Electronic Data Records Law | How to Win E-Discovery

SANS Conference on Computer Records Policy

Summit Title: "E-Data Retention, Discovery and Destruction: Developing and Implementing IT Policy"

Announcement:  We have cancelled this conference.  We are evaluating whether to revive it at different place, time and/or format.  If readers or potential partners/sponsors have any ideas, please contact Ben Wright.  Many thanks to the speakers who agreed to support this summit.

Former date and place:  September 27-28, 2010, Las Vegas

Summit Description:  Almost unheard of ten years ago, electronic discovery is today chewing up IT resources – equipment, services and staff time.  Recognizing that many electronic records such as e-mail, spreadsheets and text messages might some day be demanded in a lawsuit or freedom-of-information request, what policy should your enterprise adopt for retaining and destroying electronic records?  Although it is foolhardy to keep everything forever, numerous, recent court cases have punished organizations for failing to retain data, or for failing to find and disclose it in a timely, responsive manner.  This summit [conference] draws from the wisdom of diverse experts and end-users, including case studies, to address: 

- the process for setting workable policy,

- techniques for managing storage and service costs,

- confidentiality, security and other tradeoffs between in-house and cloud storage,

- ever-improving methods for searching and culling vast troves of records,

- real-world experiences on the interplay between lawyers and IT professionals,

- protocol for access to records for internal investigations,

- international issues, including non-US privacy laws.

Given that law and technology are simultaneously undergoing rapid change, the summit assesses what the future may hold for e-records management policy, products, services and legal expectations.

We are looking for sponsors and suggestions!  If you wish to exhibit or offer an idea, then please: 

- leave a comment below; or

- call me at 1.214.403.6642; or

- email ben underscore wright at compuserve dot com (put "BLOG" in subject line).

Update:  We are proud to announce these confirmed speakers: 

- Steven Broberg and Shawn Malone of the Records Management Department of Travis County, in Austin, Texas

- Jorge Rey, Director of Information Security and Compliance, Kaufman, Rossin & Co., P.A. (policy development case study)

- Kevin Bong, Director of Corporate Security, Johnson Financial Group (end-user policy case study)

- Sonian, Inc. (cloud email archiving)

- Alex Blumrosen (American attorney practicing in Paris, France)

- Greg Smith, Messaging Architects

- Vivien Osamiluyi, Internal Auditor, Legg Mason

- CrowdFlower will demonstrate crowdsourcing as a tool for assessing large quantities of documents in an official investigation, such as a lawsuit or government inquiry

- Michael Osterman of Osterman Research

- Brian W. Foster, Access Sciences Corporation

- Kevin Larson - Qualcomm, Inc (end user enterprise)

- Digital Reef

- Jesse Wilkins - Access Sciences Corporation

- Jim Balter - University of Miami

Twitter hashtag for the Summit:  #sanspolicy

Summit Agenda

[Tentative as of July 21, 2010 - Subject to Revision.]

[Not yet approved by Speakers.]

September 27 – 28, 2010

Las Vegas, NV

Title: "E-Data Retention, Discovery and Destruction: Developing and Implementing IT Policy"

The mission of this Summit is to stimulate discussion and debate as a tool for learning. Each session will allow ample time for interaction among participants.

DAY ONE Monday, September 27

9:00-9:40: Welcome and Introduction

Speaker: Benjamin Wright, Summit Chairman

 

 

Title: Resolving the conflict in electronic records retention policy setting.

Abstract: The quantities of electronic records are skyrocketing, and courts are expecting better retention of them. How do we reconcile these developments with traditional records management practices? What to expect in this Summit. Mr. Wright will query participants to bring their issues and experiences to light.

Throughout the Summit, Mr. Wright will attempt to summarize and stimulate discussion around major points that emerge from the sessions.

9:50 – 10:50

Title: Records Managers – Travis County, Texas – Confront E-mail

Speakers: Steven Broberg and Shawn Malone, Records Department, Travis County, Texas.

 

 

Abstract:  Professional records managers will articulate the considerable challenges they have encountered in trying to square legal expectations with the realities of email in a complex enterprise having 4500 email users.

10:50 – 11:10 Break

11:10 - 12:15

Session Title: Experts on Record Retention Policies

Speaker: Access Sciences Corporation - Brian W. Foster (former Director of eDiscovery at one of the top five global oil companies) and Jesse Wilkins

Session description to be determined.

Lunch 12:15 – 1:30

1:30 – 2:20

Session Title: Finding Email Records in the Real World

Speaker: Greg Smith, Messaging Architects

Abstract: Practical e-discovery experience – the proliferation of email records throughout an enterprise, including in unexpected places. Stories from the trenches.

 

 

2:20 – 2:40 Break

2:40 – 3:55

Session Title: User Panel

Abstract: All enterprises wrestle with how to set policy for the retention of electronic records in a changing environment. Hearing the experiences of diverse user enterprises can paint a more realistic picture of what is possible and what should be expected for well-crafted policy.

Panel Members:

Internal Auditor: Vivien Osamiluyi, Legg Mason

Kevin Bong - Johnson Financial Group

 

Kevin Larson - Qualcomm, Inc (end user enterprise) - How do security issues influence policy on electronic records retention? Podcast about Kevin's presentation: Download Sans_intro_klarson

- Jim Balter - University of Miami

 

Steven Broberg and Shawn Malone, Records Department, Travis County, Texas

4:00 – 5:00

Session Title: e-Discovery's Influence on Email Record Retention Policy

Speakers: Digital Reef - Steve Akers (Founder and CTO) and Digital Reef's Customer, James Bandes

Abstract: What are practical experiences with e-discovery telling us about how to write and implement e-record retention policies?

DAY TWO Tuesday, September 28

9:00 – 10:00

Session Title: European Experience

Speaker: Attorney Alexander Blumrosen, Bernard-Hertz-Béjot - Paris, France

Abstract: In lawsuits and investigations, privacy issues can loom larger outside the US. How are these issues influencing e-Discovery and the development of e-records policy in Europe?

10:05 – 11:00

Session Title: Drawing Practical Lessons

Speaker: Benjamin Wright, Summit Chairman

Abstract: What are the larger implications of the stories from day 1? How can these be combined with the lessons today to write a take-home list of principles and guidelines? Mr. Wright will lead the group in compiling that list, starting now and running through the rest of the day.

11:00 – 11:20 Break

11:20 – 12:15

Session Title: The Future of Electronic Records Policy and Technology

Speaker: Michael Osterman, Osterman Research

Abstract: What are the big trends in records management and e-discovery and how are organizations not keeping pace from a policy perspective with regard to records management, social media management, or managing data for regulatory or legal compliance? How is technology changing and what is the role of technology vis-à-vis things like employee training and establishment of corporate policies? What can we expect two years, five years from now? How should enterprises prepare for the future from both a technology and non-technology perspective?

12:15 – 1:30 Lunch

1:30 - 2:30

Session Title:  e-Mail & Electronic Records Disposal Policy Case Study

Speaker: Jorge Rey, CISA, Kaufman, Rossin & Co., P.A.

 

Abstract: In this case study, an accounting firm helped an organization save costs by implementing a policy that reduced the quantity of electronic records and emails retained. During this session, ample time will be available for all Summit participants ask questions, make comments and debate.

2:30 – 2:50 Break

2:50 – 3:40

Session Title: Cloud Storage of Records

Speaker: Sonian, Inc. and End-User Customer

Abstract: What are the true costs for storing enterprise email in the cloud? As a practical matter, can the enterprise be assured that those records will be secure and will be retrievable many years in the future? Will privacy and confidentiality issues limit the use of cloud services for the storage of critical business archives? Can these issues be addressed with contracts, technical controls and other procedures?

3:45 - 4:15

Session Title: TBA

Speaker: TBA

4:20 – 5:00

MUST SEE HIGHLIGHT OF THIS SUMMIT!

Session Title: Crowdsourcing Demonstration

Speaker: CrowdFlower

Abstract: In modern lawsuits and investigations, the massive volumes of electronic records is daunting. How do we make sense of all these records? Crowdsourcing may be one effective tool, where a swarm, an army, of virtual workers is employed to review and analyze records. CrowdFlower will present a pioneering demonstration of this concept, live at the Summit. Don't miss this unprecedented learning experience.   Download Media alert SANS-CrowdFlower

 

Electronic Mail Storage In-House or In the Cloud

E-mail Archive Economics

How expensive is it to store many terabytes of enterprise email so they are available for survey, eDiscovery, investigations, internal control and purposes of institutional memory?  The raw cost of data storage is dropping, so is it not cheap to retain lots of email?

I explored this topic in an email exchange with Dennis Vlasich, Director of the IT Department at the municipality of Fontana, California.  Following is our conversation.  

I started by pointing Dennis to my earlier post suggesting "content addressable storage" for inexpensive retention of large volumes of e-mail.  

DENNIS replied: “It [the earlier post] is basically a standard storage vendor's sales pitch and we have a SAN that can accommodate terabytes of ‘cheap’ storage.  You have to factor in the rack space, power and HVAC requirements to keep the storage system running and I can assure you that because such technology [content addressable storage] is less expensive, its MTBF [mean time between failures] will be much shorter than other forms of storage, so what happens when it crashes?  The bottom line is cost versus benefit versus risk.”  [Update:  Greg Smith of Messaging Architects responds to Dennis' comment.]

To which BEN said: “As a lawyer, here's what I don't understand.  I use Yahoo as my business email provider.  I pay Yahoo a paltry $20 a year for this email service, and Yahoo provides me unlimited storage.  Unlimited.  And since I pay for my service, Yahoo does not attach ads to my email. I store on Yahoo all my business e-mail (including attachments) dating back to 2004.  (I also back it up in zip files I download onto a local hard drive.)  The economics suggest that storage costs -- including all the infrastructure and management -- are just not a big deal to Yahoo.  Why can't an in-house IT department at a mid-sized enterprise get anywhere close to the same economics that Yahoo (or AOL or Hotmail) gets?”

Then DENNIS said: “Yahoo probably restricts the size of your attachments to 1MB and your mail client (probably not Outlook) does not have the search and archiving capabilities of an Exchange/Outlook environment.  I don't know what your SLA [service level agreement] is with them, but I would guess they aren't guaranteeing that all your email will be available forever.

"The City of Los Angeles just switched from an in-house mail system (using Groupwise) to Google's gmail for 30,000 users.  Google charges $50 per year per user for up to 250 gigabyte of disk space, however they do not have any archiving capabilities yet.  

“Google, Yahoo, and other large providers are using data center technologies on a massive scale that brings the cost per MB down below what those of us in smaller shops can come even close to. The big problem they have is security.  Google had to guarantee LA to use dedicated servers and storage for all their email so it wouldn't co-mingle with their other customers, and for $7.5MM Google said OK.  Most of the rest of us cannot negotiate on that scale.

“The administration overhead for managed disk space is quite high because it requires routine backups with take time and resources which all cost money.”

BEN responded: “My attachments, both incoming and outgoing, are limited to 20MB, which is reasonably large.  The mail client I use is Yahoo's web mail page.  It provides quite a few search capabilities.  I have my 'archives' arranged as large chronological zip folders on my local hard drive. Still, Yahoo stores a full copy of all my emails back to 2004.”

DENNIS: “[Regarding the 1MB attachment limit] I guess I was thinking of the free version [of Yahoo mail].  It's been a while since I looked at those kinds of mail services. We're looking seriously at Google Apps with gmail (waiting to see how things work for LA).  The 250GB limit might be a problem for some of our users, but I figure by the time we're ready to move, there will be more space available or they will have an archiving feature.”

Update July 2010:  The General Services Administration has certified Google Apps as qualified for use by government agencies.  Typically, a US government implementation of Google Apps would keep data on servers in the continental US.

–-Benjamin Wright.    A senior instructor at the SANS Institute, Mr. Wright regularly serves as a public speaker at lunch and dinner meetings for local professional groups, such as IIA and ARMA.