e-Discovery Insights

e-Discovery California: Proposed Formal Opinion Interim No. 10-0003 (VLO) is the Right Answer to the Wrong Question

42.  (That's for those of you who picked up on the 'Hitchhiker's Guide to the Galaxy' reference).

I usually don't feel it necessary to refer you to my disclaimer but, because this is a State Bar of California opinion - and I'm Vice-Chair of their Law Practice Management & Technology Section Executive Committee (LPMT) - I want to remind you that:

"This blog site is published by and reflects the personal views of Perry L. Segal, in his individual capacity.  Any views expressed herein have not been adopted by the California State Bar's Board of Governors or overall membership, nor are they to be construed as representing the position of the State Bar of California."

The LPMT Executive Committee may publish its own, 'official' comments, to which I may also contribute.  That being said...

Technology is an extremely logic-based discipline, in its purest form; or it should be, at least.  Indeed, like the practice of law, success or failure is predicated upon compiling and understanding a particular set of facts, then realistically acting upon those facts.  Note my emphasis on the word, 'realistically'.  If I wish to suspend disbelief and begin with a set of unrealistic criteria, I may be equally able to formulate a reasonable solution, assuming it's possible to locate someone - or something - that fits the original, unrealistic premise.

This is my assessment of Formal Opinion Interim No. 10-0003 (Virtual Law Office).  It's actually a very well-crafted opinion, but it's based on a 'Statement of Facts' that, to me, are an unrealistic portrayal of how an attorney practices - or would practice - law.

First, there's no reason for me to re-invent the wheel.  For another excellent nuts & bolts assessment of the opinion, please see Stephanie Kimbro's post on her Virtual Law Practice blog.  She's an authority on the Virtual Law Office and is also cited as a resource on page one of the opinion itself.

From a pure cloud security standpoint, this is an excellent document and a perfect complement to opinion 2010-179 on wireless networks.  In fact, I would recommend that practitioners ignore the hypotheticals for a moment (especially if they're pressed for time) and proceed to the Discussion heading, Section 1 ("Duties"), which is what I'm doing for the purposes of this post.

Section 1 examines confidentiality issues of employing a cloud-based system with a 3rd-party vendor and provides a five-point list of due diligence factors that includes, but isn't necessarily limited to:

1. The Credentials of the Vendor
2. Data Security (Well, that's not very helpful, but it goes on to refer the reader to California, New York and ABA opinions for guidance)
3. Vendor's Transmission of Client Info in the Cloud Across Jurisdictional Boundaries or Other 3rd-Party Servers (You've heard - or read, I suppose - me pontificate on that one; the "digital roach motel" and "know where your data is")
4. Attorney's Ability to Supervise the Vendor (As I've reminded you often, you may hire competence, but not delegate this duty)
5. Terms of Service of Contract with the Vendor (This is huge where the cloud is concerned.  For example, many provider contracts contain language to the effect that, "Once you transfer it to us, it becomes our property.", a major no-no for attorneys)

It also points out the security environment must be periodically reassessed, which is terrific advice.  I usually refer to it as "fire drills".  Finally, it points out that none of this may take place without proper disclosure to the client, who may, by the way, have no idea how any of this works.

Section 2 examines competence issues as follows:

1. Proper management of attorney's intake system to determine one of the basics; "Who is the client?"
2. Determining whether attorney may perform the requested services
3. Determining that the client comprehends the services being performed (This document also refers to comprehension issues due to a language barrier)
4. Keeping the client reasonably informed
5. Determining that the client understands technology (When I read #3 above, it immediately triggered the thought that technology is another language both attorney and client must understand...)
6. Determining when to decline to represent a client via a VLO, and whether representation may continue through traditional means

This section also re-raises the supervisory issue, but this time it's in terms of the attorney supervising other attorneys and/or non-attorneys.

Ok, so you know what I like, now let's get into what I don't like.  The hypothetical describes the VLO as a password-protected and encrypted portal that sits on a 3rd-party cloud.  So far, so good.  But then, it goes on to say that the attorney plans not to communicate with clients by phone, email or in person, but will limit communication solely to the portal.

Yeah, that covers a lot of us, doesn't it? 

I understand that it's possible for attorneys to communicate this way, but is it probable?  Does this opinion realistically apply to most attorneys; now and even into the future?  I'm not trying to be snarky here, but you can't blame me for being a tech guy.  Immediately, my mind wanders to what would likely happen in this scenario.  A technology or communication issue arises and the frustrated attorney - or client - resorts to email or a phone call.

And what about secrecy?  No, I'm not alluding to some nefarious purpose.  There are legitimate reasons why attorney and/or client might not want to document ideas or discussions - electronically or otherwise - in the short-term (what comes to mind is a nervous potential client who has invented a new product, but doesn't want to provide a lot of written detail to attorneys, while soliciting the representation of several of them, for fear that the inventor's intellectual property will be revealed).

The second thing that bothers me is the "Issue" statement that opens the opinion.  It states, verbatim:

"May an attorney maintain a virtual law office practice ("VLO") and still comply with her ethical obligations, if the communication with the client, and storage of and access to all information about the client's matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")."  [Italics/bold added.  It's posed as a question, but in the text, the paragraph ends with a period - not sure if it's a typo that will be corrected in a later version].

What's the danger here?  Hello?  Facebook is the cloud!  Google is the cloud!  Email is the cloud!  A lot of communication is taking place - right now - through means not anticipated in this opinion.  What I'm saying is, if one removes the term, "VLO", from this document, it could just as easily apply to methods attorneys use to communicate with their clients on a daily basis, while at the same time, being completely unaware that many of these products are in the cloud.

It also fails to anticipate one other factor; what will happen the day these measures apply to all cloud-based technology (that day is coming, and in some cases, is already here).  As it stands today, if most attorneys attempted to comply with these security measures, law practice as we know it would grind to a halt.

Better start preparing now...

e-Discovery California: Wow - I Coulda had a VLO!!!

Happy Holidays, everyone.  I'm about 2/3 of the way through my book-writing and with any luck, I hope to submit most of my remaining contribution before New Years (that is, if I don't succumb to the most wonderful time of the year - Bowl Season!).  Hopefully, then, I can get back to posting here more often.

In the meantime, I have some homework for you.  The California State Bar Standing Committee on Professional Responsibility and Conduct (COPRAC) has posted, "Proposed Formal Opinion Interim No. 10-0003 (Virtual Law Office)" for public comment [Warning; link opens a 7-page PDF].

I'm currently working on an in-depth analysis of the proposal and hope to post it next week, but when I first scanned the opinion, my mind wandered to the law of unintended consequences.  I'll reserve commenting further until I've completed my analysis, however, I encourage you to familiarize yourselves with the opinion - whether you personally make use of a VLO or not.  After all, (and it pains me to say this), it isn't all about you; the attorneys at the other end of your communications may make use of a VLO.

The public comment period remains open until March 23rd, 2012.  Hope to see you before the ball drops, but if not, please be safe and have a great holiday!

Century City Executive Counsel Exchange - Summary

Alec Baldwin's Twitter rant?  So last year...(that's why I created a 'Twit List').

BP accused of spoliation?  I've never heard that, before...

This week, I actually saw an article warning people to be careful what they post on social media, 'because it might come back to haunt you, someday.'...

Folks, it's almost 2012!  If any of the above headlines surprise you, you're either new to this game or you've been hiding in a cave (or you haven't been reading e-Discovery Insights the past three years...).  So, let me tell you about something more substantive - the annual Executive Counsel Exchange that was held this past Monday and Tuesday at the Hyatt in Century City, California.

I'm not aware of any other conference that operates the way this one does it.  It's a roundtable, free-form discussion over a period of a day-and-a-half.  Two old pros were moderating this year, Robert Brownstone of Fenwick & West LLP and Browning Marean of DLA Piper (if you don't recognize either of these names, we may have to have the 'cave' discussion again).  The moderators cover a series of relevant topics and the attendees are encouraged to participate.  Everything is memorialized and the attendees receive a copy.

Another thing I really appreciate is that, although it's a sponsored conference, the vendors are highly respectful about not bombarding us with sales pitches during their contributions to the program.

If you want to know what's happening right now, this is the place to be, because you're hearing it exactly as it is, from people covering all parts of the spectrum who do this every day (vendors, technology, inside and outside counsel, executive, etc).  Over the next several months, The Exchange (as its called) will be in four more cities across the country.  Unfortunately, I was only able to attend Monday's session this time, but I encourage you to check it out if you have the opportunity.

#ABA Seeking Comments Re: Loosening Restrictions to Cross-Border Practice

The ABA has cited a deadline of November 30th, 2011 for comments on several proposals to make it easier for attorneys to practice across multi-jurisdictional lines.  The proposals may be viewed on the ABA's "Ethics 20/20" Commission web page, however, comments may only be submitted via email.

These proposals should be of particular interest to eDiscovery professionals, especially now that cross-border issues are more prevalent than ever with the explosion of cloud computing and other technological advances.

As a Consultant and Attorney, I'm constantly bending over backward to make sure potential clients understand that I'm licensed in California, while at the same time I'm free to consult anywhere.  The tension arises when an out-of-state project or case begins with a consulting agreement, then is in danger of meandering into law practice.  Clients can't always tell the difference; but I can, and it means having a further conversation to clarify my role.

Heck, the disclaimer on this blawg exists for the same reason!

Any modification to the Rules that would ease this burden would be highly beneficial to eDiscovery professionals.  Of course, in my case, I must still defer to the California Rules, but you gotta start somewhere...

Let your voice be heard.  Send your comments to the ABA by November 30th, 2011.

e-Discovery California: Predictive Policing or e-Profiling?

Please note; I didn't say racial profiling...

I was some kind of Twitter-maniac this weekend.  Normally, I don't tweet a lot of articles because I don't think it's the best use of the discipline, but it seemed like every time I turned around, I was reading interesting pieces about technology, security, evidence, law or the economy (as it pertains to us) that I thought would be of interest.  If you're one of my followers (how creepy-sounding is that?!), I hope you'll check them out.

This article begs further examination, however.  The police force in Santa Cruz, California is experimenting with using mathematics to predict where crime hots spots will occur - then deploying resources to those likely hot spots.

I wrote about this back in January.  It kind of takes on the pathology of the movie, Minority Report.  At the time, I said, "We don’t arrest people for crimes they haven’t committed, yet."  We still don't; but it sure would be convenient to be in the vicinity waiting for them when they do.

In theory, it seems like a great tool - using history of prior crimes to predict future ones; but it was the following comment by a patrol officer that raised my eyebrow (just one, mind you):

"[The program] doesn't give me legal reason to arrest somebody just for being in my hot spot, but it gives me good reason to stop and ask what they are doing,"

My question in response to that statement is, "No, it doesn't give you legal reason to arrest somebody, but does it give you reasonable suspicion?"

It's a rhetorical question because, absent any additional facts, we can't really answer.  However, I know one person who would definitely be asking it; a good defense attorney.

"My Receipt? I Left it in my Other PDA."

Receipts are going digital.  Great.  Now I can lose them electronically instead of accidentally throwing them into a physical trash bin.  But seriously folks...

The upside?  No more wasting paper (which not only makes the 'green' folks happy, but also lowers costs), ease of organization, tracking, recall and portability.  The longer the item is warranted, the more useful this is, of course (unless you enjoy digging up that receipt nine-years after a device warranted for ten-years goes on the fritz).  And has anyone noticed that when they go back through those older heat-created receipts, some of them have faded to the point of being completely unreadable?

The downside?  Privacy.  In order to get the receipt, the sender needs your information such as an e-mail address (although there are ways around that, if you wish, but some of them are clunky).  One way to retain privacy would be for the retailer to project your receipt on a screen as a Bar or Q-code.  Then you could scan it onto your PDA with the appropriate app.

Just spit-ballin' here, but eventually, this will be the standard way of doing things.

The Star(t) Chamber

 

Take note; the FBI has given itself expanded powers to potentially examine information such as databases or your household trash; based on flimsy - or non-existent - evidence.  This is more of a "be aware" notice as some jurisdictions have been doing this already.

But it reminded me of the movie, The Star Chamber, because there was a scene in which evidence was tossed due to agents searching a suspect's trash and the court later finding that this required a warrant; because at the time of the search, the trash was deemed not to be in the public domain.  Based on several higher-court decisions, it's unlikely one would obtain that ruling today.

So here's my question.  What're they going to do when they're searching someone's computer trash folder?  Will it depend on the location of the machine?  Are discarded electronic files the same as discarded physical trash?  Will I be making this argument in a future court hearing, someday?

At first glance, this may seem specious, but I know many people who never empty their trash folder.

#CalBar Solo & Small Firm Summit Recap

Yeah, I know.  The summit ended Saturday at noon.  It's been a busy week for me, but better late than never.  I had to skip the Thursday sessions, but arrived early Friday morning.  I was backing up another one of my LPMT colleagues in the tech lab, so between his presentations and mine, I didn't get to attend anyone else's sessions, which was a shame, because there were some good ones.  I did catch the bulk of Stephen Fairley's morning keynote on marketing and SEO.  I can only say this; the man is right on about what he was saying.  It was similar to the advice I received from my web guru, Clint Brauer.  Bottom line; if you're going to make a serious attempt at creating an online presence, you need to understand how your information will propagate to the 'web before you develop web sites, create accounts, etc.

I didn't know what to expect for my labs on disaster planning, but for both sessions (I did the identical presentation back-to-back) I had full houses.  The attendees asked a lot of good questions - which is the first indication they're not bored - and although we had some technical difficulties, I was able to illustrate how, in some cases, a few minutes is all it takes to create a basic backup strategy.

Day three, Saturday, I took in the morning keynote on "Multitasking Gone Mad", or, how the more we multitask, the less we accomplish.  Now, this was Irwin Karp presenting - who also preceded me on the LPMT committee - but I'll tell you, the idea of doing one thing at a time is something to strive for, but awfully hard to accomplish.

The second session should really make the eDiscovery people excited.  It covered hearsay (civil, for the most part), but guess what the starring attraction of most of the examples was?  Electronic evidence!  For example, the presenter showed a slide from a traffic camera of a car colliding with a truck at an intersection.  Another was a photo of a simple bar code (not a QR code, like the one you see on my right sidebar).  In both instances, the question was, is this hearsay?  As usual, the answer was, it depends on your jurisdiction.

The third session was one that eDiscovery professionals most likely wouldn't be attending.  It covered the activity up to and including the arrest of a client.  As you know, I also handle criminal cases, so again, this was a good refresher for me.

So, basically a quick in-and-out, and barring any changes to the schedule, my next presentation will be at Calbar's annual meeting in September.

A Lawyer Walks into an #LPMT Presentation...

No, I'm not going to post every time I make a presentation - unless there's something interesting to note.  In this case, my colleague Gideon Grunfeld and I presented on law practice management issues.  He covered attorney advertising and reputation-protection online and I covered - what else - protecting your data in the cloud, via social media, on your PDA, etc.  I also ran the attendees through the new California State Bar Opinion 2010-179 re: wireless networks.

Now, this was a group of tax attorneys, which is not in our usual wheelhouse, and being as we were the first presenters at 2:30 PM, I assumed we wouldn't get more than 15-20 people.  Then they started having to bring in extra chairs...then more extra chairs...and by the time we concluded, they were standing in the hallway; we estimated close to 50 people!

What's the significance?  Well, first of all, we knock ourselves out to try to do quality presentations, so it's no fun presenting to an empty room, but second of all, I was heartened that these attorneys wanted to know this material.  We took a bunch of quality questions, also.

Things are looking up!

e-Discovery California: Go See Cal!(PERS) about Retention Policy Pitfalls

 

Retention policies.

Can't live with 'em...can't live without 'em.

Damned if you do...damned if you don't.

Very few people like change, especially in corporate environments.  It's just another burden to bear.  If something's changing, you know what'll follow; a meeting, memo, or training.  Who wants that?

Rolling out a retention policy will usually result in a lot of complaining, but when coupled with all of the complex, new eDiscovery regulations, it gives you something else to worry about - even if you have no anticipated litigation at the time the policy is implemented (notice I didn't say 'pending', which isn't the proper standard).

Just ask CalPERS, aka the California Public Employees' Retirement System.  CalPERS implemented an internal 60-day retention policy - and apparently didn't bother to tell anyone.  Furthermore, they gave 2,300 of their employees discretion over what additional ESI should - and shouldn't - be kept.

Oh, did I mention they're currently under state and federal investigation?

It's prudent to be aware that, no matter when a retention policy is implented, your opponents will always have an interest in claiming you're committing misconduct by deleting evidence of...misconduct.  Therefore, I rountinely suggest that, prior to implementing - or modifying - a retention policy, a thorough review of current status should be performed - just in case you have to explain it to the judge.