Avoiding the Email Iceberg
Sean Regan
October 2008
• Data stored in a
structured format
(databases, data sets,
etc.).
• Database tables
• XML
• 10-40% of corporate
data
Unstructured Data
Structured Data
Data Definitions
• Masses of data which
do not have a data
structure or have a data
structure not easily
readable by machine.
• Email/IM/SharePoint
• File Shares
• Audio/ Video
• 60-90% of corporate
data
2
From land, icebergs are “pretty…”
3
From sea, icebergs are “pretty lethal.”
4
“Fun” Facts about Icebergs
• Icebergs are made of fresh water
• 90% of an Iceberg is below water
• 1600 icebergs drift southward past Newfoundland each year
• Average age of the “ice” in an iceberg is ~12,000 years old
• 680+ reported iceberg collisions since 1850 in North Atlantic
5
“Fun” Facts about
Unstructured Information
Soaring information volume
Legal Hold
• 52% Growth YOY
• 33% of e-discovery cases related to
holds/spoliation
Email Servers
File Servers
Databases
IM Servers
Time and cost of e-discovery
What is being asked for
• 77% of e-discovery requests are for
e-mail or attachments
SharePoint
• Cost of review 1400x cost of
storage
6
Documents, Records, and Legal Holds
• All Records are Documents
• Not all Documents are Records
Documents
Legal Hold
• Legal Hold applies to both
Documents and Records
Records
Desktop/
Workstation
Email
Server
File
Server
Laptop
Mobile
Device
Tape
Subsystem
CDs
Disc
Subsystem
E-Discovery
e-Discovery Timeline
8
E-Discovery
Extend Retention Policies to
Electronic Documents
Learn about all data that may
be involved in preservation,
e-Discovery
Find, Preserve, and Copy that data
to some specific repository
Lawyers!
(if needed)
Review all that data, with all
the capabilities you might
have at hand
9
E-Discovery
$$
Notifications, Manual
Holds, Tape Freeze
$$$
Image extractions, Deduplication, passwords, …
e-Discovery Timeline – Case 1
e-Discovery Timeline – Case 2
e-Discovery Timeline – Case 3
$$
Tape restores, endpoint
images, manual collection
e-Discovery Timeline – Case n…
$$$$
Document Coding &
Review ($350 / hour!!)
10
Maturity of Legal Hold Practices
Source: ITPolicyCompliance,com
11
Steps to Improve Results
Legal Practices to Improve Results
• Notify employees of legal holds within one hour
• Form cross-functional teams to respond within one day
• Employee & enduser training on legal hold
• Update retention program, policies & procedures for ESI
IT Practices to improve results
• Identify and gaps in procedural and technical controls
• Indexing of ESI with retention and expiry
• Converting of information to electronic format
• Measure results more frequently
Source: ITPolicyCompliance,com
12
Policies: Legal Hold Process
• Procedure for determining when a hold is triggered
• Ability to preserve both ESI and paper documents
• Joint responsibility between Legal, IT, and individual custodians
• Ability to track, monitor, and enforce compliance
The litigation hold instructions should include:
• Issuing party
• Date issued
• Scope of the instructions
• Subject matter at issue
• Types of records and any specific content covered
• Locations and media under hold
• Time frame relevant to the lawsuit