Correct and Complete Data Archival

C1000g When we are going down the road of e-mail archiving for regulatory reasons is there a thing as 100% complete, or is 5 - 9’s accuracy good enough?

What is the consequence for correct and complete as it relates to data archival systems deployed for compliance, legal discovery and ultimately corporate risk management.

If you are challenged with the requirement for capturing all electronic communications (inbound/outbound) what mechanism, process or IT controls can help you to achieve 100% accuracy or better put - can guarantee both complete and correct results? Even in the best case scenario can you ever really account for technology outages, software bugs (that can occur at every layer below the application, firmware for example on a hardware device), or even good old fashion human error. Although the vision of an archival system gives you the impression that you are dealing with a very static durable almost simple piece of technology that houses long-term data - nothing could be further from the truth.

Continue reading "Correct and Complete Data Archival" »

September 05, 2005

Updates to Federal Rules of Evidence

Some heavy but pertinent reading below. There has been unanimous approval by the Judicial Conference of the US on approved changes to the Federal Civil Procedures Rules that will significantly impact electronic discovery practice and procedure in federal courts. Unless the Supreme Court disapproves the amendments by next May the changes will take effect in 12/06. The major changes can be encapsulated as the recognition of "electronically stored information" as a distinct component electronic discovery and specific guidelines around ESI. I've excerpted and commented some of the proposed amendments below. In short, this recognition at the Federal level shows the continued need and importance for solutions that enable electronic discovery, it recognizes that electronic data discovery is now a standard way of life and that state and local rules will not suffice as the creation of electronic information continues to grow. I do not think that most software vendors will manage to keep up with these rules and the effect that they have on their solutions and marketing positions. As we continue to see the market evolve and solutions converge towards legal discovery and archival it is important that we do stay aware of these rulings. More information can be found at http://www.uscourts.gov/rules rules6.html <http://www.uscourts.gov/rules/newrules6.html>

Best,
Peter Mojica

Clarifying and Conforming Proposed Amendments to Rules 33 and 34. The proposed amendment to Rule 33 provides that a party may answer an interrogatory involving review of business records by providing access to ESI if the burden of finding the answer is substantially the same for either party.

The proposed amendment to Rule 34 explicitly recognizes ESI as a category subject to discovery that is distinct from "documents" and "things" to clarify that there are differences among them important to managing discovery. Rule 34 is also amended to authorize a requesting party to specify the form of

production and for the responding party to object. Absent an order, agreement, or a request for a specific form, a party may produce responsive ESI only in one form - the form in which the party ordinarily maintains it or in a reasonably usable form.

They are recognizing that the amount of information is in many cases simply to much. This effects several industries, especially those that focus n evidence preparation, that are specific to how law firms produce evidence, this can negate the transformation of electronic information into paper, where defendants overwhelm plaintiffs counsel with 1000's of boxes of paper.  This makes our strategy for continuing to build and expand web based tools and profiles for data access the continued correct direction. Other vendors are stopping at the archival and basic search and query and interfacing into third party tools for evidence preparation or what they generally term e-discovery. Our view is that these industries of archival and e-discovery are converging and this recognition at the federal level will continue to support that view.

Addressing Inadvertent Privilege Waiver - Proposed Amendment to Rule 26(b)(5). The proposed amendment to Rule 26(b)(5) provides a procedure for asserting privilege after production that is parallel to the similar proposals for Rules 16 and 26(f). The volume of ESI searched and produced in response to discovery can be enormous, and certain features of the forms in which such information is stored make it more difficult to review for privilege and work-product protection than paper. Thus, the inadvertent production of privileged or protected material is a substantial risk. See Report at 10-11. Under the proposed amendment, a producing party may notify the receiving party, within a reasonable time, of a claim that privileged material or work product was inadvertently produced. After receiving notification, the receiving party must return, sequester, or destroy the information, and may not use or disclose it to third parties until the claim is resolved. If the receiving party disclosed the information before being notified, the receiving party also must take reasonable steps to retrieve the information. The receiving party has the option of submitting the information directly to the court to decide whether the information is privileged or protected as claimed and, if so, whether a waiver has occurred.

Again, the federal courts are recognizing that the amount of information is overwhelming, and thus saying that mistakes will be due to the volume and course corrections are allowed. So, one side or the other can call a time-out and say we shouldn't have given you those documents, please return and forget you ever saw them. If counsel follows the above changes to Rules 33 and 34 and provides electronic access ESI then a full chain of custody is maintained within our systems. For example, ACME Corp. has to produce records to plaintiff counsel, after deciding what they will provide they provide access to the data instead of sending the data. What this actually does, is give ACME Corp. a full audit trail of what plaintiff looked at and when, it becomes part of the audit trail for the chain of custody. It may actually be better than providing paper of CD's/DVD's of files. In the later case, ACME Corp has no idea if plaintiff looked at every document provided, by providing access defendants can know not only what they looked at, but more specifically what, if anything, they did not look at.

Two-Tier Discovery: Proposed Amendment to Rule 26(b)(2). The proposed amendment to Rule 26(b)(2) would require a court order for production of ESI that is "not reasonably accessible because of undue burden or cost." The proposal recognizes a "distinctive, recurring problem" in e-discovery and builds on existing rules to facilitate early production of relevant and accessible ESI. And, it specifically references the 1983 proportionality amendments first empowering judges to limit or forbid discovery where costs and burdens outweigh benefits, explicitly implemented in the adoption of "two-tier" discovery in the 2000 Copy right 8 2005 Washington Legal Foundation 4 ISBN 1056 3059 amendments. See Report at 11-13.

The amendment requires the responding party to identify, "by category or type," the sources of potentially responsive information that it has not searched or produced because of the costs and burdens of accessing the information. If the requesting party moves for production of such information, the responding party has the burden to show that the information is not reasonably accessible. Even if the responding party makes this showing, a court may order discovery for good cause, "considering the limitations of Rule 26(b)(2)(C)," and "may specify conditions for the discovery." Such conditions "may also include payment by the requesting party of part or all of the reasonable costs of obtaining information from sources that are not reasonably accessible." See Committee Note at 45, 48.

Here we see that at the Federal level they want to impose a standard of reasonableness for request for electronic information. This has already been hashed out in lower court rulings and this takes into account that not all ESI is equal in terms of finding and producing it. The court is saying that they will be the final arbiter when asking for data that is not easily accessible; this can potentially mean; stored on tape, across thousands of local hard disks, other and its still open to interpretation, probably the best litigator wins unless precedence exists or more prior rulings are established at the Federal level which establish precedence moving forward. The accessibility of programs like Google Desktop and other freeware tools and the "accessibility" that they provide can create a condition where data that was unreasonable to produce can suddenly become reasonable to produce and require production of more data during initial discovery with no cost to the requesting party. I believe that those companies that are mindful of data accessibility and this rule of reasonableness will err on the side of caution for deploying or permitting use of certain systems, operating systems and software as ubiquitous technologies within their organizations. Massive indexing and search a capability across the board with no controls is not necessarily a good thing with respect to litigation, the archival approach continues to bear well for the long-term.

Sanctions - Proposed Amendment to Rule 37(f). Under the addition to Rule 37: "absent exceptional circumstances, sanctions cannot be imposed for loss of electronically stored information resulting from the routine, good faith operation of an electronic information system."

The proposed rule recognizes that all electronic information systems are designed to recycle, overwrite, and change information in routine operation, even without "specific direction or awareness," not because of any relationship between the content of particular information and litigation, but because they are necessary functions of regular business operations. The proposed rule also recognizes that suspending or interrupting these features can be prohibitively expensive and burdensome, again in ways that have no counterpart in managing "static" hard-copy information. Even when litigation is anticipated, it can be very difficult to interrupt or suspend the routine operation of computer systems to isolate and preserve discrete parts of the information they overwrite, delete, or update on an ongoing basis, without creating problems for the larger system. Routine cessation or suspension of these features of computer operation is also undesirable; the result would be even greater accumulation of duplicative and irrelevant data that must be reviewed, making discovery more expensive and time-consuming.

However, sanctions are not avoided simply by showing that information was lost by routine operation of an information system. It also must be shown that the operation was in good faith. One factor in the good faith determination may involve intervention to modify or suspend certain features of a system's routine operation to prevent the loss of information, if that information is subject to a preservation obligation. When and if such an obligation arises depends on the substantive law and the circumstances of each case; the amendment does not create a new preservation obligation. The logic behind the proposal is that the cost and disruption of interrupting routine computer systems are not justified when there exist other means for preserving necessary and relevant information, such as: a "litigation hold" process, early discussion of the need for such extreme preservation measures, and entry of preservation orders tailored to the specific case. The proposed rule should provide necessary guidance in a troublesome area distinctive to electronic discovery.

This is the last and most interesting. It discusses sanctions. On the surface it can be interpreted that accidents such as erasure of data might be OK, as long as you can show that you were running your systems under the good faith premise. The second paragraph does add clarity that this is not as simple, and that efforts must be made to preserve and prevent loss of information. The "other means" of preserving information and not interrupting routine systems is what we provide with the archival platform. This continues to add more emphasis that major corporations should not build applications internally for managing content that is regulated and possibly destined for legal discovery, which today means nearly all data, from telephone call logs, conversations, etc.


October 24, 2005

What's Discoverable and the Value of Where

Where Let’s suppose that a user’s local hard-drive (or shared file system) contains the following directories with the file entries listed below:

>>directory1>projects>ibm>file1.doc (note, these are the same file)
>>directory1>projects>ibm>file2.doc
>>directory1>projects>ibm>file3.doc

>>directory2>projects>oracle>file1.doc (note, these are the same file)
>>directory2>projects>oracle>file4.doc
>>directory2>projects>oracle>file5.doc

Now, your comapny is joined in a legal suit and recieved a discovery request for relevant documents to the legal matter. You are now on the receiving end of having to find and produce relevant documents in a very important legal matter. On the surface the request seems clear, "all relevant documents", well after many rounds of legal back and forth (the discovery order is to broad, etc.) the discovery request is now understood and amended to specify "documents" containing the word "IBM"

Now comes the conundrum.

Continue reading "What's Discoverable and the Value of Where" »

March 29, 2006

Deleting e-Mails From Your Archive

Delete To delete or not to delete, this now appears to be one of the holy grails of the e-mail archival industry, and it’s extending beyond regulated industries. On the surface, you would think that the regulatory industry is the best suited for deleting e-mails as the regulations are very specific for how long particular e-mails have to be kept. What more could you ask for, you have it in black in white, from the government in a loud booming voice "thou shall keep the Equity traders e-mails for a period of 5 years, thou shall only delete it after the prescribed period has come and gone".

So what’s the issue with deleting that e-mail on it’s 5 year anniversay date? With today’s systems you can schedule the deletion for the exact second it reaches it’s 5 year anniversay.   So again, what’s the big deal, well let’s take a look at look at it from the opposite perspective. 

Continue reading "Deleting e-Mails From Your Archive" »

July 22, 2006

Outsourcing message to a CIO friend of mine

Outsourcing Like most of you I spend a lot of my time on airplanes reading and writing e-mails. On a recent flight I decided this would be worth posting and sharing. It's an email communication with a friend of mine who I met with earlier in the day. He's a CIO at one of the largest banks in the US. Our meeting was to discuss his banks storage dilemmas and how his normal IT operations were being frustrated and quite frankly confused with the heightened awareness around regulatory compliance.  He and I grew up in the IT industry together, so our meeting and conversations are pretty casual.

After our meeting I told him that it sounded like his dilemma was keeping him up at night, he concurred, and offered that 'it's just not as easy as 'writing a program' like the old days' to solve a business problem, that the issues of 'business risk' is daunting for both him and his IT managers and it does in fact 'keep him up at night'.

As a friend and trusted confidant I told him that I would try to help him with his 'sleep' problem.

Anyhow, moving on, when the plane hit 10,000' and the familiar bell tolled I reached for my notebook and started jotting him a note. An excerpt from my note to him follows.

e-Mail to a Large U.S. Bank Corporate CIO.

Excerpt begins here...

Continue reading "Outsourcing message to a CIO friend of mine" »

Upfront Considerations for E-Mail Archival

I_dream_of_jeannie_statue E-Mail archival has taking several twists and turns over the last few years.

The primary one is the use of the archive for legal discovery, sometimes referred to as eDiscovery.

This has left many vendors flat footed and the reasons are in fact quite simple.

Continue reading "Upfront Considerations for E-Mail Archival" »

Backup vs. Archival

Archiveshistory Backup technologies, as they relate to the actual hardware and software involved in the backup process, have and continue to improve - more density, faster robotics, etc. etc. - it's an extensive list. However, what has not changed much over the last year is the actual "process" of backup execution.

The process hasn’t changed much in over a decade, it’s a well tuned systematic process of incrementals, fulls, swapping tapes, sending tapes off-site, etc. As prices for the backup technology have dropped overall, their has been a lack of attention paid to the actual cost of data stored on tape, but the cost today, is being fueled by a completely different rationale - compliance.

{For the purpose of this discussion let's define compliance simply as governance of data as it relates to an organizations legal and regulatory liabilities or requirements}

It’s no longer prudent to keep data that may be subject to discovery in a billion dollar class action lawsuit locked away, safe secure, and accessible on a tape - just waiting to be "discovered" by lawyers who know how to ask for the information.

So, what does that mean to today's backup approaches?

Continue reading "Backup vs. Archival" »

July 26, 2006

Google Desktop Search

101404google_search_2 I've been asked several times this week about local desktop search software such as Google Desktop. Interesting that the questioners were all major worldwide corporations who themselves were evaluating tools for long term archival and more importantly legal discovery.

So what's the answer; well in this writers opinion; it boils down to one word "risk".

July 31, 2006

Tape Restoration and E-Mail Archival

70 Depending on the industry and the typical damage periods (i.e. Anti-Trust where the damage period can go back 10-15 years on averge) most of the data needed for responding to legal discovery will reside on tape.  So if you’ve recently implemented an archival strategy for capturing e-mails, where you can use the system for legal discovery, you may still need to deal with tape restores for quite some time, years even.

It’s prudent to consider tape restoration to the archive as part of your implementation and strategy upfront.

About the picture. PowderHorn 9310 tape library

Continue reading "Tape Restoration and E-Mail Archival" »

Instant Messaging and Rules of Evidence

Yahoomicrosoft Instant Messaging Summary:

A criminal defendant convicted of assault claimed that instant messages threatening the victim should not have been admitted without authentication evidence of their source from the Internet Service Provider or the testimony of a computer forensics expert. The court rejected this argument, which it characterized as having the court create a whole new body of law just to deal with e-mails or instant messages.

Although the court recognized that such digital messages are inherently unreliable because of their relative anonymity and the fact that while an electronic message can be traced to a particular computer it can rarely be connected to a specific author with any certainty, the court found that the same uncertainties exist with traditional written documents.

Thus the court saw no justification for constructing unique rules of admissibility of electronic communications such as instant messages. Therefore, the court held that under Pennsylvania Rule of Evidence 901 circumstantial evidence, such as the contents of the writing and surrounding events, is sufficient to establish authenticity.  In this case, the circumstantial evidence establishing authenticity included the fact that defendant had acknowledged his first name in one of the instant messages and had failed to dispute having sent the instant messages in verbal discussions shortly after their occurrence.

Spolilation

Safe Kirk v. Ford Motor Company, 2005 Ida. LEXIS 112 (Idaho June 23, 2005) (updated on Jul/12/2005 06:00 pm EST) Summary: Because the plaintiff did not elicit testimony about the company’s destruction of data relevant to the vehicle’s rollover propensity, the trial court did not err in declining to give a jury instruction that the data could be inferred to be unfavorable to the defendant.

November 13, 2006

Google eMail on Cell Phones

Gmail_mobile If I had to encapsulate Google into a simple word or phrase I would call Google, "simple". Simplicity in their interface, search, and ability to deliver complexity in a shielded way from the end user has to be a major key to their success. I guess if your audience is the masses, the kiss approach has to be the order of the day, and taking the least common denominator approach is something that has proven to be a winning formula, and not just for Google by the way. The acronym KISS (keep it simple stupid, or is it keep it stupid simple) was around long before Google. So given the Google ability to reduce complexity and KISS and manage to capaitalize with the lowest common denominator approach to the masses what will happen when your corporate users begin the process of installing gmail.com/app on the masses of cell phones in use for everyday business mean to an ever changing industry around email and compliance? More to come....

December 20, 2006

New Tidbit - Comments forth coming....

Regulator: Morgan Stanley withheld e-mail in cases

NASD says Morgan Stanley made false claims that millions of e-mail messages in its possession had been lost in 9/11 attack.
The New York Times

By Gretchen Morgenson  

Published: December 20, 2006, 4:57 AM PST

The NASD, the nation's largest self-regulatory organization for the securities industry, accused Morgan Stanley on Tuesday of routinely failing to provide e-mail messages to aggrieved customers who had filed arbitration cases against the firm over three and a half years and with making false claims that millions of e-mail messages in its possession had been lost in the September 11 attack on the World Trade Center.

The regulator also contended in its complaint against Morgan Stanley that the firm regularly destroyed millions of e-mail messages by overwriting its backup tapes and by allowing employees to delete messages. Securities and Exchange Commission rules require that firms keep all e-mails and business communications for three years.

Morgan Stanley's failure to provide e-mail messages relating to arbitration cases began in October 2001, the NASD said, and extended through March 2005. While claiming that the World Trade Center disaster had destroyed many of its e-mail messages, Morgan Stanley actually held millions of pre-September 11 e-mail messages that were restored to its system from backup tapes shortly after the attack, NASD said.

Continue reading "New Tidbit - Comments forth coming...." »

January 18, 2007

CP Rail deleted e-mails related to Minot accident

Citylinks Interesting article that appeared in the Minot Daily News. Comments?

CP Rail deleted e-mails related to Minot accident

By DAVE CALDWELL, Staff Writer dcaldwell@minotdailynews.com

A new twist in the legal wrangling over a deadly train derailment five years ago this Thursday has shed some fresh light on the tactics purportedly used by one of the parties in the resulting lawsuits.

Continue reading "CP Rail deleted e-mails related to Minot accident" »

March 02, 2007

Legal Technology Article: The Real Implications of the New Rules on EDD

Judge One of many articles on FRCP below. The Federal Rules of Civil Procedure - if your an IT manager and you haven't Google'd FRCP and boned up on everything there is to know about the effect that it will have on how you deliver, deploy and maintain systems and technology I strongly suggest you give it a go!

Domestic and even world-wide corporate entities, as a whole, are still living under the  post effects of SOX, Enron, Anderson and all of the others which have created the umbrella of hyper-sensitivity to regulations which were originally intended to provide "adequate" levels of audit ability, checks and balances and transparency - and what has now turned into governmental control of the corporate environment.

The cause for much of the chaos can be traced back to various technology accelerations over the last few years. And how many different links on a technology chain that have traditionally been delineated are now truly linked.

An example of this is the storage industry and the advancement of CAS (Content Addressable Storage). In the past the application really didn't need to know a whole lot of where an object was being stored.  Today to write an object to a CAS storage device you have to write to an API and be prepared from within your application to receive back an acknowledgment, think of it as a coat check ticket, so that you application knows how to get that object back - and also be aware of the no ticket, no object mantra that goes along with the territory. So, applications and now intrinsically tied to particular storage devices, in a way that they never were before. This is just one example, of two links on a technology chain and how they truly are linked.

Continue reading "Legal Technology Article: The Real Implications of the New Rules on EDD " »

April 24, 2007

Alec Baldwin's Phone Tirade

0504_alec_kim_bn_lrge One of the recent pieces to bubble to the surface of the news media has been the Alec Baldwin tirade that was caught on voice mail and then circulated into the internet and  television media. I have no personal comments on the actual phone message content, context etc. Those are private matters between family members of the Baldwin family.

However, it does have a related lesson for anyone and everyone including private and public sectors of business - its been a long standard regulatory requirement on   trading desks to record all telephone calls, technologies called trading turrets provided by a number of manufacturers facilitate the logical recording of these telephone communications. And like most technologies responsible for accumulating large amounts of data, little or no thought is given to the search and retrieval of the same data -  hundreds of phone calls were recorded each minute and stored and if you ever needed to get one of them back to listen to it, well, good luck, another million of so dollars and six months later you found that call.

Continue reading "Alec Baldwin's Phone Tirade" »

May 22, 2007

Corporate Cell Phone Compliance, the time is coming

2984 It's taken fewer number of years for the cell phone to become as ubiquitous as e-mail.

Until, e-mail reached the point of the reliability of a dial-tone - not to many years back -  it could not have been deemed ubiquitous. There are many factors, the snow ball effect, that needs to come to fruition simultaneously for any single technology to reach the point of being truly ubiquitous.

Continue reading "Corporate Cell Phone Compliance, the time is coming" »

September 08, 2007

NYSE Picture

NyseI had a meeting this week at the New York Stock Exchange as I was walking into the building I snapped this picture from my cell phone. I liked it so much it's now my wall paper on my PC. I'm posting it here, feel free to take a copy.

Jonathan Schwartz's Weblog

Network Appliance, Inc. - DaveBlog : : : : :

Law.com - Legal Technology

CSI1000

Tip Jar

Change is good

Tip Jar