Some companies never recover from a disaster related loss. A business that cannot operate will lose money, customers, credibility, and good will.

Transcription

1 How Disaster Recovery Planning Can Be Leveraged For Electronic Discovery and Litigation Response Digital Discovery and e-evidence John Connell April Hurricanes, floods, earthquakes, power outages, computer viruses, and terrorist attacks: disasters of all kinds happen. Some are natural, and some are man-made. These disasters can disable a company for minutes, days, weeks, and months. Some companies never recover from a disaster related loss. A business that cannot operate will lose money, customers, credibility, and good will. In fact, of companies that suffer a major loss of computerized records, 43 percent never reopen, 51 percent close within two years, and only 6 percent will survive long-term. [1] Disaster Recovery (DR) Plans are logistical roadmaps created to ensure an organization has the ability to continue critical business functions after a disaster or disruption. Specifically, these plans usually denote how to relocate personnel to a safe location (if their physical office locations experience an incident), facilitate internal communications, manage customer relations and activities, and keep information technology (IT) and other business systems running. While the likelihood of disasters is low and impossible to predict, many organizations devote considerable time, money, and resources to develop and document DR Plans. With litigation on the rise in the United States and the amendments to the Federal Rules of Civil Procedure in effect, the likelihood that a company will encounter a lawsuit (or multiple lawsuits) is high. It is ironic, then, with litigation a much more likely and predictable disaster, that many organizations have not given the same attention to litigation response plans as they have to basic DR planning. Fortunately, documentation for DR Plans, if well developed and up-to-date, can be used as an effective starting point for implementing plans and procedures to successfully complete discovery of Electronically Stored Information ( ESI ). This article will explain what DR Plans are, describe what components of a DR Plan may be useful for litigation preparedness, and provide suggestions for litigation preparedness when incorporating DR Plan information. Information Technology Disaster Recovery Planning. Since almost all organizations rely on IT systems to execute various functions like payroll, accounting, and customer transactions, the computer systems that support them must continue operating after an incident. As business has become increasingly electronic, plans to recover or continue IT systems are of critical importance as those systems are a vital (and perhaps the only) link between the business and its customers. Many organizations dependent on IT systems for their daily business have created redundant data centers and systems in order to meet their 24-hour-a-day, 365-days-per-year business needs. These parallel data centers typically house hardware for additional computing capacity during normal operation and for DR purposes in the event of an incident. Some companies own and operate these redundant facilities themselves, while others outsource or simply lease space to house systems for their DR purposes. Companies will often run scheduled exercises and drills simulating a disaster to test their IT staff s ability to recover their systems. The goal is to return the systems and data to working order as quickly as possible, effectively minimizing or even eliminating an outage from the operational perspective.

2 The Components. A well-crafted DR Plan consists of several documents, each detailing a critical component of the overall plan to be executed in a disaster situation. For example, a Business Impact Analysis (BIA) captures the critical functions that a business unit provides and outlines the most significant risks that the unit faces. These can include natural disasters that impact physical locations, a pandemic that would impact personnel, simple equipment failures that can affect a computer system or network, or other events that disable an organization from sustaining business functions. After analyzing the threats, (and their perceived likelihood of occurring), the BIA evaluates the impact to the organization if those functions become unavailable. In addition, a set of Recovery Time Objectives (RTOs) establishes the amount of time that it is acceptable for a function (or system) to be out of commission without a major impact to the business. This also serves as a prioritization tool, as those with the shortest acceptable times are the first systems and functions to be recovered. In sum, based on the priorities established in the previous analyses, the written plan itself contains the procedures and steps to be taken to recover the business functions. The plan will also include a list of systems, IT personnel, Subject Matter Experts (SMEs), physical location information, and the like. Many plans also outline the systems that are highest risk for failure and some opportunities for proactively mitigating those risks before a failure. For example, older computer hardware might be highlighted for immediate replacement to mitigate component failure risks. Leveraging IT DR Plans for ESI Discovery Purposes. In the event of a new litigation matter, as with a DR event, certain steps must be taken to mitigate the potential risk to the business. While a disaster can require large scale action to move people, hardware, or transaction processing to a new location, litigation also prompts action on the part of the organization. At the onset of litigation, there is a duty to identify and preserve potential sources of data relevant to the matter. While this seems like a straightforward sequence of events, many complications can arise during execution. Since corporations often have myriad systems and multiple locations where data is stored, there are many places that must be examined in order to identify the data that may be needed. In addition, as the litigation matter unfolds, additional data not identified at the onset of discovery may become relevant. Initial Steps. First and foremost, DR Plans typically contain an abundance of information concerning the nature and locations of IT systems that should prove helpful when putting together a litigation response plan. Furthermore, hardware and personnel resources can contribute when it comes to identifying, preserving, and collecting information for their legal teams. The key to leveraging DR Plans is to identify how these existing resources and information can be used effectively to deal with ESI discovery. Identification of Key IT Personnel. Employee identification and contact information is generally part of a well written DR Plan. These contact lists typically outline the assignment of specific duties for DR exercises a specify who should perform those actions in the event of an actual disaster. Contact lists provide two unique components of a litigation response plan: (1) They create a centralized list of contact information for the IT professionals that support the systems. Using the lists of names and phone numbers, a prepared litigator can usually find one or more people who can answer questions about the system in question. They may not be ideal 30(b)(6) witnesses, but they could prove helpful for developing a plan for ESI preservation and collection.

3 (2) They typically identify more than one employee who is knowledgeable about and responsible for an IT system. For complex systems, several employees may need to contribute to the ED planning in order to effectively identify, preserve, and collect relevant data. Documentation of IT Infrastructure. DR Plans often contain information about system infrastructure, key applications, data storage locations, system versioning, and system recovery processes. This information can be very helpful when addressing ESI discovery projects. Specifically, system architecture documentation can include infrastructure diagrams, feature information provided by the system designer, vendor release notes, and implementation specifics. This information can be used to get an understanding of what the system does and how it works, to show the nature and locations of key IT hardware, and to provide some insight into the relative complexity of the system. Architectural documentation may be helpful to demonstrate burden when trying to recover data from older versions of the system or from backup tapes. Infrastructure diagrams may also be used to demonstrate the complexity of building a parallel environment to perform data recovery. In addition, this documentation might be required by a third-party vendor to perform data recovery if internal resources are unavailable or unable to provide support for litigation. Finally, there may be information contained in the system architecture documentation that will point to different data storage locations. For instance, portions of data may primarily reside in different data centers. For disaster recovery purposes, there is often redundant data stored in multiple locations to keep the systems operational after an incident. If the primary copy of data is corrupt, it may be possible to recover and collect data from the secondary site. System versioning documentation is created to document changes to a system over time, which can be crucial to establishing the functionality and data available during the relevant time period of a lawsuit. There may be data that is available in the current version of the system that was not available in the previous system, and vice versa. For example, certain functions or data fields may have been added to the system between the close of the relevant litigation period and the point where the lawsuit is served. System recovery procedures can be crucial for performing data recovery during the collection phase of the ESI discovery process. If external resources are needed to execute data recovery in response to the litigation, the documentation may be used to provide guidance for constructing a parallel system in order to perform data restoration from backup tapes or other media. Recovery Time Objectives. RTOs are designed to prioritize systems for recovery and, for highpriority systems, can be used to estimate the approximate time to recover the system for ESI discovery production. The different RTOs are designated internally and are based on the relative system importance and the time it takes to recover the system. For instance, RTOs can be designated as less than one hour, one to 12 hours, 12 to 24 hours, 24 to 48 hours, and 48 to 168 hours. RTOs can be misleading, and must be put into context of the company s priorities. For instance, an RTO of 48 to 168 hours does not necessarily mean that the system takes 168 hours to restore, but rather how long it is acceptable for the system to be down after a disaster. It is important to determine how long the recovery procedures take to execute. The execution time will point to how long it takes to recover the system and collect data, thus allowing the ED

4 resources to develop time and cost estimates when preparing burden arguments and developing discovery timelines for planning case strategy. Tips for Successful ESI Discovery Using DR Plan Information. After this brief view of some of the potential DR Plan information that can contribute to litigation response plans with respect to ESI, there are some other factors to consider when incorporating DR information as part of a litigation response plan. Resource availability, DR plan quality, and litigation response drills should all be accounted for when ESI discovery procedures are executed in response to an actual matter. With regard to employee availability, DR personnel serve a dual role with system support. Thus, manager approval should be obtained to ensure the employee s manager is aware of the support role they may have in the ESI discovery process. The personnel and hardware resources possessed by a company comprise the teams that support the systems if there are performance problems, and they are responsible for routine system maintenance. When viewing a list of DR personnel, it must be assumed that they have existing responsibilities that may impact the timeline for executing litigation response procedures. When developing case strategy with respect to ESI, these resource constraints must be considered to predict realistic timeframes for data collection and production. Documentation Deficiencies. The overall quality of DR documentation should also be considered before becoming too dependent on this information when developing litigation response plans. DR documentation may not be current in some organizations. When attempting to incorporate DR Plan content into litigation response plans, the information needs to be validated to ensure that it is accurate and up-to-date. When response to a litigation matter is required, there probably won t be time to update DR documentation. Thus, periodic reviews are recommended to ensure information is current and litigation response procedures can be enacted immediately. As with traditional DR Plans, organizations should execute litigation response drills to test their plans and procedures. DR exercises and scenarios are crucial to determine exactly how recovery should occur after an incident. During these exercises things can and do go wrong. In fact, the main reasons for running these exercises are to encounter, identify, and address issues before a disaster ever ensues. When responding to an actual disaster, there is no room for error. In the same vein, organizations who expect to face litigation or a governmental/regulatory inquiry should consider conducting litigation preparedness exercises as well as developing and executing the steps needed to respond to a fictitious case. This exercise should include the identification of custodians, their data, and other data that may be relevant to the case as well as determining how to best preserve this data (including suspension of automated deletions, storage of preserved data in an archive system, etc.). Working in the face of an actual multi-million dollar lawsuit or an investigation by the Department of Justice is not the time to determine how ready your organization is to responding to such matters. DR documentation and resources can be of great assistance when creating litigation response plans and procedures. As with any other technology resource or document, however, there is no single source of information that can be solely depended upon for litigation. Rather, the litigation response plan must be carefully crafted using multiple sources of information, including current system information, input from knowledgeable staff, and when possible, DR documents and litigation response exercises.

5 John Connell is a managing consultant for Kroll Ontrack s ESI consulting practice, Ontrack Consulting. He can be reached at jconnell@krollontrack.com References [1] Jim Hoffer, Backing Up Business-Industry Trend or Event, Health Management Technology, Jan 2001.