eDiscovery and Data Retention CHECO Fall Conference - September 20, 2011 David Lee, Director of Enterprise Systems Esther Henry, Associate Counsel

Background at Mines Started formally issuing Preservation of Evidence Directives (PEDs) in 2008 27 different PEDs currently in effect 108 employees subject to PEDs (some on multiple) Less than 20% on PEDs are academic faculty Total of 193 individual directives in effect Average 48 individual directives per year 17% of named individuals are no longer Mines employees Only two cases have ever been resolved/PEDs released Dave - give disclaimer that this is what we do at Mines but it doesn't mean it's right for everyone - we are just using ourselves as an example.

Why Should I Care? During the discovery phase of litigation, a party to a lawsuit may request that another party provide any and all documents that pertain to the subject matter of the lawsuit. The responding party is required to furnish copies of any and all documents that are responsive to the request. Failure to do so can result in significant penalties. Esther - give disclaimer. The world has changed now that information is electronic and can be retrieved and recovered and retained, etc. It used to be that it either existed in paper or it didn't. Now it's much more complex and the obligations associated with document production are also more complex and onerous. Mines has elected to use our CCIT unit as a safety net to "back up" the efforts of individual employees subject to PEDs. We see this as not only a reasonable and appropriate business practice but also believe that we could be found to be required to do what we are doing (and possibly more!).

Major Concerns for IT Initial Collection Data stored on servers Email Preservation/Continued Collection Production Dave: In order chronologically and by amount of work required. Think about all the places people could potentially store information. We had to limit the scope of the initial collection – more on that later. Now think about adding 48 more PEDs every year and the growth in storage required to support this. Lastly, Producing the data requires a large amount of IT time to properly inventory, categorize, and manage the data. The potential for exhaustive keyword searches

Major Concerns for Legal We trust our users, BUT.... IT provides crucial safety net for data retention. Trust that IT is doing everything that needs to be done, and in an appropriate matter. Vast lack of understanding (by Legal Services) of actual IT data preservation steps and technologies. Volume and relevance of data preserved. This is an ever-changing world. How do we know we are doing enough to get to a "reasonable" standard?

Preservation of Evidence Process - Notification by Legal Services Colorado School of Mines Office of Legal Services CONFIDENTIAL MEMORANDUM TO: [Employees Names Here] CC: Anne Stark Walker, General Counsel FROM: Esther Henry, Associate Counsel DATE: September 20, 2011 RE: Preservation of Evidence – [Name of Matter] Appeal Esther - hand out sample PED and IT PED. Mention that CCIT receives a copy of this memo to employees AND a separate, specific memo. Go over how very vague and trusting the language is in the CCIT memo. After we send these out, unless there are questions, we blissfully stop thinking about it - at all!

Preservation of Evidence Process - Implementation by IT Find out what systems are affected Archive (zip/tarball) user’s home directory to central repository Export mailbox to a .pst file and send to central repository Fork incoming/outgoing email to a journal Dave: Capture an image of the hard drive(s)?

Preservation of Evidence Process - And Then What Happens? Nothing! Collection and preservation of data continues and amount of data grows. Resolution of matter and release of PED Running of statute of limitations and release of PED Production of data

Issue #1: Imaging of Local Drives He Said… SHe Said… Disk and Email quotas Academic users encouraged to archive locally Best practice to require users with mission critical data to store data on networked drives Therefore, there should not be data on local drives.

Issue #2: Personally-Owned Computers/Devices with Business Data He Said… SHe Said… There are a lot of possible places to store information! PC/laptop Smartphone/PDA/tablet Thumbdrives Etc. Propriety of exerting control over these devices? What privacy rights may exist? Dave: You could include Google Apps, Microsoft Skydrive, Dropbox, etc., but the focus here is on hardware purchased by the user.

Issue #3: Encrypted Drives/Vaults He Said… SHe Said… Archive useless without password/ application Current policy encourages use Underscores need for enterprise encryption system Will likely not become an issue (or even known) until preparing for production Dave: Special concern for that 17% who are no longer employees.

Issue #4: What if You Find Misuse and/or Illegal Materials (Files?) He Said… SHe Said… Obligation to preserve user files and environment Alienate users vs. enforce rules? May be under a legal obligation to report to local law enforcement May be a violation of school policy May indicate employee misuse or lack of performance

Issue #5: PEDs after the Person Subject to Them Leaves He Said… SHe Said… Who is responsible party? Who maintains and produces electronically stored information? Under what circumstances did he/she leave? Ongoing obligation to follow current records management policy.

He Said… SHe Said… Issue #6: Backup Tapes $35-50K to pull tapes Tapes contain everyone’s data, not just subjects of PEDs Zubalake v. UBS Warburg (2003) "...inaccessible backup tapes (e.g., those typically maintained solely for the purpose of disaster recovery)...." contrast with those "...actively used for information retrieval...." Esther: In the context of a gender discrimination and retaliation lawsuit, the plaintiff Laura Zubulake moved to obtain from defendants UBS Warburg LLC, UBS Warburg and UBS AG (UBS) "all documents concerning any communication by or between UBS employees concerning the Plaintiff." UBS responded by providing several document, including e-mail records totaling 100 pages, but did not search its backup tapes or other archives for responsive e-mails. The Plaintiff requested e-mails from UBS' optical disks, servers and backup tapes. According to the decision, UBS e-mails are automatically backed up on tapes and optical disks. Optical disks contained only the internal emails of registered traders. To restore a backup tape would take UBS approximately five days, although such restoration could be faster if using services available in the private sector for a higher price. Ninety-four backup tapes were identified as containing information relevant to Zubulake’s request. UBS objected to the Plaintiff's request, stating that the cost associated with complying would be too high, which they estimated to be about $175,000 excluding the cost of lawyers reviewing the e-mails. Alternatively, the Defendants asked that the Plaintiff shoulder the cost of such electronic discovery.

Issue #7: Same Person on Multiple PEDs He Said… SHe Said… Take snapshot on first PED Continue email journal for additional PEDs Pivot table… Why another snapshot of the same user's data must be taken with each PED

Issue #8: Difference in Roles He Said… SHe Said… IT role in PED work vs. forensic investigation work during certain matters Routine preservation and "safety net" role v. directive from Legal Services

Summary There is no single right answer and this area will continue to evolve, BUT… There is a legal obligation and all practices will likely be judged under reasonable and best practices standards. Schedule a review of your practices with your legal counsel now!

Contact Information David Lee dmlee@mines.edu (303) 384-2398 Esther Henry ehenry@mines.edu (303) 273-3423