Month: December 2009

Employees Using Personal Email Accounts to Send Large Files

Bill Tolson eDiscovery , , , , , , , ,

In a recent survey conducted by Osterman Research, it was revealed that 82 percent of employees use their personal email accounts to send large work-related files when an email attachment exceeds the size limit imposed by IT.

Is this a problem?…YES

Lets say your company is involved in civil litigation and has received interrogatories (written questions as part of the discovery process) from opposing counsel. One of the questions could be; “Has any of your employees or contractors ever sent business related emails or attachments to another party using their personal email account?” According to the Osterman data, 82% of your employees will answer yes to that question.

Why is this a problem?

First, your eDiscovery process including legal hold requirements will have to include searching your employees personal email accounts, if they give you permission. In my opinion, that doesn’t relieve you of the responsibility of protecting those responsive emails.

Second, eventually your employees are going to face the possibility of attorneys reading their personal emails and attachments from within their personal email accounts. There are few employees that will think this possibility is a good thing.

So how do you remove or at least lower this possibility?

First, create written email use policies that forbid employees from ever accessing their personal email accounts at work from employer provided equipment.

Second, Include in the above mentioned policy that company related records are never to be sent or received from personal email accounts.

Third, explain to employees that if they violate the policy, they could be fired.

Forth, explain that if they were to violate the policy, attorneys, including opposing counsel may be reading their personal emails in discovery some day.

Fifth, create a way within your infrastructure to send and receive large files so employees don’t have to fall back to using their personal email accounts to send or receive large business related files.

10 Clues Corporate Counsel Should Take to Heart about eDiscovery

Bill Tolson eDiscovery , , , , , , , , , ,

The following content was inspired by an article in Law Technology News in Oct 2009 by Tom O’Connor titled “Top 10 EDD Tips for General Counsel”.

  1. Read the Rules: Read the Federal Rules of Civil Procedure or at least the amendments passed in December of 2006. For most of you, the days of farming out all discovery preparation is quickly disappearing. You are going to be responsible to not lose the case against you in the first couple of weeks by screwing up the discovery process. Come on…you made it through law school and read (?) all those books as well as you probably have suffered through your share of mind numbing IP applications. The FRCP is not as bad as that. I also recommend taking a look at the Electronic Discovery Reference Model (EDRM), a great site for in-depth learning of the eDiscovery process.
  2. Learn from Others: Case decisions are a great place to learn what others assumed or tied and didn’t work. They are also a great place to determine Judge’s opinions and judicial thinking. There are many great blogs and websites. The one site I look at every day is Electronic Discovery Law which consistently has great write ups and analysis on current and past cases. I have been constantly amazed over the years to see how little corporate counsels pay attention to current legal actions. If nothing else, some of these decisions have a great deal of humorous revelations in them and will give you a chance to make fun of others. Another great organization to look at for information and leadership in the discovery process is the Sedona Conference organization.
  3. Understand the Terms: No, eDiscovery is not an electronic dating service; early case assessment (ECA) is not a process to determine if a case of wine in your basement has gained in value and “PST” is not a juvenile texting shortcut for “Please Stop Texting”. Knowing the legal terms is expected, generally knowing technical terms such as “Giga Byte” and “Thumb Drive” will be helpful and just might impress the Judge.
  4. Understand Where the Corporate ESI Could be Stored: Understanding all the places ESI could exist is the first step in lowering your risk in litigation. After you understand where all the ESI could exist, and it could be thousands of places that have little or no central control, limit the number of locations that ESI can be stored. This will lower your cost of collection a huge amount.
  5. Talk to your IT department: Take the key individuals in your IT department out once in a while, maybe to your club. This will impress the propeller heads enough so that the next time you incorrectly reverse sync your Blackberry and blow all your contacts out of your outlook, they might actually fix it quickly. You might also learn some other stuff that would be helpful like the fact that they are keeping backup tapes around for years (if you don’t know why this is a problem, you didn’t take the prerequisite to this class).
  6. Acknowledge (and work with) your Records Managers: They’re not bad people, just misunderstood. I have heard Records Managers often referred to as “Blue Hairs”. This is an obvious reference to the stereotype that all records managers are “mature” women. I won’t lie to you; this is sometimes true in certain industries but not everywhere. The Records Management department can be an important ally in your understanding of eDiscovery problems and ways to fix those problems. They are also important in the next clue.
  7. Create a Usable Records Management Policy and Schedule: I walked into a large company several years ago on a consulting engagement and asked them for their records retention schedule. After about a day and a half I was given a 212 page document that was full of record types and retention periods, all in 8 point type. When I asked them if they really thought every employee actually followed this schedule, they answered “absolutely” and they met it. After interviewing 40 or so employees I found that 34 on them didn’t know the company had a retention schedule and the other 6 employees just regularly kept everything for ever. Having a records retention policy and schedule is the first step in controlling your ESI. The idea is to manage and control it; not keep everything forever. A word of caution; a retention schedule that is not enforced is worse than not having one at all.
  8. Create a Litigation Hold Policy and Test It: Creating a litigation hold policy before you experience litigation should not be a revelation to anyone even though I know for a fact it is for many.  It just makes sense that being able to effectively stop the destruction of potentially responsive ESI would lower your risk of spoliation. A common sense next step would be to test it. A litigation hold policy that doesn’t work will not usually impress the Judge.
  9. Train Your Employees: Train your employees on the records retention policy and schedule as well as the litigation hold policy. Remember the example above in the “Create a Usable Records Retention Policy and Schedule” topic. Having a policy and not telling your employees about it will not get you an invitation to the next Mensa gathering. Employees should be trained regularly and asked to sign a document that says they understand the training.
  10. Automate Where You Can: The bigger your organization, the harder it will be to do things manually. I know “archive” is a dirty word to most legal types but the term archive does not mean save everything for ever. It is a way to manage your ESI so that it is eventually deleted. Put ESI management systems in place that will help you meet your legal, regulatory and business requirements.

Do we need an addition to the EDRM?

Bill Tolson eDiscovery , , , , , ,

The Electronic Discovery Reference Model is a great reference model showing all the general steps/processes around eDiscovery. There has obviously been a great deal of thought and work put behind it with fantastic results but does it cover everything that corporate legal departments want?

The reason I bring this up is I often run across companies that comment on the EDRM mostly because it doesn’t really reflect their processes. I don’t think it was met to be specific and probably couldn’t have been. Organizations have their own processes they have developed and are use to and it would be nearly impossible to take them all into consideration.

An addition I would like to see in the EDRM is a costing component. What processes, for example, incur the highest costs and how could those costs be better controlled. Again, I don’t believe it was in the EDRM’s target to answer those kinds of questions but wouldn’t those answers be great?