The cloud
can drastically reduce the costs of storing information and implementing
applications and is, therefore, a hot topic. However, it is also a
controversial one. The cloud, as a term, is used as if there is a common
understanding of what it means. The National Institute of Standards and
Technology (NIST) defines cloud computing as "a model for enabling ubiquitous,
convenient, on-demand network access to a shared pool of configurable computing
resources (e.g., networks, servers, storage, applications and services) that
can be rapidly provisioned and released with minimal management effort or
service provider interaction." These characteristics add
up to huge potential benefits for customers. Resource pooling across multiple
clients brings economies of scale that lead to lower costs. Elasticity lets
customers scale up without having to add internal IT resources.
Just because the cloud is a hot topic and seems to be
gaining traction, however, does not necessarily mean that it has achieved
mainstream usage in corporations. eDJ Group, a market research and consulting firm focused on information
governance and e-discovery requirements, has found that while the cloud is gaining mindshare, official
usage is evolving slowly. This gives companies the opportunity to get ahead of
the curve on how to conduct eDiscovery on these new sources and types of
information.
eDJ's "The Cloud And
eDiscovery" survey, conducted throughout November and December
of 2011, found that only 26.2% of respondents have adopted cloud-based storage
of enterprise information, while another 18% did not know. Over half of the respondents have not yet adopted cloud-based,
proactive information storage.
This does not mean that cloud-based storage for
information will not become dominant; it simply means that, pragmatically,
companies have to prioritize e-discovery efforts around the information sources
currently in use. If moving to the cloud over time, e-discovery should be part
of the strategic plan. In the meantime, initiatives must be focused on where
the information lives right now.
In addition, while the use of software as a service
(SaaS) for applications like customer
relationship management
(CRM) (e.g., Salesforce.com) and bookkeeping (e.g., Quicken) feels pervasive, half of the respondents indicate that
they are not using SaaS tools for these kinds of applications. Just over 25% of
respondents indicated that they are using SaaS applications for enterprise
processes. As such, these sources of information must be part of the e-discovery
plan.
It is clear that usage of the cloud will grow. In
fact, even President Obama has called for the US Government to begin
investigating a move to managing digital records in the cloud. President Obama's order calls on
government agencies to "improve the management of existing and ongoing records
— including emails and social media communications. Their plans should include
the use of cloud-based services or storage systems for digital recordkeeping." When government agencies begin
adopting technologies and practices, it is common for corporate America to
follow along or at least get over some of the concerns about those solutions; in the case of the cloud
and social media, the primary concerns are security, privacy and control of the
information.
In addition to the cloud usage simply becoming more commonplace,
there is another reason to address these data sources in e-discovery — case law
is emerging that says companies have to. There may not be an overwhelming amount
of case law pertaining to the cloud, but one important case to note is "IN RE NTL, INC. SECURITIES
LITIGATION; GORDON PARTNERS, et al., Plaintiffs, -against- GEORGE S. BLUMENTHAL,
et al., Defendants." The main idea in this case is that if a company has "access to documents to conduct business, it has possession, custody or control
of documents for the purposes of discovery." One
of the keys to the cloud is ubiquitous access to information, essentially putting companies on the hook to be
responsible about e-discovery of that information.
A decade ago, the e-discovery focus was
around a challenging data source known as email. Companies adopted email so
quickly that e-discovery was never correctly planned for; discovery
capabilities were built in after the fact. Many painful lessons were learned,
and yet, the possibility of repeating those mistakes is very real when it comes
to information in the cloud and social media. For the eDJ survey respondents,
e-discovery is very much an afterthought as companies evolve into using these
data sources more and more. Less than
16% of respondents put an e-discovery plan into place before moving data to
the cloud.
The maturity level is rising, though. At present, 22.8% of respondents
have put an e-discovery plan in place, while another 19.8% are working on a
plan currently. One must hope that
companies have learned from the past and can avoid the same mistakes.
Getting information stored in the cloud under control
for e-discovery is imperative. Best practices are just beginning to emerge and
the good news is that companies have the opportunity to get ahead of the curve
in ways they were not able to do with data like email. The key is to treat cloud-based sources of data like any
other data source — include it in data maps, have a plan for collecting and
preserving it, know how to manage the chain of custody and understand when to
dispose of the data so that it poses no e-discovery risk.
For any company beginning to plan for e-discovery of
cloud-based information, it is important to work closely with vendors of
cloud-based services. In order to reduce risk, organizations storing data in the
cloud should work out the e-discovery details before rolling out the solution.
eDJ's survey respondents do not tend to know what their cloud vendor's policy
for responding to clients' e-discovery needs is — more than 71% do not
currently know.
In addition, while planning for e-discovery and the cloud,
companies must remember to account for on-premise information as well. While
the long-term trend is that cloud computing will gain more and more traction, in
the short-term, e-discovery professionals need tools for collection and
preservation of content where it lives now — and the location of data now is
very much on-premise. According to eDJ's
survey results, the dominant places that users store data today is on their
local machines or network file shares.
The saying goes that those
that don't learn from history repeat it. Companies that don't want the e-discovery
nightmares of the last decade, with time wasted and dollars spent corralling
information from distributed and hard-to-access information sources, should
ensure the same fate does not wait in the cloud. Turning a blind eye to the
issue — as many companies are doing now — does not make it go away. Legal teams
continue to get smarter regarding conducting discovery; it is a good bet that
lawyers will target cloud-based sources of information in the hopes of catching
the opponent off guard and unprepared.
BARRY MURPHY is a co-founder of eDJ Group, Inc., which offers unbiased information and pragmatic advice based on years of experience and proven industry best practices for e-discovery professionals, and a thought leader in information governance,
e-discovery, records management and content archiving. Previously, Mr. Murphy was director of Product Marketing at Mimosa Systems, a leading content
archiving and e-discovery software. He joined Mimosa after a highly
successful stint as principal analyst for e-discovery, records management and content
archiving at Forrester Research. For more, visit www.edjgroupinc.com.
