Golf, Tiger Woods and ESI???

by Cary J. Calderone, Esquire

Even though I have been a golfer (those who know me might say golf nut) for quite a while, I never thought I would be blogging about a famous golfer here. When does golf ever have a connection to Document Retention and Electronic Discovery? Never, right? WRONG. Enter Tiger Woods and the media circus that has grown due to his recently admitted "transgressions." Of course there are many of the typical "he said, she said" stories dominating the media outlets, much like they do when Tiger is dominating a golf tournament. After all, Tiger Woods is always big news. However, what is most interesting to me is that if lawsuits are eventually filed, will Tiger be in even more trouble for attempting to destroy the evidence of his "transgressions?" Has he failed to preserve relevant Electronically Stored Information (ESI) relating to a reasonably foreseeable legal matter? If the answer is yes, then Tiger may have exacerbated his problems. Let me explain.

Tiger initially claimed the news stories of marital problems and affairs were unfounded and he issued a statement on his website www.tigerwoods.com. Did that mean litigation could be "reasonably anticipated?" Did his wife mention "divorce" in one of their private "discussions" about his "transgressions?" If the answer to either of these questions is "yes" and he then went and tried to delete any damaging text, voice or other messages that would have made him look guilty, he may be in serious trouble. Tiger may face civil and/or criminal penalties under the Federal Rules (FRCP), and many state laws, that prohibit spoliation (i.e., destroying or altering) of potential evidence.

For example, there may be an issue with the voice mail Tiger allegedly left (it sure sounds like his voice but you be the judge) for his "friend" wherein he instructed her to change her voice mail message because his wife "went through his phone" and "may be calling." On the one hand, he has publicly claimed outrage at the press: "the many false, unfounded and malicious rumors that are currently circulating about my family and me are irresponsible." Moreover, one of his alleged mistresses hired the famous attorney, Gloria Allred, and issued a statement that the rumors are not true. Sure sounds like a lawsuit is brewing if it has not already been filed! On the other hand, Tiger is trying to get rid of messages that connect him to the alleged mistress and would indicate that the stories and "rumors" are actually fact-based and true.

Attorneys under the old rules and paper documents, would almost always go public and threaten to sue the newspapers and magazines on behalf of their celebrity clients. That may have been the standard operating procedure historically, but today, that kind of public condemnation means your client shouldn't also be going through their phone, and email accounts to try to delete potentially relevant material, no matter how much they would like to do so. In the days of paper evidence, lawyers might interview their client at the outset and ask if any damaging material "could be located?" The client could honestly answer "no" to that question when they knew they were completely innocent or, they had done a fantastic job of shredding, burning and burying any damaging documents before meeting with the lawyer. Nowadays, the new rules and technology have changed the question and perhaps the best initial public course of action because it is not a matter of if, but rather, when the damaging material will be "located."

This blogger will continue watching and reporting to see if and how Tiger navigates his way out of this "hazard."

What's that up in the Cloud? Is it a bird? Is it email? Or, is it a Health Club?

by Cary J. Calderone, Esquire

Cloud computing is HOT! Hosted exchange solutions are being advertised to every small, medium, and large business. Google, Microsoft and other big players are promising their cloud solutions will provide security and hassle free email and applications without having to worry about more infrastructure and personnel investments. They may even include archiving and record retention management features to help with DRED (Document Retention and Electronic Discovery). Lower cost and more service, it sounds great, but is it?

Time for a confession here: I have been in the Cloud for years. In fact, I have been operating in the Cloud since long before it was called “the Cloud.” Years ago, I decided I wanted to be able to travel on vacation to Europe or to Hawaii, without lugging a laptop. So I hosted my business account through Yahoo. This meant I kept my email at Yahoo (while using my own domain address) and only downloaded copies of my email as backups. Therefore, wherever I was, if I had access to a computer in an internet café, or a library, or could borrow a friend’s laptop, I could access my email and attachments and work. I even started to store my “working documents” in a secure online briefcase so I could review and edit work product if I had the need and if it was not already in my email box as an attachment. Even though this was years before Blackberrys and iPhones made transportable email commonplace, I was mobile.

Chances are some of you have been Clouding too. If you have an email account with Yahoo, Hotmail or Gmail, then it is likely you have been in the Cloud. Or, as I describe it, you do not need your “personal computer” and installed applications to work with your email. Any computer with internet access will suffice. And yet, as a self-proclaimed longtime happy Cloudy, why am I not ringing the bells, extolling the virtues, and pushing companies to make the move to the Cloud? The answer is because, I workout. Or, more importantly, I have always had a membership at a health club. Non-sequitor you say? Please keep reading.

Back in the health club boom of the 1980s, many health clubs sprouted up creating an ample supply for those people who decided that a healthy and active lifestyle was desirable. However, I noticed a problem with almost all new clubs. When they first opened they had new equipment, reasonable membership deals and a few members. I remember going at 6:30 pm, jumping on the machines I needed, and in 45-60 minutes, I was out of there. But with the success of the new health club came more sales and more memberships. Over time the equipment ran down and the lines to use it grew longer. At some point it became necessary to schedule workouts for non-prime times, or just skip them. Do you still feel like this analogy is misplaced? Then check out this article by Brett Winterford, "Stress tests rain on Amazon's cloud" or the followup article, "More data released on cloud stress tests." The report following testing of three big service providers for seven months indicates that among these very big Cloud providers (Amazon, Google and Microsoft), there are already noticeable performance issues with on-demand services, especially during peak hours. And, even more distressing, the report finds these performance and accessibility issues are “regular” and that the Cloud providers do not provide performance monitoring tools so that Cloud customers may track performance. The report is enough to make this happy Clouder worry a little that the health club analogy is spot on.

There are other critical issues in considering the Cloud, like security. How secure is your company data in the Cloud? On this issue, I would need more information to know if the Cloud would decrease or increase your security risks. How experienced, well-staffed and well-funded is your IT department? Perhaps your data is actually more secure in the Cloud than it is on your old and out-dated servers. The best argument I have heard for mistrusting the Cloud is that, if a security breach occurred, would you even know it? Do we trust the Cloud providers to quickly stop any breach and report it? Do we trust them as much as we trust our internal IT and security staffs to report a breach? This is a very good question to ponder before making the move to the Cloud.

Truthfully, I feel odd writing this post. Here I am, a long-time Clouder writing about potential pitfalls with Cloud computing. I have been very happy with my Cloud experience and have had only extremely rare instances of any problems or issues and these issues would have likely occurred with even the best internal IT department running my email server. Still, happy as I have been, I have always had the option to use another email account if one Cloud account quit working. When the health club became too crowded, I just joined a different gym. Your company cannot easily just switch and join a different gym or Cloud! Yogi Berra could have been speaking about our modern Cloud solution providers when he commented on a restaurant: “Nobody goes there anymore. It’s too crowded.”

New E-Discovery Rules in California: What does this mean for you?

by Cary J. Calderone, Esquire

With no fanfare our Governor, Arnold Schwarzenegger, signed into law AB 5, the California Electronic Discovery Act ("CEDA") (Full Text). The only surprise to those of us who practice in this area was that it did not get signed into law last year. Most believe it was delayed solely due to California's pressing budget problems. California is the home of Silicon Valley and the High Tech industry so the laws in our state typically lead the way when it comes to considering their effect on technology and business. In California email correspondence has been legally enforceable as a "written instrument" since the mid 1990s. It made no sense that one state after another, except California, was adopting rules to mirror the e-discovery rules contained in the Federal Rules of Civil Procedure and thereby, acknowledging that business disputes were now dominated by Electronically Stored Information ("ESI") such as email, word-processed documents and databases etc. These states recognized the importance of having specific discovery rules around ESI and yet, California did not. Now that California has acted what does this mean for your company when it operates in, or is subject to legal proceedings in state courts in California?

First, all those stubborn attorneys who used to tell me that they did not need to worry about Legal Hold Notices, Email Procedures and Record Retention Schedules, because they never were involved in Federal disputes, no longer have that weak excuse. It was a weak excuse because under the old California discovery rules, litigants and their lawyers were affirmatively charged with the duty to protect potentially discoverable materials. In most cases, destroying "evidence" can be charged separately as a crime. There was never any exclusion for emails and ESI and in fact, emails and ESI have been critical pieces of evidence in many criminal and civil matters for at least a decade.

Second, not only is that lame excuse gone, the California rule requires that attorneys from all sides of a litigation matter will need to "meet and confer" 30 days prior to the Case Management Conference. This means they will need to discuss ESI and what/how it will be preserved and exchanged during the discovery process for state legal matters, just like they already must do for Federal matters. Do you know how much ESI you have on your network and in other places you control? Do you know where it is? Can you search it? You should be able to answer a resounding "YES" to these questions. Otherwise, it means you may end up litigating from a weakened position.

Some commentators believe the CEDA modifies the Federal Rule around "inaccessibility" of data as it may be used to defend from producing materials in a litigation matter. I believe the CEDA merely does a better job of explaining the real world arguments that occur in front of the judge. Namely, the judge will ultimately decide whether or not the information is "reasonably accessible" on a case by case basis. Judges have never been fans of an attorney conducting a cost escalating "fishing" expedition during discovery, but if there is a likelihood that important information is only available in one location, there are very few circumstances when a judge will not want that information to be retrieved and searched. The idea is that "Justice" is about finding the truth, not about being able to hide the truth from the judge.

Now it pains me to admit this, but in some ways, if your company has procrastinated and delayed having an Assessment Report and updating its ESI policies and procedures, you have benefited in that the software programs and procedures for accomplishing these tasks are better now and, in some cases, even cheaper. The bad news is that you have at least 2 more years of data to organize, review and remediate. So the longer you wait, the more likely the process will become more difficult and more costly. Will your company be like so many others out there that waited until they got tagged by losing a legal matter or got sanctioned for mishandling ESI? Or, those that had to settle a matter because they could not find their evidence to prove their case, or, they could find it but it would be cost-prohibitive to produce it in a defensible manner? Or, will your company need to feel the sting of a hefty discovery sanction to be motivated to organize their ESI? In a prior post, I mentioned performing a Google search for "million dollar discovery sanctions." There are even more now than there were the last time I mentioned it!

Kermit was right: It’s not that easy, being green

by Cary J. Calderone, Esquire

At a recent ARMA Golden Gate chapter meeting presenters gave real-life accounts of two law firms that had taken on the challenge to become “Green Certified.” Even if you do not believe Al Gore’s reasoning for going Green and that “the debate is over,” going Green may serve an unintended but very useful purpose. It is one more justification for updating the document retention practices and policies in your organization. One obvious and continuing hurdle to becoming document retention and electronic discovery (“Dred”) ready is the cost. IT, Legal, Compliance may need to make significant investments in new technology to better manage electronic data. Even if you have adequate hardware and software, employees may have to devote more time and effort to help the company achieve and maintain this goal. Even though it is less obvious, the work involved can be substantial and it may affect HR, IT, Legal, Compliance and every other department in your organization. Unless your company is currently operating with under-worked and under-utilized employees (LOL-very doubtful) the people in these departments already have full-time responsibilities and making the move towards Dred-ready means a lot of extra time involved in reviewing and updating retention schedules, policies and procedures. It would be nice to be able to dangle another reward carrot and justification for doing the work. Going Green can really help justify the cost and effort of this often arduous undertaking.

At this talk, I expected to learn of great new paperless approaches to records management but instead the “real-life” examples centered on trying to save paper by mandating duplex printing, while at the same time demanding that 100% consumer recyclable paper was being used. I was surprised to learn that this type of recycled paper can cost 3-4 times more than standard copy/printer paper. This conflicted with my stated purpose of using “greening” in connection with Dred to make it more compelling. However, from my perspective, pushing towards Dred compliant and avoiding most of the printing of electronic documents would make for a much “Greener” approach and avoids the issue of spending extra money for more expensive paper. I certainly can respect that law firms would have an awful lot of time, money and focus on paper, so firms in less paper dominated fields should find it easier to pursue Green Certification.

And, although I was hoping to learn about some new groundbreaking scanning technologies or other methods to avoid using paper, we all should recognize that paper will continue to fade away in importance as better electronic document and email management systems are adopted. These types of systems work pro-actively which is by far the best way to avoid the need to print and store information on paper. For example, the Federal Courts have used the Pacer system for electronic filing for a number of years. California law has recognized email is the equivalent of a “writing” since about 1998. California has been considering adopting rules simlar to the Federal Rules of Civial Procedure demanding that Electronically Stored Information ("ESI") is exchanged to perform litigation discovery. These changes to the law, and the practices that are modified to comply with these changes to the law, will continue to reduce the need to focus much time and investment on scanning and other paper management technologies. The obvious flip-side to this is that file and email management and archiving will continue to grow in importance.

Since this blog is focused on Dred, I will not bore or disgust you with the helpful hints about recycling and composting office waste for the achieving a rating of Green. It is always nice to avoid waste but in a word, yuck. And you thought keeping the company lunch area clean and odor-free was difficult before! Given the volume of articles written and the number of presentations scheduled at trade shows, one thing becomes certain; in this day and age going Green has become hip. In summary, I will close with more of the insightful and, as it turns out, prophetic lyrics sung by Kermit the Frog, “Green can be cool and friendly-like.” (For Kermit singing on you tube : ) .

RSA Conference 2009-Mock Hearing and Appeal re: Spoliation of Digital Evidence

by Cary J. Calderone, Esquire

This was a treat. The Mock Hearing and Appeal, presided over by the Hon. John Facciola at the trial level and the Hon. Shira Scheindlin and Hon. Richard Kramer at the Appellate level, examined a spoliation challenge, its defense, and had an interactive discussion after the decision. It is very rare to get a chance to observe and learn about the decision-making process of any active Judge, let alone have veritable "rock stars" of electronic discovery, walk you through a hypothetical case and explain the issues as they rule, but that is exactly what the Mock Trial and Mock Appeal sessions provided. For those who do not have a legal background, all active Judges are governed by strict rules of professional conduct and must avoid "even the appearance of impropriety." This, in addition to the fact that they are monumentally busy, is why we seldom hear from these brilliant and experienced people on the evening news or talk shows. We are generally limited to reading their opinions and using them as precedent to argue similar case facts follow or can be distinguished from those previous cases. However, these mock trials are hypothetical and accordingly, the judges are at liberty to point out why the lawyers and witnesses won or lost their arguments. I implore anybody who is in the Legal, IT, Compliance, Records Management or Risk departments and, is in any way responsible for or involved in Records Retention or Electronic Discovery at their companies, to seek out this type of session at an upcoming conference and attend. Short of going into real court and observing (See Federal Court for Discovery-Be a Boy Scout) this type of presentation provides the best opportunity to learn why we are dealing with Record Retention Schedules and Policies in the first place.

In brief, the hypothetical involved an airline, who had an incident allegedly occur between a disgruntled passenger and an angry flight attendant. The airline had a document retention policy where handwritten Incident Reports from flight attendants would get entered into electronic format. Then the handwritten original would be destroyed. Also, there was a court ordered Legal Hold in place and the flight attendant shockingly had no recollection of the events that happened. It is not necessary to go through all the details that were discussed but a couple of important items relevant to Document Retention and Electronic Discovery are that: 1) Check to see if your company is actually following its Policy? Judge Scheindlin commented that "if you follow a policy that allows for routine destruction of data, before a duty to preserve it on Legal Hold arises, you are safe." 2) Is your policy reasonable or will it look like it is designed to eliminate any potentially relevant and/or harmful evidence? 3) Know your facts when it comes to claiming or defending claims of spoliation. For example, the Second Circuit does not require malicious acts. Mere gross negligence will be sufficient to justify an "adverse inference instruction" from the Judge.

At the trial level Judge Facciola ruled that the airline had disobeyed the Legal Hold when it destroyed the original handwritten document. Further, he found that the electronic version did not include a signature or an attestation from the flight attendant so the electronic version was not "complete" which violated the airline's own retention policy. He ordered an adverse inference instruction be given. An adverse inference instruction means the before the jury deliberates, the Judge explains that because this evidence was destroyed they may assume that it meant it was evidence harmful to the airline. Not good for the airline! On appeal, the panel overturned the lower court and found that given it was negligence and not malicious acts, the adverse inference instructions was too harsh and monetary sanctions would be more appropriate. Better for the airline, but they did not discuss the amount of the sanctions so it might not have been that much better.

When I expressed my condolences to Judge Facciola for getting reversed by the mock Appeal panel he said that he was very confident that the Appeal would have been reversed back in his favor at the mock Supreme Court level. :)

Panelists: Honorable John Facciola, United States Magistrate Judge
United States District Court for the District of Columbia
Honorable Shira Scheindlin United States District Judge
United States District Court for the Southern District of New York
Honorable Richard Kramer San Francisco Superior Court Judge
Stephen Wu, Esq. Partner Cooke, Kobrick & Wu, LLP
Hoyt Kesterson II Consultant
Randy Sabett Attorney Sonnenschein Nath & Rosenthal
Joseph Burton Attorney/Managing Partner
Duane Morris LLP
Moderator and Counsel for Mock Plaintiff: Steven Teppler, Esq. Senior Counsel Kamber Edelson, LLC

"Reasonable" is graded on a scale

by Cary J. Calderone, Esquire

The Silicon Valley chapter of ARMA International held an ITRIM (Trim your data) one-day conference recently and I was fortunate to attend the lunch panel discussion. The panel members, Grant Law, Esquire of Shook Hardy & Bacon, Nathan Walker, Senior Technical Marketing Engineer of NetApp Corporation, Lisa Ripley, CISSP, Electronic Discovery Manager of Sun Microsystems, Inc., and Greg Lipptez, Esquire of the Jones Day law firm, gave brief presentations covering many familiar data retention and electronic discovery ("DRED") themes: 1) You will get sued therefore having a Data Map that explains what you have and where you have it is critical.. 2) Legal needs to be able to listen to IT and vice versa.
3) There is a constant struggle between lawyers who prefer to keep very little data and IT personnel who keep as much as possible. 4) Too many organizations have too many employees who are “surprised” to learn they actually have a record retention policy (and this is especially bad when their legal team learns of this fact during sworn testimony). And finally, 5) the law requiring what you need to keep, is not static, it changes. While it is nice to know that concepts that I have previously covered in this blog are out there being discussed and adopted by more data managers and professionals, I would almost have declined to write about the discussion but for one really great quote from Nathan Walker. Answering a question on "how best to avoid getting into trouble" with the production of Electronic Discovery for Meet and Confer conferences and motions to compel hearings, Nathan said: “The more you appear to know what you have and where you have it, the more your threshold for “reasonable” goes down.” This comment was cheered by the audience and maybe the best simple explanation for why Records and Information Managers, IT, Compliance and Legal departments need to make retention schedules, train people to follow them, and continually monitor them. To paraphrase the famous Billy Crystal character Nando, on Saturday Night Live, when it comes to electronic discovery, it is more important to appear to “look absolutely marvelous” than actually "feel absolutely marvelous." Bottom line-it is always best to know what you have and where you have it.

Industry Blurb Follow Up: Symantec Discovery Attorney Annie Goranson

by Cary J. Calderone, Esquire

Last summer I commended the move by Symantec Corporation to create a Discovery Attorney position in their Enterprise Vault applications group (See, Smart Move by Symantec). From my own personal experience, the often used phrase, “bridging the gap” does not adequately describe the lack of understanding between the Legal and Information Technology departments. In many organizations, the “gap” looks more like the Grand Canyon. After applauding the fact that Symantec recognized that someone with a legal perspective, Annie Goranson, could be a useful addition to a technology team, I wanted to take the opportunity to discuss some real world experiences with her. After all, she has now served in the position of Discovery Attorney for approximately eight months and indicated she was ready to describe some of her findings, both good and bad, learned from her attempts to help bridge the gap between Legal and IT.

Calderone: Why was the position of Discovery Attorney created? Goranson: It was determined that there was a need to add an electronic discovery educational resource on the sales side to better explain general legal issues around email archiving and the e-discovery process. In the past, before e-discovery was the driving force, sales was driven by IT and Legal was out of the loop. Now that has changed. Legal may be the driving force for the sale, and legal compliance is a critical component to satisfying the customer with their implementation of Enterprise Vault.

Calderone: What interested you in the position? Goranson: I thought it would be fun to help customers understand the bigger issues and the different ways they might accomplish their goals with Enterprise Vault. I also wanted to help the sales team understand some of the bigger legal issues as well.

Calderone: Any general comments on what you learned working with customers? Goranson: While they often ask about “Best Practices” around legal compliance, in reality there is a huge range of sophistication in the way technology is used and employed from customer to customer. This depends on how the legal department is structured and the frequency with which it is involved in litigation or investigatory matters.

Calderone: What surprised you the most in dealing with customers? Goranson: Many customers just think it is a good idea to keep everything forever. They are really afraid to delete something they may want to look at in the future.

Calderone: What retention or electronic discovery issue was present most often? Goranson: Customers really struggle with retention requirements questions. They would like a simple Best Practices answer but I cannot answer that for them. We try to raise issues that should be considered, but at the end of the day, every organization will have unique considerations, so we refer them to their own Legal Departments or outside counsel or e-discovery consultants to develop their processes.

Calderone: Any other issues you noticed frequently? Goranson: Having good Legal Hold processes is a big driver for email archiving, due, in large part, to the many court cases in the news recently where there were big discovery sanctions awarded. But, similarly to retention practices, customers may not realize that good Legal Hold strategy is about the tools, the processes, and the training, and not simply having a written Legal Hold policy.

I wish to thank Annie Goranson, for taking time to answer some interesting questions and to provide her perspective as a Discovery Attorney, to this Document Retention and Electronic Discovery blog. Her opinions are a welcome addition to the insights of others (not just my own) that have been published here.

A Shout-out to Records Managers: Don’t forget the lecords and becords

by Cary J. Calderone, Esquire

No, this was not an attempt to increase my Blog’s page visit time by using a few strange typos in the title. Rather it is my well-intentioned plan to add some new words to our Electronic Discovery language. Records managers have been using the term RECORD for decades to separate a mere copy, draft or scribble from an important company document that needs special attention. The RECORD copy was subject to retention schedules and possibly higher security and archiving protocols as well. Non-RECORDS were largely considered unimportant. Two things have changed to make Record and Information Managers' (RIM) jobs a bit less fun.

Firstly, we have the introduction of the desktop computer as an office productivity tool and with it, email. RECORD and Non-RECORD distinctions simply do not work very well with email. For example, does an email that has a RECORD attached to it, or a copy of a RECORD attached to it, and may discuss the subject matter of the RECORD, get the same treatment under the Retention Schedule? Secondly, the lawyers got involved (do we ever make things any easier?) and have been directed by State Courts and the Federal Rules of Civil Procedure to work with Electronically Stored Information (“ESI”). To the Courts and the litigants what is important is not whether an email is a RECORD or non-RECORD but whether it might be a “business record” or “legal record.” If it falls in either of those two categories a company may need to preserve it as part of its reasonable computer record keeping practices. This is especially true when a particular industry is highly regulated or the company is preserving data pursuant to a Legal or Litigation Hold. Hence, I thought it was time for newly invented ESI Retention words to use because when legal discovery documents refer to “Records” they mean lecords (legal records) and becords (business records).

These new words work well with the modern rule that says anything that documents how a company makes business or legal decisions, i.e., lecords and becords, are determined by content and not whether they are a word document, an email message or an old fashioned piece of paper. They may even include telephone voicemail messages that are stored on a computer or PDA. Also, lecords and becords may include all copies that appear to be identical and previously would have been distinguished and separated from the RECORD copy but now need to be treated as potentially important evidence. Sometimes this is because of the content and the distribution list, but other times copies may be important because they contain hidden meta-data that reveals things like who opened or edited the document and when. The world of RIM was never designed to capture this type or volume of information. Even a separate log document to determine who checked out or edited a RECORD will not work nearly well enough.

Moreover, thinking about lecords and becords helps one to understand why an Instant Message, where one co-worker asks another co-worker out to lunch might be important enough to keep. There is not RECORD category for seemingly innocent chit chat between co-workers. There is no Retention Schedule covering Instant Messages about lunch dates. However, if the message said, “want to get together for lunch to talk about why we might miss our quarterly numbers” it may certainly be considered a becord. Or, if it was the 4th IM from the same employee asking out another employee who complained to a supervisor about sexual harassment, then it would be a lecord. As a becord or lecord there could arguably be a duty to preserve these messages, even if according to the rules of RECORDS and non-RECORDS and the Retention Schedule, these messages do not merit special attention. By thinking about becords and lecords, a company can stay a little safer. I have used both these examples with Records managers to illustrate my point, and while they do not necessarily like the new perspective, and obligations it creates, it does make sense to them given our usage of email and IMs.

In my dealings with Records Managers, this has been a very difficult distinction to comprehend and appreciate. I understand their frustration and hope that the idea of RECORDS, lecords and becords may make their jobs easier. I want to keep Records Managers involved in the retention management process because there is nobody in a corporation, who has more experience tagging and organizing information. True, the tagging and organizing processes have changed from paper to the new world of ESI, but I believe RIMs will be the most important part of the solution moving forward.

How to Modify a Form Data Retention Policy for Your Company's Use

By Cary J. Calderone, Esquire

Do you have a Records Retention Policy (“RRP”) form we can work from? Without question, this is the most frequent favor request from friends and associates and occasionally, even from relative strangers. So this article explains five steps to follow to take some other company’s form and make it your own without having to use an attorney, like myself, or a reputable document and management or eDiscovery consulting firm to assist you in the process.

1) Start by finding a form that might be a relatively good fit. While RRPs all generally look similar and contain descriptions of computer content and timelines for retention, the ideal situation would be to have a form from someone in your industry that is about your size, with offices and products that cover the same legal jurisdictions. Also, they should have about the same technology as your company. Some may consider looking at forms used by a competitor.

2) If it is well written and thorough then you will need to make sure your other company documents that may overlap with or refer to information in this form, conform to it. Check your employee manuals, your technology, Email, Instant Messaging, PDA and cell phone policies to make sure they are consistent with the language of your new RRP. If not, you may need to acquire copies of those documents from the same source as the RRP. Also, be sure to replace the custodian names from the source document with the people from your company, who are likely to be called as witnesses and placed under oath to verify that the retention procedures are regularly followed. Be forewarned, some of your co-workers may feel uncomfortable with accepting this new responsibility.

3) Upper management needs to sign off on your new documents. The CEO, CFO, General Counsel and other high-ranking executives will be the ones who may face criminal penalties if the new policies do not pass muster in a court or audit proceeding-so get their signatures. Caution-they may not really want to know all the details of the source of the new RRP.

4) Now that you have your policy paperwork in order you need to make sure all the employees will understand and follow it. This may involve re-arranging your company’s current data file structure on the network and any current retention and records review habits, but it is a necessary step. It would also be preferable if you have the same archiving and backup procedures to match your form.

5) Warning Warning Warning. Now that you have saved money by modifying someone else’s forms all you need to do to complete the procedure is protect against the following missteps: a) Your company’s software applications must work the way the source company’s do. So if your applications are less capable you will need to purchase upgrades, or if you have better software, you may need to disable some of the features to comply with your new RRP. b) Check that your electronic storage also matches in capacity and security features, otherwise, follow the same routine as for software and upgrade or disable accordingly. c) Make sure your business group leaders understand that any growth plans or upgrades may need to be delayed unless they match those of your source company. d) Always a good idea to check your source company to find out if the form you have borrowed was successfully tested in court and did not lead to sanctions of a few million dollars. e) If it was tested in court than verify that the source company is the source company and used best practices to develop their Policy. Otherwise, it may have been copied and adopted from a dubious source and not be all that great a starter form. f) Lastly, make sure you do a very good job with search and replace for the source company and your company’s name because there is a good chance that this policy form contains confidential and privileged and/or trade secret information that may make it a crime for your company to have it in its possession. This would be especially bothersome if the form did come from one of your competitors.

In conclusion, my writing approach for this post was in honor of the late professor Dr. Randy Pausch who’s YouTube video, The Last Lecture, made him a celebrity. In following with his style of teaching, did you catch the head-fake? This was not really a way for you to work off somebody else’s form but rather a list of real-world reasons why you should not even attempt it. Records Retention Policies and Legal Hold Policies are like fire escapes and exit procedures for emergency evacuations. They really need to meet the needs of your particular building, layout and people. This is simply not an area where cookie-cutter form documents will do the job very well, if at all.

Industry Blurb: Smart Move by Symantec

by Cary J. Calderone, Esquire

Symantec has made a very interesting move in creating a new Discovery Counsel position to work with the Enterprise Vault team. Annie Goranson, an attorney from their legal department, has been promoted to this position. She will work with the Systems Engineers and Enterprise Vault clients to help with system design and implementation. This is a bold strategic move in an effort to address....
the legal issues around email archiving that typical Systems Engineers and consultants can not or may not handle. Her real-world e-discovery experience should help Symantec keep their people operating within the rules that prohibit non-lawyers from practicing law while providing clearer advice to the customers who want to use E-Vault to be better prepared. I would not be surprised to see other companies in the electronic information management space follow suit and utilize more knowledgeable legal personnel to avoid potential problems in this area. While we lawyers do deserve some of the criticism directed at us, sidestepping legal traps and distinguishing critical legal facts and issues is not usually handled best by sales people and systems engineers without extensive legal backgrounds. Score one for the lawyers!

Who Makes the Decision: Or, why I sometimes feel like Dr. Phil

By Cary J. Calderone, Esquire

Sometimes I miss just being “the lawyer.” Working as a pure lawyer, I outline the facts and the issues, the laws provide the foundation for my analysis and whenever possible, I explain the conclusions we may reach. And, with very few exceptions, that is that.

Largely, the lawyer is focused on the facts, the rules and precedence. There are certain requirements and frequently, there is little room for variance. In this rather new area of Document Retention and Electronic Discovery (“DRED” for short) this is changing.

More frequently the law around DRED has set forth guidelines of “reasonableness” and then, depending on the particular company structure, industry, and the current state of technology, there may be more than one approach that would bring about an acceptable level of risk for the desired legal compliance. With DRED consulting, I have to play the role of a consultant, which means I need to know and understand why things are the way they are on a technological and business level, before I can suggest a path for change. Good lawyers in this space recognize that they have to take on some of the tasks of consultants, even if we do not like it.

So who decides what is reasonable? In practice, a judge would want to see a set of policies that have been created by considering structure, industry, technology, and business needs. As I mentioned in Best Practices for Managing Electronic Data: Chickens or Eggs whatever the policy, it needs to be followed and enforced company-wide for it to withstand legal scrutiny. So now instead of a lawyer dictating the rules, the consultant must elicit information from various department heads and members. Collaboration, which may be a common realm for Dr. Phil lead counseling may not be with the newly enlisted stakeholders in corporate document management, and it is crucial.

Many books and articles that describe best practices for management consulting explain methods and available tools for collaborative creation. And while I believe that “negotiated implementation” a specific form of collaboration brings about higher rates of adoption, i.e., success, too many consultants, management gurus, and how-to books fail to adequately examine and/or describe the people at the table. Let me explain. The best example I have came from a Business School professor Dr. Terri Griffith ( one who focuses on negotiated implementation). She presented an exercise to her class where they were divided into teams and each team was to work together to create a jungle survival plan. Everyone felt they needed to contribute and share their opinions or collaborate. However, in one group, no one asked about the experience and background of their members. It turns out, one student was a Navy SEAL with survival training expertise and the rest of the group members had absolutely no real-world experience in wilderness survival and quite possibly had never even been camping. So, why did everyone need to share their opinions equally in this collaborative exercise?

In the world of document management, we have a minimum of two worlds colliding, and frequently 3 or more. Authors Randolph A. Kahn and Barclay Blair describe 4 quadrants in their highly regarded book Information Nation. We have legal and IT and depending on the size of the organization and the particular industry, perhaps compliance and records management departments. Regardless of the number of people at the table, when it comes to designing a company-wide policy there will be no initial consensus on even the basic policy terms. For example, “Dr. Phil, how long should we keep email?” Legal might say 3 months is plenty of time if it is not something that needs to be retained according to a Records Retention Schedule. Knowledge managers would like to keep good stuff for many years, if not for ever. Most others will have ideas somewhere in between those two extremes.

For negotiated implementation to work best, I believe we need to know the “whys” and realistic limitations of any policy. The “whys” are important because when people know “why” it makes it easier for them to remember and because they can see that their and the organization’s needs have been considered they are more likely to adhere to the policy. Somebody who has made a valid suggestion for improvement feels better knowing it was not adopted because the technology was not able to accomplish it or it was cost-prohibitive, as opposed to feeling like their idea was not seriously considered.

There are many advantages to collaboration, but it may not be necessary or even advisable if you have the document management version of a Navy SEAL in your group. If you do, then the most efficient way to move forward is by starting with their best idea, understanding why it works, and fine-tuning it or not, with your group’s suggestions – these will be based on their needs so even by merely listening you are increasing their motivation for compliance. Dr. Phil might refer to this as “being heard.” It is still negotiated implementation but it is a shortcut to good results and will avoid protracted fruitless meetings and the need for someone to sooth over hurt feelings. We know that department heads who previously were separate and isolated must be involved and sign off on this process, sometimes because the law actually requires it. We know these participants may not have previously worked together or get along very well. So if we can get good results quickly, everyone will benefit by saving the company money and, being able to get away from the document management negotiations table, and back to their separate, primary job functions.

Last From Legal Tech West 2008-Keynote by Magistrate Judge Laporte

By Cary J. Calderone, Esquire

Judicial perspective on E-Discovery- by the Honorable Elizabeth D. Laporte, Magistrate Judge, U.S. District Court, Northern District of California

Judge Laporte addressed an audience that understood that in the last year about 100 billion gigabytes of business information was subject to compliance regulation. Emails, which included business and personal email, were now fodder for lawsuits and criminal indictments. So, the Judge noted, “litigation readiness is more important than ever.” She gave examples that explained when meta-data should probably be produced and examples of when native versus non-native formats might be necessary. My favorite observation the Judge shared was that, if you are going to claim you were surprised by this litigation matter, and that was why you did not have a litigation hold in place and any data that was destroyed or altered hold was purely accidental…you should not also try to make the argument that you should not be required to produce data because it is protected as attorney work product, prepared in anticipation of a legal matter. Scary that Judge Laporte believed she should remind the audience that while these were two legitimate points they should be raised separately. If argued together they become an oxymoron and cancel each other out. Perhaps all lawyers need the occasional reminder not to suspend logic and common sense when making multiple arguments in their efforts to aggressively and completely represent the interests of their litigation clients.

The Judge commented that the obligation for when a party must start to preserve evidence is when litigation is “reasonably anticipated” and that this was not a “bright line.” She also reminded the audience to review the Local Rules for each Federal District Court as they would likely contain important e-discovery information. For example, in the Northern District of California local rules require that parties at the Meet and Confer discuss whether voice mail needs to be preserved. She also quotes another Judge explaining that there will be no “drive-by” Meet and Confers and that real effort of all parties is expected to meet and resolve any discovery challenges. To accomplish this Judge Laporte recommends the parties be: 1) reasonable, 2) candid, and 3) credible, in their e-discovery efforts. For the Meet and Confer she pressed for lawyers to know enough to make accurate representations to the court and have alternatives for collection of discoverable materials. This can involve the in-house IT personnel, outside experts and the in-house General Counsel and sometimes the outside lawyers will bring outside IT experts to the Meet and Confer. There should be no uncertain terms and lead counsel must be acquainted with what they need to know, which includes what data is in your custody and control and what data is likely to be relevant. Furthermore, you must be willing to make mid-course corrections and adjustments to the legal hold as the case unfolds. Otherwise, she believes Courts will continue to use sanctions to keep the litigants “honest and trying to do their best.” Although I had not visited Judge Laporte’s courtroom while researching my “Federal Court for Discovery? Be a Boy Scout!” article, I am happy to note that doing so would not have altered the conclusions I reached and most likely would have bolstered my arguments for litigants to “be prepared.”

More Legal Tech West 2008

By Cary J. Calderone

Data Privacy Issues for Multinational Corporations. Or, what kind of food do they serve at your jail?

Data compliance in the USA and EU is an important and evolving area of document retention and electronic discovery law. One of my first research projects involving electronic data was for a company looking to pro-actively set and maintain good e-document retention policies and plans for their multi-national company which included a publicly traded US Corporation. On the one hand, we have Sarbanes-Oxley requirements for managing corporate computer data that contains content and processes of a company’s financial record keeping and technology systems. On the other hand, we have European Union privacy-protection rules prohibiting even the collection and review of emails which contain personal information.


So I raised my hand and asked a question. The very informed panel, which included Amor Esteban, Partner, Shook Hardy & Bacon LLP, Mark Smith, Senior Associate, Winston & Strawn LLP, Tom Hopkinson, Director, Forensic Technology, KPMG Europe LLP and Moderator, Omid Yazdi, Managing Director, Forensic, KPMG LLP explained part of the reason for this divergence was due to the history of European countries and their experiences with Totalitarian governments. They commented that I raised a good question, even though I added my tongue-in-cheek observation to advise General Counsel to pick the countries with the harshest jails, and follow their rules first. I expected they would laugh and then propose a valid work-around. They sort of agreed that it was virtually impossible to be totally compliant with the letter of the law in the EU and US in the area of email retention. One noted that recently a French lawyer was criminally charged for violating French Blocking statutes and faced jail time for working with US lawyers to produce materials in a way that violated French law. So apparently considering the jails and penalties is a valid approach to setting a Multi-National electronic document policy. Yikes!

More from Legal Tech West 2008

by Cary J. Calderone, Esquire

1) Best Practices for Email Retention and eDiscovery Seminar sponsored by Mimosa Systems, Inc.
2) Index Engines Inc.-Technology can change the law.

Legal Tech West

by Cary Calderone, Esquire

Electronic discovery, electronic document and email management, strategies and technology are all hot topics of discussion at Legal Tech West Coast 2008 in Los Angeles. More reports will be posted but for starters, it was most enjoyable to hear the keynote delivered by Charles A. James, Vice President and General Counsel, Chevron Corporation. He openly described the trials and tribulations his department experienced while successfully growing Chevron's award-winning legal technology systems. He humbly noted that he had been overly seduced by the idea of automation while under-estimating the value of change management to lead to successful implementations. He even described that now they are reaping other rewards like being able to use data collected from their web, litigation management, and direct payment systems to streamline and focus their resources in cost-effective and efficient ways. If industry vendors listen to his advice and address his "Three Vendor Gripes" every worker in a corporate legal department around the country will be happier. Gripe number 1, ("G1"), is that vendors are overselling
the practical, compatible and functional capabilities of their products. This can lead to delusions of "automated" systems that replace the people in the process but in reality, Mr. James teaches that people need to work with the technology to have the best results. For G2 Mr. James paraphrased Rodney King's famous plea, "Can't we all just get along." Phrases like "complete solution,""enterprise" and "seamlessly" should be banned from all sales literature until the multitudes of products that are advertised as "open" and touted as part of "inter-operable solutions" do, in fact, work together in more than a limited and concocted fashion. My personal experience in the world of "enterprise solutions" had me nodding my head in agreement with Mr. James, along with many other members of the audience. For G3 a challenge was proposed that there would no longer be a need for e-discovery for lawsuits, Attorney General actions and other legal and criminal inquiries because compliance rules would be logical and specific, and technology would serve to illuminate electronic data to the point where people in corporations would simply do their jobs while staying fully compliant. In other words, there would be no need for e-discovery if technology worked pro-actively with automatic audits and controls for content and process. One of my favorite sayings is appropriate here: if you are going to dream, dream big. I hope your wish is granted soon Mr. James.