1.5 Billion by 2013, the information governance market is going to be many times this size.  Or, in other words, more than likely the largest  software and services market on the planet in the next five (5) years (Note that HP paid $11 Billion for Autonomy to play in the IG Market).

So, maybe CSPs need to think of eDiscovery as Information Governance and concentrate on the fact that information governance is potentially the single biggest market on the planet in the coming years?

CSP CLIENTS DON'T UNDERSTAND eDISCOVERY
Another interesting fact emerged from my recent study on eDiscovery in the CSP market.  It appears that most CSP enterprise clients don't understand eDiscovery.  Come to find out, a very high percentage of the standard CSP client base are actually "renegade" business units with global 2000 enterprises that were unhappy being held hostage by their IT organizations and decided to outsource their information management to a CSP.  Unless the business unit in question is the legal department (which is highly unlikely), the stakeholders within these units have no idea what eDiscovery or information governance is or would they know to even ask their CSP if it can be supported if the need were to present itself.

After further investigation into this market dynamic, the story actually gets even more interesting.  If one of these global 2000 enterprises is sued and is presented with a request to produce information (ESI) or some governance regulatory entity asks for proof of compliance, the request is normally handled by the General Counsel (GC) and legal department.  More than likely the first place the GC will go is to the IT department asking for its help in producing the requested data (Please note that most global 2000 enterprises are now relatively adept at the process of internal eDiscovery).  However, the GC may not even know to ask about the data (ESI) from the renegade business unit and if they do, the renegade business unit is not going to know how to comply with the request and their IT department is probably not going to help since they are no at all happy that they went to a CSP for IT services in the first place.  Given all of this, the business unit executives or the GC may call the CSP and ask for help.  However, since the CSP doesn't really understand eDiscovery, they aren't going to be much help.  Basically, at this point the entire eDiscvoery process can get pretty ugly.  The GC is under a legal obligation to respond (i.e. Federal Rules of Civil Procedure) under a fairly limited time frame with financial and other sanctions are real possibilities for non-compliance with the request.

THE PERFECT STORMSo, unfortunately, what I have determined to be the current status in the Cloud Service Provider (CSP) market is the perfect storm of neither the CSP or the CSP's client base understanding the need for eDiscovery.  However, there are solutions and there is hope.

THE ROADMAP FOR SUCCESS FOR CSPs
The roadmap to success for the CSPs is actually not that complicated.  CSPs need to get serious about providing eDiscovery and/or information governance as a component or their standard offering.

In a January 8, 2012 blog post titled, "Cloud Computing Architecture and eDiscovey", I stated that "It is within the Platform-as-a-Service (PaaS) layer where eDiscovery services belong.  In fact, this may be a good time to coin the term eDiscovery-as-a-Service (eDaaS)... And, since providing eDaaS as a standard option for any PaaS offering makes so much sense and could provide a first mover and key competitive advance for Cloud Service Providers (CSPs), I predict that we will see several eDaaS offerings before the end of 2012.  And, I also predict that once the eDaaS offerings hit the market, the legacy eDiscovery platform providers will be forced to re-evaluate the value propositions of their non eDaaS offerings in the cloud."

CSPs can contact me at cskamser@ediscoverysolutionsgroup.com for additional insight on which technology vendors currently have or are about to announce eDaaS offerings.

THE ROADMAP FOR SUCCESS FOR CSP CLIENTS
The roadmap to success for the CSP clients is also actually not that complicated.  First of all, enterprise business unit stakeholders need to add eDiscovery and Information Governance to  their list of requirements for the CSPs.  And, they need to seek out and collaborate with their legal and IT departments in regards to a plan to follow when an eDiscovery and/or compliance event occurs.  It just make sense and its not complicated.

Enterprise stakeholders that are contemplating or already working with a CSP can contact me at cskamser@ediscoverysolutionsgroup.com for additional insight on what to expect from their CSP and what best practices to follow when an eDiscovery and/or compliance event occurs.

CONCLUSION
Both the cloud and the eDiscovery / Information Governance trains have left the station and therefore it is no longer an option for either Cloud Service Providers or their clients to ignore the legal requirements and business benefits.  The current practices to address the issues of eDiscovery or Information Governance are ugly at best.  However, the roadmap for success is not that complicated.  And, the rewards for both the CSP and their clients is well worth the investment.

Labels: Cloud Service Providers, CSPs, Early Case Assessment, eDiscovery, Federal Rules of Civil Procedure, FRCP, Legal, Litigation

posted by Charles Skamser @ 10:59 AM 0 Comments

Information Governance and eDiscovery Trends for 2012

2011 has been a transitionary year for information governance and eDiscovery.  Enterprises and governments worldwide have had to come to grips with the sudden acceleration of the use of social media, cloud computing, mobile devices and the resulting explosion in the volume of Electronically Stored Information (ESI).

Some are predicting the end of email in favor ot texting, Twitter and other social media electronic communications.  There are over 100 million users on Twitter each day with 35% utilizing a mobile device.  Facebook now has over 800 million users with 74% outside the United States and 350 million on mobile devices.  There are also over 100 million LinkedIn users worldwide as business social media and the assocication collaboration and communications is now required as a fundamental marketing tool for any serious business player.  Click Here for a more detailed graphic overview of the the growth of social media from the Search Engine Journal.

In addition to social meida, the fundamental infrastructure matured in 2011 to support more serious cloud computing.  Enterprises worldwide began to realize the dramatic cost benefits and potential business benefits of cloud computing.  As a result they gave serious consideration to private cloud implementations and are becoming more comfortable with moving some ESI to public Cloud Service Providers (CSPs) such as Amazon and Rackspace.  Microsoft launched Office360 to enable users to access the Microsoft Office Suite of products as Software-as-a-Service (SaaS) removing the expensive and time consuming software update dance that we all dread.  And, late in 2010, Apple released the iCloud platform for consumer cloud storage and set the stage for literally millions of iPhone, iTouch and Mac users to begin storing their pictures and other personal data in the cloud.

For anyone involved in the world of Information Technology (IT) whether as a user or a technologist, 2011 was definitely an exciting year.  For those of us in the information governance and eDiscovery business, 2011 marked a turning point, both literally and conceptually, for the monitoring, indentification, collection, processing, review and production of electronic evidence.

Is it no longer just an interesting discussion at the local pub to talk about the eventuality of social media as a source of evidence.  There were already close to 1,000 cases in 2011 where the judge issued a written opinion that mentioned social media. Likewise, information governance and eDiscovery in the cloud is longer just an interesting breakout session at tradehows to fill up your 'dance card".  Harvesting ESI from the cloud for the purpose of eDiscovery was a real issue in 2011 and therefore anyone that is serious about eDiscovery from a process, legal and technology standpoint, had better start to pay attention.

Given all of this (and more that I have not even mentioned), 2012 is going to be a banner year for changes in information governance and eDiscovery.  Following are my predictions:

Information Governance and eDiscovery Will Move to the Cloud
As more and more ESI moves to the cloud, the requirement to harvest this ESI "from the cloud" will also continue to grow.  However, there will be a tremendous amount of confusion in regards to exactly what information governance and eDiscovery in the cloud means.  Most, if not all, of the seroius technology vendors will announce that they are cloud ready or work in the cloud.  However, in most cases, this will mean that they are using the same old legacy technology and harvesting data "from the cloud" and processing it the same old way they have been processing ESI and paper for years.  Some of these vendors will have their own data centers and offer up information governance and eDiscovery as as Service.   However, this is nothing new.  The real change that we will witness in 2012 will be virtual technology (not hardware based) that enables users to move information governance and eDiscovery solutions/platforms to the cloud ESI and collects it and processes it in the cloud where it resides.  Physical location will no longer be an issue.  Collection and moving massive amounts of data will no longer be an issue.  The salability of hardward solutions will no longer be an issue.  Staging information governance and eDiscovery respositories in third party service provider data centers will no longer be required.

Enterprises will be able to move virtual information governance and eDiscovery solutions around their networks and private clouds as required to collect and process ESI where it resides. Cloud Service Providers (CSPs) will provide information governance and eDiscovery solutions as part of their standard IaaS and PaaS technology stacks.   Early Case Assessment (ECA) is going to take on a whole new meaning.  This approach is a major paradigm shift in the entire concept of how information governance and eDiscovery should work.  2012 is going to be an exciting year for information governance and eDiscovery in the cloud.

Semantic Search will Go Mainstream
The mystical world of semantic search and natural language processing technology will finally go mainstream in 2012.  New Information governance and eDiscovery technology vendors will emerge that are utilizing this technology as the foundation of their offerings or have seamlessly integrated this technology into their platforms.  Litigators will begin to understand the value of semantic search, courts will begin to accept the results and users will begin to demand its use.  Before the end of 2012, the industry may even recognize the term "Lucene".

Predictive Coding will Go Mainstream
Just like the mystical world of semantic search and natural language processing technology, Predictive Coding will also go mainstream in 2012.  New Information governance and eDiscovery technology vendors will emerge that have seamless integrated this technology into their platforms.  Litigators will begin to understand the value of Predictive Coding, courts will begin to accept the results and users will begin to demand its use.  Offshore coding will become less attractive as Predictive Coding will enable all but the very detailed review and tagging to be done automatically.

Informationn Governance and eDiscovery for Social Media Will be Required
Pushed by the ethical requirements for litigators to understand and utilize eDiscovery for social media and the practical requirements to ensure that all pertinent ESI is being collected and submitted, there will be a  major move by the courts and litigators in 2012 to ensure that social media evidence is being collected and submitted with an appropriate chain of custody and with access to metadata to ensure the validity of the evidence.  And, as a results, legacy ECA vendors will social media file types to their bag of tricks and numerous new Discovery tools for social media will be released in 2012.

End-to-End Information Governance and eDiscovery Solutions
As Early Case Assessemnt (ECA) vendors expand their product lines "right" into document review and case management and as document review platform expand their product lines "left" into ECA, the market is going to have a choice of more end-to-end information governance and eDiscovery solutions.  In addition, we will see the integration of data mapping, legal hold, semantic search, predictive coding, project management, workflow management and case management into these end-to-end solutions.

Litigator Will Become More Technology Savy
Out of both practical necessity and statute ordered requirements, litigators will become more technology savvy in 2012.  The days of the hands-off, don't bother me with the technical details for eDiscovery litigator are quickly coming to a close. 

Information Governance and eDiscovery Pricing will Drop
The move to the cloud along with easily scalable virtual solutions offered up as Software-as-a-Service (SaaS) will enable a dramatic price decrease for information governance and eDiscovery in 2012.

eDiscovery will become a subset of Information Governance
As I have predicted in previous years, as eDiscovery moves to the enterprise, eDiscovery will become a subset of Information Governance in 2012.


In conclusion, 2012 is going to be a very exciting year in information governance and eDiscovery.  Enjoy the rest of 2011 and strap yourself in for a wild ride in 2012.



 

Labels: 2012 Trends, Early Case Assessment, ECA, eDiscovery, FRCP, Legal, Legal Hold, Litigation, Predictive Coding, Project Management, Semantic Search, Worlflow Management

posted by Charles Skamser @ 9:02 AM 0 Comments

eDiscovery from Magic to Mainstream Technology

Is the current state of eDiscovery sufficiently advanced from a technology standpoint that it is indishtinguishable from magic? Probably, but that isn't necessarily a bad thing.

It wasn't that many years ago that only a hand full of ligitation technology "geeks" knew what eDiscovery (Electronic Discovery or E-Discovery) even meant.  In fact, it really wasn't that many years ago that Information Technology (IT) had little or nothing to do with supporting the fine art of litigation. Don't get me wrong, there were plenty of disagreements about the ownership and use of  intellectual property and associated technology that were adjudicated in a court of law long before anyone had ever heard of eDiscovery.  There just wasn't much technology, if any, used to support the litigation process.

Litigation has historically been the dominion of lawyers with visions of men in white wigs and "Sherlock Holmes type" investigators gathering and presenting evidence under a set of rules that were completely foreign to all those except members of a club called the bar.  Perrry Mason dragged litigation and the "experience within the courtroom" into the post World War II era and made it a bit more glamerous and attractive.  But, there still wasn't much technology involved in the litigation process.

Typewriters and the Gold Era of Litigation
The introduction of the IBM Selectric typewriter in the 1960's revolutionized business around the world.  And,  in conjunction with the first commercially feasible copy technology in the 1960's, thanks to Xerox, the volume of paper expanded exponentially (Please note that I am not sure that anyone except a few math geeks used the word exponential at that time).  I think that the rule of thumb for most enterprises at this time was that if 1 copy was good, 20 copies was great!  So, with the proliferation of paper copies of everything, litigation had to accommodate this new paradigm of massive volumes of paper evidence.  And, hence the introduction of the cardboard legal box and what we all now fondly refer to as "document review".  Since most evidence was now on a piece of paper somewhere, every document had to be copied multiple times so that teams of lawyers (on both sides of the case) could review every single document (usually multiple times) and copies of all of this paper also had to sent to the courts. Some in the copy and document review business probably call this the "golden era of litigation" as there was millions of dollars spent on just copying and reviewing documents before the lawyers could even begin to get ready for trial.  Under any circumstances, the amount of potential evidence exploded and therefore litigation became very expensive during this time.

Scanning and Optical Character Recognition (OCR)Sad for many but true, the paper only era was actually short lived in the overall timeline of present day litigation practices.  By the 1980's, the Professional Computer (PC) with word processing was replacing the typewriter and a new paradigm shift was underway with the advent of Electronically Stored Information (ESI).  However, there was still lots of paper left over from the previous "owners" and still a fair of amount of paper being printed (and not stored) in the present paradigm.  So, beginnig in the 1980's and becomming prevalent in the 1990's commercially feasible scanning technology along with Optical Character Recognition (OCR) software hit the litigation technololgy market and now paper could be scanned and converted into searchable ESI.  The litigation service provider market emerged almost over night turning many with little more than a scanner in a warehouse into multi-million a year businesses.  With the advent of the scanner and OCR, the litigation cost per page went down.  But, with the accellerating volume of ESI, the overall cost of litigation continued to go up.  Unfortunately, the amout of information and the costs were about to go up even more.

eMail and the Internet
Even though PC's were prevelant throughout the enterprise in the 1980's, it was until the late 1980's and early 1990's with the advent of the commercial World Wide Web (Internet) and the subsquent explosion of email, that ESI really began to become the driver of the next big paradigm shift in eDiscovery.

Litigation Software and MagicWith the explosion of ESI in the 1990's, the technologists began to realize that there was a very lucerative and, in many cases, captive audiance (i.e. you can't hide from litigation) that needed software to drive ESI through the litigation process, find the specific data required, increase productivity and reduce costs (please note that I am not convined that the cost reduction criteria was real high on the list of benefits of the early litigation software vendors).  And therefore, almost overnight, a whole new industry was born and what I am referring to as the "magic" began.

In an industry that just 40 years earlier was barely dealing with paper, the introduction of ESI and the need collect, processing, find/search and review data was probably not that much different to many litigators than fire was to the early cavemen (no offense meant to cavemen).  The legal process (i.e. the courtroom and associated rules) had not changed.  However, the entire playing field of where most evidence came from and how it had to be handled and how it had to be presented was totally diferent. For all practical purposed, it was magic to most in the legal industry.  Remember that sufficiently advanced technology is indishtinguishable from magic!

Social Networking and Mobile Devices
Today, with the dawn of cloud computing, the era of email comming to an end and the exponential explosion of social networking platforms such as facebook, Twitter and LinkedIn (just to name a few of the big players) on mobile devices, the true era of ESI and the subsequent birth of true eDiscovery has really just begun.

To put this into perspective, there 30 billion pieces of content (e.g., links, photos, notes) shared on Facebook each month and there were 25 billion tweets sent on Twitter in 2010.  I could go on and on with the staggering statistics.  However, I think that we all get the point.  Social media has changed the world and as a result, the practice of eDiscovery will never be the same.

All of this being said, we are making tremendous progress moving from magic to mainstream technology.

Changes to the FRCP

Labels: Copier, Costs, Early Case Assessment, eDiscovery, FRCP, IBM, OCR, Paper, Scanning, Typewritter, Xerox

posted by Charles Skamser @ 12:18 PM 0 Comments

Predictive Coding Drama is Good for eDiscovery Market

In a Law.com blog post by Evan Koblentz on August 1, 2011 titled, "Bragging Rights or Blowing Smoke?", Mr. Koblentz indicates that Recommind's CEO Bob Tennant pointed out that, "If nothing else, the ruckus acknowledged the importance of automation to the future of legal discovery, and the significance of our intellectual property, including the announced patent, to the e-discovery industry."  I am not sure about the significance of Recomminds intellectual property and its announced patent.  But, Bob is spot on about the fact that the rukus over who owns what predictive coding IP is absolutely outstanding to the future of eDiscovery.  litigators, judges, general counsel, IT directors, litigation service providers and even some litigation technology vendors need to realize that mature and tested technology already exists to completely change the game and change the paradigm in which we currently view how technology is utilized and how it affects litigation.

As a result, it won't be long before risky off-shore coding and document review and expensive on-shore coding and document review will be practices that we read about in the history books and wonder why.

Finally, I couldn't let another blog posting on predictive coding go by without mentioning, as may others have, that there are lots of other predictive coding vendors with exceptional predictive coding technology that need to be acknowledged, including Orcatec, Equivio, Capital Legal Solutions, Catalyst, FTI Technology, InterLegais, Kroll Ontrack, Valora and Xerox.

Labels: Coding, eDiscovery, FRCP, Litigation Technology, Predictive Coding

posted by Charles Skamser @ 4:49 PM 0 Comments

eDiscovery Decisions in 2011 Increase at Accelerating Rate

The coveted  Gibson Dunn 2011 mid-year analysis on eDiscovery cases is out and it is not surprising that the number and sophistication of eDiscovery cases continued to grow at an accelerating rate.

Highlights from the Gibson Dunn analysis of pertinent decisions include:

 

• The number of eDiscovery decisions continues to increase at a blistering pace. The 187 decisions we identified in the first half of 2011 represents an 82% increase over the 103 decisions we identified at mid-year 2010.
• The number of instances in which litigants sought sanctions in the first half of 2011 was more than double the number in the same period last year (68 at mid-year 2011 versus 31 at mid-year 2010), and sanctions awards have nearly doubled in absolute terms (38 at mid-year 2011 versus 21 at mid-year 2010).
• Notwithstanding this increase, courts awarded sanctions at essentially the same rate as in 2010 (56% of the instances in which a party sought sanctions in the first half of 2011, versus 55% for the full year in 2010).
• Determining when litigation is "reasonably foreseeable" for purposes of triggering the duty to preserve continued to be a fact-specific analysis.
• Courts continued to emphasize that counsel's responsibility to ensure preservation does not end with timely distribution of a legal hold notice.
• Courts continued to demand cooperation and remained keenly aware of counsel's efforts--or lack thereof--to resolve eDiscovery disputes before seeking judicial involvement.
• It turns out that there is such a thing as "discovery karma," at least in the 10^th Circuit, and "ankle-biting" an opponent for alleged discovery glitches may not be appreciated, especially when one's own house is not in order.
• While no reported case addressed the use of predictive coding or other advanced search technologies, there is no doubt that these tools have been noticed, as The New York Times and Forbes focused on their potential impact in featured articles.
• eDiscovery law continued to develop rapidly, and while some areas of law are coming into focus, other areas--including basic issues such as whether a litigation hold notice must be written--continue to be heavily debated.
• Calls for reform of the Federal Rules of Civil Procedure continued, and the Civil Rules Advisory Committee is considering various

Unless you are stuck in some Star Trek  time warp where Electronically Stored Information (ESI) and the associated eDiscovery is in some future and maybe even parallel universe, the Gibson Dunn report should come as no surprise.  The amount of ESI is going to continue to grow at an accelerated rate for the foreseeable future.  The cloud is going to accelerate the increase in the volume of  ESI acceleration even faster.  So, the fact that our judiciary is “dealing” with these facts is a good think. Let’s all hope that this continues to accelerate also.

Labels: eDiscovery, Federal Rules of Civil Procedure, FRCP

posted by Charles Skamser @ 11:53 AM 0 Comments

eDiscovery Data Mapping Should be a Top Priority for General Counsel and CIOs within the Global 2000

A key aspect and legal requirement of eDiscovery is the creation of a data map to determine precisely what information is available within an organization and where it resides. This is a process that should begin long before a company ever finds itself in court. Surprisingly, over the past 2 years, I haven’t found more than a hand full of General Counsel and CIOs at some of the largest companies in the world that truly understand the importance of eDiscovery Data Mapping, the risks involved in not having a working eDiscovery Data Map nor the fact that they should be leading the charge to develop and manage an enterprise wide eDiscovery Data Map.

Ganesh Vednere, a manager at Capgemini, wrote an excellent overview of the key aspects of eDiscovery Data Mapping titled, “The Quest for eDiscovery: Creating a Data Map”. that appeared on the November / December 2009 Informatics site. In this overview, Ganesh indicated that, at a minimum, the enterprise should consider completing the following tasks as a general practice to start the eDiscovery Data Mapping process:

Get a list of all systems – and be prepared for a few surprises
Begin the process by creating a list of all systems that exist in the company. This is easier said than done, as in many cases, IT does not even have a full list of all systems. Sure, they usually have a list of systems, but don’t take that as the final list! Due diligence involves talking to business process owners, employees, and contractors, which often brings to light hidden systems, utilities, and home-grown applications that were unbeknownst to IT. Ensure that all types of systems are covered, e.g. physical servers, virtual servers, networks, externally hosted systems, backups (including tapes), archival systems, and desktops, etc. Pay special attention to emails, instant messaging, core business systems, collaboration software, and file shares, etc.

Document system information
After the list of all systems is known, gather as much information about each as possible. This exercise can be performed with the help of system infrastructure teams, application support teams, development teams, and business teams. Here are some types of information that can be gathered: system name, description, owner, platform type, location; is it a home grown-package, and does it store both structured and unstructured data; system dependencies (i.e., what systems are dependent on it and what systems does it depend on); business processes supported, business criticality of the system, security and access controls, format of data stored, format of data produced, reporting capabilities, how/ where the system is hosted; backup process and schedule, archival process and schedule, whether data is purged or not; if purged, how often and what data gets purged; how many users, is there external access allowed (outside of the company firewall), are retention policies applied, what are the audit-trail capabilities, what is the nature of data stored, e.g. confidential data, nonpublic personal information, or still others.

Get a list of business processes
Inventory the list of business processes and map it to the system list obtained in the step above to ensure that all the various types of ESI are documented. The list of business processes is also useful during the discovery process, when one can leverage the list to hone in on a particular type of ESI and obtain information about how it was generated, who owned the data, how the data was processed, how it was stored, and so on. A list of business processes can also be useful when assessing information flows.

Develop a list of roles, groups, and users (custodians)
Obtain the organizational chart and determine the roles and groups across the business and the business processes. Document the process custodians and map out who had privileges to do what. Understand the human actors in the information lifecycle flow.

Document the information flow across the entire organization
Determine where critical pieces of information got initiated, how the information was/is manipulated, what systems touch the information, who processes the information, what systems depend on the information, and so on. Understanding the flow of information is key to the data mapping/discovery process.

Determine how email is stored, processed, and consumed
Given the large percentage of business information and business records that reside in email, special attention needs to be placed on email ESI. Typically email is the first thing that opposing counsel go after, so determining whether email retention and disposition policies are consistently enforced will be key to proving good faith. There are a number of automated tools that will enable you to create email maps, link threads of conversation, heuristically perform relevancy search, extract underlying metadata, and so on. Before deciding to buy the best-of-breed solution, however, perform due diligence on existing email processes. Understand how employees are using email. Are they creating local archives (.PST files), are they storing emails on a network or a repository, are they disposing of them at the end of retention periods, are they using personal emails to conduct official business, and so on. Identify deficiencies and violations in email policies before the opposing counsel does.

Identify use of collaboration tools
SharePoint will have the lion’s share of the collaboration space in many organizations, but even then you must ensure that all other tools – whether they are social networking tools, Web-based tools, or home-grown tools – are included in the data-mapping process. You need to carefully document the types of information being stored on each of these tools. Sometimes company information has a nasty habit of being found in the most unlikely of places. Wherever possible work with compliance, information management, or records management groups to establish usage policies to prevent runaway viral growth of these tools. If the organization already has thousands of unmanaged SharePoint sites, work with IT and business to institute governance controls to prevent further runaway growth.

Don’t forget offsite storage
After inventorying and mapping all systems, one would think the job is done. Alas, there is more work ahead. Offsite storage is an often under-appreciated aspect of the discovery process. It is quite reasonable to assume that there might be substantial evidence stored offsite which might become incriminating at a later date. Offsite storage may contain boxes or tapes full of records whose existence was somehow never properly documented, with the result that they cannot be located unless someone opens the box or attempts to recover the tape data. These records continue to live well past their onsite cousins. This means the organization continues to have the record in backup tapes (or paper) and other formats that it purportedly claimed to have destroyed. The search for records in offsite storage is made more complicated if the offsite storage process did not create detailed indices about the contents. If there are tapes labeled “2007 Backup Y: Drive,” then it may become quite an arduous task to determine what information is really contained in those tapes. Nevertheless the journey must be started. It could involve anything from a full-scale review of all tapes, followed by reclassifying and re-filing the tapes, to perhaps a review of just the offsite storage manifests. It could also involve a search for critical information or a clean-up of the last three years’ worth of tapes, and so on.

eDiscovery Data Mapping Platform
This is an impressive beginning best practice. However, I would add the requirement of seriously considering investing in an eDiscovery Data Mapping platform to help guide you through the eDiscovery Data Mapping process and then manage all of the information that you discovery. After all, just creating your eDiscovery Data Map is just the beginning of the process. The real value of creating the eDiscovery Data Map will be seen when your enterprise uses the eDiscovery Data Map to support your first legal matter and enables you to more fully meet the legal requirements of the the Federal Rules of Civil Procedure (FRCP) and the associated state and local rules.

Genome from Exterro, is an excellent example of a new generation of data mapping solutions that are dynamic, shifting to reflect your company's information universe as it evolves.Through intelligent workflows and automated processes, Genome enables IT departments and legal teams to quickly visualize and analyze data source information to proactively scope case parameters. Over the next couple of weeks, I will be reviewing the solutions that are currently available along with some recommendations for which platforms will provide the best return on your investment (ROI).

The full text of Ganesh Vednere’s overview is as follows:

A key aspect of ediscovery is the creation of a data map to determine precisely what information is available within an organization and where it resides. This is a process that should begin long before a company ever finds itself in court.

The phone rings. It is the general counsel. The organization may be sued over patent infringement. Counsel knows that this could be “The Big One.” All sorts of data, documents, metadata, emails, and other forms of information may be required. Counsel asks IT: Do you have, or can you get together, a list of all systems and the data they contain?” There is a long, silent pause on the phone. Then the IT manager says “Well, we do have a list of systems. Let me send it your way.” Counsel gets the list. It is nothing close to the data map it needs. Instead it is a list of servers, their IP addresses, platform configuration, and their physical rack location in the data center. Good information for disaster recovery purposes, but not particularly helpful in court.

“Well, this is the best I’ve got,” comes the retort from IT. “We do not have a data map nor would we know how to create one – and, by the way, do you really think we have the bandwidth to work on this now?”

Why You? The Challenge of Data Mapping So who gets stuck with the job? You do. You might argue that “IT manages all the infrastructure and stuff, why couldn’t they just run an inventory on their systems?” And IT will reply that “Well, we do manage the infrastructure, but we know very little about the inputs, outputs, documents, records, and other information on these applications. Go talk to the business side.” And you go to business, and business will tell you that “I just use the system and click these buttons on the screen. The system is a black box to me. I have no idea about all of the underlying data, metadata, and data structures. I suggest you talk to the operational folks.” And you talk to the operational folks, and they say, “What are you talking about? We just execute business processes. Don’t ask us about data and metadata. Go talk to the analyst who worked on the system design.” And you look for the analyst, and you eventually learn that …“Oh, she was a consultant and she left the project three years ago.”
The challenges are many but the data map must be created. And the job is yours. So where do you start? By going back to the beginning … the very beginning.

How Did We Get in Such a Mess? Let’s take a look at a typical mid-size organization. It has several thousand employees and contractors with offices in the U.S. and E.U. The sheer volume of information that resides in just one division is mind-boggling. New information sources keep popping up, employees keep creating new SharePoint sites on their own, and there is use (or misuse) of social collaboration tools, to say nothing of several hundred IT systems in play at any point in time. Data is moved and migrated from one place to another without proper documentation or communication, more and more tape backups are being created, and some employees are making copies of data on thumb drives or worse, emailing them to their personal email addresses.

How did things ever become such a mess? There are manifold reasons: IT is traditionally kept at arm’s length on compliance and uninvolved with information management and governance during systems design and development. Records management departments, on the other hand, often institute sound policies and retention schedules but have a tough time putting these into practice and getting people to adhere to them. On the legal side, general counsels often work against themselves: becoming increasingly exasperated over the large amount of money spent on searching, processing, and producing electronically stored information (ESI), they often push hard to cut costs, thereby shortcircuiting the process.

Must an Organization Have a Data Map?
It may seem surprising that even today, many successful organizations do not have a data map, or at best, a superficial one. It is not that organizations are lacking in will, however, but that the process seems too daunting. Consider the “typical organization” above. If there are several hundred IT systems and other home-grown business applications, one must not only know what these systems are, and where they are located, but also the types of information (documents, records, other content) that are produced from these systems and additional information such as data format, data location, whether the data is updated by other systems, or transformed into other formats, etc.

To add to the complexity, a determination also needs to be made as to whether a piece of ESI can be extracted and presented using reasonable and customary means. For example, if an IT system was retired and the data backed-up on tape, it is reasonable to assume that extracting the tape, processing the information, and presenting it in a readable format may not be easy since the underlying version of the software no longer exists. Counsel, however, must be able to assess whether this is indeed the case. Having a data map eases some of these tasks and makes it easier for counsel to relate the information as needed.

Data Mapping Considerations
In the current economic environment, companies are bracing themselves for an uptick in the number of lawsuits. Whether the matter is related to regulators, customers, consumers, employees, or business partners, companies are often required to provide ESI in court. While this should be sine qua non for most organizations, many are simply too overwhelmed to be able to react fast enough and are thus placing themselves at a much greater risk. If that’s the case in your enterprise, here are some initial steps that will help you move forward.

1. Understand the prevailing legal environment. Organizations are not created equally, and not all have the same set of applicable legal requirements. It is therefore important to analyze the type of environment that the organization operates in, the jurisdiction it is under, and the various federal and state laws, regulations, and common industry standards that apply to it, with regard to ESI. While the contents of a data map by itself do not directly correlate to a particular law or regulation, it is useful to know what checks and controls need to be established during the datamapping process and ensure that there are no “show-stopper” questions in court around how the data map was created or what the process was.
2. Use a partnership model and obtain buy-in from senior management. It is important that each entity within an organization have a vested stake in the success of any data-mapping project. This means that management in each of these organizational fiefdoms must understand what a data map is, how it will be used, and what the process of creating one is. Getting buy-in from these senior managers is a crucial first step and must be completed prior to the start of the process. Additionally, it is important that people of the appropriate rank are selected to work on the project. Folks who are deep in the weeds will generally have a lot more information about data flows and how processes and people work together versus the senior executive who operates in more of a decision-making capacity.
3. There is little point in pursuing a “big-bang” approach for the data map. Instead, work towards a phased approach. Prioritize which divisions or lines of business to focus on first and then address the remaining ones later. Work with line managers to determine what, if any, information has been collected on systems and processes within their particular areas. Standard industry lists may be employed as a starting point, e.g. HR, Accounting, Communications and Marketing, etc. Begin the first phase of the process here and then iteratively build upon what’s already available.
4. Use the right technology. As more capital is allocated towards automating ediscovery, vendors will naturally gravitate towards building specialized software for this mission. Time, cost, and relevancy of results will drive the success of vendor products. While some organizations have attempted to build custom tools, more and more prefer choosing established products or service offerings to guide them through the rediscovery and data-mapping process. Already many vendors have begun mapping their offerings to the electronic discovery reference model (EDRM) and other industry standards. This market is still maturing and organizations should not go out and immediately purchase a top-rated vendor’s software without due consideration of the organization’s unique circumstances.

Creating the Data Map
Once you’ve worked your way through each of considerations above and taken action as needed, you’re ready to start the actual data-mapping process. It is lengthy but well-defined and can be broken down into each of the following steps:

The Data Mapping Process

1. Get a list of all systems – and be prepared for a few surprises. Begin the process by creating a list of all systems that exist in the company. This is easier said than done, as in many cases, IT does not even have a full list of all systems. Sure, they usually have a list of systems, but don’t take that as the final list! Due diligence involves talking to business process owners, employees, and contractors, which often brings to light hidden systems, utilities, and home-grown applications that were unbeknownst to IT. Ensure that all types of systems are covered, e.g. physical servers, virtual servers, networks, externally hosted systems, backups (including tapes), archival systems, and desktops, etc. Pay special attention to emails, instant messaging, core business systems, collaboration software, and file shares, etc.
2. Document system information. After the list of all systems is known, gather as much information about each as possible. This exercise can be performed with the help of system infrastructure teams, application support teams, development teams, and business teams. Here are some types of information that can be gathered: system name, description, owner, platform type, location; is it a home grown-package, and does it store both structured and unstructured data; system dependencies (i.e., what systems are dependent on it and what systems does it depend on); business processes supported, business criticality of the system, security and access controls, format of data stored, format of data produced, reporting capabilities, how/ where the system is hosted; backup process and schedule, archival process and schedule, whether data is purged or not; if purged, how often and what data gets purged; how many users, is there external access allowed (outside of the company firewall), are retention policies applied, what are the audit-trail capabilities, what is the nature of data stored, e.g. confidential data, nonpublic personal information, or still others.
3. Get a list of business processes. Inventory the list of business processes and map it to the system list obtained in the step above to ensure that all the various types of ESI are documented. The list of business processes is also useful during the discovery process, when one can leverage the list to hone in on a particular type of ESI and obtain information about how it was generated, who owned the data, how the data was processed, how it was stored, and so on. A list of business processes can also be useful when assessing information flows.
4. Develop a list of roles, groups, and users (custodians). Obtain the organizational chart and determine the roles and groups across the business and the business processes. Document the process custodians and map out who had privileges to do what. Understand the human actors in the information lifecycle flow.
5. Document the information flow across the entire organization. Determine where critical pieces of information got initiated, how the information was/is manipulated, what systems touch the information, who processes the information, what systems depend on the information, and so on. Understanding the flow of information is key to the data mapping/discovery process.
6. Determine how email is stored, processed, and consumed. Given the large percentage of business information and business records that reside in email, special attention needs to be placed on email ESI. Typically email is the first thing that opposing counsel go after, so determining whether email retention and disposition policies are consistently enforced will be key to proving good faith. There are a number of automated tools that will enable you to create email maps, link threads of conversation, heuristically perform relevancy search, extract underlying metadata, and so on. Before deciding to buy the best-of-breed solution, however, perform due diligence on existing email processes. Understand how employees are using email. Are they creating local archives (.PST files), are they storing emails on a network or a repository, are they disposing of them at the end of retention periods, are they using personal emails to conduct official business, and so on. Identify deficiencies and violations in email policies before the opposing counsel does.
7. Identify use of collaboration tools. SharePoint will have the lion’s share of the collaboration space in many organizations, but even then you must ensure that all other tools – whether they are social networking tools, Web-based tools, or home-grown tools – are included in the data-mapping process. You need to carefully document the types of information being stored on each of these tools. Sometimes company information has a nasty habit of being found in the most unlikely of places. Wherever possible work with compliance, information management, or records management groups to establish usage policies to prevent runaway viral growth of these tools. If the organization already has thousands of unmanaged SharePoint sites, work with IT and business to institute governance controls to prevent further runaway growth.
8. Don’t forget offsite storage. After inventorying and mapping all systems, one would think the job is done. Alas, there is more work ahead. Offsite storage is an often under-appreciated aspect of the discovery process. It is quite reasonable to assume that there might be substantial evidence stored offsite which might become incriminating at a later date. Offsite storage may contain boxes or tapes full of records whose existence was somehow never properly documented, with the result that they cannot be located unless someone opens the box or attempts to recover the tape data. These records continue to live well past their onsite cousins. This means the organization continues to have the record in backup tapes (or paper) and other formats that it purportedly claimed to have destroyed. The search for records in offsite storage is made more complicated if the offsite storage process did not create detailed indices about the contents. If there are tapes labeled “2007 Backup Y: Drive,” then it may become quite an arduous task to determine what information is really contained in those tapes. Nevertheless the journey must be started. It could involve anything from a full-scale review of all tapes, followed by reclassifying and re-filing the tapes, to perhaps a review of just the offsite storage manifests. It could also involve a search for critical information or a clean-up of the last three years’ worth of tapes, and so on.

Conclusion
In today’s highly litigious world, creating a data map is one of the primary steps in responding to litigation requests. It is vital that organizations get a solid foundation by focusing time, energy and resources in doing it right – and creating it long before it’s needed.

Labels: Compliance, Data Management, Data Map, Discovery, eDiscovery, Electronically Stored Information, ESI, Exterro, Federal Rules of Civil Procedure, FRCP, Legal Holds, Litigation Readiness

posted by Charles Skamser @ 8:00 AM 0 Comments

How is Outside Counsel Doing wtih eDiscovery?

I grew up in the world of Global 5000 Business Process Automation (BPA), Business Process Improvement (BPI), Business Process Management (BPM) and Balanced Score Cards. Therefore, I can sling information and business consulting acronyms with the best of them. However, now that I live in the world of eDiscovery and Governance, Risk and Compliance (GRC), I am faced with an industry that, for the most part (there are some exceptions), is just not familiar with the practice of BPM or its benefits. And, in many cases it is literally a matter of "not even knowing what you don't know." Therefore, I believe that the next big market for BPM and all of its associated glory is the GRC and eDiscovery markets. After all, I can't help by wonder if there are any General Counsel in the Global 2000 that would like to know how their outside counsel would score on an independent eDiscovery and GRC Assessment. And, there may even be some CEOs or Board of Director members that would like know how their legal departments would score on an independent internal eDiscovery and GRC Assessment.

As a place to start, I wanted to comment on some of the finding by Elise Olding in the Gartner RAS Core Research Note G00165528 from March 12, 2009 titled, "It's a Matter of Survival: Use BPM to Drive Out Costs".

Ms. Olding put forth the proposition that, "In a troubled economy, struggling companies often cut costs broadly and blindly without understanding whether those cuts further compromise their survival." This statement should ring very true today for both the legal departments of the Global 5000 and certainly law firms as they have both dramatically cut costs across the board without understanding the effect it may have on their ability to effectively handle eDiscovery. She went on to state that, "For struggling companies, business process management is a lifeline that helps them survive by reducing and avoiding costs in this volatile and turbulent economy." I contend that the same holds true for law firms and legal departments as they struggle to compete and survive. However, I am also going to contend that due to the fact that very little is truly understood and very little has been documented about the processes involved in GRC and eDiscovery, even without the pressures of the current economic situation, BPM would be an excellent approach for law firms and legal departments to employ to ensure that they are carrying their duties in regards to the serious issues of governance, compliance, risk management and eDiscovery in a manner that will enable the best possible outcomes.

Whether its Sarbanes-Oxley compliance or ensuring that you are following the rules of handling Electronically Stored Information (ESI) as stated in the amended Federal Rules of Civil Procedure (FRCP), leaders from Global 5000 legal departments and partners at the major law firms need to seriously consider beginning to employ the Business Process Management (BPM) methodologies and technologies that have been successfully used throughout the rest of the Global 5000 enterprises for many years.

Labels: Assessments, BPM, Business Process Automation, Compliance, FRCP, Global 5000, Governance, GRC, In re: Fannie Mae Securities Litigation, Law Firms, Sarbanes-Oxley

posted by Charles Skamser @ 3:47 PM 0 Comments

Will California's New Rules for eDiscovery Increase Costs?

1. The California law differs from the FRCP in how it approaches data in "a reasonably useable form". If your company is subject to an eDiscovery request, the burden will be upon you to provide the information in a reasonably useable form. This is a big departure from FRCP. This new wording could lead to a large expense for a company as definitions of a "reasonably, useable form" are worked out.
2. Expands eDiscovery beyond inspection and copying to include testing or sampling of ESI. This act expands existing eDiscovery procedures and demands that can be made for inspection of ESI to include copying, testing or sampling of ESI.It also allows for a party to demand that another party of someone acting on that party's behalf, to inspect, copy, test, or sample ESI in the possession, custody, or control of the party when an eDiscovery demand is made.
3. Parties that fail to produce ESI pursuant to a discovery request may face monetary sanctions. This sets a new precedent that organizations must now consider. Before they mostly just had to contend with costs at the federal level. Now the state of California has the power to levy monetary sanctions as well
4. Sanctions are prohibited if failure to produce ESI is due to routine, good faith business operations. I consider this California's version of the safe harbor provision, but as with FRCP, safe harbor can be elusive as evidenced by the aforementioned statistics on sanctions.

Mr. Haile went on to further point out that There is much more to this act, including more notable departures from the language of the FRCP. Overall this is a detailed act with new risks and eDiscovery considerations that now impact organizations if they end up in the California state court. Like all risks, it all boils down to costs but the big question organizations have to answer is, "What is the cost of complying versus doing nothing and taking a reactive approach to an eDiscovery to deal with it only if and when it hits you?"

Current case law in California for cost shifting is found in Toshiba America Electronic Components vs. Superior Court (2004, 21 Cal Rptr. 3d at 532) where the Court concluded that California Code of Civil Procedure Section 2031(g) (1) shifts the cost of providing compilations of electronic data in a usable format to the demanding party. However, it is now clear if this precedent will continue to be the rule?

In discussions the past two weeks with General Counsel from California based corporations and with partners from some of the larger California law firms, I didn't get the impression that Bill 5 was on the top of anyone's list of concerns. However, I don't think that anyones "hair was on fire" due to eDiscovery collection or production issues either. But, it is just a matter of time before it will be. And, for those litigatore who have not really been paying attention to the changes in the FRCP, the new California Bill 5 and the bills from other states that are sure to follow, there are going to be additional costs involved in any cases that require eDiscovery. Which, with the accellerating increase the amout of ESI, is probably close to 100% of all matters in 2009 and beyond.

Iny any case, chagnes in eDiscovery practices, law and costs are here to stay in California and the rest of the United States. And, the litigators that "don't pay attention" may in fact get "terminated". And, it is going to cost more to litigate in 2009 and beyond than in did in previous years where Electronically Stored Information (ESI) was just not that prevalent. However, even if you wait until ther terminaor is cashing you and/or your hair is on fire, there are ways to contorl costs and get eDiscovery done properly. And, it might even make sense to proactively beging to think about how you are going to handle eDiscovery and maybe even take some steps to be prepared so that your hair never does catch on fire.

Over the next couple of weeks, I will be gathering more specific information about the increasing cost of eDiscovery in California due to Bill 5 and the costs everywhere due to the changes in the FRCP.

So, if anyone has any input, send it to me and I will include it in my next posting on this topic.

Labels: California Bill 5, eDiscovery Costs., FRCP

posted by Charles Skamser @ 9:19 AM 0 Comments

Standards Need to Emerge for Collecting and Processing Electronically Stored Evidence (ESE)

Most litigators and their litigation support staff that have been practicing over the past 5-10 years could probably teach a class on the process of preservation, collection, processing, review and production of paper evidence. Or, at least they could stand at a whiteboard and draw a basic workflow diagram of the basic steps.

However, with the dramatic and accellerating increase in the amount of Electronically Stored Information (ESI) which I like to call Electronically Stored Evidence (ESE), the subsequent technical issues and the associated changes to the Federal Rules of Civil Procedures (FRCP), very few, if any of the same litigators and their staff, can now even describe the most basic workflow to to get ESE for a trial. Therefore, although many are talking of their importance (myself included), eDiscovery standards of any substance, are a long way off.

This is certainly not the fault of the lawyers as they have never been required to have much of true understanding of the technology of processing evidence in order to be successful litigators. However, the bar has now literally been raised and litigators can't even provide adequate representation without an indepth understanding of these new issues.

Maybe we should consider requiring a license or some type of ceritification to practice law when eDiscovery is involved? Or, has ESE become so intertwined in our matters that there isn't a case without eDiscovery and therfore every lawyer that want to litigate anything should have to be certified?

As a place to start this discussion / debate, we need to start identifying the basic components of ESE and how it is stored, how to preserve it, how to extract it (the new word for collection), how to process it, how to review it, and how to produce it.

Wouldn't it great if 5 years from now, litigators could stand at a whiteboard and diagram and explain the basic "standard" components of the workflow for processing Electronically Stored Evidence (ESE)?

Eric P. Blank addresses these issues in an excellent article titled,"The Need for E-Discovery Standards: A Call From the Trenches", posted on October 5, 2009 on the EDD Update Blog.

Eric P. Blank is the founder and managing attorney of Blank Law + Technology PS. His practice focuses on electronic discovery counseling, e-security response planning and implementation, investigations and computer forensics. Mr. Blank has conducted more than 300 investigations into computer and software-related torts and employee misconduct since 2001 and has frequently been a court-appointed special master or neutral in e-discovery matters.

The full text of Mr. Blank's post is as follows:

Most discussion about standards in electronic discovery focuses on the big-picture issues of scope, cost and cost shifting.

These are important questions eloquently argued in the courts. However, they overlook the mundane, pick-and-shovel e-discovery concerns that affect every case. I’m talking about the elementary technical issues of preservation, extraction, processing, review and production.

I’m talking about extracting data from electronic storage media, processing the data and its metadata into a document review software application platform, supporting the review and producing the data as discovery or evidence.

Outside the e-discovery world, the first stage of this process is known as Extract, Transform, Load (ETL). Identifying and overcoming the challenges of ETL have occupied computer scientists for decades. Principal obstacles to effective ETL include widely diverse and poorly documented storage repositories, asynchronous multimedia platforms, constantly evolving software, hardware and software anomalies, and human error, usually with respect to initial planning.

E-discovery vendors on the ground face those obstacles and more. Consider, as just a few of many examples, the following:

Mobile phones and PDAs: In some models, data can be extracted through forensic imaging. In others, such as many of those without SIM cards, data can only be pulled through live file extraction. Click here and here to read my earlier blog posts about the difference between forensic imaging and live file extraction. In any case, the question is this: Should data extraction scope be defined by current technical capabilities, or should there be a single common standard – such as live files only – for those instances when mobile phones and PDAs are subject to e-discovery?

A multitude of file types: Extraction and processing applications address dozens, sometimes hundreds, of file types. These file types are usually associated with, and identified by, a particular file extension, such as .doc or .xls. However, custom extensions are easy to apply – documents I create might have a .epb file extension, for example – and it is also simple to apply a nonstandard extension to a particular file type (e.g., a .doc extension to a PDF file). These are often missed, or improperly processed, by extraction and processing software.

Computer forensics software in the hands of an experienced technician can reveal documents by file type without relying on extension format and such, but doing so is costly and time consuming. What checks should be done for mislabeled or unusual file extensions? When are such checks required?

Metadata: Most of us think of metadata in basic terms such as the putative author, creation date, modification date, last-access date and so forth. However, metadata varies widely across data types. Microsoft Office documents, for example, have more than 100 metadata fields. It is also possible to create custom fields with many document types. Nearly all of these, such as the ubiquitous P-size and L-size, are nearly never important in civil litigation.

“Nearly never” is not, however, the same as “never.” Such data can be extracted, but it is not, as a rule, supported by processing software, which renders it unavailable at the attorney review level. Is it possible to agree on which metadata fields should be preserved and processed? When they should be processed? Which fields are important forensically? When all fields should be preserved?

Rapid technological change: Software is updated all the time. This affects how metadata is produced and the appearance of electronic documents. Processing software hasn’t kept up. It’s also inconsistent. For example, the last-access date on a Word 2007 document running in Windows Vista is affected differently than an Office XP Word document running on Vista. Both documents, however, are processed the same, as if the metadata means the same, when it does not. How should inconsistencies like this be addressed? What should the typical approach be?

Webmail: Screenshots of Web-based email services such as Hotmail are a common and inexpensive workaround to downloading actual Hotmail files. Which method is preferred? Is either method not preferred? As third-party cloud data repositories multiply, what constitutes best practices with regard to extraction methods will become a critical question.

Capture rates: What percentage capture rate is acceptable for processing software? Many files are often not processed by even the best technology, and must be laboriously hand processed. In a million-item processing job, a 1 percent miss rate equals 10,000 documents not processed and available for review. Is 99 percent acceptable? Is 98 percent? Note: If you think that the processing rate for your document review software is 100 percent, you’re kidding yourself.

Searching: Keyword searching, including keyword searches supported by “fuzzy” search techniques, are giving way to conceptual searching, which is the future of document search and review. Conceptual searching, however, involves proprietary algorithms and processes with a wide range of accuracy. What standards must conceptual searching meet to be accepted? How are these standards applied? When, if ever, is conceptual searching disallowed?

File format: In e-discovery today, most documents are produced in .Tiff format. Putting aside the larger question of whether .Tiff should be the standard for producing electronic documents, what about documents such as spreadsheets that don’t translate well into .Tiff files? In what format should presentation-type documents be produced? As slide shows? As workbook copies with notes and presenters’ comments? How are native files to be tracked and authenticated as a best practice?

Today, e-discovery consultants decide many of these questions on their own or after consulting with litigation counsel. In essence, a consultant decides when it is and isn’t practical to extract files from a system, whether to image a particular hard drive and whether to put aside as unreadable a back-up tape from a set of tapes that must be searched.

Much of the time, the consultant makes the “right” decision, as subsequently decided by the court, the client or the opposing party. It’s a rare consultant, however, who won’t admit that adopting e-discovery standards would bring enormous benefit to the practical challenges of data extraction, processing and production.

I'll be discussing these and other issues in the future. Any of the problems mentioned above could be an entire article. I look forward to working with the legal and technical community to address these “technical” standards – as opposed to the widely discussed “strategic” standards which may ultimately be addressed by changes in the Federal Rules of Civil Procedure.

Labels: EDD, Electronically Stored Evidence, Electronically Stored Information, ESE, ESI, Federal Rules of Civil Procedure, FRCP

posted by Charles Skamser @ 9:20 AM 0 Comments