C O D E 42 E - B O O K Laying a Strong Foundation: Building your Legal Hold Process with Code42 CrashPlan
How to Navigate this e-book This e-book is split into two parts. Part one discusses ediscovery trends, best practices, headaches and workflows. Part two discusses how you can leverage your endpoint backup from Code42 to simplify your ediscovery process, bring legal hold activities in-house, cut IT and counsel costs, and build a successful litigation discovery process on a solid foundation of relevant, authentic data. Use the clickable graphic below to navigate the book, and begin laying the foundation of your stronger ediscovery process. Executive Summary Part 1: Legal Hold A Shifting, Shaky Environment The ediscovery Landscape Legal Hold in the Eyes of IT & Counsel Increasing ediscovery Expectations and Stakes The ediscovery Process Diagram: A Best Practice Blueprint In-House ediscovery: A Simpler, Stronger Strategy 1 2 Part 2: Code42 Legal Hold A Strong Foundation Preparing for ediscovery Universal Truth: Quality In = Quality Out Code42 CrashPlan with ediscovery tools Code42 Legal Hold: A Solid Foundation for your ediscovery Process Code42 Supports Four Fundamental Factors of ediscovery Conclusion Glossary To return to this navigation page at any time, click the arrow in the top left-hand corner of each page. 2
Code42 is platformagnostic, and can be used and managed by any team member, regardless of technical training. Executive Summary Rapid changes in technology and software, and the nearly universal shift to electronically stored information (ESI), has made ediscovery more complex and expensive. In a movement to simplify and standardize their procedures and dissolve some of the extra tensions surrounding litigation many organizations are bringing phases of the ediscovery process in house, in particular legal hold. CODE42 DISCOVERY If you have Code42 CrashPlan for endpoint backup, congratulations, your organization has already automated the collection of user data, not only for backup but also for legal hold. The ability to preserve in place is a function that sits on top of your enterprise data collection and protection tool. It is completely operated from a web application that enables litigation support personnel to access the Code42 platform. Among other benefits, Code42 ediscovery simplifies legal hold management. Litigation preparation can be a large task crossing over many departments, but will consistently feature two main players: Legal and IT. This document focuses on those two groups, and aims to enable one to see the ediscovery world through the point of view of one group or the other. IT L INFORMATION TECHNOLOGY LEGAL COUNSEL See how the other half views ediscovery, and how IT v. Legal can become IT & Legal with the help of Code42. 3
C O D E 42 1 2 Part 1: Legal Hold A Shifting, Shaky Environment 4
The ediscovery Landscape The modern ediscovery landscape is shifting as justice systems throughout the world adapt to swift technological change. Litigation is on the rise, as is the amount of electronic evidence processed by courts. ediscovery is a complicated space that requires a unique skill set. Some common best practices are followed, but it s far from an exact or standardized science. It is foggy, complex, time-consuming, expensive and rife with potential for human error. As a result, most organizations maintain a highly reactive process addressing litigation as or after it arises, rather than preparing for it in advance. This process is more painful, even more costly, and never wins you favor in court. 89% >$1M of companies spent on litigation expenses IN 2013 2 of companies face litigation 1 71% ediscovery Total cost savings often consumes from proactive 25% ediscovery: 63% 4 of the total litigation budget 3 3% reduction in employee time spent on legal hold means >$1M IN SAVINGS PER COMPANY PER YEAR 5 1. http://www.alixpartners.com/en/publications/allarticles/tabid/635/articletype/articleview/articleid/687/litigation-and-corporate-compliance-survey.aspx#sthash.9e3rhjrc.exoncbra.dpbs 2. http://www.bizjournals.com/kansascity/news/2014/04/21/companies-face-high-cost-litigation.html#g 3. http://www.protiviti.com/en-us/documents/pov/pov-e-discovery-protiviti.pdf 4. http://www.slideshare.net/morrisjd1/ediscovery-infographic 5. http://www.forbes.com/sites/wlf/2014/03/06/new-corporate-survey-illustrates-burdens-of-document-preservation-and-benefits-of-proposed-reform/ 5
Legal Hold in the Eyes of IT Unless IT personnel are dedicated entirely to legal hold processes, legal hold presents a disruption in their workday. It is a laborious process that often requires physical collection of employee devices or hard drives. The sheer amount of ESI that must be preserved during litigation results in substantial time and cost and exposes the organization to serious risks including risk of accidental destruction of data. While chief counsel is typically responsible for a reasonable collection methodology, IT is on the front line and must understand tools, technology, data repositories, metadata and chain of custody, user devices, user behaviors and more. Two Teams, Two Priorities IT prioritizes the logistics of legal hold: they re required to understand data repositories, server and mobile technology, metadata, chain of custody and more. IT INFORMATION TECHNOLOGY Legal Hold in the Eyes of Counsel Before the legal hold process begins (and ideally before litigation is threatened), counsel must understand where information repositories exist within the company. Following the information governance phase, counsel is less concerned about collection tools and more concerned about building a solid foundation for their ediscovery process. L Counsel understands the risk of sanctions for untimely identification of custodians, delays in implementing legal holds and omitting relevant data sources from productions. LEGAL COUNSEL Counsel wants a reasonable process: they prioritize communicating legal hold requirements to IT, rapid definition of custodians and identification of relevant information. 6
HMS Holdings Corporation VS. Arendt Increasing ediscovery Expectations and Stakes Current U.S. litigation law requires that all parties must have good ediscovery capabilities in place before litigation starts: In this case, HMS (Health Management Systems) was suing several former employees, alleging the misappropriation of strategic HMS confidential information and trade secrets that the defendants distributed in efforts to assist their new employer (PCG) to compete against HMS. FRCP Rule 26(a)(1) requires that all litigants have a solid understanding of their data assets and that they are able to discuss all relevant, data-related issues ahead of the initial pre-trial discovery meeting. FRCP Rule 16(b) requires that this meeting take place within 99 days after a legal action begins. Following the commencement of the suit, PCG placed a broad litigation hold on all employees associated with the case, advising employees to discontinue any data destruction. But that wasn t enough. HMS brought a spoliation motion before the court alleging deletion of relevant ESI from the defendants personal computers and electronic devices. The defendants did not deny the deletion of ESI, but raised various explanations and excuses. Following a hearing, the court found that a mandatory, adverse inference against two of the three defendants was necessary to alleviate the harm suffered by HMS. The defendants were also ordered to pay HMS the costs, attorney s fees and expenses of the spoliation motion. 5 This case highlights the risks associated with non-compliance during the litigation discovery process. Automating legal hold processes assures that ESI held on custodian devices cannot be deleted intentionally or unintentionally. Courts are requiring increasingly faster production of relevant content, making responding to ediscovery requests in a timely manner absolutely critical. If Legal and IT teams do not have the right collaboration tools at their disposal, the organization risks fines or sanctions, or instructions from the court such as adverse inference. The Real Threat of Adverse Inference Another important benefit of good information governance is the ability to minimize or eliminate the possibility that data might not be properly identified and preserved during an ediscovery exercise or a regulatory audit. Evidence spoliation during a legal action, for example, can carry with it enormous and damaging consequences. The destruction of evidence inhibits a court s ability to hear evidence and accurately determine the facts. An adverse inference instruction from the court to a jury, in which the jury is instructed it may assume the party failing to present data is hiding something, can be extremely damaging. 7 5. http://www.nycommdivcompendium.com/2015/06/02/thou-shalt-not-destroy-esi-yet-another-cautionary-tale-on-the-duty-to-preserve-electronically-storedinformation-from-the-commercial-division-albany-county/ 6. https://www.law.cornell.edu/rules/frcp/rule_26 7. http://www.ediscoverylaw.com/2010/11/court-imposes-adverse-inference-for-failure-to-preserve-text-messages-related-to-criminal-investigation/ 7
The ediscovery Process Diagram: A Best Practice Blueprint The ediscovery process diagram gives you a bird s eye view of the path a piece of electronic evidence will take from start to finish. The Electronic Discovery Reference Model (EDRM) shown here is widely used and respected in the U. S.; it demonstrates a conceptual view of the ediscovery process. 8 According to a RAND Corporation study, the legal and financial costs and stakes greatly increase with each chronological step in the diagram. The study found that 8% of the costs of producing electronic documents was for collection, 19% was for processing and 73% of costs were in review-related activities. This cost expansion trend reinforces the necessity to have a careful ediscovery plan, right from the start. Organizations that efficiently cull non-relevant documents during the less costly collection and processing phases will incur lower costs when it s time for the more expensive review and analysis phases. 9 One direct result of poorly defined or enforced information governance is greater ediscovery costs. Without a strong start, litigation processes will be less efficient, resulting in the production of excessive amounts of content that must be reviewed by paralegals or attorneys down the line. It s all about laying a strong foundation. Information Governance Identification Preservation Collection Processing Review Analysis Production Presentation Est. cost/gigabyte: $910 Est. cost/gigabyte: $2,931 Est. cost/gigabyte: $13,636 10 8. http://www.edrm.net/resources/diagram-elements 9. http://www.rand.org/content/dam/rand/pubs/monographs/2012/rand_mg1208.pdf 10. http://www.slideshare.net/jmancini77/arma-michigan 8
THE HIGH COST OF OUTSOURCING ediscovery: An RFP requires research, analysis, scoping, collection and prioritization of requirements, and communicating the IT landscape to a potential supplier. RFP MANAGING ediscovery IN-HOUSE: With Code42 CrashPlan, an admin simply authorizes the legal hold application to enable counsel or litigation support to select custodians and manage preservation. In-House Legal Hold: A Simpler, Stronger Strategy In many organizations, the legal hold and ediscovery processes look a lot like the titles of litigation cases: Outside counsel v. Inside counsel, Legal team v. Vendor, IT team v. Vendor, Legal team v. IT team, Legal team v. the system, IT team v. the system, etc. In a movement to simplify and standardize their procedures and dissolve some of these extra tensions surrounding litigation many organizations are embracing the new best practice of bringing their ediscovery process in-house. One ESG survey found that 96% 100 73% of the costs of producing ELECTRONIC DOCUMENTS are spent on outside counsel or vendors. 11 MEGABYTES OF CONTENT eliminated during the collection phase will save $1,364 IN REVIEW COSTS. 11 OF FORTUNE 2000 enterprises & government agencies have a plan to bring ediscovery in-house. 12 Bringing certain early ediscovery FUNCTIONS in-house reduced the amount of material one company had to send to outside counsel for review by over 11 75% Read part two to learn how you can leverage your Code42 endpoint backup now with improved Legal Hold capabilities to move legal hold management in-house, and build your ediscovery process on a more solid foundation. 11. http://www.rand.org/content/dam/rand/pubs/monographs/2012/rand_mg1208.pdf 12. http://www.computerworld.com/article/2516002/enterprise-applications/e-discovery-moves-in-house.html 9
C O D E 42 1 2 Part 2: Code42 Legal Hold A Strong Foundation 10
CODE42 LEGAL HOLD: Works across multiple operating systems including Windows, Mac and Linux giving IT full visibility of all user data in a single dashboard. Preparing for ediscovery As every IT team member knows, the power, potential, value and life of an organization is its data. Every year, big data grows bigger, and it s not living neat and tidy in the center of the system. It lives on endpoint devices that are mobile, geographically dispersed and not always connected to network servers. Supports very rich policy management to ensure that technology corroborates information governance policies. Offers feature parity across platforms with a single agent for open file handling. When employee devices are backed up with Code42 CrashPlan, IT has visibility via historical archive of every version of every file, wherever employees are stationed. IT can facilitate counsel and/or litigation support personnel by giving access to the legal hold web app from the console. Once enabled, counsel can choose custodians, define and manage preservation policies, and select and collect documents for the second phase of ediscovery. Administration Legal Hold Return to all legal holds Total Quality Litigation Status: ACTIVE Date created: 5/12/15 Created by: Joseph Wang Details Custodians Activity Choose status: Active Name Date added Status Collection Barton Macklin 5/2/15 Active Get Files Dwight Schrute 5/2/15 Active Get Files Efrain M. Harper 5/2/15 Active Get Files George Lundy 5/2/15 Active Get Files James Borum 5/2/15 Active Get Files Joseph A. Lyons 5/2/15 Active Get Files Joyce J. Gilligan 5/2/15 Active Get Files Restore Target: Zip file Done Get files... Lorraine M. Daly 4/19/15 Active Get Files 11
Universal Truth: Quality In = Quality Out Endpoint backup across the enterprise is the foundation upon which disaster recovery plans, compliance and remediation strategies, streamlined data migration processes and other business functions are built including proactive legal hold. The Code42 CrashPlan legal hold module extends the utility of your enterprise data platform to support a legal hold process that is thorough, relevant and meticulously documented. Your process contributes to your ability to win favor in court and avoid instructions or sanctions resulting from spoilation. Legal Hold Data Mining, Modeling and Analysis Future Compatible Vital Evidence Legal Hold Process Data Migration Predictive Risk Analysis Forensics Disaster Recovery and Business Continuity Data Security CAPTURE AND STORE ALL END-USER DATA ON THE CODE42 PLATFORM When your ediscovery process is built on a solid foundation, so is your case. 12
Code42 CrashPlan with ediscovery Tools Endpoint backup can support a strong information management policy, and is the foundation of a proactive and reasonable approach to data management and litigation preparation. Code42 s integrated legal hold module is intended for use by technical or non-technical teams. This module enables ediscovery teams to centrally control policies, profiles, permissions, user accounts and groups in real time. In the legal hold application, a legal hold is applied when the lawyer (or legal technologist) selects the custodian and preservation policies, including a data destination where files are stored. The console activities do not disrupt a custodian s work. Return to all legal holds Total Quality Litigation Rename Status: ACTIVE Date created: 5/12/15 Created by: Joseph Wang Details Custodians Activity Description Administration Legal Hold Deactivate ho Remove hold Description: No legal hold description yet Code42 legal hold is a reasonable, repeatable process that preserves custodian data in an onsite or offsite system. The data is only collected/restored for processing if the legal team is unable to resolve the litigation. Preserving in place can result in significant cost savings if an early settlement is reached. Preservation Policy General Backup: Adjust backup set settings File Selection: Choose which files to include and exclude Code42 legal hold: Provides a silent, continuous, unlimited and unified solution Places legal holds without user disruption or file duplication Allows access to audit trails and file metadata Provides a single role-based admin interface Integrates with ediscovery processing software User Profile Backup: User profile and state settings to capture 13
Code42 Legal Hold: A Solid Foundation for ediscovery Process Code42 CrashPlan provides the solid endpoint backup that s vital to a robust information governance policy. The Code42 legal hold application provides litigation team members with a strong collaboration tool providing visibility, management and legal hold capabilities for the identification, preservation and collection phases of ediscovery. Information Governance Identification Preservation Collection Processing Review Analysis Production Presentation Information Governance: Code42 CrashPlan enables an accountable framework for information governance of end-user data. The Code42 legal hold application is built atop its robust endpoint data protection and security platform which backs up every version of every file automatically and enables management of end-user data via a single powerful console. Identification: The Code42 platform makes it easy for a single admin to manage all legal holds from a unified console. Preservation: Through the legal hold module, litigation support specialists select custodians, assign parameters and policies of the legal hold data set, and audit processes throughout. Custodians can be placed in multiple legal holds, each with unique policies. Collection: The self-service function is administered through the legal hold web app. Here, files and associated metadata are restored in native formats to maintain auditable chain of custody. 14
Building Success on a Solid Foundation Code42 integrates with ediscovery analysis products, ushering your relevant data collected with its integrity and authenticity intact into the processing, review, analysis, production and presentation phases. Quality in = quality out. Information Governance Identification Preservation Collection Processing Review Analysis Production Presentation Processing: Following collection, native files are prepared to be loaded into a document review platform. Review: During the review phase, documents are reviewed by counsel for responsiveness to discovery requests and for privilege. Analysis: At this point, the scope of the ediscovery project is set, and the files are analyzed by counsel for use in building an argument. Production: Documents are turned over to opposing counsel based on agreed-upon specifications and governed by the rules of procedure. Documents can be produced either as native files or in a standardized format (such as PDF or TIFF), alongside metadata. Presentation: In the final stage, evidence is presented to a judge in court. 15
Code42 Supports Four Fundamental Factors of ediscovery In the United States judicial system, an organization s ediscovery process is judged based on reasonableness. This is a largely subjective quality, or rather a balance of many qualities, but consistently includes the following factors: 1 2 3 4 Duty to Preserve Scope Chain of Custody Data Management Philosophy Code42 CrashPlan supports the duty to For defining the amount of information As relevant information progresses The Code42 platform enables the preserve through continuous, automatic that will undergo ediscovery, the Code42 through the ediscovery workflow, it organization to: collection of every version of every file continuously and automatically preventing loss, deletion or spoliation of documents. platform supports robust search of people, past, present and deleted files, topics and devices. It also provides the ability to see what data has been saved in third-party clouds (such as Dropbox or OneDrive) or removed via external drives (such as USB drives). moves from place to place, is seen by new people, and will eventually leave the organization for review and processing. Code42 CrashPlan supports chain of custody with audit trails and metadata log files. Set retention policies individually, by group or geographical location Determine where to store custodian data Select which data is backed up and preserved through an extensible rule set Perform legal hold on custodian endpoints regardless of operating system platform (i.e., Windows, Mac and Linux) The duty to preserve evidence prohibits destruction or alteration of electronically stored information (ESI). When preserved data is narrowed down, the process is also referred to as culling. It is incumbent upon attorneys to periodically notify custodians that a legal hold has been placed on their devices; custodian compliance needs to be monitored. Spoliation sanctions have increased 271% since 2005. The most common misconduct resulting in sanctions was the failure to preserve. 12 16 12. http://www.abajournal.com/files/dukelaw.pdf
Conclusion In order to strengthen processes, avoid spoliation fines, simplify complexities and control costs, innovative enterprises are moving vital parts of their ediscovery processes in-house. Those with Code42 CrashPlan can do this with ease, using its legal hold module, which sits on top of their continuous endpoint backup platform. The legal hold module enables legal teams to create and manage all legal holds through a single application. Endpoint backup is a secure and solid foundation for managing and protecting end-user data. In the event of litigation, you can extend this strength to your ediscovery process. When your process is built on a solid foundation, so is your case. To learn more about the legal hold feature of Code42 CrashPlan, contact your sales representative or visit code42.com/contact. CORPORATE HEADQUARTERS 1 MAIN STREET #400 MINNEAPOLIS, MN 55414 612.333.4242 WWW.CODE42.COM BK081601 CODE42 Code42 is a global enterprise SaaS provider of endpoint data protection and security to more than 37,000 organizations, including the most recognized brands in business and education. Our highly secure cloud solutions enable IT and security teams to limit risk, meet data privacy regulations and recover from data loss--no matter the cause. 17
Glossary Adverse Inference A legal ruling, resulting from the absence of requested evidence, in which the jury is instructed that it may assume the party failing to present data is hiding something. Chain of Custody The documentation of the path a piece of evidence traveled before being presented in court; an audit of who made, saw, touched, altered evidence and why. Collect and Preserve A legal hold method where relevant files are collected and placed in a new location when it is practical to do so. Custodian The creator or holder of a piece of evidence. ediscovery The process of identifying, preserving, collecting, processing, reviewing, analyzing, producing and presenting electronically stored information associated with legal proceedings. ESI Electronically Stored Information; an acronym referring to any evidence that exists or existed in digital form. Legal Hold An action taken by an organization to preserve relevant information; must be performed when litigation is anticipated. Information Governance The set of structures, policies, procedures, processes, controls and general philosophy implemented by an organization to manage the information it creates and uses. Litigation A lawsuit; the proceedings initiated between two or more opposing parties to enforce or defend a legal right in court. Preserve in Place A legal hold method where relevant files are immediately locked down in the same location in which they are found workstations, laptops, file shares, information repositories, etc. Reasonableness A judgment determined by the court regarding the quality of the ediscovery and information governance policies of an organization. Sanctions Penalties for disobeying or disregarding a rule of law; fines, restrictions, or other deterrents. Spoliation The deletion, misplacement or alteration of evidence. 18