e-Discovery Insights

Beware the Ides of #Google

You didn't think all that free stuff was free, did you?  Sure...multi-billion-dollar conglomerates give you all kinds of tools and want nothing in return.  No, like with most loss-leaders, they lure you through the door at a bargain, make you comfortable, then make it up elsewhere; such as by mining your data.

Beginning March 1st, 2012, Google will be using a bigger shovel.  That's when they implement their new privacy policy.  Funny...it should probably be deemed a 'lack-of-privacy' policy.  Essentially it allows them to mine your data over most of their products in order to create a better profile of you; ostensibly for your benefit, but really, for theirs.

Here's the deal.  I think most people, including me, are fine with giving up something in order to receive something.  I know that Google mines data, so I tweak my privacy settings to the maximum protection level and also bypass gmail, calendar and contacts sync for my Droid (I do the same with Yahoo and any other site that wants me to upload my contact and calendar information).  Why?  Because I know that Google, et al, wants to get their hands on it!

But, where it's a problem is for all of the people who have absolutely no concept of what they're actually giving up.  That means, you, attorneys!  This is the problem with the cloud.  If attorneys store their data - and that of their clients - in the cloud without understanding that its being mined, they've already violated their ethical duties in most jurisdictions.

We attorneys call it informed consent.  The problem is, it's the attorneys who have to inform themselves - and their clients - before they may reasonably consent.

These free services are coming with more and more strings attached (e.g., users who are forced onto Facebook Timeline know what I'm talking about).  The benefits are gradually shifting from the end-user to the provider.  Naturally, we always have a choice; conform or be cast out (thank you, Rush...).

As many of you know, I don't have a Facebook account.  A while back, when 200 million people were using the service, they seemed unusual.  Now that 800+ million are using it, I seem unusual!  Peer pressure is a bitch, but I was never one to run with the crowd, anyway.

Be cool or be cast out...

e-Discovery California: Proposed Formal Opinion Interim No. 10-0003 (VLO) is the Right Answer to the Wrong Question

42.  (That's for those of you who picked up on the 'Hitchhiker's Guide to the Galaxy' reference).

I usually don't feel it necessary to refer you to my disclaimer but, because this is a State Bar of California opinion - and I'm Vice-Chair of their Law Practice Management & Technology Section Executive Committee (LPMT) - I want to remind you that:

"This blog site is published by and reflects the personal views of Perry L. Segal, in his individual capacity.  Any views expressed herein have not been adopted by the California State Bar's Board of Governors or overall membership, nor are they to be construed as representing the position of the State Bar of California."

The LPMT Executive Committee may publish its own, 'official' comments, to which I may also contribute.  That being said...

Technology is an extremely logic-based discipline, in its purest form; or it should be, at least.  Indeed, like the practice of law, success or failure is predicated upon compiling and understanding a particular set of facts, then realistically acting upon those facts.  Note my emphasis on the word, 'realistically'.  If I wish to suspend disbelief and begin with a set of unrealistic criteria, I may be equally able to formulate a reasonable solution, assuming it's possible to locate someone - or something - that fits the original, unrealistic premise.

This is my assessment of Formal Opinion Interim No. 10-0003 (Virtual Law Office).  It's actually a very well-crafted opinion, but it's based on a 'Statement of Facts' that, to me, are an unrealistic portrayal of how an attorney practices - or would practice - law.

First, there's no reason for me to re-invent the wheel.  For another excellent nuts & bolts assessment of the opinion, please see Stephanie Kimbro's post on her Virtual Law Practice blog.  She's an authority on the Virtual Law Office and is also cited as a resource on page one of the opinion itself.

From a pure cloud security standpoint, this is an excellent document and a perfect complement to opinion 2010-179 on wireless networks.  In fact, I would recommend that practitioners ignore the hypotheticals for a moment (especially if they're pressed for time) and proceed to the Discussion heading, Section 1 ("Duties"), which is what I'm doing for the purposes of this post.

Section 1 examines confidentiality issues of employing a cloud-based system with a 3rd-party vendor and provides a five-point list of due diligence factors that includes, but isn't necessarily limited to:

1. The Credentials of the Vendor
2. Data Security (Well, that's not very helpful, but it goes on to refer the reader to California, New York and ABA opinions for guidance)
3. Vendor's Transmission of Client Info in the Cloud Across Jurisdictional Boundaries or Other 3rd-Party Servers (You've heard - or read, I suppose - me pontificate on that one; the "digital roach motel" and "know where your data is")
4. Attorney's Ability to Supervise the Vendor (As I've reminded you often, you may hire competence, but not delegate this duty)
5. Terms of Service of Contract with the Vendor (This is huge where the cloud is concerned.  For example, many provider contracts contain language to the effect that, "Once you transfer it to us, it becomes our property.", a major no-no for attorneys)

It also points out the security environment must be periodically reassessed, which is terrific advice.  I usually refer to it as "fire drills".  Finally, it points out that none of this may take place without proper disclosure to the client, who may, by the way, have no idea how any of this works.

Section 2 examines competence issues as follows:

1. Proper management of attorney's intake system to determine one of the basics; "Who is the client?"
2. Determining whether attorney may perform the requested services
3. Determining that the client comprehends the services being performed (This document also refers to comprehension issues due to a language barrier)
4. Keeping the client reasonably informed
5. Determining that the client understands technology (When I read #3 above, it immediately triggered the thought that technology is another language both attorney and client must understand...)
6. Determining when to decline to represent a client via a VLO, and whether representation may continue through traditional means

This section also re-raises the supervisory issue, but this time it's in terms of the attorney supervising other attorneys and/or non-attorneys.

Ok, so you know what I like, now let's get into what I don't like.  The hypothetical describes the VLO as a password-protected and encrypted portal that sits on a 3rd-party cloud.  So far, so good.  But then, it goes on to say that the attorney plans not to communicate with clients by phone, email or in person, but will limit communication solely to the portal.

Yeah, that covers a lot of us, doesn't it? 

I understand that it's possible for attorneys to communicate this way, but is it probable?  Does this opinion realistically apply to most attorneys; now and even into the future?  I'm not trying to be snarky here, but you can't blame me for being a tech guy.  Immediately, my mind wanders to what would likely happen in this scenario.  A technology or communication issue arises and the frustrated attorney - or client - resorts to email or a phone call.

And what about secrecy?  No, I'm not alluding to some nefarious purpose.  There are legitimate reasons why attorney and/or client might not want to document ideas or discussions - electronically or otherwise - in the short-term (what comes to mind is a nervous potential client who has invented a new product, but doesn't want to provide a lot of written detail to attorneys, while soliciting the representation of several of them, for fear that the inventor's intellectual property will be revealed).

The second thing that bothers me is the "Issue" statement that opens the opinion.  It states, verbatim:

"May an attorney maintain a virtual law office practice ("VLO") and still comply with her ethical obligations, if the communication with the client, and storage of and access to all information about the client's matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")."  [Italics/bold added.  It's posed as a question, but in the text, the paragraph ends with a period - not sure if it's a typo that will be corrected in a later version].

What's the danger here?  Hello?  Facebook is the cloud!  Google is the cloud!  Email is the cloud!  A lot of communication is taking place - right now - through means not anticipated in this opinion.  What I'm saying is, if one removes the term, "VLO", from this document, it could just as easily apply to methods attorneys use to communicate with their clients on a daily basis, while at the same time, being completely unaware that many of these products are in the cloud.

It also fails to anticipate one other factor; what will happen the day these measures apply to all cloud-based technology (that day is coming, and in some cases, is already here).  As it stands today, if most attorneys attempted to comply with these security measures, law practice as we know it would grind to a halt.

Better start preparing now...

e-Discovery California: Wow - I Coulda had a VLO!!!

Happy Holidays, everyone.  I'm about 2/3 of the way through my book-writing and with any luck, I hope to submit most of my remaining contribution before New Years (that is, if I don't succumb to the most wonderful time of the year - Bowl Season!).  Hopefully, then, I can get back to posting here more often.

In the meantime, I have some homework for you.  The California State Bar Standing Committee on Professional Responsibility and Conduct (COPRAC) has posted, "Proposed Formal Opinion Interim No. 10-0003 (Virtual Law Office)" for public comment [Warning; link opens a 7-page PDF].

I'm currently working on an in-depth analysis of the proposal and hope to post it next week, but when I first scanned the opinion, my mind wandered to the law of unintended consequences.  I'll reserve commenting further until I've completed my analysis, however, I encourage you to familiarize yourselves with the opinion - whether you personally make use of a VLO or not.  After all, (and it pains me to say this), it isn't all about you; the attorneys at the other end of your communications may make use of a VLO.

The public comment period remains open until March 23rd, 2012.  Hope to see you before the ball drops, but if not, please be safe and have a great holiday!

#EDRM Seeks Public Comment on their MCoC

EDRM has posted their proposed Model Code of Conduct and they're asking us to weigh in.  The comment period is open through September 30th, 2011.

Never mind Predictive Coding; what is Predictive Policing?  The answer is coming up in my next post.  Have a great weekend, everybody!

#eDiscovery California: AB 141: "Fresh" Approach makes Juror Texts & Tweets a Misdemeanor!

California is putting its money where my mouth is and is enacting AB 141, authored by Assemblyman Felipe Fuentes (D-Sylmar) and signed by Governor Brown yesterday.  It codifies the already-existing rule that juror texting or tweeting - or any other electronic communication in relation to an existing case - is a violation of duty.  But effective January 1, 2012, a juror caught doing so is chargeable with a misdemeanor.

Technically, judges could most likely do so right now under their general 'contempt' power, but, as we've seen with electronic discovery rules, this specifically targets and clarifies the rules as they apply to electronic misconduct.

I'm firmly in the camp that believes there must be harsh (or more harsh) penalties for juror mischief if we have any hope of maintaining the integrity of the legal process (some will probably say we're too late).  This is a good start.

And for anyone who believes a judge wouldn't dare impose such a penalty?  Any lawyer who's spent time in a few California courtrooms will tell you plainly; you're wrong!

#LTWC 2011 - Day 2: The Dancing Itos Meet the #DigitalRoachMotel

I'm sure you've noticed I'm using hash tags in my subject titles.  I picked up a lot of followers on Twitter during the conference and the former tag allows others following LTWC to find my summaries easily.  If you're already following me, you've seen the latter tag before.  We'll get into that, below.  As always, my disclaimer from my Day One post remains the same.

I am the man of steel!  Ok, maybe I'm the man of aluminum!  Ok, I'm thinking more along the lines of the man of caffeine.  I attempted to do the impossible; attend every single session available on day two.  I'm sure plenty of others do so, but I'll admit, when you do this, coupled with quick meetings prior to the commencement of the day, on every break and even afterwards, I can't speak for others, but I resembled some kind of zombie by the time I approached the parking garage (ask the person who met with me at the end of the day).  You know why?  Because, save for the final session, I sat in the front row (which is something I always do).  For one thing, I'm live-commenting on the event via Twitter, plus, it keeps me engaged, which is important because I'm there to drink in every bit of knowledge I can - not to sit in the back and collect CLEs (not that I don't love CLEs...).

The keynote, "Trial by Sound Byte", was given by Manny Medrano.  I've met Manny before and if you're from the L.A. area, you've likely seen him on local networks, covering cases like the OJ Simpson murder trial.  Manny's a very personable guy and is even more so as a speaker.  He contrasted his desire to cover hard news cases with the network's desire to cover celebrity cases, such as the death of Anna Nicole Smith.  He focused heavily on the issue of media coverage and how it may interfere with justice rather than simply telling the story.  Put simply, news reporters and networks are as apt to let the confidential cat out of the bag as social media users.  He cited a few examples (some that we've covered on these pages) but what I liked was his hard-line approach to violators.  He believes in harsh penalties (monetary, if possible) when there are egregious instances of juror misconduct.  I agree wholeheartedly and have said so many times.  Closing observation: this is probably the first time I'd heard the term, 'Dancing Itos', since 1996.  A decade later, during the last criminal case I worked on for the D.A.'s office, the day the verdict came out, our sitting judge took ill, so we had a substitute.  I walked into the courtroom and sitting at the bench was none other than Judge Lance Ito.

On to session one, covering "Electronic Discovery in the Cloud", with the 'legend', Tom O'Connor.  He was supposed to be presenting alone, but was joined later by Brett Burney.  This was an unexpected treat for me because last year, I stood in for Brett at another conference when he was stuck in Ohio and couldn't come.  The whole thing was hastily arranged and I basically did it sans notes.  Brett and I had never met in person, so it was great to finally put the face to the name.

This session was a perfect antithesis to the cloud presentation I attended on day one.  Here, we covered all of the risks & rewards of cloud computing.  In particular, the biggest bone of contention is how much control the vendor retains over the data.  In some cases, a law firm that agrees to those terms may actually violate their code of ethics by turning control of confidential client information over to another without their consent.  This was a more sobering - and in my opinion, more realistic - overview of what cloud computing is all about.

That's when it hit me; as far as your data is concerned, the cloud is like a digital roach motel.  Your data checks in, but it may never check out.  Or, for a little California emphasis, call it the Hotel California.  Your data can check out any time it likes, but it can never leave...

Time for the lunch session, "A View from the Bench" which was led by two Federal Magistrates, Jay C. Ghandi and Suzanne H. Segal (no rel.).  Judge Segal presented to my litigation group only two or three months ago on jurisdictional matters.  I'm presenting an eDiscovery CLE to the same group in about two weeks and if I could just get the videotape from this session and play it, I'd let my attendees watch it while I sneak up and eat all of their cream-cheese desserts.  It's exactly what I'm going to be saying, which is, in a nutshell:

• It's never too early in the process to bring in your technical assistance,
• You must plead with particularity regarding eDiscovery matters,
• Take as many of the decisions as possible out of our hands and you'll make us happy,
• Get your clawback agreements in place,
• You've had enough time to understand this stuff, so if you screw up, we'll sanction you!

*Sigh*  The latter statement seems to be more in force in Federal jurisdictions, but I suspect that - in California's case, anyway - that's because our rules came into power in 2009, not 2006 like the Federal rules.

The judges presented us with a hypothetical scenario regarding a corporate sexual harassment case and we analyzed the mistakes that were made during the process.  The gist of the issues were more focused on a paralegal performing attorney functions and making decisions that only an attorney may make, but what bugged me most was that, in a personal misconduct case, when the misconduct was reported, the paralegal contacted the subject of the accusation.  This particular fact tidbit had nothing to do with their presentation and was likely just a by-product, but I would say this to you.  If you become aware of that type of misconduct (which will trigger respondeat superior), here's my advice.  Do not pass go.  Go directly to whoever is responsible for overseeing these matters, call the accused into a meeting, have them sign a document informing them of the complaint while simultaneously arranging to collect an image of all of the person's data that you can.  And do not let them access any of it until you're done.

Why?  Because your job is also to protect the corporation; and the corporation may be held liable for any additional misconduct of its members.  If you inform the accused perpetrator, what might they do?  Go back to their office and start deleting incriminating emails?  Who knows?  The point is, you must issue a true litigation hold on the spot and preserve an image of all of the information you can.  Think I'm being harsh?  I know of organizations who do this, exactly.  In fact, one of them will put the accused on leave without even informing them of the basis of the accusation.  Doesn't that sound like being found guilty, until proven innocent?  Yep.  Welcome to Corporate America.  But I digress...

Next session was "The Top 5 Ethical Concerns for Lawyers in E-Discovery", presented by Brett Burney (again, who I didn't know was going to be there).  This was a nuts & bolts session and was very clear.  The slides spelled out what our duties are, what the rules say (both eDiscovery and ethics), the supporting and dissenting case law and links to resources.  Obviously, the longer one has occupied this space, the more one knows of these matters, but I've never thought it to be a bad thing to attend a refresher.  It's very easy to forget.

Here's what I have to say about the last session.  Do you recall what I wrote yesterday about the first session?  Ditto.  My brain was fried at this point, anyway.  And so, we shall not speak of it again...

All in all, a great conference for me.  See you next year!

Newton's 3rd Law of eDiscovery

"For every eDiscovery action, there is an equal and opposite reaction."

— Sir Isaac Newton

As I've mentioned before, my litigation hold letter - that you see over on the right sidebar - is still the most popular link on the blog (next to the actual posts, that is...).  I've also provided this template to attendees of my presentations.  A question comes up regularly:

"If we send out a letter like that, our adversary will simply replace their name with ours and send it right back to us.  We don't want that to happen!"

It's a good point.   And as I've also mentioned before, what's good for you may also be good for your adversary.  Furthermore, there's absolutely no fault in thinking about this strategically, for example, keeping your clients' advantages/disadvantages in mind when you craft your demands and responses (which, hopefully, you're doing anyway).

There are times when you want everything but the kitchen sink, but sometimes, the sink itself will do nicely.  After all, if both sides produce a gargantuan amount of product, somebody's going to have to review it - and pay for it.

Be careful what you wish for in litigation; you might get it - and get nothing.

An adversary may produce reams of product, the sole purpose of which is to either make it next to impossible to find relevant needles in the document haystack, or worse, obfuscate the fact that they didn't produce relevant documents at all.  Oracle's Larry Ellison knows a bit about this [In re Oracle Corp. Sec. Litig., 627 F.3d 376 (9th Cir. 2010)].

That's why my template is meant only as a guide.  It may be appropriate to issue a letter that simply says, "You're on notice and we expect you to preserve relevant data."  And here's the other elephant in the room to consider; are you absolutely certain that your client is completely forthcoming about their own data?  If not, we already know who'll be on the hook for it.

As for attorneys who are complicit in assisting their clients with 'hiding the football'?  As they said in the movie, Airplane, "...they bought their tickets, they knew what they were getting into. I say, let 'em crash!"

Huh?  Wrong Newton?  Don't look at me.  Go back and redo your keyword & concept searches!

Japan Epilogue: (Un)Safe Harbor: 10% x 50 Years = Prison?

We started with a premise:  A disaster has occurred.  What now? 

We segued into a limited examination:  Were we properly prepared?  Why or why not? 

Now, comes the all-too-familiar Watergate-esque finale:  What did we know; and when did we know it?

According to this comprehensive report, officials were warned that there was a 10% risk within a 50-year span of a tsunami swamping the protective barriers of the Fukushima Dai-ichi nuclear power plant - and disregarded it.  What result?

• Human toll: incalculable
• Environmental damage due to radiation contamination: incalculable
• Damage to 'hard assets' (plant, equipment, etc): incalculable
• Near-term cost to replace loss of % of daily supply of electricity to Japanese citizens: incalculable
• Evacuation and relocation costs: incalculable
• Current financial losses to shareholders of TEPCO: $30 billion dollars of market value
• Errors and Omissions losses to insurance carriers: incalculable

I could go on, but you get the idea.  Now for the bad news.  That's not the worst of it.  How about:

• Liability of executives, government officials, etc. for negligence.  I'm referring to all liabilities (i.e., not just financial issues), since some parties may enjoy sovereign immunity; but that doesn't address their political liabilities.
• Liability of executives, government officials, etc. for criminal negligence.  Think that it isn't a distinct possibility?
• Liability of corporate executives to their shareholders for massive losses due to lack of reasonable prudence.

You know what?  I have to stop now.  This feels ghoulish.

The point I'm making is, certainly, this is about as bad as a disaster gets, but we can all learn from it because there's only one item we need to change - scale.  Plus, the most important thing relevant to us in the real-life case study we're now seeing is what happens when we're wrong.

Worried eDiscovery clients always ask me how they're ever going to do everything right.  I tell them, there is no such thing.  It's impossible to anticipate everything, but as a rule of thumb, the fallback position is the basic negligence standard:

Knew, or should have known.

If they acted in good faith based on what they knew or should have reasonably anticipated at a given point in time - and present a defensible position as to why they acted - they'll likely preserve safe harbor.  Naturally, one can never completely account for the odd rogue judge.  The day all judges rule alike is the day I give a specific answer.  In the meantime, you do the best you can.

The key is in making sure you have the appropriate harbor pilot.

Japan Redux: You can lead a Board to Water, but you can't make them Drink

It's been roughly two weeks since the devastating events in Japan.  As I mentioned in my initial post regarding their disaster-recovery efforts, we weren't going to know all of the elements we needed to know at that time in order to make an assessment - and we don't know them now.  On the other hand, we know enough to put them under a magnifying glass.  If you're part of a disaster-preparedness team, a cursory examination of their nuclear mess is a true 'teachable moment'.

Why do I keep harping on this?  Because litigation may take on all of the elements of a disaster-recovery operation in that out of nowhere, you're tasked with finding, restoring and producing massive quantities of information - possibly from several sources and/or geographic locations.  And, somebody has to pay for it (Zubulake, Toshiba, et al).  Oh, and tic-toc - the clock is ticking...

Let me preface this by saying that armchair quarterbacking is easy - and this is not a 'bash Japan' post.  You don't kick someone when they're down (but you do try to learn from their mistakes).  Nor is it an "I told you so" post - at least, not by me.  Let's be honest, for a moment.  Sometimes, when a person says "I told you so", they really did tell you so.  So what?  The issue isn't what they told you, the issues are:

1. Did they tell you something of substance?
2. Did they provide facts & figures to support it?
3. Were they qualified to make the assessment? (i.e. on what basis should you rely on their opinion?)
4. Was it relevant to the concerns at hand?
5. If you answered 'yes' to one through four, did you give their information careful, deliberative and proper consideration?
6. Did you solicit, collect and examine supporting and/or dissenting viewpoints to confirm/contradict the opinion?
7. Was a 'Cost vs. Benefit' analysis performed?
8. Did you adopt all (or some) of their recommendations?
9. Why?
10. Did you dismiss all (or some) of their recommendations?
11. Why?
12. Have you properly assessed every possible risk?
13. Are you qualified to answer question #12, and if not, what other sources should you consult? ("Know what you don't know")
14. What is the timetable to re-convene in order to re-assess the situation and modify the plan, if necessary?

[Add your own questions here]

What are questions nine and eleven about?  You should always be prepared to justify and/or defend your position.  After all, you may have to persuade your bosses today, but you never know who you might have to persuade tomorrow (I'm thinking...a judge?  A jury?)

Last night I read this article from the Washington Post (and others over the past few days) regarding how the Japanese authorities considered risk when assessing how to protect their nuclear plants.  In my opinion, if you commit to the short amount of time necessary to read the entire story, you'll learn more about disaster-preparedness than you ever could in a classroom; unless, of course, they're studying this disaster.

In an island nation, surrounded by volcanic activity, "experts" didn't even consider a major tsunami as part of the plan for the Fukushima Daiichi power plant because it was considered "unlikely".  But, here's an even better question, raised at the conclusion of the story:

"To what degree must regulators design expensive safeguards against once-a-millennium disasters, particularly as researchers learn more about the world’s rarest ancient catastrophes?"

Which leads me to the obvious follow-up:

1. If a catastrophe occurs superior to our level of protection, what will be the likely result?
2. Was this factored into our 'Cost vs. Benefit' analysis?

Two weeks ago, the experts may have thought that the risks were worth it.  But now that radiation is showing up in drinking water as far away as Tokyo?  My guess is, they wish they'd have built the retaining walls a few feet higher.

"Nobody anticipated..."

Voyeurism: eDiscovery Style

So, my PDA was working fine this morning...then it wasn't.  A total and complete software crash.  I traced it down to an offending app, but it completely hosed (thank you, Canada) the O/S.  And of course, I'm out of town!  So, I located my carrier's nearby retail outlet and headed on over.  They couldn't repair it, even with their "push" software.  However, due to my predicament (out of town and desperate), they were able to swap me over to a new device.  Awesome!

How did I reward them for their excellent customer service?  By hounding the poor tech, first by insisting that he had to wipe my prior device clean and second, by insisting that he show me how he was going to do it, then let me watch.  The store was full, they were busy and I caught a person or two rolling their eyes at my request, but I persevered.

Quite frankly, the tech understood when I explained that as an attorney, there was confidential client info on the device and our ethics rules compel us to protect it (that, or he thought I was just making it all up so he would delete porn, or something...hey, as long as I get it done, let him imagine whatever he wants!)  But take note; I protected client information - as I'm obligated to do - and, I had a recent backup available on my laptop, so I lost virtually nothing.  Good for me; good for my clients!

Sadly, this is the eDiscovery equivalent of voyeurism.

e-Voyeurism?  Nahhhh...