E-Discovery Management in the Age of Big Data

Transcription

1 E-Discovery Management in the Age of Big Data Effective e-discovery can be daunting as data volumes grow exponentially. Learn cutting-edge e-discovery strategies to avoid legal complications in the big data era. CLASSIFICATION VITAL TO BIG DATA CLOUD- BASED

2 EDITOR S NOTE Big Data Forces New Look at E-Discovery Management and Processes TO BIG DATA The amount of data the typical modern organization generates and is responsible for maintaining for legal and regulatory compliance is astounding. As the big data age continues, many businesses have to completely rework information management strategies to adapt, and e-discovery processes are no exception. The trouble is that the vast majority of stored data is never needed for litigation purposes, making discovery of relevant legal data seem like finding an (expensive) needle in a haystack. As businesses try to ensure their information systems and processes can produce relevant legal information, it puts a strain on resources and drives up costs. Throw third parties such as cloud storage providers into the mix, and big data management processes and e-discovery become even more complicated. In this SearchCompliance handbook, we ll guide you through the development of mature information management processes and e-discovery best practices. In our first article, we look at how information classification is the essential first step to e-discovery in the age of big data. In our second piece, we discuss the data management policy must-haves to ensure effective e-discovery if information is needed for litigation purposes. And in our final article, information governance expert Jeffrey Ritter provides key strategies to ensure cloud provider contract agreements meet the organization s e-discovery management and legal requirements. We hope you find this handbook useful as your business seeks the best e-discovery policies that reduce legal and regulatory risk in the face of big data. n Ben Cole Editor, SearchCompliance 2 MANAGEMENT IN THE AGE OF BIG DATA

3 DATA MANAGEMENT Information Classification Vital to Big Data E-Discovery TO BIG DATA Big data takes many forms, with the umbrella term used to describe vital business information stemming from applications, security logs and business productivity documents, to name a few. Then, of course, is the unmanaged, or unstructured, data not stored in a database which is headache-inducing if the information must be located for a compliance audit or lawsuit. When it comes to aging data, 50% of respondents to a 2013 Gartner Inc. survey responded that understanding exactly what specific data is used for and what information should be discarded is the No. 1 issue with which their organization struggles. From an information governance perspective, big data challenges stem primarily from not knowing what data to keep, said Gartner Inc. Research Director Garth Landers. This is increasingly hard given that these big data analytics opportunities may not be readily evident, Landers said during a presentation at the 2014 Gartner Security and Risk Management Summit. For those of us in IT, there is a lack of understanding, a fear of what to do with that data. This trepidation makes data classification and what to do with that newly defined information vital when it comes time to identify and recover that data if it s needed for litigation. After all, if you don t know exactly what the data is, how will you know how to properly store and recover it? Having a rock-solid structured data archiving process is a great place to start. It is now common for organizations to generate and manage petabytes or even exabytes of data. As a result, organizations are moving away from storing data indefinitely and toward identifying any information that can be deleted, Landers said. If you store everything, it s more likely to come up in pending litigations or regulatory 3 MANAGEMENT IN THE AGE OF BIG DATA

4 DATA MANAGEMENT TO BIG DATA compliance audits, Landers said. If data has no business value, get rid of it. Classification is vital to this process starting with simply defining what a record is as it pertains to your organization, said John Isaza, who leads the information governance and records management practice at law firm Rimon PC. Once you have that definition of a record, then you can dispose of information that is not a record, except of course if there is a legal hold in place, Isaza said. Companies need to strike a delicate balance, however: Keeping too much information can create legal complications, but the organization also must be prepared in the event that relevant information is called upon as part of an e-discovery request. To prevent over-retention, you have to, first and foremost, have a records retention schedule that dictates what you absolutely need to keep as a matter of best business practices and to remain fully compliant with regulations, Isaza said. If the organization has adequate resources, Isaza suggests having a legal hold steering committee in place to oversee anticipated or pending litigation. The committee would be responsible for identifying legally relevant data to prevent the destruction of not just records, but of all data in your systems that could be relevant to the subject matter of that lawsuit or investigation, Isaza said. USE BIG DATA MAPPING TO YOUR ADVANTAGE If implemented correctly, these information classification and big data e-discovery processes can help reduce litigation costs and risk. But where should organizations start? One proactive solution is to develop your organization s data map, said Marshall Hoel, a managing consultant at Berkeley Research Group LLC. The data map is a comprehensive listing of the systems employed by a business, their functions, how they store data, how often they are backed up, and which other systems deal with similar data and how they interact, Hoel said. This information will be invaluable if specific data must be located quickly to fulfill a legal obligation. Data maps can help the IT team communicate with legal counsel about how the 4 MANAGEMENT IN THE AGE OF BIG DATA

5 DATA MANAGEMENT TO BIG DATA record is classified, its location and the retention policies for it. It s also important to know the key players who are involved in the day-to-day management of the various systems, Hoel said. It will be critical to interact well with these individuals when the time comes to act in the face of impending litigation. Thorough data classification and mapping techniques have become necessary as organizations adapt to the demands of big data, as well as its associated storage costs. In the past, businesses that dealt with large amounts of structured and unstructured data would do so using relational database management systems tailored to the various applications. Under these systems, the data being analyzed was stored in a logical, easily identified location so that information management policies could be readily applied, Hoel said. Big data has dramatically changed these processes, he added. When confronted with the problem of legal preservation and discovery, businesses are forced to rethink their strategies regarding structured and unstructured data and traditional collection techniques, Hoel said. Ben Cole 5 MANAGEMENT IN THE AGE OF BIG DATA

6 POLICY KNOW-HOW The Role of Strict Data Management Policy in E-Discovery TO BIG DATA Big data complicates numerous aspects of data management. Questions around information access, security controls and data retention and deletion schedules all become more pressing when there is a seemingly endless amount of data to sift through. Without a thorough data management policy, it s also very difficult to access relevant e-discovery data during a court case. And even the organizations that do have a policy in place often don t take into account the complexity of big data, said Garth Landers, a research director at Gartner Inc. These policies have not largely been adopted and applied to big data, or activated data that may sit in depositories like Hadoop and data warehouses, Landers said during a presentation at the 2014 Gartner Security and Risk Management Summit. Access enablement and control become increasingly important. Of course, information governance policy development is no picnic in the big data era. Every crucial aspect of the organization finance, security, IT, etc. will have its own data-related governance, risk and compliance and legal mandates. Determining exactly what data needs to be kept and for how long will become convoluted quickly when all of these departments provide input. When developing an information governance policy, a key aspect is to identify the crucial areas that drive data retention, such as regulatory compliance mandates and potential legal issues, Landers said. There must be organization-wide communication, cooperation and cross-training about information governance responsibilities. Representatives from the legal, IT and compliance departments should also be able to refine the processes when the regulatory landscape inevitably changes. You want to have those rules and policies 6 MANAGEMENT IN THE AGE OF BIG DATA

7 POLICY KNOW-HOW TO BIG DATA come from the people that know the people that understand the regulation, the people that understand the legal requirements of the organization, that are involved in litigation, Landers said. Of course, strategic information management programs should also decrease e-discovery challenges while helping lower storage costs and mitigate risks. The plan should take into account the nature of the impending litigation, the people involved, the systems in play, and the processes needed to respond to the discovery request in a timely and cost-effective manner, said Marshall Hoel, a managing consultant at Berkeley Research Group LLC. Too often, organizations are caught flatfooted by a discovery or other legal request, and this usually leads to significant strain on resources and costs, Hoel said. Proactive management of these issues is the most effective way to mitigate both cost and risk. THIRD-PARTY (BIG) As big data continues to complicate information governance, organizations are increasingly turning to third parties to help. Tools that help manage unstructured data can be invaluable to ensure legal and regulatory compliance, for example. Predictive coding solutions have also become necessary to help scan millions of documents for legal proceedings. It s important to remember that information governance policy doesn t end at the company doors. For third-party vendors, we are encouraging our clients to have contractual provisions to obligate them to follow your records management procedures and follow your needs as an organization when it comes to e-discovery, said John Isaza, who leads the information governance and records management practice at law firm Rimon PC. Companies also should take into account the potential for lag time for requests to cull data from third-party systems, Hoel said, and factor that into their vendor information management strategy to avoid missing e-discovery deadlines. He suggests conducting periodic testing that extracts small amounts of data with random identification parameters. 7 MANAGEMENT IN THE AGE OF BIG DATA

8 POLICY KNOW-HOW TO BIG DATA This will give you a good idea of how to respond and work with your providers when it comes time to respond to an actual discovery request, Hoel said. Mobile data creates another information management hurdle. As organizations increasingly allow employees to create and store company data on personal mobile devices, companies must establish guidelines that clearly depict what types of data are allowed on these devices. Any location where electronically stored information (ESI) exists whether in the cloud or on social media or mobile devices could be culled for litigation, Hoel said. Companies have to remain vigilant and take into account vendors business strategy as well, especially when it comes to discovering legal data. In many cases, third-party data management and storage providers pool their clients data into massive data sets to make the technology more efficient. While this is a great way to reduce upfront costs, it can present an additional hurdle when it comes to the process of preservation and collection of potentially relevant ESI, Hoel said. Companies have to remain vigilant and take into account vendors business strategy as well, especially when it comes to discovering legal data. This adds to the importance of consistent, documented processes that are regularly audited. Companies seem to be paying attention: Gartner predicts that by 2018, 25% of progressive organizations will manage their unstructured data using information governance and storage management policies, up from less than 1% today. But of course, just having policy isn t enough. When we talk about organizations being prepared and responding to events like audits, investigations and litigation, it s not just about having a policy, Landers said. It s about executing it, being consistent, and making sure that it s demonstrable to litigators, auditors or any regulatory body that makes an inquiry. Ben Cole 8 MANAGEMENT IN THE AGE OF BIG DATA

9 GOVERNANCE Five Strategies for Managing Cloud-Based E-Discovery TO BIG DATA As data volumes increase, so does the complexity of searching for, collecting, processing and producing potentially relevant evidence required for internal investigations, civil litigation, compliance filings and enforcement proceedings. To manage this complexity, a new generation of cloud-based e-discovery products and services has emerged. Here are five key contract agreements to ensure that cloud providers meet your e-discovery management and information governance requirements. STRATEGY #1: USE THE CLOUD IN BUSINESS CAREFULLY A provider may license software applications to be accessed and used on its systems, including the processing and storage of related digital information (software as a service, or SaaS). The provider may also lease the use of its systems, servers and infrastructure, whether for general computing purposes (infrastructure as a service, or IaaS) or for building and launching various types of software applications (platform as a service, or PaaS). In any of these three service models, the service contract is very important to the future performance of e-discovery management, as well as to the ability to meet legal requests and deadlines for information. The Federal Rules of Civil Procedure impose discovery obligations (including those for electronically stored information, or ESI) with respect to information that is within a company s possession, custody or control. Courts regularly conclude that cloud-based data is still within a company s or the cloud customer s control. But unless the customer has clearly defined a service provider s duties and services with respect to cloud-stored data in the provider s custody, significant costs and administrative 9 MANAGEMENT IN THE AGE OF BIG DATA

10 GOVERNANCE TO BIG DATA challenges emerge. A 2013 Symantec survey reported two-thirds of the responding companies with cloud-based storage had missed legal deadlines for delivering the requested information. Therefore, customers should anticipate that any digital information stored with a cloud provider may be required as potential evidence in legal proceedings. The contract agreement, as well as internal corporate procedures, should anticipate how e-discovery will be performed against the data, and the respective duties (and costs) of the provider to do so. STRATEGY #2: GOVERN YOUR ESI Beyond the direct service agreement, cloud customers (and law firms with respect to their own business records, as well as their clients) should include cloud-based ESI in the design and management of their information governance programs. Information governance is far more than just records management. It involves applying all of the rules applicable to business data at any location at which the data may be collected, processed or stored. It is astounding the number of companies that have yet to revise their 20th century records management practices to fully embrace 21st century digital realities. Customers should anticipate that any digital information stored with a provider may be required as evidence. Effective information governance means a company is also anticipating the impact of collecting, processing or storing ESI with cloud providers under various legal duties unrelated to e-discovery management. Privacy and data protection, information security, data transfers and destruction rules all must also be navigated when e-discovery is conducted in the cloud. A business must both build a complete inventory of those rules, including the e-discovery rules to which the company may be subject, and assure those rules can be and are being enforced against all of the company s data assets. In fact, without that foundation, 10 MANAGEMENT IN THE AGE OF BIG DATA

11 GOVERNANCE any service agreement with a cloud provider will likely fail to support the company s future e-discovery needs. requires the provider to develop and deliver operating logs and similar records that demonstrate performance and log-relevant events. TO BIG DATA STRATEGY #3: ENGAGE CLOUD SERVICES WITH PRECISION As part of a company s information governance program, rules describing e-discovery processes and their application to all of a company s ESI should be in place before engaging cloud-based products and services. Those rules then become the basis by which detailed statements of work can be composed and included in the related agreements. Doing so is a dramatic step toward minimizing the potential for data management chasms between the customer and the providers, particularly when operating under court-imposed deadlines. Whether using a provider to store ESI for later processing in discovery, or for licensing the use of advanced e-discovery software for filtering and reviewing ESI, companies still will want to ensure their internal controls are being properly implemented for the data assets in the provider s custody. That assurance often STRATEGY #4: PROTECT THE CHAIN OF CUSTODY FOR ESI If a company (and its lawyers) cannot show the digital chain of custody through which the ESI has passed, when offered to the court, opposing counsel may successfully argue the ESI is not worth the paper on which it may be printed. Therefore, customers should choose providers that properly design and carefully control ESI management processes. Once the ESI is under the custody of the provider (e.g., at the moment of collection from the desktop machine of an employee or a backup server archive), the providers often have superior chain of custody processes. After all, protecting the integrity of the ESI as evidence is their fulltime job. It is not merely an incidental task, as is often the case in corporate departments and divisions who crowd information governance onto an often too-filled plate of other business duties. 11 MANAGEMENT IN THE AGE OF BIG DATA

12 GOVERNANCE TO BIG DATA The agreements must have documentation of those procedures. As an added safeguard, the agreement must also include stipulations that the cloud service provides for production and delivery of process documentation on specific cases or specific ESI assets. It is not enough to offer the agreement s promises of how the ESI will be managed. What matters is the customer s ability to demonstrate the actual ESI management activities that occurred for a specific data set. Additionally, the customer may want to negotiate the availability of a provider s staff to testify in depositions or in court regarding those activities. STRATEGY #5: TEST THE CAPABILITIES AND PROCEDURES Complex litigation and the potential for sanctions, fines or irreparable adverse rulings imposed for e-discovery negligence are like any other substantive disasters. Careful planning and testing are essential to ensure everything fires correctly when things get hot. Cloud providers should be strong partners with their clients in developing suitable tests of their capabilities to execute the required e-discovery procedures. It isn t enough to offer the agreement s promises of how the ESI will be managed. Based on the contracted services being implemented (SaaS, IaaS or PaaS), these tests will vary in their complexity. But it is important that the documentation of their execution and the results be retained as further evidence of the company s commitment to responsibly execute its e-discovery obligations. The primary agreement should ensure these tests are part of the initial setup and launch of the services, and that recurrent testing occurs. If major services are altered, including in response to changing legal rules, additional testing to ensure conformity with the alterations is always appropriate. Jeffrey Ritter 12 MANAGEMENT IN THE AGE OF BIG DATA

13 ABOUT THE AUTHORS TO BIG DATA BEN COLE is site editor for SearchCompliance. Prior to joining TechTarget, he was the online editor for Health- Leaders Media, based in Marblehead, Mass. He began his journalism career as a reporter with the Massachusetts daily newspapers The Gardner News and the Sentinel and Enterprise. Write to him at bjcole@techtarget.com. JEFFREY RITTER is one of the nation s experts in the converging complexity of information governance, security, the use of digital information as evidence and the emergence of cloud-based services. He advises companies and governments on successful 21st century strategies for managing digital information with legal and business value. He is currently developing and teaching courses on information governance at Johns Hopkins University s Whiting School of Engineering and Georgetown University Law. Write to him at jeffrey@jeffreyritter.com. E-Discovery Management in the Age of Big Data is a SearchCompliance.com e-publication. Rachel Lebeaux Senior Managing Editor Ben Cole Site Editor Fran Sales Associate Site Editor Jeffrey Ritter Contributing Writer Christina Torode Editorial Director Linda Koury Director of Online Design Neva Maniscalco Graphic Designer FOR SALES INQUIRIES Amalie Keerl Director of Product Management akeerl@techtarget.com TechTarget 275 Grove Street, Newton, MA TechTarget Inc. No part of this publication may be transmitted or reproduced in any form or by any means without written permission from the publisher. TechTarget reprints are available through The YGS Group. About TechTarget: TechTarget publishes media for information technology professionals. More than 100 focused websites enable quick access to a deep store of news, advice and analysis about the technologies, products and processes crucial to your job. Our live and virtual events give you direct access to independent expert commentary and advice. At IT Knowledge Exchange, our social community, you can get advice and share solutions with peers and experts. COVER PHOTOGRAPH: TCMAKE/THINKSTOCK 13 MANAGEMENT IN THE AGE OF BIG DATA