eDiscovery Data Mapping Should be a Top Priority for General Counsel and CIOs within the Global 2000

A key aspect and legal requirement of eDiscovery is the creation of a data map to determine precisely what information is available within an organization and where it resides. This is a process that should begin long before a company ever finds itself in court. Surprisingly, over the past 2 years, I haven’t found more than a hand full of General Counsel and CIOs at some of the largest companies in the world that truly understand the importance of eDiscovery Data Mapping, the risks involved in not having a working eDiscovery Data Map nor the fact that they should be leading the charge to develop and manage an enterprise wide eDiscovery Data Map.

Ganesh Vednere, a manager at Capgemini, wrote an excellent overview of the key aspects of eDiscovery Data Mapping titled, “The Quest for eDiscovery: Creating a Data Map”. that appeared on the November / December 2009 Informatics site. In this overview, Ganesh indicated that, at a minimum, the enterprise should consider completing the following tasks as a general practice to start the eDiscovery Data Mapping process:

Get a list of all systems – and be prepared for a few surprises
Begin the process by creating a list of all systems that exist in the company. This is easier said than done, as in many cases, IT does not even have a full list of all systems. Sure, they usually have a list of systems, but don’t take that as the final list! Due diligence involves talking to business process owners, employees, and contractors, which often brings to light hidden systems, utilities, and home-grown applications that were unbeknownst to IT. Ensure that all types of systems are covered, e.g. physical servers, virtual servers, networks, externally hosted systems, backups (including tapes), archival systems, and desktops, etc. Pay special attention to emails, instant messaging, core business systems, collaboration software, and file shares, etc.

Document system information
After the list of all systems is known, gather as much information about each as possible. This exercise can be performed with the help of system infrastructure teams, application support teams, development teams, and business teams. Here are some types of information that can be gathered: system name, description, owner, platform type, location; is it a home grown-package, and does it store both structured and unstructured data; system dependencies (i.e., what systems are dependent on it and what systems does it depend on); business processes supported, business criticality of the system, security and access controls, format of data stored, format of data produced, reporting capabilities, how/ where the system is hosted; backup process and schedule, archival process and schedule, whether data is purged or not; if purged, how often and what data gets purged; how many users, is there external access allowed (outside of the company firewall), are retention policies applied, what are the audit-trail capabilities, what is the nature of data stored, e.g. confidential data, nonpublic personal information, or still others.

Get a list of business processes
Inventory the list of business processes and map it to the system list obtained in the step above to ensure that all the various types of ESI are documented. The list of business processes is also useful during the discovery process, when one can leverage the list to hone in on a particular type of ESI and obtain information about how it was generated, who owned the data, how the data was processed, how it was stored, and so on. A list of business processes can also be useful when assessing information flows.

Develop a list of roles, groups, and users (custodians)
Obtain the organizational chart and determine the roles and groups across the business and the business processes. Document the process custodians and map out who had privileges to do what. Understand the human actors in the information lifecycle flow.

Document the information flow across the entire organization
Determine where critical pieces of information got initiated, how the information was/is manipulated, what systems touch the information, who processes the information, what systems depend on the information, and so on. Understanding the flow of information is key to the data mapping/discovery process.

Determine how email is stored, processed, and consumed
Given the large percentage of business information and business records that reside in email, special attention needs to be placed on email ESI. Typically email is the first thing that opposing counsel go after, so determining whether email retention and disposition policies are consistently enforced will be key to proving good faith. There are a number of automated tools that will enable you to create email maps, link threads of conversation, heuristically perform relevancy search, extract underlying metadata, and so on. Before deciding to buy the best-of-breed solution, however, perform due diligence on existing email processes. Understand how employees are using email. Are they creating local archives (.PST files), are they storing emails on a network or a repository, are they disposing of them at the end of retention periods, are they using personal emails to conduct official business, and so on. Identify deficiencies and violations in email policies before the opposing counsel does.

Identify use of collaboration tools
SharePoint will have the lion’s share of the collaboration space in many organizations, but even then you must ensure that all other tools – whether they are social networking tools, Web-based tools, or home-grown tools – are included in the data-mapping process. You need to carefully document the types of information being stored on each of these tools. Sometimes company information has a nasty habit of being found in the most unlikely of places. Wherever possible work with compliance, information management, or records management groups to establish usage policies to prevent runaway viral growth of these tools. If the organization already has thousands of unmanaged SharePoint sites, work with IT and business to institute governance controls to prevent further runaway growth.

Don’t forget offsite storage
After inventorying and mapping all systems, one would think the job is done. Alas, there is more work ahead. Offsite storage is an often under-appreciated aspect of the discovery process. It is quite reasonable to assume that there might be substantial evidence stored offsite which might become incriminating at a later date. Offsite storage may contain boxes or tapes full of records whose existence was somehow never properly documented, with the result that they cannot be located unless someone opens the box or attempts to recover the tape data. These records continue to live well past their onsite cousins. This means the organization continues to have the record in backup tapes (or paper) and other formats that it purportedly claimed to have destroyed. The search for records in offsite storage is made more complicated if the offsite storage process did not create detailed indices about the contents. If there are tapes labeled “2007 Backup Y: Drive,” then it may become quite an arduous task to determine what information is really contained in those tapes. Nevertheless the journey must be started. It could involve anything from a full-scale review of all tapes, followed by reclassifying and re-filing the tapes, to perhaps a review of just the offsite storage manifests. It could also involve a search for critical information or a clean-up of the last three years’ worth of tapes, and so on.

eDiscovery Data Mapping Platform
This is an impressive beginning best practice. However, I would add the requirement of seriously considering investing in an eDiscovery Data Mapping platform to help guide you through the eDiscovery Data Mapping process and then manage all of the information that you discovery. After all, just creating your eDiscovery Data Map is just the beginning of the process. The real value of creating the eDiscovery Data Map will be seen when your enterprise uses the eDiscovery Data Map to support your first legal matter and enables you to more fully meet the legal requirements of the the Federal Rules of Civil Procedure (FRCP) and the associated state and local rules.

Genome from Exterro, is an excellent example of a new generation of data mapping solutions that are dynamic, shifting to reflect your company's information universe as it evolves.Through intelligent workflows and automated processes, Genome enables IT departments and legal teams to quickly visualize and analyze data source information to proactively scope case parameters. Over the next couple of weeks, I will be reviewing the solutions that are currently available along with some recommendations for which platforms will provide the best return on your investment (ROI).

The full text of Ganesh Vednere’s overview is as follows:

A key aspect of ediscovery is the creation of a data map to determine precisely what information is available within an organization and where it resides. This is a process that should begin long before a company ever finds itself in court.

The phone rings. It is the general counsel. The organization may be sued over patent infringement. Counsel knows that this could be “The Big One.” All sorts of data, documents, metadata, emails, and other forms of information may be required. Counsel asks IT: Do you have, or can you get together, a list of all systems and the data they contain?” There is a long, silent pause on the phone. Then the IT manager says “Well, we do have a list of systems. Let me send it your way.” Counsel gets the list. It is nothing close to the data map it needs. Instead it is a list of servers, their IP addresses, platform configuration, and their physical rack location in the data center. Good information for disaster recovery purposes, but not particularly helpful in court.

“Well, this is the best I’ve got,” comes the retort from IT. “We do not have a data map nor would we know how to create one – and, by the way, do you really think we have the bandwidth to work on this now?”

Why You? The Challenge of Data Mapping So who gets stuck with the job? You do. You might argue that “IT manages all the infrastructure and stuff, why couldn’t they just run an inventory on their systems?” And IT will reply that “Well, we do manage the infrastructure, but we know very little about the inputs, outputs, documents, records, and other information on these applications. Go talk to the business side.” And you go to business, and business will tell you that “I just use the system and click these buttons on the screen. The system is a black box to me. I have no idea about all of the underlying data, metadata, and data structures. I suggest you talk to the operational folks.” And you talk to the operational folks, and they say, “What are you talking about? We just execute business processes. Don’t ask us about data and metadata. Go talk to the analyst who worked on the system design.” And you look for the analyst, and you eventually learn that …“Oh, she was a consultant and she left the project three years ago.”
The challenges are many but the data map must be created. And the job is yours. So where do you start? By going back to the beginning … the very beginning.

How Did We Get in Such a Mess? Let’s take a look at a typical mid-size organization. It has several thousand employees and contractors with offices in the U.S. and E.U. The sheer volume of information that resides in just one division is mind-boggling. New information sources keep popping up, employees keep creating new SharePoint sites on their own, and there is use (or misuse) of social collaboration tools, to say nothing of several hundred IT systems in play at any point in time. Data is moved and migrated from one place to another without proper documentation or communication, more and more tape backups are being created, and some employees are making copies of data on thumb drives or worse, emailing them to their personal email addresses.

How did things ever become such a mess? There are manifold reasons: IT is traditionally kept at arm’s length on compliance and uninvolved with information management and governance during systems design and development. Records management departments, on the other hand, often institute sound policies and retention schedules but have a tough time putting these into practice and getting people to adhere to them. On the legal side, general counsels often work against themselves: becoming increasingly exasperated over the large amount of money spent on searching, processing, and producing electronically stored information (ESI), they often push hard to cut costs, thereby shortcircuiting the process.

Must an Organization Have a Data Map?
It may seem surprising that even today, many successful organizations do not have a data map, or at best, a superficial one. It is not that organizations are lacking in will, however, but that the process seems too daunting. Consider the “typical organization” above. If there are several hundred IT systems and other home-grown business applications, one must not only know what these systems are, and where they are located, but also the types of information (documents, records, other content) that are produced from these systems and additional information such as data format, data location, whether the data is updated by other systems, or transformed into other formats, etc.

To add to the complexity, a determination also needs to be made as to whether a piece of ESI can be extracted and presented using reasonable and customary means. For example, if an IT system was retired and the data backed-up on tape, it is reasonable to assume that extracting the tape, processing the information, and presenting it in a readable format may not be easy since the underlying version of the software no longer exists. Counsel, however, must be able to assess whether this is indeed the case. Having a data map eases some of these tasks and makes it easier for counsel to relate the information as needed.

Data Mapping Considerations
In the current economic environment, companies are bracing themselves for an uptick in the number of lawsuits. Whether the matter is related to regulators, customers, consumers, employees, or business partners, companies are often required to provide ESI in court. While this should be sine qua non for most organizations, many are simply too overwhelmed to be able to react fast enough and are thus placing themselves at a much greater risk. If that’s the case in your enterprise, here are some initial steps that will help you move forward.

1. Understand the prevailing legal environment. Organizations are not created equally, and not all have the same set of applicable legal requirements. It is therefore important to analyze the type of environment that the organization operates in, the jurisdiction it is under, and the various federal and state laws, regulations, and common industry standards that apply to it, with regard to ESI. While the contents of a data map by itself do not directly correlate to a particular law or regulation, it is useful to know what checks and controls need to be established during the datamapping process and ensure that there are no “show-stopper” questions in court around how the data map was created or what the process was.
2. Use a partnership model and obtain buy-in from senior management. It is important that each entity within an organization have a vested stake in the success of any data-mapping project. This means that management in each of these organizational fiefdoms must understand what a data map is, how it will be used, and what the process of creating one is. Getting buy-in from these senior managers is a crucial first step and must be completed prior to the start of the process. Additionally, it is important that people of the appropriate rank are selected to work on the project. Folks who are deep in the weeds will generally have a lot more information about data flows and how processes and people work together versus the senior executive who operates in more of a decision-making capacity.
3. There is little point in pursuing a “big-bang” approach for the data map. Instead, work towards a phased approach. Prioritize which divisions or lines of business to focus on first and then address the remaining ones later. Work with line managers to determine what, if any, information has been collected on systems and processes within their particular areas. Standard industry lists may be employed as a starting point, e.g. HR, Accounting, Communications and Marketing, etc. Begin the first phase of the process here and then iteratively build upon what’s already available.
4. Use the right technology. As more capital is allocated towards automating ediscovery, vendors will naturally gravitate towards building specialized software for this mission. Time, cost, and relevancy of results will drive the success of vendor products. While some organizations have attempted to build custom tools, more and more prefer choosing established products or service offerings to guide them through the rediscovery and data-mapping process. Already many vendors have begun mapping their offerings to the electronic discovery reference model (EDRM) and other industry standards. This market is still maturing and organizations should not go out and immediately purchase a top-rated vendor’s software without due consideration of the organization’s unique circumstances.

Creating the Data Map
Once you’ve worked your way through each of considerations above and taken action as needed, you’re ready to start the actual data-mapping process. It is lengthy but well-defined and can be broken down into each of the following steps:

The Data Mapping Process

1. Get a list of all systems – and be prepared for a few surprises. Begin the process by creating a list of all systems that exist in the company. This is easier said than done, as in many cases, IT does not even have a full list of all systems. Sure, they usually have a list of systems, but don’t take that as the final list! Due diligence involves talking to business process owners, employees, and contractors, which often brings to light hidden systems, utilities, and home-grown applications that were unbeknownst to IT. Ensure that all types of systems are covered, e.g. physical servers, virtual servers, networks, externally hosted systems, backups (including tapes), archival systems, and desktops, etc. Pay special attention to emails, instant messaging, core business systems, collaboration software, and file shares, etc.
2. Document system information. After the list of all systems is known, gather as much information about each as possible. This exercise can be performed with the help of system infrastructure teams, application support teams, development teams, and business teams. Here are some types of information that can be gathered: system name, description, owner, platform type, location; is it a home grown-package, and does it store both structured and unstructured data; system dependencies (i.e., what systems are dependent on it and what systems does it depend on); business processes supported, business criticality of the system, security and access controls, format of data stored, format of data produced, reporting capabilities, how/ where the system is hosted; backup process and schedule, archival process and schedule, whether data is purged or not; if purged, how often and what data gets purged; how many users, is there external access allowed (outside of the company firewall), are retention policies applied, what are the audit-trail capabilities, what is the nature of data stored, e.g. confidential data, nonpublic personal information, or still others.
3. Get a list of business processes. Inventory the list of business processes and map it to the system list obtained in the step above to ensure that all the various types of ESI are documented. The list of business processes is also useful during the discovery process, when one can leverage the list to hone in on a particular type of ESI and obtain information about how it was generated, who owned the data, how the data was processed, how it was stored, and so on. A list of business processes can also be useful when assessing information flows.
4. Develop a list of roles, groups, and users (custodians). Obtain the organizational chart and determine the roles and groups across the business and the business processes. Document the process custodians and map out who had privileges to do what. Understand the human actors in the information lifecycle flow.
5. Document the information flow across the entire organization. Determine where critical pieces of information got initiated, how the information was/is manipulated, what systems touch the information, who processes the information, what systems depend on the information, and so on. Understanding the flow of information is key to the data mapping/discovery process.
6. Determine how email is stored, processed, and consumed. Given the large percentage of business information and business records that reside in email, special attention needs to be placed on email ESI. Typically email is the first thing that opposing counsel go after, so determining whether email retention and disposition policies are consistently enforced will be key to proving good faith. There are a number of automated tools that will enable you to create email maps, link threads of conversation, heuristically perform relevancy search, extract underlying metadata, and so on. Before deciding to buy the best-of-breed solution, however, perform due diligence on existing email processes. Understand how employees are using email. Are they creating local archives (.PST files), are they storing emails on a network or a repository, are they disposing of them at the end of retention periods, are they using personal emails to conduct official business, and so on. Identify deficiencies and violations in email policies before the opposing counsel does.
7. Identify use of collaboration tools. SharePoint will have the lion’s share of the collaboration space in many organizations, but even then you must ensure that all other tools – whether they are social networking tools, Web-based tools, or home-grown tools – are included in the data-mapping process. You need to carefully document the types of information being stored on each of these tools. Sometimes company information has a nasty habit of being found in the most unlikely of places. Wherever possible work with compliance, information management, or records management groups to establish usage policies to prevent runaway viral growth of these tools. If the organization already has thousands of unmanaged SharePoint sites, work with IT and business to institute governance controls to prevent further runaway growth.
8. Don’t forget offsite storage. After inventorying and mapping all systems, one would think the job is done. Alas, there is more work ahead. Offsite storage is an often under-appreciated aspect of the discovery process. It is quite reasonable to assume that there might be substantial evidence stored offsite which might become incriminating at a later date. Offsite storage may contain boxes or tapes full of records whose existence was somehow never properly documented, with the result that they cannot be located unless someone opens the box or attempts to recover the tape data. These records continue to live well past their onsite cousins. This means the organization continues to have the record in backup tapes (or paper) and other formats that it purportedly claimed to have destroyed. The search for records in offsite storage is made more complicated if the offsite storage process did not create detailed indices about the contents. If there are tapes labeled “2007 Backup Y: Drive,” then it may become quite an arduous task to determine what information is really contained in those tapes. Nevertheless the journey must be started. It could involve anything from a full-scale review of all tapes, followed by reclassifying and re-filing the tapes, to perhaps a review of just the offsite storage manifests. It could also involve a search for critical information or a clean-up of the last three years’ worth of tapes, and so on.

Conclusion
In today’s highly litigious world, creating a data map is one of the primary steps in responding to litigation requests. It is vital that organizations get a solid foundation by focusing time, energy and resources in doing it right – and creating it long before it’s needed.

Labels: Compliance, Data Management, Data Map, Discovery, eDiscovery, Electronically Stored Information, ESI, Exterro, Federal Rules of Civil Procedure, FRCP, Legal Holds, Litigation Readiness

posted by Charles Skamser @ 8:00 AM 0 Comments

eDiscovery Solutions Group Partners with Third Coast Consultants

Labels: Document Rentention Policy, eDiscovery, FRCP Rule 26(f), Litigation Readiness, Third Coast Consultants

posted by Charles Skamser @ 10:22 AM 0 Comments

Doesn't Everyone Already Know About eDiscovery?

It's been over 2 years since the changes to the Federal Rules of Civil Procedure (FRCP) took effect, spawned a whole new industry called ediscovery and changed the face of litigation forever. So, since I have been living and breathing eDiscovery and watching this "eDiscovery Paradigm Shift" from ground zero and helping the "early adapters" wade their way through the morass of issues and technology, it appears that I may have lost some perspective in regards to the fact that no everyone in the legal market or in enterprises across the globe are worrying about eDiscovery compliance. How could that possible be?

Well, whether intended or not, that point was made clear to me by Rick Dales, Vice President of Product Management at Proofpoint, through an article that he had published on the Computer Technology Review site titled, "Is Your Company Ready for e-Discovery?: What FRCP Can Mean for Your Business and How to Prepare."

This article is well written, very informative and would be a great resource for the novice, uninformed IT director as an introduction to the requirements for managing Electronically Stored Information (ESI) in 2009. It may also qualify as required reading for any litigators or anyone associated with enterprise information management that been in a coma for the last 36 months.

In all seriousness, it is really easy for those of use who spend most of our waking hours working within the eDiscovery market to forget that eDiscovery is a fairly new discipline and that there are more professionals that don't know about it or haven't thought too extensively about how it will effect their operations and business than have.

So, maybe I am the one that has been living under the eDiscovery rock and maybe its time for me to realize that the rest of the world has not yet had the pleasure of experiencing the thrill and excitement of eDiscovery.

The full text of the article is as follows:

Electronic Discovery (or e-Discovery) refers to the producing, obtaining and reviewing of digitally stored electronic evidence in response to civil litigation. With the passing of the Federal Rules of Civil Procedure (FRCP), it’s a new era in which organizations are challenged with how to face the increasing pressure to proactively manage the retention and handling of various forms of corporate records and data for compliance and legal discovery purposes.

The first step to addressing this challenge is for enterprises to be aware of what is required under FRCP. Next, businesses should prepare themselves for compliance by ensuring the ability to retrieve and analyze terabytes of data upon request. With new advances in technology, this crosses an increasingly expansive landscape, including: email, instant messages, handhelds, laptops, enterprise networks, databases and SMS. By proactively addressing FRCP challenges, enterprise IT staffs can ensure a seamless process should the need for legal discovery ever arise.
What Is the FRCP?
The FRCP governs the conduct of all civil actions in US Federal District courts. Although the most recent amendments to the FRCP were made over a year ago, many companies are not familiar with what is required of them by law. Enterprises should be concerned about these new amendments because, unlike most data retention requirements that are industry specific (such as the NASD and SEC rules for financial institutions and broker-dealers), the FRCP applies to organizations in all industries.

Proper data retention is no longer just a best practice – it’s a legal obligation. If electronic data is not properly managed, corporations face serious consequences that include hefty fines or imprisonment, making it particularly important for business decision-makers and IT administrators to understand the new amendments. To prepare for e-discovery, organizations must adopt a complete approach to managing all types of data so that it can be easily searched and retrieved when necessary.

The Amendments and Their Implications
Recent FRCP amendments require companies to retain all their corporate correspondence, including electronically stored information (ESI), so that it can be produced in a timely and complete manner. As such, litigation readiness has become an increasingly important IT responsibility. The following is a summary of the amendments that impact e-discovery and reinforce the need for email archiving.

Rule 16: Pretrial Meetings
Requires all parties to meet and discuss a discovery plan and evaluate the preservation and production of ESI.

Rule 26(a): Duty to Disclose
Requires parties to identify all sources of ESI that may be relevant by category and location.

Rule 26(b): Discovery Scope and Limits
Every organization has “a duty to disclose all potentially relevant sources of information” to the courts as soon as they “reasonably anticipate” litigation unless these sources are “not reasonably accessible because of undue burden or cost.”

Rule 26(f): Planning for Discovery
Requires opposing parties to meet before the trial, or at least 21 days before a scheduled conference to discuss the nature and basis of their claims in an attempt to speed the possibilities of a prompt settlement.

Rule 34(a): Producing Documents
Electronically stored data – including email – is one of the types of records which can be requested for inspection by opposing parties.

Rule 34 (b): Procedure and Form of Production
As a part of the discovery process, the responding party should provide a “proposed plan for discovery” and produce all requested information, including ESI, in a form that is “reasonably useable.”

Rule 37(f): Sanctions for Failure to Make Disclosures or to Co-operate in Discovery This rule creates a “safe harbor” protecting a party from sanctions arising from its deliberate deletion of ESI as long as it was deleted “as a result of routine, good faith operation of an electronic information system.”

Complying with the Amendments
In an effort to be proactive, businesses should develop an organization-wide approach to understanding and organizing ESI. However, many storage managers do not have the technology in place to properly produce information such as corporate and personal email records, attached files and instant messages. According to a recent survey conducted by Osterman Research, about one third of IT managers surveyed admitted that they could not produce an email over a year old.

The research showed that only a small number of organizations have a corporate retention policy in place and one fourth of these companies deleted their emails within 90 days of being stored. The lack of policies for items such as personal emails and the inability to locate each and every place where corporate or personal email data could reside can cause serious problems for companies that need to produce all relevant information during e-discovery or regulatory audits. These findings demonstrate that over a year after the amended FRCP, most organizations are not fully prepared to comply. To meet these requirements, organizations must develop a sound email policy that can be implemented and maintained with an effective email archiving solution.

Are You Prepared?
To evaluate your organization’s litigation readiness, IT managers should ask the following:

Do you have an email retention policy?
Your records management policy must address the different types of electronic documents that may be created in a corporate environment. It is critical that email policies provide adequate instructions to employees regarding their duty to preserve email and the manner, method and location of preservation.

Are you confident that your email retention policy is being enforced?
Simply having an email retention policy is not sufficient to meet the FRCP requirements. Organizations must ensure that the policy is enforced and that all copies of email are disposed of once they have reached their retention period. Implementing an effective email archiving solution within your organization will allow you to set retention policies that are automatically enforced so that regular electronic data is not kept longer than necessary and relevant data (such as emails that have been placed on litigation hold) is preserved for a longer period of time.

Do you know where all copies of corporate email are stored? Can you easily access them?
As the FRCP amendments require full disclosure of relevant ESI and their location, organizations must clearly disclose to staff the acceptable locations for storage of business records. By specifying in the email policy that all electronic records can only be stored in the corporate email server (and the accompanying corporate email archive), businesses can dramatically simplify this process.

Can you enforce a litigation hold?
The FRCP requires businesses to place a litigation hold on any information that may be relevant to a case as soon as they “reasonably anticipate” litigation. Placing a litigation hold ensures that any existing or future electronic records related to a particular lawsuit are preserved indefinitely, even if past the stated retention period. Most companies do not have the storage resources to handle this, nor do they have the ability to put data on hold within short notice. An email archiving solution that is equipped with a litigation hold capability can address this concern by allowing organizations to automatically put relevant records on hold so that they are preserved for the duration of the litigation.

Do you have the tools to search through every email sent or received for legal discovery purposes within 30 days of an order?
Electronic messages are typically stored in many different locations. For purposes of litigation, companies must be able to quickly sort through all this email data. The simplest and most effective way of achieving this is to ensure that electronic records are stored in a searchable format in a centralized location. Most email archiving systems have an advanced search capability which allows the legal department to easily search through the full text and attachments of all email in order to quickly respond to legal discovery requests.

If you answered ‘No’ to any of the above questions you need to sit down with your IT team and legal counsel as soon as possible. In order to be in compliance, appropriate solutions need to be in place before it is too late.

Labels: Data Management, Document Rentention Policy, eDiscovery, email, Federal Rules of Civil Procedure, FRCP, IT, Litigation Readiness

posted by Charles Skamser @ 8:59 AM 0 Comments

Proactive eDiscovery should be at the top of Enterprise Hierarchy of Needs

It appears that the debate over the importance of proactive eDiscovery isn't going to linger in perpetuity like the 60 year debate over how Maslow's Hierarchy of Needs pertains to the Enterprise or the other well know corporate decision about whether to stock Coke or Pepsi.

According to The Radicati Group, the total email archiving market (including both on-premises archiving solutions and hosted archiving services) reached almost $1.3 billion by the end of 2007, and should grow to over $6 billion by 2010. Other analysts such as Gartner and Forrester show similar trends.

However, there are still some in the industry that are contending that the enterprise still has time to investigate and move forward at a more measured approach based upon the potential risks (e.g. sanctions and potential losses due to the costs associated with reactive eDiscovery).

As an example, in an article titled "Driving Toward Cost-Effective E-Discovery", by Jeffrey Beard, published in the May 2008 issue of InsideTech, Mr. Beard contends that well thought out processes and procedures may be a sufficient remedy in the short term. And, although I agree 100% that top down driven enterprise wide process and procedure are a necessary component for success, proactive eDiscovery technology needs to be at the top of every enterprise list for implementation in the 2008-2009 time frame. With costs plummeting and sophistication increasing at an accelerating rate for email archiving, enterprise wide Electronically Stored Information ("ESI") achieving, off-site/online storage and all of the associated Litigation Readiness eDiscovery infrastructure, there is no longer any financial justification for any enterprise at any level to not have some type of proactive solution already implemented.

And, in light of the afforable proactive eDiscovery options, I am beginning to see the courts and juries less and less tolerant of enterprises contending that the costs of reactive eDiscovery is prohibitively high or too complex. As an example, Medtronics, having already invested millions just to retrieve and review documents, including vast amounts stored on backup tape, was stunned by a jury verdict of $570 million and learned a hard lesson about retaining too much electronic information. Morgan Stanley was ordered to pay $604 million in damages to an investor after it failed to produce e-mails in a fraud case, and Phillip Morris was ordered to pay court-imposed sanctions of $2.9 million for failing to comply with its own document retention policy.

Proactive eDiscovery is obviously not going to create the same debate as Maslow's Hierarchy of Needs. Nevertheless, it is always interesting to watch the enterprise drag its feet or reluctantly "Cross the Chasm" even in the face of overwhelming evidence that it must do so to just keep pace with the pack or worse yet face financial ruin.

The full content of Mr. Beard's thought provoking article titled "Driving Toward Cost-Effective E-Discovery" is as follows:

In the first 18 months after the enactment of the amended Federal Rules of Civil Procedure (FRCP), companies tend to be at various stages in their internal initiatives and overall litigation readiness. Some litigation-heavy industries have felt the sting more strongly, including pharma, health care, energy, insurance and financial, so many of the larger players in these markets have already established in-house litigation readiness programs, processes and procedures. Others have experienced several substantial matters involving electronically stored information, not as a routine, but more akin to intermittent fire drills upon which to test their readiness mettle.

When everything is added up, though, reactionary measures often cost more than proactive ones. Why? Because reactionary processes are at best ad hoc, generated on-the-fly as the need and urgency compels decision-makers at all levels, from the GC and CIO down to the paralegals and IT personnel charged with their execution. As we’ve seen in various reported cases, they introduce huge inefficiencies and costly mistakes, particularly in the areas of preservation, collection, and the timely and effective imposition of an internal legal hold. Also, not having a smoothly practiced and executed preservation/collection plan causes additional and very substantial costs to be incurred downstream, particularly during the most costly phase—review.

Those looking to more proactively increase their readiness have increasingly begun to turn to e-mail, content and records management. However, unless it’s a bet-the-company or other high-profile case, a floodgate-opening precedent or the promise of a stinging sanction, it often doesn’t make sense to write a blank check on e-discovery. The new rules introduced the concept of proportionality, balancing the costs of discovery with the potential monetary amount at issue. Indeed FRCP Rule 1, sometimes referred to as the mission statement of the new rules, tells us they “should be construed and administered to secure the just, speedy, and inexpensive determination of every action and proceeding.”

Inexpensive? The harsh reality is that the legal market isn’t there yet, not by a long shot. So where does it make sense to invest in litigation readiness and ultimately reduce your risks and associated costs? Naturally, it depends on your litigation and e-discovery risk, your company’s tolerance for those risks and the financial and human resources that can be applied. In-house legal departments tend to lack in one or both of the latter due to the regular push of business and financial pressures to keep head count reasonable.

Many companies already have defined processes in varying stages of development and execution, so the next logical step is to assess their inherent strengths and weaknesses—what has worked well and what hasn’t. From that analysis, you can determine your ongoing inherent risk as well as areas for improvement and additional investment. However, it can be challenging for in-house groups to have a truly objective perspective of their internal processes. Sometimes they are simply too close to the problem or, worse, are part of it, whether they realize it or not.

For example, where are the “black holes” in your internal collection efforts? Sometimes key things get overlooked when the professionals tasked with these efforts have conflicting priorities and workloads. These problems are further compounded by miscommunication and changing expectations due to the matrix nature of cross-functional groups.

This is where it often pays dividends to bring in the broader perspective of an outside litigation readiness consultant who will take a more objective and comprehensive approach. Organizations can then use their recommendations to address the highest risk areas first, coupled with best practices derived from working with similarly situated organizations.

E-mail still remains one of the highest risk areas, and worthy of further efforts. While tools exist to help with collection, review and early assessment, those tools are most effective when you have implemented effective processes and procedures within your organization. For instance, do you have policies which allow the creation of separate e-mail archives on each user’s local computer hard drive? These are often referred to as PSTs for Microsoft Outlook and NSFs for Lotus Notes. Having these additional custodian repositories can vastly drive up the cost and complexity of your litigation readiness and response to requests, with additional preservation, collection, deduplication, search and review requirements. Do you have consistent auto-deletion periods for all custodians or defined classes of custodians? As e-mails can also become business records, are your e-mail system policies tied to your records management policies? The more consistency you have across your systems and policies, including in their execution by users and administrators alike, generally the better your overall defensibility.

Recent case law addressing e-discovery-related issues suggests that among the greatest risk areas are the timely and effective imposition of a litigation hold and the resulting successful identification, preservation and collection of all relevant e-mail and other data. A number of organizations are still doing legal hold notices the “old fashioned way”—e-mailing notices to identified or potential custodians.

While leading e-mail systems allow for sending delivery and/or read receipts from the intended recipients, further automation support is likely required to consistently address tasks such as custodian follow-up and tracking, auditing and reporting the statuses for interviews, collections and ongoing preservation efforts. There are a growing number of third-party systems which address some or all of these needs, while some companies have turned to their internal technology professionals to build them instead. This is a key area in which to involve a qualified litigation readiness consultant, who can help identify your specific needs, assimilate the requirements for inclusion in RFIs and RFPs and work with outside system providers and your IT professionals to select the solution best matched to those needs.

For organizations looking for better ways to achieve their goals with limited resources, these are key steps that can lead to meaningful improvements and substantial reductions in their overall risk and cost. The important thing to keep in mind is that the solution is not a product, but a well-designed and defined process supported by good documentation, engaged and motivated people, and training, practice and automation where needed.

Labels: eDiscovery, email archieving, ESI, FRCP, Litigation Readiness, Maslow

posted by Charles Skamser @ 10:29 PM 0 Comments