More and more companies are faced with the challenges of dealingwith e-discovery in the cloud, which, in a general sense, iselectronically stored information that exists outside of acompany's firewall. In a sense, a company that has a networkprovided by a third party is in the cloud.

In the early days of e-discovery these arrangements caused somepain because the contractual terms often did not contemplatefrequent need for small and large discovery projects. Companiesfound themselves negotiating for pricing to access their own datain ways that had not been contemplated, with an incumbent vendorthat had not planned for the people, process or technology neededto accomplish what the company needed. Many of the newer forms ofcloud computing also were not created with e-discovery in mind andthey generate the same kinds of problems for companies.

These days, companies may be struggling with any number ofcloud-based services—from third-party email services to socialmedia such as Facebook, Twitter, or LinkedIn. Such cloud data isdynamic and rapidly changing and, therefore, presents preservationand collection problems similar to internal email and instantmessaging. However, unlike internal systems, there is the addedcomplexity that the company does not control how the outsidesystems operate, and neither the users nor the cloud serviceproviders have seriously contemplated the needs of e-discovery.They lack the needed ability to access, preserve and collect dataneeded for litigation.

Take web-based email applications such as Yahoo!, Gmail andHotmail: They typically provide a good user interface for normalpersonal or business needs, but cloud services so far have seenlittle benefit or need to provide users with a robust ability toidentify and collect email relevant to a particular issue. This isa problem when business has been mixed with personal emailaccounts.

Gmail now offers Gmail Backup as a free program. Once installedand configured, the program will back up all messages in an EMLformat that is saved to a specified location. After backing this upon a local storage device, the email can be searched, collected andhandled in a company's standard way.

For other cloud email services that do not have such a solutionthe company, the company's counsel or vendor can create a POP3account and have the company's email administrator create astandalone account that links to the external email account,allowing extraction of the email into the company email platform.(The company should create a standalone email account just for thisprocess so that the personal email is not inadvertentlycomingled.)

The problem with both processes is that they result inextraction or backup of all of the messages in the cloud account.This is because, apart from some ability to limit date ranges,there is very limited functionality to narrow the scope of theextraction or backup. So getting at the affected employeesbusiness-related email requires a filter after collection isperformed.

One way to manage this problem is for the employee to folder thebusiness email into a specific folder before the extraction orbackup is performed. Then the company takes the business folder andimmediately destroys the remainder.

Obviously, this solution is not ideal for anyone. The employeemust expose personal information and trust that the employer, itscounsel and vendors respect the agreed upon parameters. For itspart, the company must trust that the employee has identified andfoldered the needed email despite the risks associated withself-collection. Finally, the emails become live once in Outlook,meaning that messages can be forwarded and sent out, just like anyother email.

Social media sites, on the other hand, pose a different set ofchallenges. The interactive nature of the medium itself is hard todeal with, but balancing it against conflicting scope, privacy andregulatory issues adds to the challenge. Some organizations take a proactive approach, adopting social mediapolicies and implementing technology to prevent or minimizebusiness-related social media use, and manage privacy expectationsif it does occur. For employees whose job it is to use social mediafor business (e.g., marketing) there are enterprise softwaresolutions for monitoring and capturing such data.

When the need does arise to collect social networking data of anemployee whose activities are not routinely monitored and captured,there are methods provided by some social networking sites. Forexample, Facebook now provides a method for users to archive theirdata locally for review and production. There are also consultantswho can collect Internet information. Note that some methodscapture only static pages and do not simulate the interactivenature of the native environment. Some consultants employ toolsthat watch someone “click around” while on a computer and, thus,allow more native-like play back. Of course, because of the mixtureof personal and business data, there will need to be a mutuallyacceptable process for separating the two.

The cloud presents special challenges for e-discovery. It isbest to avoid the admixture of business and pleasure in the cloud.When that fails, however, there are solutions to the specialchallenges that result.