More and more companies are faced with the challenges of dealing with e-discovery in the cloud, which, in a general sense, is electronically stored information that exists outside of a company's firewall. In a sense, a company that has a network provided by a third party is in the cloud.

In the early days of e-discovery these arrangements caused some pain because the contractual terms often did not contemplate frequent need for small and large discovery projects. Companies found themselves negotiating for pricing to access their own data in ways that had not been contemplated, with an incumbent vendor that had not planned for the people, process or technology needed to accomplish what the company needed. Many of the newer forms of cloud computing also were not created with e-discovery in mind and they generate the same kinds of problems for companies.

These days, companies may be struggling with any number of cloud-based services—from third-party email services to social media such as Facebook, Twitter, or LinkedIn. Such cloud data is dynamic and rapidly changing and, therefore, presents preservation and collection problems similar to internal email and instant messaging. However, unlike internal systems, there is the added complexity that the company does not control how the outside systems operate, and neither the users nor the cloud service providers have seriously contemplated the needs of e-discovery. They lack the needed ability to access, preserve and collect data needed for litigation.

Take web-based email applications such as Yahoo!, Gmail and Hotmail: They typically provide a good user interface for normal personal or business needs, but cloud services so far have seen little benefit or need to provide users with a robust ability to identify and collect email relevant to a particular issue. This is a problem when business has been mixed with personal email accounts.

Gmail now offers Gmail Backup as a free program. Once installed and configured, the program will back up all messages in an EML format that is saved to a specified location. After backing this up on a local storage device, the email can be searched, collected and handled in a company's standard way.

For other cloud email services that do not have such a solution the company, the company's counsel or vendor can create a POP3 account and have the company's email administrator create a standalone account that links to the external email account, allowing extraction of the email into the company email platform. (The company should create a standalone email account just for this process so that the personal email is not inadvertently comingled.)

The problem with both processes is that they result in extraction or backup of all of the messages in the cloud account. This is because, apart from some ability to limit date ranges, there is very limited functionality to narrow the scope of the extraction or backup. So getting at the affected employees business-related email requires a filter after collection is performed.

One way to manage this problem is for the employee to folder the business email into a specific folder before the extraction or backup is performed. Then the company takes the business folder and immediately destroys the remainder.

Obviously, this solution is not ideal for anyone. The employee must expose personal information and trust that the employer, its counsel and vendors respect the agreed upon parameters. For its part, the company must trust that the employee has identified and foldered the needed email despite the risks associated with self-collection. Finally, the emails become live once in Outlook, meaning that messages can be forwarded and sent out, just like any other email.

Social media sites, on the other hand, pose a different set of challenges. The interactive nature of the medium itself is hard to deal with, but balancing it against conflicting scope, privacy and regulatory issues adds to the challenge. Some organizations take a proactive approach, adopting social media policies and implementing technology to prevent or minimize business-related social media use, and manage privacy expectations if it does occur. For employees whose job it is to use social media for business (e.g., marketing) there are enterprise software solutions for monitoring and capturing such data.

When the need does arise to collect social networking data of an employee whose activities are not routinely monitored and captured, there are methods provided by some social networking sites. For example, Facebook now provides a method for users to archive their data locally for review and production. There are also consultants who can collect Internet information. Note that some methods capture only static pages and do not simulate the interactive nature of the native environment. Some consultants employ tools that watch someone “click around” while on a computer and, thus, allow more native-like play back. Of course, because of the mixture of personal and business data, there will need to be a mutually acceptable process for separating the two.

The cloud presents special challenges for e-discovery. It is best to avoid the admixture of business and pleasure in the cloud. When that fails, however, there are solutions to the special challenges that result.

Special Reports /

e-Discovery In The Cloud

Related Stories

Recommended For You