Ride The Lightning

Same Bat Time, Same Bat Channel: Rob Robinson Moves to Applied Discovery

It is with great pleasure that I note that my friend Rob Robinson is taking his formidable social networking and Web 2.0 marketing talents to Applied Discovery. If you want to keep abreast of the dizzying EDD world, Rob is one of the very best sources of up-to-date information.

The "bat uniform" may change, but I'm delighted to learn from today's post that the data hose I depend on so often will continue to gush information.

Congratulations Rob and all the best in your new job!

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

KPMG and Harris Survey: Half of In-house Lawyers Doubt E-Discovery Readiness

Computer Weekly reported yesterday on the disheartening results of a KPMG Forensics and Harris Interactive Survey of 200 global companies in which half of the in-house counsel respondents expressed doubt about their legal department's ability to find data. Nearly 40% thought it would be challenging to retrieve data even for a major lawsuit or a regulatory action.

21% of the legal departments were not consulted by their IT departments about changes in data storage and, worse, 25% said were "rarely or never" consulted about the implementation of new technologies intended for electronic discovery. 19% were doubtful that their IT department could effectively help them meet e-discovery challenges and 10% didn't see the situation changing much in the future.

A notable quote from Paul Tombleson, head of forensic technology at KPMG Forensic in the UK: "Storing and searching large volumes of data, often across borders and across different legacy IT systems, continues to be a major challenge for many companies. While this might seem like an IT issue, when an investigation arises, it can become an urgent reputational and forensic one."

The survey's gloomy result is consistent with what we see all the time, and Tombleson's quote is reflective of the complexity of large volumes of ESI which have overwhelmed the capacity of many businesses to deal effectively with their data. By in large, we are still racing to catch up with the electronic world - and we are many laps behind the exponential growth of our data.

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Keep Track of Ever-Changing State E-Discovery Laws and Rules

Keeping up with changes in state e-discovery laws and rules is a royal pain. One of the best resources available is provided for free by Applied Discovery. A brief description of each state’s status is included along with direct links to the statutes and rules.

This is definitely a resource you’ll want to bookmark and revisit whenever you need to verify current state laws regarding e-discovery.

Bookmark this one before you forget!

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Computer forensics and virtualization

In response to a query I posted last week about computer forensics and virtualization, Clay Calvert of Metrostar Systems was kind enough to write. The procedure he outlines below is essentially what we do at Sensei:

“I’ve had to test files to see if they are malicious, or not.  Unfortunately, launching an executable can damage a PC beyond simple repair.

To do malware analysis I will copy the .exe file to a VM, take a snapshot of the VM, and then virtually unplug the VM from the network.  The malware is contained and any damage caused can be un-done by reverting to the snapshot.  It is also possible to run an external debugger with VMware workstation.  Why would you want to run an external debugger?  Well, that is because some malware looks to see if it is being directly debugged and then the program will behave differently if it determines such tools are being used against it.

To forensically capture a VM, suspend it and then copy the entire folder to other media.  This automatically captures the contents of RAM as well.  The contents of the memory will be in a file slightly larger than allocated RAM and in VMware the file often ends with .VMEM.

Multiple forensic tools can be launched in separate VMs.  One can be running a Helix CD and a Backtrack .ISO at the same time, while still having the capabilities of the host OS.”

Thanks Clay, for this guest post.

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Cloud Computing Security

In response to last week's post about cloud computing, I received the following guest post from Heather Axworthy, who is a self-described "Network Security Diva" (alas, I fear my diva days are over) and who has an aptly-titled blog called "Chick Bits."  Here's what Heather had to say:

On the heels of the recent announcement of a cloud computing initiative by the new federal CIO, I thought it would be time to talk about the security components needed to protect all the data within the cloud.

If you are not sure what "Cloud Computing" is, in short, it is a new paradigm in which all your resources are delivered as a service over the internet. A perfect example of this is Google Docs! You create, store, use, and share your documents but they are are "housed" at Google and not on your local machine. Your data exists in the big cloud we call the Internet.

The big issue is how to keep the data in the cloud secure. Here is my two cents and what they should be thinking about, out of the gate:

1. Monitoring Activity: You have to look at not just user <--> user activity, but user <--> system activity, and system <--> system activity within the cloud. This can consist of using application and database monitoring products, system logs, and file integrity monitoring products. You have to monitor the data while in motion and at rest!

2. Encryption: Can't have security without it. Look at the data flow within the cloud, encrypt at the weak points, such as downloads, e-mail, and transport between applications and databases.

That is going to be a big challenge, it has the potential to be a security nightmare, but I think if the architects incorporate the items below from the start, it will be less of a nightmare!

Thanks Heather for weighing in. John and I continue to be cloud curmudgeons - it seems that nary a week goes by without a leak in the cloud. And we don't mean rain. As for the federal government's ability to establish a secure cloud . . . Hell will freeze over first.

E-mail: snelson@senseient.com   Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

The Future of Search in EDD Rocked the House

When I first saw that Jason Baron, a man of boundless energy and rapid-fire humor, was putting together a full day on the future of search in e-discovery, I wondered if he could pull it off. A whole day? I should never have doubted Jason, who in his real life is the Director of Litigation in the Office of the General Counsel of the National Archives and Records Administration.

Pulling in such heavy hitters as Judges Paul Grimm and Andrew Peck, Craig Ball, Ralph Losey and Patrick Oot was a feat in itself. The facilities at Capital One were first-class as was the food and hospitality. We got CLE credit and the whole thing was free. Hard to beat any of that, but the education component set a very high bar for future conferences. It was with the greatest reluctance that John and I dragged ourselves away in the afternoon to teach a CLE on courtroom technology in one of the high tech courtrooms of Fairfax Circuit Court.

We were thoroughly captivated by the opening multimedia presentation, a "Did You Know?" movie that is still in draft form (though it looked doggone good), which will premiere in its final form at LegalTech in New York this coming February. Concocted by Ralph and Jason, it had lots of thought-provoking data:

Cost to store 1G in 1956: $2 million

Cost to store 1G in 2009: Less than $1.00

Average lawyer now receives approximately 100 e-mails per day

% of relevant data found by keyword searching: 20%

% of relevant data lawyers thought they had found: 75%

How much data will exist in 2011? 2 zettabytes (a zettabyte equals one billion terrabytes)

Accompanied by the music of Durude's Sandstorm, nuggets like these (and I couldn't write fast enough to capture a quarter of them) intermingled with imagery, dazzling both the mind and the eye.

More on this conference tomorrow - I just can't bring myself to make my posts as long as Ralph's (grinning).

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Cloud Computing, Virtualization and Computer Forensics

The world of computer forensics has never been a stable one. Few worlds morph as fast as ours.

There has been much discussion recently about the impact of cloud computing and virtualization on computer forensics. I have, dare I say it, found the conclusions "cloudy." In truth, I'm not sure we have yet grasped what all of the implications will be.

I have asked John for his thoughts on this and he has promised to provide them when I cease to nag him about other deadlines. As I'm not sure that day will EVER come, I would cheerfully ask readers to consider offering up a guest post on this subject.

Futurists, please take to your keyboards!

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Seventh Circuit's Electronic Discovery Pilot Program

While watching the Sedona Conference webinar on the Cooperation Proclamation today, it struck me that I had never talked in Ride the Lightning about the Seventh Circuit's Electronic Discovery Pilot Program. This program, whose first phase is October 1, 2009-May 1, 2010 was developed in response to the obvious need for reform of the civil pretrial discovery process.

If it was bad before, and it was, it is much worse now with the advent of e-discovery.

The august group which developed the program composed a set of Principles Relating to the Discovery of Electronically Stored Information. These principals are enumerated in the link given above. The principles are really an extension of the Cooperation Proclamation and involve early case assessment, proportionality in formulating an e-discovery plan, the participation of e-discovery liaisons, specificity of preservation requests and orders, the proportionate scope of preservation, identification of electronically stored information, production format and education.

Also included is a model Standing Order Relating to the Discovery of Electronically Stored Information.

All in all, some very nice work. Of course, they are trying to defy the natural order of litigation today- the "take no prisoners" approach that seems so deeply rooted in our (less than civil) civil justice system. But it is a call to action backed up by the court's inherent authority to punish those who disobey the order. I applaud it and hope it will bear some fruit.

Some of the judges in the circuit bravely volunteered to walk this gangplank and will apply the principles to selected cases, which will then be evaluated using objective and subjective measuring tools. The resulting data will be presented at the Annual Meeting of the Seventh Circuit Bar Association and Judicial Conference of the Seventh Circuit, to be held in Chicago on May 2-4, 2010. After that, the Pilot Program will move on to Phase Two (yet to be precisely defined), which will be conducted from June 2010-May 2011.

So can lawyers, famous for eating their young, be retrained to be cooperative? I'm not betting the mortgage money.

E-mail: snelson@senseient.com   Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Sedona Conference Webinar on the First Year of the Cooperation Proclamation

Anyone interested in e-discovery may want to attend the next Sedona Conference “Voices From the Desert” webinar focusing on the first year of the existence of the Cooperation Proclamation. The seminar will be held on Wednesday, November 4th at 1 p.m. Eastern and you may register here: http://www.thesedonaconference.org/wgsa_html

The Cooperation Proclamation was intended to stop escalating e-discovery costs which have threatened to undermine the civil justice system. Since its issuance, nearly 100 state and federal judges have signed on as endorsers of the Proclamation. It has also been cited in at least a dozen reported court decisions, and it has received widespread press coverage. 

To celebrate the Proclamation's first anniversary, The Sedona Conference Journal® is publishing a special Supplement to Volume 10, devoted to the theme of "cooperation," with a preface by Associate Supreme Court Justice Stephen Breyer. 

Happily, there is no additional charge for more than one person to participate from a single phone line, so bring a friend. Or attend in your conference room and use the speaker phone so that a group may participate. The registration fee is $99 for the general public and $79 for members of Sedona’s Working Group Series.
 
Once registered, you will be able to listen to the discussion by telephone, view PowerPoint slides, download the Supplement in PDF format, and ask questions during a question-and-comment period.

We'll certainly be among the attendees!

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Pizza party supporting the eDiscovery Institute on November 12

A guest post submitted by Joe Howie on behalf of the eDiscovery Institute:

"I’ve enjoyed reading your blog and thought you might want to blog about the upcoming 5th Annual Pizza After Party in support of the eDiscovery Institute to be held in two weeks – Nov. 12, following that day’s activities at the Georgetown University Law Center Advanced eDiscovery Institute CLE.

The Institute is a 501(c)(3) organization doing some important work in researching solutions to problems with ediscovery processing and costs, and the Pizza After Dinner in a fund-raiser in support of their mission. Lawyers who seriously want to find and/or validate e-discovery processing and review alternatives should be supporting the Institute. If they’re looking for a way to do more than continue debating the concept of improved ways of handling e-discovery and actually fund an organization that is doing research and providing metrics on benefits of different techniques, this is their opportunity.

It’s a great opportunity to interact and mingle with some of the leading e-discovery jurists, lawyers and providers. Last year’s party drew 150 participants, and it looks like this years party will have an even larger crowd.

This year’s sponsors include: Alix Partners, Aphelion Legal, BIA, Crowell Mooring, Encore Discovery, Epiq Systems, Guidance Software, Integreon Discovery Solutions, Jurinnov, Kroll OnTrack, Mayer Brown, Peak Discovery, Precision Discovery, Recommind, RenewData/Digital Mandate, Shook Hardy & Bacon, TCDI, UHY Advisors, and Winston & Strawn.

For ticket information, contact one of the above sponsors or email info@ediscoveryinstitute.org"

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq