Five Initial Steps to Meet the Governance, Risk and Compliance Obligations Brought on by Today's Big Data File Stores

The accelerating increase in the amount of unstructured Electronically Stored Information (ESI) is leaving IT organizations struggling with how to store and manage all of this new information. Aside from just providing the underlying storage infrastructure to host this amount of data, companies are also faced with the task of properly managing their Big Data file stores to meet existing governance, risk and compliance obligations. To do so, there are five steps they can take now to position their organization to meet them.

Labels: Big Data, Compliance, eDiscovery, FISMA, FRCP, Governance, GRC, HIPPA, Information Governance, Legal, Litigation, Risk, Sarbanes-Oxley

posted by Charles Skamser @ 10:50 AM 0 Comments

eDiscovery in the Cloud is Obviously Working

eDiscovery in the cloud is obviously working as this week Autonomy. a global leader in eDiscovery and GRC infrastructure software for the enterprise, announced that  they are now managing over 17 Petabytes of email, documents, and multimedia data on 6,500 servers on 8 data centers around the world. Seventeen Petabytes is equal to more than 11 times the size of the 10 billion photos on Facebook, or 226 years of HD video.

I think that this announcement answers questions about whether or not the enterprise will allow its data outside the firewall.  And, to a certain degree answers the debate about the future of cloud computing in the eDiscovery and GRC markets.

As a cloud based, software-as-a-service (SaaS) evangelist of the past 10 years,  I am really pleased to see that cloud based computing is gong mainstream and gaining momentum within the enterprise.  And, I am even more pleased to see these trends in eDiscovery and GRC market.

However, as I am also a best-in-class advocate and evangelist, it is disappointing to see that a vendor with a monolithic solution based on a proprietary database (IDOL) seems to have taken the lead in cloud based computing.  Don’t get me wrong, I am very impressed with what Autonomy has accomplished and have tremendous respect for their technology.  That being, said I am now curious about market penetration and acceptance, hosted data amounts and SaaS based application utilization by best-in-class component technologies in the same markets that Autonomy is playing.

We all know about the success of salesforce.com.   I wonder which technology vendor or technology vendors will take on Autonomy with an more open systems best-in-class type approach and rise to the level of success as a salesforce.com?

In some respects, the answer to the question of who is competing with Autonomy may be found in the fact that there are no other providers that have put all of the “best-in-class” solutions together along with workflow management under a single enterprise class data center.  And that each of the individual SaaS based technology providers is only marketing a component of the overall solution and therefore doesn’t really have a single source solution to compete with Autonomy.

So, is the answer that some service provider needs to bring all of this together?  I have been studying several potential candidates over the past 12 months and will be reporting on their offering(s) and their potential impact on the market before the end of the year.  Stay tuned.
The full text of the Autonomy press release is as follows:

Cambridge, UK and SAN FRANCISCO – October 12, 2010 – Autonomy Corporation plc (LSE: AU. or AU.L), a global leader in infrastructure software for the enterprise, today announced that Autonomy's private cloud computing platform has reached a new data processing milestone, extending its lead as the world's largest private cloud. Autonomy private cloud now manages over 17 Petabytes of email, documents, and multimedia data on 6,500 servers on 8 data centers around the world. Seventeen Petabytes is equal to more than 11 times the size of the 10 billion photos on Facebook, or 226 years of HD video.

The continued dramatic growth of Autonomy's private cloud is the result of Autonomy's unique, meaning-based approach to cloud computing, as well as the rapid adoption for multichannel marketing applications. Powered by Autonomy's Intelligent Data Operating Layer (IDOL), Autonomy's private cloud automatically recognizes concepts and patterns in the billions of files it ingests and indexes every day. The ability to automatically understand the meaning within all forms of data provides a significant advantage to the customer, whether it's a compliance officer or lawyer responsible for archiving and reviewing emails, video, and social media posts around a particular case, or a chief marketing officer looking to deliver the most relevant and proven content to a website visitor in real-time.

As a result, Autonomy is now the dominant leader in a range of private cloud computing applications. Autonomy is driving rapid uptake amongst marketers looking for a cost-effective, fast, and turnkey platform for hosted marketing applications. For instance, a marketing team can form a virtual chain with its network of design and advertising agencies, to securely collaborate on the development of rich media content. Autonomy's cloud-based marketing modules include Autonomy Optimost, Autonomy TeamSite, and Autonomy Virage MediaBin.

Likewise, corporate legal departments are increasingly turning to Autonomy to form a virtual private chain with their law firm partners, in order securely collaborate on relevant information for a particular investigation or case. This cloud-based approach to eDiscovery results in radically compressed timeframes for the eDiscovery process. Autonomy's private cloud processed 36,000 eDiscovery audits year-to-date, producing 48 Terabytes of eDiscovery data. Autonomy's cloud-based information governance modules include Autonomy Consolidated Archive, Early Case Assessment, Introspect, Legal Hold, Records Manager, Supervisor, and iManage WorkSite.

"Most technology providers consider cloud computing to be nothing more than making the contents and applications in a digital storage box accessible via the internet," said Mike Lynch, CEO of Autonomy. "However, Autonomy's meaning-based approach to cloud computing brings intelligence to a range of applications, from archiving to eDiscovery to marketing. Autonomy provides the ideal platform for our Protect and Promote customers, who are dealing with an increasing array of content to govern and apply policy to, produce for eDiscovery investigations and review, and who are seeking greater agility in launching multichannel campaigns that resonate with their customers."
Autonomy's private cloud is hosted in state-of-the-art and high-security data centers. The data centers are under 24/7 surveillance, and each one undergoes annual Statement of Accounting Standard number 70 or "SAS 70" audits. Two fully synchronized, geographically separated systems provide complete data and system redundancy and parallel processing of all tasks. The design addresses all aspects of multi-tenancy, such as multiple firewalls and virus protection, and is ideally qualified to support the performance and volume requirements that are necessary for processing the rapidly expanding number of corporate formats and unified communications – including all forms of text, audio, and video.

About Autonomy
Autonomy Corporation plc (LSE: AU. or AU.L), a global leader in infrastructure software for the enterprise, spearheads the Meaning Based Computing movement. IDC recently recognized Autonomy as having the largest market share and fastest growth in the worldwide search and discovery market. Autonomy's technology allows computers to harness the full richness of human information, forming a conceptual and contextual understanding of any piece of electronic data, including unstructured information, such as text, email, web pages, voice, or video. Autonomy's software powers the full spectrum of mission-critical enterprise applications including pan-enterprise search, customer interaction solutions, information governance, end-to-end eDiscovery, records management, archiving, business process management, web content management, web optimization, rich media management and video and audio analysis.

Autonomy's customer base is comprised of more than 20,000 global companies, law firms and federal agencies including: AOL, BAE Systems, BBC, Bloomberg, Boeing, Citigroup, Coca Cola, Deutsche Bank, DLA Piper, Ericsson, FedEx, Ford, GlaxoSmithKline, Lloyds Banking Group, NASA, Nestlé, the New York Stock Exchange, Reuters, Shell, Tesco, T-Mobile, the U.S. Department of Energy, the U.S. Department of Homeland Security and the U.S. Securities and Exchange Commission. More than 400 companies OEM Autonomy technology, including Symantec, Citrix, HP, Novell, Oracle, Sybase and TIBCO. The company has offices worldwide. Please visit http://www.autonomy.com/ to find out more.

Autonomy and the Autonomy logo are registered trademarks or trademarks of Autonomy Corporation plc. All other trademarks are the property of their respective owners.

Labels: Autonomy, Compliance, eDiscovery, Governance, GRC, Litigation Service Providers, Litigation Software, Risk and Compliance

posted by Charles Skamser @ 10:17 AM 0 Comments

When to Bring eDiscovery In-house or Move to Cloud Computing?

Over the past 18 months, the “big buzz” in the eDiscovery market has been that the Global 2000 are bringing eDiscovery in house.  The value proposition is that outsourcing to legal vendors, service providers and/or outside counsel is just too expensive.  And, ultimately, ensuring that it (eDiscovery) is done properly (i.e. in a legally defensible manner, etc.) is the responsibility of the General Counsel (GC) and other C level executives (i.e. CIO, CFO, CEO) anyway.

However, what about members of the Global 2000 that don’t have enough litigation to justify bringing it (eDiscovery) in-house?  And, what about all the rest of the enterprises outside of the Global 2000 (the majority of the enterprises worldwide) that never have to deal with the issues and costs of eDiscovery?

First of all, with the inevitable convergence of eDiscovery and Governance, Risk and Compliance (See “ Government Intervention and Oversight Driving the Convergence of eDiscovery and Governance, Risk and Compliance (GRC)”) all enterprises worldwide are going to have to deal with the issues of information management and reporting as it relates to eDiscovery and GRC.
So, just because you never have to respond to requests to produce information due to litigation, it is negligent to not  be prepared (e.g. have a data retention policy and a plan for eDiscovery).  And now, with the accelerating increase in government intervention and oversight, Governance, Risk and Compliance (GRC) are almost certainly going to affect all enterprises worldwide in some way shape or form.

So, given the cost of “outsourcing” along with this inevitable new playing field, when do you bring eDiscovery in-house? Or, given the convergence of eDiscovery and GRC, maybe a better question is when should the enterprise have an  in-house plan and associated capabilities to support whatever legal and/or GRC requests come along?

The answer for some may be to keep outsourcing.  However, those that do had better brush up on their responsibilities (outsourcing or not) as the courts are no longer accepting ignorance as a defense.

Another alternative maybe to investigate Cloud Computing as a cost effective way of moving eDiscovery / GRC in-house without having to invest in all of the IT infrastructure.  Obviously, archiving data (e.g. email) “in the Cloud” has matured to the point where it is almost a “no brainer” for most enterprises to consider (no hate mail from the anti Cloud contingency please as your security concerns are beginning to wear a bit thin).  And, most if not all of the applications that it takes to support eDiscovery / GRC processing such as Early Case Assessment (ECA), Legal Holds, Search and Analytics and Document Review are now available as Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS).  Moving large amounts of data around and maintaining an appropriate chain-of-custody are still issues that need to be watched closely in this environment.

Enterprises worldwide, whether in or outside the Global 2000, are having to deal with the paradigm shift and subsequent realities of eDiscovery and Governance, Risk and Compliance (GRC) reporting.   And, the pressures of the worldwide financial crisis along with the accelerating increase in government intervention and oversight have unfortunately added another layer of complexity.

However, Cloud Computing is now a very viable alternative when considering moving your eDiscovery and GRC operations in-house.

Labels: Cloud Computing, Compliance, Convergence, Early Case Assessment, eDiscovery, eDiscovery Costs, eDiscovery Market, Electronically Stored Information, Governance, GRC, Risk and Compliance

posted by Charles Skamser @ 9:16 AM 0 Comments

Government Intervention and Oversight Driving the Convergence of eDiscovery with Governance, Risk and Compliance (GRC)

With the accelerating increase in the volume of Electronically Stored Information (ESI) along with increased government intervention and oversight, enterprises worldwide are experiencing an unprecedented increase in investigations and reporting  for eDiscovery and Governance, Risk  and Compliance (GRC).   With the financial pressures from today’s economic realities to reduce costs, you would have guessed that most enterprises would be investigating internalizing and centralizing the common activities of eDiscovery and GRC. 

However, as humorous, unbelievable or sad (or some combination of all three) as it may seem, this has just not been the case.

Historically, eDiscovery has been a reactive and outsourced process with little or no involvement from the Information Technology (IT) departments and Governance, Risk and Compliance (GRC) has been something that the “bean counters” will worry about.

However, in 2010 and beyond with increased government intervention and oversight in just about every aspect of the corporate world,  enterprises worldwide are beginning to realize that eDiscovery and all of its associated practices and requirements and Governance, Risk and Compliance (GRC) and all of its associated practices and requirements, may actually be “one- in-the-same” from many respects.  In other words, these previously disparate and most times redundant practices of eDiscovery and Governance, Risk and Compliance (GRC) are converging.

After all, how “forward thinking” do you need to be to “step back” from the daily complications of Global 2000 Information Technology (IT) and realize that, at some level and with a few paragraphs of caveats, it would be a “good thing” to retain all of this Electronically Stored Information (ESI) in some centralized repository, hook up one of today’s analytic platforms and then enable anyone within the enterprise, including eDiscovery and Governance, Risk and Compliance (GRC) practitioners to extract the ESI that they need to full their requirements.

Well, if you throw Data Retention Policy along with enterprise intra and inter divisional politics and inability of legacy systems to talk to one another into the mix, it may be a bit more complicated that I have portrayed. And, if you consider the legal requirements and associated ramifications incumbent in collecting and process ESI for a legal matter, eDiscovery does have its fair share of subtle nuiaces to consider.

However, the fact remains that from a pure financial standpoint. most enterprises world wide will have no viable options short of “continuing to drop the ball” but to integrate and converge eDiscovery and Governance, Risk and Compliance (GRC). 

Looking at this issue from an “investigative” standpoint, Albert Barsocchini, Guidance Software, wrote an excellent article that appeared on May 14, 2010 on the Wall Street and Technology Website titled, “Financial Institutions Now Taking a Holistic Approach to eDiscovery, Internal Investigations and Compliance”.

In this article, Mr. Barsocchini states that, “The 2009 financial meltdown has resulted in new lawsuits and the possibility of increased regulation for many financial firms. Pending legislation that will boost regulation of big banks and hedge funds are two recent examples of this trend. Similarly, legal action against Wall Street firms such as Goldman Sachs, Lehman Brothers and others illustrate the increasing need to be able to respond to an increase in both civil and criminal legal inquiries.”

He goes on to contend that, “These trends are driving a trend toward the corporate legal departments at financial institutions taking a unified approach on the mission critical functions of internal investigations, eDiscovery, audit and compliance. This has now become a boardroom-level issue. “

The “perfect storm is” is here and therefore it is time to stop debating about whether or not it is coming.  It is now time to debate how to deal with it.  Therefore, over the next 90 days, I am planning to evaluate and report on the “best-in-class” technologies and best practices that will provide the foundation for this convergence to occur.  I am also going to be reporting on several successful case studies.  So, I invite technology vendors, consultants and enterprises worldwide to contribute input and comments.  I look forward to hearing from you.

The full text of Mr. Barsocchini’s article is as follows:
 
The 2009 financial meltdown has resulted in new lawsuits and the possibility of increased regulation for many financial firms. Pending legislation that will boost regulation of big banks and hedge funds are two recent examples of this trend. Similarly, legal action against Wall Street firms such as Goldman Sachs, Lehman Brothers and others illustrate the increasing need to be able to respond to an increase in both civil and criminal legal inquiries.
These trends are driving a trend toward the corporate legal departments at financial institutions taking a unified approach on the mission critical functions of internal investigations, eDiscovery, audit and compliance. This has now become a boardroom-level issue.

Internal investigations can include issues involving human resource, fraud, unauthorized network access and intellectual property theft. eDiscovery can include both civil and criminal evidence collections as well as regulatory inquiries. Compliance covers data audit (personal identifiable information, record management enforcement, etc.), data security, HIPAA, Sarbanes-Oxley (SOX) fraud investigations, to name a few.
Traditionally, these types of investigations have been conducted by separate corporate departments and rarely have they been brought under one roof from a technology or departmental resource point of view.
Challenges Driving Convergence But recently, there has been a clear shift to consolidate these areas for efficiency, cost-effectiveness and other internal reasons. Companies are realizing that these departments can no longer operate in isolation and still meet today’s challenges.

There are a variety of challenges driving convergence, including increased litigation and internal investigations, the pressures of evolving case law, increasing volumes of data, reliance on smaller staffs and complex data privacy laws.

There’s also the possible need to defend the technology used in the investigation to prove that the computer program used to discover the computer evidence (ESI) generated authentic evidence. In these cases, the proponent of the evidence must testify to the validity of the program or programs utilized in the process. Daubert v. Merrell Dow Pharmaceuticals, Inc, 509 U.S. 579, 113 S.Ct. 2786, 125 L.Ed.2d 469 (1993) is a landmark U.S. Supreme Court decision that sets forth a legal test to determine the validity of scientific evidence and its relevance to the case at issue. On the other hand, in state courts we see the Frye v. United States, 293 F. 1013 (D.C. Cir. 1923) test employed which is used to determine whether a scientific technique for obtaining, enhancing or analyzing evidence is generally accepted within the relevant scientific community as a valid process.

Judges are also behind this convergence trend, advocating that companies bring eDiscovery in house. For example in Phillip M. Adams & Assocs., L.L.C. v. Dell, Inc., 2009 U.S. Dist. LEXIS 26964 (D. Utah Mar. 27, 2009) the court scolded the producing party, Phillip Adams, for not having appropriate technology to reasonable access potentially relevant electronically stored information (ESI). The court found it unacceptable for a party to hide behind inadequate information management systems as the reason why it could not produce relevant documents.

In Spieker v. Quest Cherokee, LLC, 2009 WL 2168892 (D. Kan. July 21, 2009) the court admonished the defendant for claiming they did not have the ability to generate the requested ESI materials in-house. "This court is aware of no case where a party has been excused from producing discovery because its employees ‘have not previously been asked to search for and/or produce discovery materials.”

Investigations are Similar in Nature
The typical investigation, no matter what practice area, tends to be reactive. Because every investigation is triggered by misconduct or legal proceedings, it is tempting to conduct every investigation in an ad hoc manner without any consistency. The more effective model is to conduct the investigation in a consistent manner under one roof using a single technology, if possible.

The ties that bind these internal inquiries are: they all have legal consequences and they all require similar investigation processes and techniques with similar consequences if not performed correctly. For example, the normal information security response to a network intrusion is to determine the scope of the breach, identify what data was compromised and patch the vulnerability. However, if these are not investigated properly, the company will not have the necessary evidence to properly prosecute a perpetrator either civilly or criminally. The information security department now needs to collect evidence properly according to forensic protocols and procedures for court validity, while at the same time doing their job to fix the breach.

Additionally, the typical triggering events (criminal misconduct, security breach, litigation, employee complaints, ethics hotlines, receipt of a subpoena, whistleblowers, competitors and customers, shareholder demands, regulatory audits and inquiries, responding to governmental investigations) for eDiscovery, compliance, security and audit requires immediate involvement from the legal department before any type of investigation can be initiated.

Legal-Centric Approach
Depending on the type of event trigger, the legal department should always be the first to be notified. They need to decide whether to investigate, who should be involved (human resources, the board of directors, outside counsel, security, etc.), the scope of the investigation, how it should be conducted and what will be done with the results of the investigation. This legal-centric approach provides companies with the best opportunity to get on top of the case early for early evaluation of the best “go forward” strategy.
This need for a unified approach is obvious when you see more cases involving network security issues, data privacy and the improper handling of electronically stored information. Because security, data privacy and collecting evidence can have significant legal consequences, corporate legal departments concerned about litigation and compliance are better equipped to coordinate and drive technology purchases than IT departments who are mainly concerned about data security and general computer network issues.
Overcoming institutional barriers within corporations is the biggest challenge to having a unified approach to eDiscovery, compliance and internal investigations. However, we are starting to see information security departments, IT and the legal departments work together to break down communication barriers and realize the benefits of cooperation and coordination.

The investigation risks are similar too - failure to find all relevant evidence, failure to properly preserve and authenticate relevant ESI, failure to meet deadlines, failure to document the process, failure to have a consistent workflow, unintentionally altering the evidence and evidence spoliation. Flawed investigations can seriously damage a corporation’s reputation, depress stock prices and hurt employee morale as well.

In all of these cases, the enterprises need to search, identify, preserve, collect and process evidence quickly for attorney or law enforcement or regulatory compliance review. Getting to the evidence over the network early is critical to the success or failure of an investigation.

For cost, efficiency, consistency and to mitigate risk, it makes sense to have a standardized, repeatable and defensible process for all types of corporate investigations. More companies today are creating a single team and using a single enterprise-class technology to perform these types of investigations. Companies without a coordinated policy and strategy will spend more on e-discovery, compliance and internal investigations than those taking a holistic approach.

Effective Response Plan
The need to become "investigation ready" is driving companies to assess, analyze and plan, and unify their investigation response practice. An effective response plan requires an organization to anticipate proactively the type of investigations that could be initiated and develop an offensive response strategy.

Technology is the linchpin to the overall implementation of a proactive response plan. When looking for enterprise technology to handle multiple types of computer investigations, look for technology that can search for evidence over the network from a central location, collect the evidence in a forensically sound manner and properly preserve all metadata. Additionally, having technology that can also do a network-based forensic examination is important for IP theft, SOX investigations and HR cases.

Recommended best practices include having a comphrensive corporate investigation and document retention policy, developing a repeatable process to properly identify and retain evidence for both civil and criminal matters, developing a response strategy for both inside and outside counsel, properly identifying event triggers and creating a decision tree, determining who in the enterprise should control and conduct the investigation, determining how the investigation should be conducted, what should the scope of the investigation be, and what will be done with the results of the investigation.

The rewards of becoming investigation ready and centralizing the process will help a company have a strategic advantage by quickly and efficiently identifying potential liability and effectively limiting risk while allowing the company to control the process before governmental or other third party intervention. It also gives the corporation more time to develop a response or defense strategy, which may ultimately minimize overall criminal and civil exposure and reduce the likelihood of lawsuits. Finally, it can make a corporation look more responsible to the courts, government regulators, shareholders, and auditors, thus minimizing the effect of any negative publicity that has arisen from allegations of wrongdoing while also satisfying the board’s fiduciary obligations to the stockholders.

Ultimately, the goal is to establish a legally-defensible response plan that builds upon prior experience, provides a common language and establishes an effective evidence lifecycle management framework to minimize risk and increase the effectiveness of an investigation. It is a critical piece of overall corporate policy. Combining these investigation areas will provide an organized business workflow that efficiently combines people, processes and technology.

Labels: 2010 eDiscovery Predictions and Trends, Convergence, eDiscovery, Governance, GRC, Risk and Compliance

posted by Charles Skamser @ 9:06 AM 1 Comments

New Incident/Fraud Prevention and Response Platform for Enterprise eDiscovery and GRC

This post announcing a new incident management platform may seem like a bit of stretch for an eDiscovery Blog. However, with the convergence of eDiscovery and Governance, Risk and Compliance (GRC), Incident/Fraud Prevention and Response and managing the process of Digital Forensics within the enterprise is actually a topic, technology and business processes that everyone involved with eDiscovery within the enterprise needs to start paying attention to.

Therefore I thought that it was appropriate to announce the release of release of version 3.0 of the IncMan Suite from DFLabs in Italy. The IncMan Suite contains IncMan Module, Digital Investigation Manager (DIM) and ITILity Help Desk Module to enable an organization to quickly and easily catalog every security incident from detection and mitigation to closure. It appears to be a really great solution for any organization that needs this functinoality but isn't ready or doesn't have the resources to install one of the legacy solutions. IncMan is definitely a really great example of the new breed of Web based applications (SaaS) that are going to give enterprise decision makers reason to upgrade from the bulky and expensive legacy systems that they have used in the past. It's just about time.

Raju Shanbhag, a TMCnet Contributor wrote an excellent intorductory overview of IncMan on the TMCnet.com site on Febraury 23, 2010. The full text of the from Raju Shanbhag article is as follows:

Managing information security incidents is a huge task for any company. DFLabs is looking to make this task simpler and easier to handle with the release of version 3.0 of the IncMan Suite. With the help of this solution, companies can manage information security incidents, within a single framework.

Companies need to adhere to their information security strategies to ensure business security. The information security involves many areas such as Incident/Fraud Prevention and Response, Digital Forensics, e-discovery, Litigation Support etc.


The complete version of the DFLabs’ IncMan Suite contains IncMan Module, Digital Investigation Manager (DIM) and ITILity Help Desk Module. It contains three modules that can operate both autonomously and integrated. Also, to catalog every security incident from detection and mitigation to closure and report generation, IncMan module is presented as an integrated component.

“We are particularly proud of the development effort that went into this latest release of our IncMan Suite,” declared Dario Forte, CEO and Founder of DFLabs. “Thanks to this new arsenal of tools, CIO, CISO, Incident Responders and Forensics Examiners, are now better equipped to respond to cyber-security incidents, precisely assessing the costs involved, documenting every detail for legal and audit purposes, and guaranteeing an unassailable Chain of Custody.”

DFLabs’ IncMan Suite ensures the compliance with standards such as IODEF (RFC 5070). It enables the investigator to catalog and manage all information related to a breach of security incident. DIM, the Digital Investigation Manager, is the forensic and evidence management module. With the help of Chain of Custody details and interactions with authorities, this component manages images from the forensic duplication of the memory, photographic catalog, log files.

In November 2009, eDiscovery Solutions Group entered into a partnership with DFLabs to provide a wide range of Governance, Risk and Compliance (GRC) and eDiscovery consulting, services and technology for eDiscovery Solutions Group clients throughout the world. Also, other partners from the eDiscovery Solutions Group consortium will enable DFLabs to expand its GRC and eDiscovery offering.

Labels: DFLabs, eDiscovery, Governance, GRC, Risk and Compliance

posted by Charles Skamser @ 1:36 PM 0 Comments

How is Outside Counsel Doing wtih eDiscovery?

I grew up in the world of Global 5000 Business Process Automation (BPA), Business Process Improvement (BPI), Business Process Management (BPM) and Balanced Score Cards. Therefore, I can sling information and business consulting acronyms with the best of them. However, now that I live in the world of eDiscovery and Governance, Risk and Compliance (GRC), I am faced with an industry that, for the most part (there are some exceptions), is just not familiar with the practice of BPM or its benefits. And, in many cases it is literally a matter of "not even knowing what you don't know." Therefore, I believe that the next big market for BPM and all of its associated glory is the GRC and eDiscovery markets. After all, I can't help by wonder if there are any General Counsel in the Global 2000 that would like to know how their outside counsel would score on an independent eDiscovery and GRC Assessment. And, there may even be some CEOs or Board of Director members that would like know how their legal departments would score on an independent internal eDiscovery and GRC Assessment.

As a place to start, I wanted to comment on some of the finding by Elise Olding in the Gartner RAS Core Research Note G00165528 from March 12, 2009 titled, "It's a Matter of Survival: Use BPM to Drive Out Costs".

Ms. Olding put forth the proposition that, "In a troubled economy, struggling companies often cut costs broadly and blindly without understanding whether those cuts further compromise their survival." This statement should ring very true today for both the legal departments of the Global 5000 and certainly law firms as they have both dramatically cut costs across the board without understanding the effect it may have on their ability to effectively handle eDiscovery. She went on to state that, "For struggling companies, business process management is a lifeline that helps them survive by reducing and avoiding costs in this volatile and turbulent economy." I contend that the same holds true for law firms and legal departments as they struggle to compete and survive. However, I am also going to contend that due to the fact that very little is truly understood and very little has been documented about the processes involved in GRC and eDiscovery, even without the pressures of the current economic situation, BPM would be an excellent approach for law firms and legal departments to employ to ensure that they are carrying their duties in regards to the serious issues of governance, compliance, risk management and eDiscovery in a manner that will enable the best possible outcomes.

Whether its Sarbanes-Oxley compliance or ensuring that you are following the rules of handling Electronically Stored Information (ESI) as stated in the amended Federal Rules of Civil Procedure (FRCP), leaders from Global 5000 legal departments and partners at the major law firms need to seriously consider beginning to employ the Business Process Management (BPM) methodologies and technologies that have been successfully used throughout the rest of the Global 5000 enterprises for many years.

Labels: Assessments, BPM, Business Process Automation, Compliance, FRCP, Global 5000, Governance, GRC, In re: Fannie Mae Securities Litigation, Law Firms, Sarbanes-Oxley

posted by Charles Skamser @ 3:47 PM 0 Comments

eDiscovery Solutions Group to Offer File Transfer Security Solution to Technology Vendors and End-users in eDiscovery and Governance, Risk and Compliance (GRC)

With the accellerating increase in the amount of Electronically Stored Information (ESI) and the subsequent exponential increase in the amount data that has to be saved, collected, analyzed and produced to meet the reporting reqirements of today's global enterprise, file transfer security and integrity should be on the minds of every CIO and General Counsel in the world. However, I believe that many of us have been lulled into a false sense of "secutiry" and throw around terms like MD5 and SHA hash, SSL certificates and ditigal signatures to cover our true understanding of whether or not "our data" is really safe.

Following the lead of IBM, Sun Microsystems and the UK Government, eDiscovery Solutions Group believes that there is market for next generation file transfer security and integrity and has therefore announced that is has formed a partnership with Tru Data Integrity Limited to Market the TruSeal™ Electronically Stored Information (ESI) Integrity and File Transfer Security Solution to Technology Vendors and End-users in the eDiscovery and Governance, Risk and Compliance (GRC) markets.

The full text of the press release is as follows:

New York, New York (October 6, 2009) - eDiscovery Solutions Group, an emerging leader in providing comprehensive eDiscovery and Governance, Risk and Compliance (GRC) consulting, services and technology worldwide announced today that it has entered into a partnership with Tru Data Integrity Limited, a European-based provider of next generation Electronically Stored Information (ESI) file transfer security solutions.

TruSeal™ is a next generation “disruptive” technology that enables users to digitally fingerprint and timestamp any Electronically Stored Information (ESI), assign a unique digital signature, store the signature and associated information about the ESI on a secure cloud based server and then require any third parties that need to read the ESI to verify their credentials. All calls to and from the server are securely encrypted as is the TruSeal record. In addition, the Software-as-a-Service (SaaS) based system keeps a complete audit log of all activities. Packaged for use by both end-user as a stand-alone system and as a component to be integrated with Governance, Risk and Compliance (GRC), eDiscovery and other ESI management platforms that require a high level of data security and integrity, TruSeal™ is easy to use and will fulfill the integrity requirements of even the most stringent users.

TruSeal™ has successfully completed extensive testing at IBM's Research and Development facility in Hursley in the United Kingdom. TruSeal™ has been granted both hardware and software clearance status for incorporation into value propositions throughout the IBM organization. With IBM’s "chiphopper" and “blue stack” status, TruSeal™ is now immediately available to work with DB2, Lotus Notes and Websphere, Integrations with Domino, Content Manager, Web forms and Tivoli are key elements of the TruSeal™ product roadmap.

In addition, Sun Microsystems has integrated TruSeal™ in a new approach to data retention. Focusing on communication service providers (CSPs), Sun’s Secure Data Retrieval Server (SDRS), combines data storage, highly secure operating system and data management software with TruSeal™ to provide a solution to the new EU Communication Data Retention initiative.

Further, Tru Data Integrity’s TruSeal™ product is the sole UK Government accredited product to lend integrity to any digital information on a COTS (commercial off the shelf) product. The GGAP objective is to establish and formalize partnerships with IT and business suppliers, and thereby facilitate innovation to assist the EDT in the implementation of the Transformational Government Agenda.

Under the terms of the partnership, eDiscovery Solutions Group will immediately begin marketing TruSeal™ to the legal and IT departments of the Global 2000, law firms and to Governance, Risk and Compliance (GRC), eDiscovery and other ESI management platforms that require a high level of data security and integrity.

“ESI security and integrity is an issue that has been on the minds of every CIO in the Global 2000 for the past 10 years. However, when you now have the real requirements of GRC and eDiscovery brought on by changes to the federal rules of civil procedure and beefed up government statutes to address the collapse of worldwide financial systems in 2008, ESI security and integrity may be the single most important issue facing the Global 2000 in 2009 and beyond,” states Charles Skamser, President and CEO of eDiscovery Solutions Group. “Therefore, we are very pleased to have formed a partnership with an organization with the reputation of Tru Data Integrity Limited and believe that together we will be very successful addressing the needs of the ESI security markets for years for come,” added Mr. Skamser.

Tru Data Integrity Limited is a company of Singlepoint Holdings Limited, a privately funded international group, founded in 2003 to address the compliance and legality issues affecting digital data.

Singlepoint Data Services Ltd, Tru Data Integrity’s sister company, was born to meet the requirements of the Regulation of Investigatory Powers Act (2000) (RIPA). It is the only organization accredited by the Home Office to act as a 'clearing house' for acquisition of communications data, as held by Telecommunications and Internet Service Providers for lawful business purposes. Access is required by a range of Law Enforcement Agencies including the Security and Intelligence Services, all Police Services, and a number of National Regulatory Bodies for the purpose of supporting criminal investigations.

“We are very pleased to be partnering with eDiscovery Solutions Group and becoming a member of the eDiscovery Solutions Group worldwide consortium, “stated Alun Thomas, Chief Executive Tru Data Integrity Limited, “We believe that TruSeal™ will have an immediate and lasting impact on the GRC and eDiscovery markets for both end users and solution vendors, ” added Mr. Thomas.

The worldwide security software market will total $14.5 billion in 2009, an 8 per cent increase from 2008, according to Gartner, Inc. In 2008, it grew at 19 per cent, and Gartner anticipates the market to grow 13 per cent in 2010 as revenue will total $16.3 billion. In Europe, the security software market will total €3.2 billion in 2009, representing 7 per cent growth from 2008.

“Although the worldwide security software market is affected by the economic downturn, the growth will continue to be strong in 2009 as security remains a critical area where drastic cuts cannot be afforded,” said Ruggero Contu, principal research analyst at Gartner. “In the medium term, the greatest growth opportunities will come from software as a service (SaaS), appliance based offering and small and medium businesses (SMBs), which are in security catch-up mode compared with large companies and therefore spend a higher percentage of their budgets on security.

Additional information is available in the Gartner report “Market Trends: Security Markets, Worldwide, 2007-2013.” The report is available on Gartner’s website at http://www.gartner.com/DisplayDocument?ref=g_search&id=1107215&subref=simplesearch.

About Tru Data Integrity Limited Tru Data Integrity Limited is a company of Singlepoint Holdings Limited, a privately funded international group, founded in 2003 to address the compliance and legality issues affecting digital data.

Singlepoint Data Services Ltd, Tru Data Integrity’s sister company, was born to meet the requirements of the Regulation of Investigatory Powers Act (2000) (RIPA). It is the only organization accredited by the Home Office to act as a 'clearing house' for acquisition of communications data, as held by Telecommunications and Internet Service Providers for lawful business purposes. Access is required by a range of Law Enforcement Agencies including the Security and Intelligence Services, all Police Services, and a number of National Regulatory Bodies for the purpose of supporting criminal investigations.

As RIPA is among the most stringent and robust of all compliance acts in Europe or North America, Tru Data Integrity was created to apply this model to other compliance areas. Tru Data Integrity delivers irrefutable data integrity for intellectual property protection, litigation and compliance purposes by sealing, transferring, managing and storing electronic information including documentation, imagery, video or audio files. For more information, visit http://www.tru-dataintegrity.com/

About IBM
For more information about IBM, visit http://www.ibm.com/.

About Sun MicroSystems
Sun Microsystems develops the technologies that power the global marketplace. Guided by a singular vision -- "The Network is the Computer" -- Sun drives network participation through shared innovation, community development and open source leadership. Sun can be found in more than 100 countries and on the Web at http://sun.com/.

About Gartner
Gartner, Inc. (NYSE: IT) is the world’s leading information technology research and advisory company. Gartner delivers the technology-related insight necessary for its clients to make the right decisions, every day. From CIOs and senior IT leaders in corporations and government agencies, to business leaders in high-tech and telecom enterprises and professional services firms, to technology investors, Gartner is the indispensable partner to 60,000 clients in 10,000 distinct organizations. Through the resources of Gartner Research, Gartner Consulting and Gartner Events, Gartner works with every client to research, analyze and interpret the business of IT within the context of their individual role. Founded in 1979, Gartner is headquartered in Stamford, Connecticut, U.S.A., and has 4,000 associates, including 1,200 research analysts and consultants in 80 countries. For more information, visit http://www.gartner.com/.

About the Forbes Global 2000
The Forbes Global 2000 is an annual ranking of the top 2000 public companies in the world by Forbes magazine. The ranking is based on a mix of four metrics: Sales, Profit, Assets and Market value. The list has been published since 2003. For more information on the Forbes Global 2000 list for 2009, visit: http://www.forbes.com/lists/2009/18/global-09_The-Global-2000_Rank.html

About eDiscovery Solutions Group
eDiscovery Solutions Group is an international consortium of leading independent eDiscovery consultants, eDiscovery consulting firms, regional litigation service providers and best-in-class eDiscovery technology companies that have come together to provide all of the services, consulting and technology necessary to support the entire eDiscovery lifecycle for the legal departments of corporations, the IT departments of corporations that need to support eDiscovery requirements and litigation centric law firms.

With a growing consortium of partners worldwide, eDiscovery Solutions Group offers a broad array of eDiscovery consulting, services and technology along with project management to support the entire eDiscovery lifecycle. Following the eDiscovery processing paradigm of the Electronic Discovery Reference Model (EDRM), eDiscovery Solutions Group has developed an eDiscovery best practices framework that includes consulting, collection, analysis, processing, production, review and presentation.
Within this framework, the eDiscovery Solutions Group can deliver data retention policy, development, data archiving, eSecurity, eCompliance, eDiscovery readiness, strategic planning, implementation support, paper and ESI collection, investigations, expert testimony, data recovery, computer forensics, early case assessment, data analysis, data redundancy management, conceptual search, de-dupe, near de-dupe, scanning, copying, coding, language translation, EDD, TIFF conversion, hosting, on-site, on-shore and off-shore review, legal process outsourcing (LPO), courtroom graphics and presentations, tool training, systems integration and custom solutions. For more information about eDiscovery Solutions Group, please visit: http://www.ediscoverysolutionsgroup.com/.

Labels: DB2, eDiscovery, Governance, Lotus Notes, Risk and Compliance, Secure Data Retrieval Server (SDRS), Tivoli, Websphere

posted by Charles Skamser @ 10:48 AM 0 Comments