e-Discovery Insights

e-Discovery California: Proposed Formal Opinion Interim No. 10-0003 (VLO) is the Right Answer to the Wrong Question

42.  (That's for those of you who picked up on the 'Hitchhiker's Guide to the Galaxy' reference).

I usually don't feel it necessary to refer you to my disclaimer but, because this is a State Bar of California opinion - and I'm Vice-Chair of their Law Practice Management & Technology Section Executive Committee (LPMT) - I want to remind you that:

"This blog site is published by and reflects the personal views of Perry L. Segal, in his individual capacity.  Any views expressed herein have not been adopted by the California State Bar's Board of Governors or overall membership, nor are they to be construed as representing the position of the State Bar of California."

The LPMT Executive Committee may publish its own, 'official' comments, to which I may also contribute.  That being said...

Technology is an extremely logic-based discipline, in its purest form; or it should be, at least.  Indeed, like the practice of law, success or failure is predicated upon compiling and understanding a particular set of facts, then realistically acting upon those facts.  Note my emphasis on the word, 'realistically'.  If I wish to suspend disbelief and begin with a set of unrealistic criteria, I may be equally able to formulate a reasonable solution, assuming it's possible to locate someone - or something - that fits the original, unrealistic premise.

This is my assessment of Formal Opinion Interim No. 10-0003 (Virtual Law Office).  It's actually a very well-crafted opinion, but it's based on a 'Statement of Facts' that, to me, are an unrealistic portrayal of how an attorney practices - or would practice - law.

First, there's no reason for me to re-invent the wheel.  For another excellent nuts & bolts assessment of the opinion, please see Stephanie Kimbro's post on her Virtual Law Practice blog.  She's an authority on the Virtual Law Office and is also cited as a resource on page one of the opinion itself.

From a pure cloud security standpoint, this is an excellent document and a perfect complement to opinion 2010-179 on wireless networks.  In fact, I would recommend that practitioners ignore the hypotheticals for a moment (especially if they're pressed for time) and proceed to the Discussion heading, Section 1 ("Duties"), which is what I'm doing for the purposes of this post.

Section 1 examines confidentiality issues of employing a cloud-based system with a 3rd-party vendor and provides a five-point list of due diligence factors that includes, but isn't necessarily limited to:

1. The Credentials of the Vendor
2. Data Security (Well, that's not very helpful, but it goes on to refer the reader to California, New York and ABA opinions for guidance)
3. Vendor's Transmission of Client Info in the Cloud Across Jurisdictional Boundaries or Other 3rd-Party Servers (You've heard - or read, I suppose - me pontificate on that one; the "digital roach motel" and "know where your data is")
4. Attorney's Ability to Supervise the Vendor (As I've reminded you often, you may hire competence, but not delegate this duty)
5. Terms of Service of Contract with the Vendor (This is huge where the cloud is concerned.  For example, many provider contracts contain language to the effect that, "Once you transfer it to us, it becomes our property.", a major no-no for attorneys)

It also points out the security environment must be periodically reassessed, which is terrific advice.  I usually refer to it as "fire drills".  Finally, it points out that none of this may take place without proper disclosure to the client, who may, by the way, have no idea how any of this works.

Section 2 examines competence issues as follows:

1. Proper management of attorney's intake system to determine one of the basics; "Who is the client?"
2. Determining whether attorney may perform the requested services
3. Determining that the client comprehends the services being performed (This document also refers to comprehension issues due to a language barrier)
4. Keeping the client reasonably informed
5. Determining that the client understands technology (When I read #3 above, it immediately triggered the thought that technology is another language both attorney and client must understand...)
6. Determining when to decline to represent a client via a VLO, and whether representation may continue through traditional means

This section also re-raises the supervisory issue, but this time it's in terms of the attorney supervising other attorneys and/or non-attorneys.

Ok, so you know what I like, now let's get into what I don't like.  The hypothetical describes the VLO as a password-protected and encrypted portal that sits on a 3rd-party cloud.  So far, so good.  But then, it goes on to say that the attorney plans not to communicate with clients by phone, email or in person, but will limit communication solely to the portal.

Yeah, that covers a lot of us, doesn't it? 

I understand that it's possible for attorneys to communicate this way, but is it probable?  Does this opinion realistically apply to most attorneys; now and even into the future?  I'm not trying to be snarky here, but you can't blame me for being a tech guy.  Immediately, my mind wanders to what would likely happen in this scenario.  A technology or communication issue arises and the frustrated attorney - or client - resorts to email or a phone call.

And what about secrecy?  No, I'm not alluding to some nefarious purpose.  There are legitimate reasons why attorney and/or client might not want to document ideas or discussions - electronically or otherwise - in the short-term (what comes to mind is a nervous potential client who has invented a new product, but doesn't want to provide a lot of written detail to attorneys, while soliciting the representation of several of them, for fear that the inventor's intellectual property will be revealed).

The second thing that bothers me is the "Issue" statement that opens the opinion.  It states, verbatim:

"May an attorney maintain a virtual law office practice ("VLO") and still comply with her ethical obligations, if the communication with the client, and storage of and access to all information about the client's matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")."  [Italics/bold added.  It's posed as a question, but in the text, the paragraph ends with a period - not sure if it's a typo that will be corrected in a later version].

What's the danger here?  Hello?  Facebook is the cloud!  Google is the cloud!  Email is the cloud!  A lot of communication is taking place - right now - through means not anticipated in this opinion.  What I'm saying is, if one removes the term, "VLO", from this document, it could just as easily apply to methods attorneys use to communicate with their clients on a daily basis, while at the same time, being completely unaware that many of these products are in the cloud.

It also fails to anticipate one other factor; what will happen the day these measures apply to all cloud-based technology (that day is coming, and in some cases, is already here).  As it stands today, if most attorneys attempted to comply with these security measures, law practice as we know it would grind to a halt.

Better start preparing now...

When Your #Privacy is #Breached, This is how It'll Happen

The best examples in life are of the 'real-world' variety.  These days, I've been hunkered down in my bunker (also known as my dining room) writing sections for the upcoming State Bar of California book, "Growing and Managing a Law Office".  This will also explain why I haven't been posting on the blog as often as I'd prefer.

A couple of days ago, I experienced a serious breach of privacy.  Not my own, mind you, but someone else's!  Specifically, I was emailed a copy of their surgical records.  Why?  Human error.  The sender simply got the email address wrong.

The message contained a 'HIPAA' privacy notice, with contact information.  Not wanting to create another electronic record by replying to the email, I picked up the phone and left a voice mail message that the person had sent the records in error and I was immediately destroying the original message.  Apparently, they didn't check their voice mail, because a few minutes later, the same person emailed me the password to access the records.  At that point, I figured I'd better reply to the message itself...

The sender - and the patient - were lucky in at least two respects:

1. They sent the records to an eDiscovery attorney, and
2. I wasn't the least bit interested in looking at them.

Fifteen years ago, when I was purely on the data side, people used to ask me how difficult it was to refrain from peeking at so much confidential information.  My answer was the same then as it is today; curious people don't do well in our line of business.  Now, you'll note, I didn't say 'inquisitive'.  Obviously, there are times and events that will require a reasonable investigation - but this isn't one of them.

As I've oft repeated, a disaster or breach will not likely manifest itself in the manner you expect.  In this case, it wouldn't have mattered if the sender's company employed the most cutting-edge security procedures available.  In the end, the whole thing was thwarted by the 'send' key.

How do you think their security, technology and legal personnel would feel if they knew?

e-Discovery LOL: A Primer on Privacy

What can I say...it's Friday afternoon and I'm in the mood for a laugh!  Disclaimer: I'm not endorsing the products shown in this video, but if you strip out the advertising and substitute the word e-Mail for Gmail, it does make a (humorous) point about how our privacy is invaded in ways we don't realize; and sometimes, with our willing participation!

 

"My Receipt? I Left it in my Other PDA."

Receipts are going digital.  Great.  Now I can lose them electronically instead of accidentally throwing them into a physical trash bin.  But seriously folks...

The upside?  No more wasting paper (which not only makes the 'green' folks happy, but also lowers costs), ease of organization, tracking, recall and portability.  The longer the item is warranted, the more useful this is, of course (unless you enjoy digging up that receipt nine-years after a device warranted for ten-years goes on the fritz).  And has anyone noticed that when they go back through those older heat-created receipts, some of them have faded to the point of being completely unreadable?

The downside?  Privacy.  In order to get the receipt, the sender needs your information such as an e-mail address (although there are ways around that, if you wish, but some of them are clunky).  One way to retain privacy would be for the retailer to project your receipt on a screen as a Bar or Q-code.  Then you could scan it onto your PDA with the appropriate app.

Just spit-ballin' here, but eventually, this will be the standard way of doing things.

News of the World Buries the eDiscovery Lede: Spoliation

For those who aren't familiar with the term, "burying the lede" refers to an article that fails to express the most important issue in the 1st sentence or paragraph.

Obviously, by now you've heard about the News of the World phone-hacking scandal.  If you're an eDiscovery professional, then you'll find the lede buried all the way in paragraph nineteen:

"On Saturday, the Guardian newspaper, which has led the reporting on the scandal, said Scotland Yard was investigating evidence that a News International executive may have deleted millions of internal e-mails to obstruct the phone-hacking probe. The company denies the allegation." [italics/bold added]

If the allegation turns out to be true, I only have one question.  When will they ever learn?

The 6th Amendment, the Blackstone Ratio & #eDiscovery

"Better that ten guilty persons escape than that one innocent suffer."

- William Blackstone, 1783

"’tis much more Prudence to acquit two Persons, tho’ actually guilty, than to pass Sentence of Condemnation on one that is virtuous and innocent."

- Voltaire, 1749

Whether you agree with the passages above (or a similarly-stated quote by Benjamin Franklin, circa 1785), one thing is certain; they form the basis of criminal jurisprudence in the United States.  At least, they used to...I think that claim would be up for strenuous debate these days.

But that's why I wanted to bring you this particular case for our examination.  It doesn't matter what I think; what matters is, familiarize yourself with these issues because there's a high likelihood you'll see them - or something like them - in civil or criminal court.  After all, attorney-client privilege is attorney-client privilege - it just so happens the venue in this example is criminal court, and the argument is Constitutionality in theory; the 6th Amendment Right to Counsel.

One thing that distinguishes a criminal complaint from a civil one is, when the government discovers and/or seizes evidence (whether due to reasonable suspicion, probable cause or a formal warrant) in many instances, the target does not enjoy the benefit of attorney representation (hey, it might be torture for you, but I'd say my company is enjoyable...).

Such is the case with defendant.  The government seized certain computer records, and among those records were emails from defendant to his wife - which were subsequently forwarded to defendant's attorney.  Defendant was convicted, but upon appeal, it was determined that the emails were subject to attorney-client privilege and the prosecutor's review of same was deemed a violation of defendant's 6th Amendment rights.

What am I telling you?  First, you won't always have control over what data is turned over to the other side (do I hear "clawback agreements", anyone?) and second, if you find yourself in a situation like this, somebody on your side had better examine each and every shred of data in the possession of your adversary.

Again, this isn't a judgment on the validity/invalidity of overturning a conviction based on a technicality (I'll leave it to followers of the Casey Anthony trial to argue their perception of what's fair or unfair about the current judicial system).  We have a job to do, our clients depend on us and we are to zealously represent - and protect - their interests.

File this one under Segal's Ratio: "For your client's sake, where electronic evidence is concerned, endeavor to know what you don't know."

The Midnight Ride of Sarah Palin

Listen my children to a tale in error
Of the midnight ride of Palin, Sarah
On the tenth of June, in Twenty-eleven;
Many a reporter is now in heaven
Who remembers that famous day and year.

She said to her friend, "If the Alaskans power
By land or sea from the town to-night,
Hang a lantern aloft in the belfry tower
Of the North Church arch as a signal light,--
One if by 'Times, and two if by 'Post;
And I on the opposite shore will at most,
Be ready to ride and spread the alarm
Through every Juneau village and farm,
That the lamestream-press means to do me harm!"

Then she said "Good-night!" and with muffled oar
Silently steered to the New Hampshire shore,
Just as the moon rose over the bay,
Where swinging wide at her RV lay
The NY Times, American man-of-war;
A phantom Grey Lady, with each mast and spar
Across the moon like a prison bar,
And a huge black hulk, that was magnified
By its own reflection in the tide.

Meanwhile, her friends through alley and street
Wandered and watched, with eager ears,
Till in the silence around her she hears
The muster of newsmen at the office door,
The sound of typing, and the tramp of feet,
And the measured tread of the cop-iers,
Marching down to their presses on the shore.

Wrapped in silence so deep and still
That she could hear, like a sentinel's tread,
The watchful night-wind, as it fell
Creeping along from dell to dell,
And seeming to whisper, "All is well!"
A moment only she feels the spell
Of the place and the hour, and the secret dread
For suddenly all her thoughts are bent
On a shadowy something far away,
Where the river widens to meet the bay,--
A line of six boxes that bends and floats
Of 24,199 e-Mails like a bridge of boats.

A hurry of hoofs in a village street,
A shape in the moonlight, a bulk in the dark,
And beneath, from the pebbles, in passing, a spark
Struck out by a steed flying fearless and fleet;
That was all! And yet, through the gloom and the light,
The fate of a nation was riding that night;
And the spark struck out by that steed, in her flight,
Kindled the land into flame with its heat.
She has left the village and mounted the steep,
And beneath her, tranquil and broad and deep,
Is the Mystic, meeting the ocean tides;
And under the alders that skirt its edge,
Now soft on the sand, now loud on the ledge,
Is heard the tramp of her steed as she rides.

It was 9 am by the village clock,
When she came to the bridge in Juneau town.
She heard the bleating of the flock,
And the Twitter of Droids among the trees,
And felt the breath of the Daily Breeze
Blowing over the meadow brown.

You know the rest. In the papers you have read...

So through the night rode Sarah Palin;
And so through the night went her cry of alarm
To every Juneau village and farm,---
A cry of defiance, and not of fear,
A voice in the darkness, a knock at the door,
And a word that shall echo for evermore!
For, borne on the night-wind of the Past,
Through all our history, to the last,
In the hour of darkness and peril and need,
The people will waken and listen to wailin'
The hurrying hoof-beats of that steed,
And the e-Mail message of Sarah Palin.

Rants & Raves! Recruiters: Keyword Search 1st, Document Review 2nd!!!

Coming to you from the 'cutting my own throat' department today...

Recruiters, you've proven that you're deft at performing keyword search for the word "eDiscovery".  Now, how about giving all of us techies and attorneys a break and actually doing some document review.  What do I mean?

READ THE DAMN RESUME!!!

For the (I kid you not) fourth time in a week, I've been appproached by a different recuiter for the same IT eDiscovery desktop support position.  One of them apparently continues to forget that he already contacted me - and received a polite response - and has contacted me two more times.  Never mind that the last time I did any type of direct desktop support was for Hughes Space & Communications in 1993, but my resume has a title.  It says "eDiscovery Attorney and Consultant".

Oh, the irony...

I have nothing against recruiters.  I've gotten lots of excellent work through many of them, and I'm certain I will in the future.  However, when they do these searches, then send an email blast to everyone with the term "eDiscovery" in their resume, they're telling us that we're meaningless to them - and they don't mind wasting our time.  Why?  Because, many of them also call, so I will always either return the call or email them back.  I will never ignore an inquiry from a recruiter because its unprofessional and just plain rude.  However, it doesn't exactly entice me to want to work with them.

You think I'm being too hard on them?  At least recruiter number one was honest about the position.  The others apparently could already tell it probably wasn't an appropriate position, so they attempted to 'dress it up' by changing it to desktop analyst and desktop engineer.  Shame on you!

There.  I said it.  I feel much better.  Now, where are those band-aids?!?!

e-Evidence Insights: bin Laden's Secret Weapon: Cut & Paste

Yes...I'm still here...and I'm about to clear out that backlog of interesting items I mentioned a few posts back.  Funny how Osama bin Laden has already moved to the back pages - unless you're interested in 'his' porn collection.

If we learned one thing from 9/11, it was that we should cast a large net, but the webbing must be finite - lest the minnows pass through.  For our purposes, 'minnow' is a metaphor for 'analog'.  We expected machine guns...instead, we got box cutters.  We expected a sophisticated digital network of operatives...instead, we got bin Laden writing up some text, copying it onto a flash drive, then a courier cutting & pasting it into an email message at a remote location.

Just something to keep in mind the next time you're collecting digital evidence.  Don't jump the shark while overlooking the minnow.

e-Evidence Insights: A Good Senator, Spoliated.

...with deference to Mark Twain...

Recently-former-Senator John Ensign's (R-NV) affair and alleged attempts to cover it up would normally be fodder for the press - and I'd take little notice of it.  However, with the release of the Senate Ethics Committee Panel report, we find this:

"The report also accuses Ensign of deleting documents and files the committee was likely to request. The senator deleted the contents of a personal email account after the investigation was launched, it says." [italics added]

And this:

"The committee's report describes Cynthia Hampton as running up $1,000 in phone bills by texting Ensign while he was traveling in Iraq with a congressional delegation."

I want to distinguish between the first quote and the second.  The former is clearly in the realm of relevance (save for an attempted-but-likely-futile privilege argument against access to his personal email account), but the latter is an example of how 'beside-the-point' ESI becomes relevant.  The affair may be morally wrong, but texts between the two players are private - or at least they would be, except for the likelihood that access to them might lead to relevant evidence that would tend to prove or disprove a material fact.  Examples?  Did they conspire to cover up the affair through means that would be deemed improper?  Plus, who paid the phone bill?

This is how your personal cell, PDA or email account ends up in the hands of your adversaries.  You're not immune.

What do you think the odds are that Sen. Ensign knew, or should have known that destroying evidence after learning of an investigation is at best sanctionable conduct and at worst, a crime?

This is how destruction turns into obstruction.  Time to call "Aunt Judy"...or Judge Judy...