Without Solid Implementation a Legal Discovery Plan Is Just a Plan Step-by-step instructions will get you started

Transcription

1 Without Solid Implementation a Legal Discovery Plan Is Just a Plan Step-by-step instructions will get you started By Paul Robichaux Published: May 2009

2 Without Solid Implementation a Legal Discovery Plan Is Just a Plan Step-by-step instructions will get you started Contents Introduction... 2 Understanding Discovery Requirements...3 Planning for Effective E-Discovery... 3 What to Retain... 4 How Long to Retain It... 4 What to Do Once Retention Ends... 4 Testing & Auditing... 4 Planning for Litigation Holds... 5 What Not to Do... 5 Implementing Your Plan... 5 Policy Creation... 5 Default vs. Custom Folders... 5 Managed Folder Mailbox Polices... 6 Policy Enforcement... 6 Message Capture... 7 Archival... 8 Conclusion... 8 Introduction Legal discovery is a complex subject. Planning an electronic discovery (or e-discovery) strategy, and then implementing it, can be challenging under the best of circumstances. In the current environment of limited budgets, accelerated schedules, and increasing regulatory requirements, it may seem impossible to adequately prepare for discovery requests without bringing in expensive outside consultants and purchasing additional software. However, as with many other complicated projects, building an effective e-discovery strategy can be made easier by careful planning coupled with attention to detail in the plan s execution. There are three key elements to building an effective strategy: understanding the discovery requirements that apply (or may apply) to you, building a plan to meet those requirements and being prepared to implement that plan when necessary. 2 Without Solid Implementation a Legal Discovery Plan Is Just a Plan sponsored by Sherpa Software

3 Understanding Discovery Requirements Discovery requirements vary widely: different jurisdictions, industries, and organizational types can have very different requirements. For example, a school system located in the United States will have different requirements than a similarly sized school system in the European Union, and both school systems requirements will probably be unlike those of a company in either jurisdiction. There s good news, though: most organizations that are legally required to comply with a particular regulatory regime already know of this requirement. This white paper is focused on helping companies who don t have existing compliance requirements but who want to be prepared for possible future discovery requests. These can happen in a number of ways, even if your company doesn t currently have regulatory requirements that you have to comply with: Your company, or one of its employees, may be sued by an outside party Your company may file suit against someone else, and as a result may have to produce electronic records You may need to search electronic records as part of an internal investigation An external entity may ask you to produce records as part of one of their investigations One of the jurisdictions where you do business may create a new regulatory requirement that you have to start complying with You may be required to implement records management or archiving to meet the requirements of a particular industrial or standards body (like the American Banking Association or the American National Standards Institute). What are the odds of one of these situations befalling your company? It s impossible to say. However, preparing to meet these kinds of requests isn t that hard if you start before you get any such request. Planning for Effective E-Discovery A solid e-discovery plan has to cover several topics: Where s your data? You should plan to build a data map that shows which locations have critical data, what kinds of data you consider within the scope of the discovery plan, and the circumstances where data can move from one place to another. What kinds of records are subject to discovery? The US Federal Rules of Civil Procedure govern e-discovery requirements for civil lawsuits in US Federal courts; other jurisdictions may have their own rules. The version of the FRCP now in effect requires parties to a lawsuit to be able to produce all types of electronic records (including , voice mail, and IM traffic) unless they can show that such production would be prohibitively expensive or technically impossible. That s a pretty high standard. Who can request discoveries? Under what circumstances will you allow discovery requests? Obviously you can t control who makes requests from outside the company, but you can control who s authorized to make such requests from the inside. Who does the actual work of searching and retrieving records? Larger companies usually have a compliance officer (or office) that handles such requests, but you can also delegate that responsibility to your company legal staff, an outside law firm, or your system administrators. This person will have to deal with the actual mechanics of searching and retrieving records, inspecting the retrieved data to make sure it s within the scope of the request, and so on. This can be time-consuming to say the least, and it may also result in the worker becoming privy to sensitive or proprietary information. Of course, the best way to cover these topics is to involve all the stakeholders who have an interest: your legal department, representatives from your business operations, appropriate members of your IT staff, and your company s outside counsel (if any). Because you ll probably be responsible for creating the e-discovery plan (and then implementing it!), you should organize and lead the meetings in which these topics will be discussed. It s important to understand that under the US FRCP, and most corresponding regulations in other jurisdictions, you have some negotiating room: your legal staff, and that of your opponent, will commonly meet in a pre-trial conference to negotiate what records you have to produce. Narrowing down the scope of a discovery request is critical; the narrower the scope, the less time and money it will take for you to meet it. Your discovery plan should include a description of what types of records you will produce on request, which types you will try to avoid producing, and which types you cannot produce. For example, if you re using a conventional PBX-based voice mail system, you probably don t have any way to search it or extract messages, so you ll probably plan to exclude voice mail messages during your negotiation. In a more specific vein, there are some additional sponsored by Sherpa Software Without Solid Implementation a Legal Discovery Plan Is Just a Plan 3

4 things that your plan needs to specify. The items discussed above can be developed by a competent messaging administrator, a lawyer, or even a nontechnical layman with good common sense. The specifics of how messages are retained and stored, though, will require higher-level messaging skills. What to Retain Your decision on what to retain will actually require you to answer two subordinate questions: what data types should you retain, and where are they now stored? The earlier-cited example of voice mail is a good example here as well. You can easily retain (or discard) information in Exchange 2007 according to its item type, so it s easy to set up a technical policy that sets different retention limits on ordinary and voice mail messages. There are several different approaches to retention scope that you should consider. The simplest policy to implement is to retain every message sent or received. Against the advantage of simplicity and ease of implementation, you have to weigh the increased cost of keeping messages that you may not need (although this cost will vary according to your retention period). You can improve on this simple policy by thinking about which messages you might be able to not retain. One common approach is to retain only messages themselves, not calendar appointments or other non-message types. Another is to limit retention to selected groups of people, like company executives or people who are likely to generate valuable content (say, members of a research or development department). This policy requires a bit of guesswork because you have to estimate, in advance, who will create messages that you might need later. However, a policy that clearly states what you re retaining, and why, will go a long way toward protecting you in the event of a discovery request. How Long to Retain It How long is a piece of string? The answer, of course, is it depends on what string you re talking about. So it is with retention periods. Some regulations explicitly specify how long the retention period must be. Retention requirements imposed as part of an active court case or discovery request will usually specify a period as well. If neither of these conditions applies to you, what s a reasonable period? The answer will probably depend on what business you re in, how often it changes, and what it costs you to store data. Short retention periods have the advantages of lower cost and easier data management; longer periods impose more storage and management costs, but they give you longer-term access to business messages, the value of which may outweigh the increased costs. Perception is important, too. Setting a retention period that s too short can look like a bad decision in retrospect if you ever have to explain it to a judge. For example, a 30-day retention period may give the impression that your organization has something to hide. Defining the reasons behind the policy length you choose is perhaps the most important aspect of this part of your policy planning. What to Do Once Retention Ends If you ve seen Raiders of the Lost Ark, you probably remember the scene where the Ark of the Covenant is consigned to a dusty government warehouse, taking its place alongside other relics. The same fate can befall your retained electronic data if you re not careful. Of course, one major part of your retention policy is that you re supposed to keep retained data until it expires or times out, so the question of what to do with your data doesn t really arise until the end of your retention period. However, for short retention periods this can happen sooner than you might like. Discovery mavens talk about the risks of destructive retention policies, a fancy way of referring to policies that call for deleting items when the retention policy expires. The chief difficulty here is that you have to do something with items at the end of your retention policy! One popular solution is to allow messages that are at the end of their lifetime to be stored in an offline archive, generally using tape. This seems like a reasonable solution if you really do need to keep things around for that long. On the other hand, if you keep data, you may be required to produce it at some future date. The only sure defense against being required to produce records at some future date is to not keep the records in the first place. Testing and Auditing It s very important that you test your plan to verify that everything works. This test has to include both technical elements (e.g., can you find and retrieve specified items when requested?) and the plan itself (e.g., if your plan specifies who can make discovery searches, what happens if that person isn t available?) This testing isn t a one-time process, of course; you 4 Without Solid Implementation a Legal Discovery Plan Is Just a Plan sponsored by Sherpa Software

5 should schedule regular tests of the plan to ensure that as things change the plan still meets your needs. Auditing is another important part of your plan. Many archiving and compliance tools provide a means for you to gather random samples of data so that you can assess whether items are being correctly retained, tagged, or otherwise processed. Regular audits of your messaging system will help verify that the data your plan calls for keeping is being kept, and that other items that shouldn t be kept are not being accidentally retained. Planning for Litigation Holds If your company does become involved in a lawsuit, you ll need to be prepared to put some (or maybe all) of your mailboxes on litigation hold. Under such a hold, you are legally required to protect electronic data items that are relevant to the litigation from loss or damage. That generally means that users shouldn t be allowed to remove or edit those items, and you may also need to preserve a read-only copy (and be able to prove that you have done so to the court s satisfaction). Exchange 2007 doesn t include any built-in tools for managing litigation holds. However, many third-party archiving and compliance products provide a means for implementing litigation holds. You ll need to ensure that you know what capabilities your selected product has, and how these capabilities tie in with the rest of your discovery plan before you re served with a records preservation request! What Not to Do There are a few pitfalls you must avoid in designing your policy. A complete discussion of these potential problem areas would take up an entire book, but the highlights are simple enough: Implementing Your Plan Once you ve got a good plan, much of the hardest work is actually over! This may be the reverse of what you expect, but the technical measures required to put the policy in place in Exchange are fairly straightforward to set up and manage. Policy Creation Exchange 2007 provides several different policy mechanisms. This overlap can be confusing. You can specify policies to control: How much storage user mailboxes can consume before they become unable to send or receive messages (this is commonly referred to as the mailbox quota). Although quotas are very useful in a variety of circumstances, they re not really useful for retention or compliance planning so we won t discuss them further. Retention policies that apply to specified folders in specified users mailboxes. These policies are officially known as managed folder mailbox policies. Custom folders that are automatically pushed into selected mailboxes; these folders (known as managed custom folders) can have managed folder mailbox policies applied to them. Default vs. Custom Folders The terminology used to describe mailbox folders in Exchange 2007 can be a bit confusing. Default folders are what users already have in their mailboxes: the Inbox, Calendar, Sent Items, and so on. You can apply managed folder mailbox policies to these folders to Don t put users in charge of deciding what items to keep and what to get rid of. If you do that, you don t have a retention policy. Instead, you have a collection of individual user policies, some of which may run directly counter to what you re trying to implement. Don t forget that electronic information is easy to copy. Several large companies have gotten into trouble because an employee or outsider has retained copies of messages that the company itself chose not to retain. Don t forget about PST files. This is a corollary to the previous item: if users are allowed to use PST files, they can essentially retain anything they want and store it wherever they like. Figure 1: Managed custom folders appear in the user s Inbox sponsored by Sherpa Software Without Solid Implementation a Legal Discovery Plan Is Just a Plan 5

6 Managed Folder Mailbox Policies Managed folder mailbox policies are the primary tool that you ll use to manage retention within Exchange. To create a managed folder mailbox policy, do the following: Figure 2: Creating a new managed custom folder control what happens to items stored in them. Managed custom folders are slightly different: when you define managed custom folders in Exchange 2007, the managed folder mailbox policy you associate with the folders will actually create folders in the mailboxes of targeted users. You can use these folders (see Figure 1) to give users a place to file content you want them to keep. Each folder can have an associated retention time and action (more on that later). 1. Launch the Exchange Management Console. 2. Open the Organization Configuration node, then select the Mailbox node. 3. Click the Managed Folder Mailbox Policies tab. 4. Click New Managed Folder Mailbox Policy in the Actions pane. 5. When the New Managed Folder Mailbox Policy dialog appears, name the policy, then use the Add button to select a managed folder to which the policy should apply. 6. Click New, then Finish to create the policy. Policy Enforcement To actually enforce the retention policies you ve defined, you still need to create managed content settings. These settings specify the retention time limit and action for the folders to which it applies. To create these settings, you right-click a managed folder (either default or custom) in the Exchange Management Console, then choose the New Managed Content Settings command. That brings up the New Managed Content Settings wizard (see Figure 3). This wizard allows you to define: Support for managed custom folders requires the add-on enterprise CAL for Exchange Server. However, you only need the enterprise CAL for users who will actually use the managed custom folder feature. To create a managed custom folder, do the following: 1. Launch the Exchange Management Console. 2. Open the Organization Configuration node, then select the Mailbox node. 3. Click the Managed Folder Mailbox Policies tab. 4. Click New Managed Custom Folder in the Actions pane. 5. When the New Managed Custom Folder dialog appears, fill it out (see Figure 2). The names that are displayed will appear for all users who get the folder; you can optionally specify a comment that appears as an Infobar-style yellow text box in the folder list. In addition, you can specify a storage limit for the folder (and its subfolders). This limit has nothing to do with the mailbox-level storage quotas. 6. Click New, then click Finish to actually create the folder. 6 Figure 3: The New Managed Content Settings wizard The name of the settings The message type to which the settings apply. By default, All Mailbox Content is selected, but you can scope the settings to calendar items, contacts, documents, messages, faxes, journal items, Without Solid Implementation a Legal Discovery Plan Is Just a Plan sponsored by Sherpa Software

7 meeting requests (plus responses and cancellations), missed call notifications, notes, and voice mail messages. The length of the retention period, if any, and when it starts. Use the When item is moved to the folder as the retention period start time if you want the period to begin when users put items in a managed custom folder. The action to take when the retention period is reached. You can choose to: o Immediately and permanently delete the item (hard delete) o Immediately delete the item but allow users to recover it (soft delete) o Move items to the Deleted Items folder o Move the item to a managed custom folder (which can have its own separate policy applied to it) o Mark the item as past its retention limit, but leave it alone otherwise You can see that these settings are fairly flexible. For example, you could apply a policy to the Inbox (a managed default folder) that would move items to the Deleted Items folder after 14 days, presumably as an encouragement to users to file them properly. Combine that policy with managed custom folders that specify set retention limits and you re in business. (Exchange 2010 improves on this mechanism by letting users put retention tags on messages to aid in automatic classification and filing of messages, but that s a separate white paper.) The managed content settings are applied by the Managed Folder Assistant. By default, the Managed Folder Assistant is set to never run! You can schedule it to run by using the Exchange Management Console as follows: Message Capture Exchange 2007 includes a robust journaling feature that allows you to capture all messages flowing inside your organization, as well as messages exchanged with outside users. When you configure journaling, you can control: Which user accounts or distribution lists are journaled. Note that per-user/per-dl journaling requires you to purchase the add-on Enterprise Client Access License (ECAL) for Exchange 2007; it s not available at all in earlier versions. Where journaled messages go. In Exchange 2007, you can send journaled messages to a mailbox, public folder, or SMTP address. In earlier versions, you ll only be able to route messages to a mailbox or public folder. To set up journaling rules on Exchange 2007, do the following: 1. Launch the Exchange Management Console. 2. Open the Organization Configuration node, then select the Hub Transport node. 3. Click the Journaling tab. 4. Click New Journal Rule in the Actions pane (see Figure 4) a. Give the journal rule a name b. Select the target of the journaled messages; it must be visible in your GAL, which means you need to create a contact if you re sending journaled items to a separate address. c. Pick a scope of messages that you want to capture. 1. Launch the Exchange Management Console. 2. Expand the Server Configuration node, then select the Mailbox node. 3. Locate the server you want to manage, then right-click it and select Properties. 4. Click the Messaging Records Management tab. 5. Set the Schedule the Managed Folder Assistant drop-down to Use Custom Schedule, then click the Customize button to set the actual schedule you want to use. Figure 4: The New Journal Rule dialog sponsored by Sherpa Software Without Solid Implementation a Legal Discovery Plan Is Just a Plan 7

8 The Tools That Fit Let s look at how Sherpa Software can help you with various e-discovery requirements. First, why use Sherpa s tools with in-house processing? Time savings: Respond quickly by automating the retention, archiving and discovery processes. In-house operation: Use existing resources to maintain control of the processes and fulfill requirements. Defensible: Establish recognized, repeatable processes for the collection and preservation of data. Targeted: Use solutions created specifically for the Exchange environment. Cost-effective: Target specific areas to reduce cost, manage data efficiently and automate processes with a favorable pricing model. Sherpa provides tools in each area Compliance, Litigation Hold, and Discovery to help manage your process in the Exchange messaging environment: Discovery Attender: Helps you answer discovery requests. Mail Attender: Manages content, retention, and compliance policies in Exchange mail stores, public folders, and network or desktop PST files. Archive Attender: Archives data and implements retention policies. For more than 10 years, Sherpa Software has provided award-winning software specifically designed to address E-Discovery, and PST Management, Archiving, and Compliance requirements for Microsoft Exchange and Lotus Notes environments. Sherpa s products are designed to streamline administrative processes while offering flexible management architectures and reasonable pricing models to companies of any size. You wouldn t tackle Mount Everest without the help of a Sherpa, so why tackle E-Discovery without Sherpa Software? For detailed product descriptions, free white papers, and evaluation versions of Discovery Attender, Archive Attender, and Mail Attender, visit or call to speak with a Sherpa Software Sales Representative. d. If you want to journal messages only for certain users, check the Journal messages to recipient checkbox, then use the Browse button to pick the lucky recipients. e. Click New to actually create the new rule. Journal rules take effect immediately. However, because they are stored in Active Directory and processed by Hub Transport servers, it may take some time for the rules to propagate to all Hub Transport servers in your organization. A best practice is to consolidate transport rule changes into idle periods, like overnight, to allow them time to replicate. Archival Exchange 2007 and earlier don t offer any built-in tools for managing retained data; the journaling features help you capture data so it can be archived, but once it s in the archive you re on your own. For that reason, there are a wide variety of third-party archival solutions that work with Exchange on the market, and Microsoft s building archival functionality into Exchange Conclusion If you wait until you actually get a discovery request to start figuring out how to comply with it, you re guaranteed to spend more money (and, not incidentally, suffer more stress) than if you already have a discovery plan in place. This plan must specify what you ll retain, how long you ll retain it for, and how you will produce data when required. While building a complete plan will probably require advice from competent lawyers (and quite possibly the purchase of third-party products) you can make a good start with your own knowledge and the tools Microsoft provides in Exchange Server. Paul Robichaux is a founding partner for 3Sharp LLC, an MCSE, and an Exchange MVP. He is the author of several books, including The Exchange Server Cookbook (Published by O Reilly and Associates); he s also an active blogger at 8 Without Solid Implementation a Legal Discovery Plan Is Just a Plan sponsored by Sherpa Software