Future Proof Your ediscovery Practices

Transcription

1 FEBRUARY 3 5, 2015 / THE HILTON NEW YORK Future Proof Your ediscovery Practices Plenary Session February 4, 2015 Barak Cohen, Partner, Perkins Coie Bruce Hartley, Vice President, Celerity Consulting Jessica Watts, AGC and Discovery Counsel, HP George T. Tziahanas, VP Strategy, HP SaaS

2 Agenda Introductions Rise of the Machines Criminal Investigations in a Digital World Information Border Wars Model of Discovery in the Future

3 RISE OF THE MACHINES

4 History of Discovery Even with the advent of ediscovery ~20 years ago, a majority of relevant discoverable content has been human generated; that is likely to change. Pierson v. Post, 3 Cai. R. 175, 2 Am. Dec. 264 (N.Y. 1805)

5 Rise of the Machines Gartner Analytics Trends: The Internet of Things Really Matters for Communications Service Providers, December 2014

6 Rise of the Machines Phases of the digital revolution Web 1.0: Destruction Web 2.0: User Creation? Wikipedia Launch A 100 fold multiplication in the amount of data is a 10,000 fold multiplication in the number of patterns we can see in that data Philip Evans: Boston Consulting Group Fellow, Ted Talk

7 Rise of the Machines

8 Rise of the Machines Discovery tomorrow will rely less on what people said, and more on what their machines tell us

9 CRIMINAL INVESTIGATIONS IN THE DIGITAL AGE SEARCH FIRST ASK QUESTIONS LATER

10 Government Right to Corporate Data Government has broad rights to obtain corporate data in connection with criminal matters Rights subject to 4 th Amendment and ECPA Generally require facially valid legal process, which varies depending on type of data sought Government may also request Grand Jury or trial testimony from records custodians

11 Government Requests for Data Requests for Your Data Domestic Abroad (e.g., FCPA investigations) Requests for Third Party Data Your vendors or service partners Your customers or clients Requests to Third Parties for Your Data Who has your data? Are they obligated to protect it?

12 More Data More Problems Government may search first ask questions later Recent circuit court decisions support broad, warrantless access to stored data Govt. using third-parties to conduct searches on their behalf (e.g., In re Warrant to Search a Certain Account Controlled and Maintained by Microsoft Corporation, Nos. M9-150, 13-MJ-2814 Govt. using new technologies with unclear precedent (e.g., cell signal tracking in United States v. Skinner, No (6th Cir. 2012)) But SCOTUS says there are limits The 4 th amendment still matters (Riley v. California, 134 S. Ct. 2473, 189 L. Ed. 2d 430, (2014)) See also United States v. Warshak, 631 F.3d 266, 286 (6th Cir. 2010), rejecting warrantless seizure of s

13 ECPA: Obsolete, But Still An Issue ECPA, enacted in 1986, has not aged well. It fails to strike a fair balance between the privacy expectations of citizens and the legitimate needs of law enforcement. ECPA fails to account for: Cloud-based services Location data from cellular devices Transactional data Should you provide, or not provide notice, to account holders when you receive a subpoena or 2703(d) order? Is an ECPA search warrant more like a subpoena than a physical search warrant to search premises or seize property?

14 Responding to Government Requests Have a process in place Point person Prompt attention/triage Assess facial validity and identify issues Negotiate to limit scope To contain costs To avoid collateral issues

15 Pick Your Battles Considerations: - PR - Customer Relations - Risk of Poking the Bear - Example: Google NSL fight re: notice to user Some examples from industry: - Reddit refused 42% of government and civil data requests in In 2012, Google received 21,389 government requests for information affecting 33,634 user accounts. Google provided at least some data 66% of the time.

16 INFORMATION BORDER WARS

17 Microsoft Case Summary (In re Warrant) Dec 2013 Magistrate issues a warrant under the Stored Communications Act to Microsoft to produce content and non-content information about a user. The customer s were stored in Ireland on Microsoft servers. The non-content information about the (metadata about the account), is stored in the US. MS objected to producing data stored in Ireland, arguing that the warrant would require an extraterritorial search and seizure of data. The Government responded the issue is whether the content is in MS s custody or control. Magistrate rejected the motion to vacate. Found that warrants issued under the SCA are hybrids part warrant and part subpoena. Therefore the extraterritorial limits on warrants are not implicated and the relevant question is whether the data is in the provider s control. Further the search does not occur until the data is reviewed by US law enforcement, which would not happen until the data is in the US. MS appealed. The District Court upheld the Magistrate s ruling. The case is now before the 2 nd Circuit: 28 technology and media companies, 23 trade associations and advocacy groups and 35 professors of computer science filed legal papers in support of MS s opposition to the warrant.

18 Information Border Wars The US government s unilateral use of a search warrant to reach in another country puts both fundamental privacy rights and cordial international relations at risk. -Brad Smith, Microsoft GC It s a question of control, not a question of location of that information. U.S. District Judge Loretta Preska In this case, no such exposure takes place until the information is reviewed in the United States, and consequently no extraterritorial search has occurred. Magistrate's Decision The refusal of the U.S. Attorney to recognize that the account at issue is located in a foreign jurisdiction and subject to foreign data protection rules is not only offensive to the sensitivities of European citizens but also reinforces the already strong sentiment of many EU citizens that their data is not 'safe' when they use IT services offered by U.S. corporations. Jan Phillip Albrecht, EU MP

19 Not entirely new Societe Nationale Industrielle Aerospatiale v U.S Supreme Court held that a litigant must produce information located overseas even if it violates a blocking statute. Five factor test (1) the importance of the documents to the litigation; (2) the degree of specificity of the request; (3) whether the information originated in the United States; (4) the availability of alternative means of obtaining the information; and (5) the extent to which noncompliance with the request would undermine important interests of the United States, or undermine the interests of the state where the information is located.

20 What is new The Cloud, the WWW, users connected everywhere/ all of the time. Compelling production of someone else s data High sensitivities around the world to privacy concerns

21 Information Border Wars What is location Physical Virtual Access privileges Third-party When will you need information Prior to litigation (broader info. governance) ediscovery Law firm practices

22 Information Border Wars Important Considerations & Questions Companies should have a data map of what is stored in Europe on servers belonging to US cloud providers. Keep it up to date. Does this open demands from foreign countries to US companies that have presence in that country to information kept in the US Contract with cloud providers stipulate that the data must not be accessible from the US. If storing information abroad make it inaccessible in the US? Use partner company so not subject to US law? Encryption of data with customer having only encryption key

23 MODEL OF DISCOVERY IN THE FUTURE (AKA NOW)

24 Model of Discovery in the Future Case Study Facts Large multinational corporation engaged in business in the US, Europe and in Asia was the subject of a significant security breach. Hackers accessed and downloaded large volumes of protected information (PII, PHI, HR, confidential, etc.). In many instances, once downloaded, the data was completely wiped from the company systems. The information was not only stolen, but large parts were published on various public websites and in the press. Eventually the corporation secured its environment, but is now subject to several types of actions.

25 Model of Discovery in the Future Case Study Questions Based on high likelihood of civil and potentially criminal action, what data sources should be preserved? Given the case specifics, must we consider additional, less standard data sources? System Security Settings DNS Logs Server Logs Security Logs System/Security Patch and Update Histories Malware and Virus Protection Software Update and Incident Logs Firewall Logs, etc. Given these additional data sources may be large and mostly unstructured text files, how do they impact discovery (preservation, collection, and review)?

26 Model of Discovery in the Future Additional Questions Where is the Network Boundary? Third-Party or Partner Networks? Propagation of Local Risks? Additional Data Sources? Potential Liability? The U.S. DOJ has issued a subpoena to a third-party service provider hosting your communications information under the SCA; do you intervene? An EU sovereign entity has sent you a letter precluding you from sharing any non-public information transmitted under Safe Harbor in any civil or criminal proceeding; how do you respond?