1. eDiscovery and Data Retention
CHECO Fall Conference - September 20, 2011
David Lee, Director of Enterprise Systems
Esther Henry, Associate Counsel

2. Background at Mines
Started formally issuing Preservation of Evidence Directives (PEDs) in 2008
27 different PEDs currently in effect
108 employees subject to PEDs (some on multiple)
Less than 20% on PEDs are academic faculty
Total of 193 individual directives in effect
Average 48 individual directives per year
17% of named individuals are no longer Mines employees
Only two cases have ever been resolved/PEDs released
Dave - give disclaimer that this is what we do at Mines but it doesn't mean it's right for everyone - we are just using ourselves as an example.

3. Why Should I Care?
During the discovery phase of litigation, a party to a lawsuit may request that another party provide any and all documents that pertain to the subject matter of the lawsuit.
The responding party is required to furnish copies of any and all documents that are responsive to the request.
Failure to do so can result in significant penalties.
Esther - give disclaimer. The world has changed now that information is electronic and can be retrieved and recovered and retained, etc. It used to be that it either existed in paper or it didn't. Now it's much more complex and the obligations associated with document production are also more complex and onerous. Mines has elected to use our CCIT unit as a safety net to "back up" the efforts of individual employees subject to PEDs. We see this as not only a reasonable and appropriate business practice but also believe that we could be found to be required to do what we are doing (and possibly more!).

4. Major Concerns for IT Initial Collection
Data stored on servers
Preservation/Continued Collection
Production
Dave: In order chronologically and by amount of work required. Think about all the places people could potentially store information. We had to limit the scope of the initial collection – more on that later. Now think about adding 48 more PEDs every year and the growth in storage required to support this. Lastly, Producing the data requires a large amount of IT time to properly inventory, categorize, and manage the data. The potential for exhaustive keyword searches

5. Major Concerns for Legal
We trust our users, BUT.... IT provides crucial safety net for data retention.
Trust that IT is doing everything that needs to be done, and in an appropriate matter.
Vast lack of understanding (by Legal Services) of actual IT data preservation steps and technologies.
Volume and relevance of data preserved.
This is an ever-changing world. How do we know we are doing enough to get to a "reasonable" standard?

6. Preservation of Evidence Process - Notification by Legal Services
Colorado School of Mines
Office of Legal Services
CONFIDENTIAL MEMORANDUM
TO: [Employees Names Here]
CC: Anne Stark Walker, General Counsel
FROM: Esther Henry, Associate Counsel
DATE: September 20, 2011
RE: Preservation of Evidence – [Name of Matter] Appeal
Esther - hand out sample PED and IT PED. Mention that CCIT receives a copy of this memo to employees AND a separate, specific memo. Go over how very vague and trusting the language is in the CCIT memo.
After we send these out, unless there are questions, we blissfully stop thinking about it - at all!

7. Preservation of Evidence Process - Implementation by IT
Find out what systems are affected
Archive (zip/tarball) user’s home directory to central repository
Export mailbox to a .pst file and send to central repository
Fork incoming/outgoing to a journal
Dave: Capture an image of the hard drive(s)?

8. Preservation of Evidence Process - And Then What Happens?
Nothing!
Collection and preservation of data continues and amount of data grows.
Resolution of matter and release of PED
Running of statute of limitations and release of PED
Production of data

9. Issue #1: Imaging of Local Drives
He Said…
SHe Said…
Disk and quotas
Academic users encouraged to archive locally
Best practice to require users with mission critical data to store data on networked drives
Therefore, there should not be data on local drives.

10. Issue #2: Personally-Owned Computers/Devices with Business Data
He Said…
SHe Said…
There are a lot of possible places to store information!
PC/laptop
Smartphone/PDA/tablet
Thumbdrives
Etc.
Propriety of exerting control over these devices?
What privacy rights may exist?
Dave: You could include Google Apps, Microsoft Skydrive, Dropbox, etc., but the focus here is on hardware purchased by the user.

11. Issue #3: Encrypted Drives/Vaults
He Said…
SHe Said…
Archive useless without password/ application
Current policy encourages use
Underscores need for enterprise encryption system
Will likely not become an issue (or even known) until preparing for production
Dave: Special concern for that 17% who are no longer employees.

12. Issue #4: What if You Find Misuse and/or Illegal Materials (Files?)
He Said…
SHe Said…
Obligation to preserve user files and environment
Alienate users vs. enforce rules?
May be under a legal obligation to report to local law enforcement
May be a violation of school policy
May indicate employee misuse or lack of performance

13. Issue #5: PEDs after the Person Subject to Them Leaves
He Said…
SHe Said…
Who is responsible party?
Who maintains and produces electronically stored information?
Under what circumstances did he/she leave?
Ongoing obligation to follow current records management policy.

14. He Said… SHe Said… Issue #6: Backup Tapes $35-50K to pull tapes
Tapes contain everyone’s data, not just subjects of PEDs
Zubalake v. UBS Warburg (2003)
"...inaccessible backup tapes (e.g., those typically maintained solely for the purpose of disaster recovery)...."
contrast with those "...actively used for information retrieval...."
Esther: In the context of a gender discrimination and retaliation lawsuit, the plaintiff Laura Zubulake moved to obtain from defendants UBS Warburg LLC, UBS Warburg and UBS AG (UBS) "all documents concerning any communication by or between UBS employees concerning the Plaintiff." UBS responded by providing several document, including records totaling 100 pages, but did not search its backup tapes or other archives for responsive s. The Plaintiff requested s from UBS' optical disks, servers and backup tapes. According to the decision, UBS s are automatically backed up on tapes and optical disks. Optical disks contained only the internal s of registered traders. To restore a backup tape would take UBS approximately five days, although such restoration could be faster if using services available in the private sector for a higher price. Ninety-four backup tapes were identified as containing information relevant to Zubulake’s request.
UBS objected to the Plaintiff's request, stating that the cost associated with complying would be too high, which they estimated to be about $175,000 excluding the cost of lawyers reviewing the s. Alternatively, the Defendants asked that the Plaintiff shoulder the cost of such electronic discovery.

15. Issue #7: Same Person on Multiple PEDs
He Said…
SHe Said…
Take snapshot on first PED
Continue journal for additional PEDs
Pivot table…
Why another snapshot of the same user's data must be taken with each PED

16. Issue #8: Difference in Roles
He Said…
SHe Said…
IT role in PED work vs. forensic investigation work during certain matters
Routine preservation and "safety net" role v. directive from Legal Services

17. Summary
There is no single right answer and this area will continue to evolve, BUT…
There is a legal obligation and all practices will likely be judged under reasonable and best practices standards.
Schedule a review of your practices with your legal counsel now!

18. Contact Information
David Lee
(303)
Esther Henry
(303)