eDiscovery: the issues facing law firms and solicitors
by Alan Batey
Information Security Consultant and Forensic Investigator
In today’s world, evidence in legal cases is sourced from the vast quantities of Electronically Stored Information (ESI) that exists across a range of platforms and devices. Acting on behalf of clients, large law firms may have access to eDiscovery platforms to sift, sort, redact and reduce the amount of data that is made available, keeping only those files with relevance to the case in a legally recognised format which preserves the integrity of the data and stands the ultimate test of court acceptance. Smaller firms may not have operated an eDiscovery platform, considering it too expensive or shying away from the complex technology. This is not altogether surprising.
ESI comes from a number of sources; from emails, texts, voicemails messages, word-processed documents and databases, including documents stored on portable devices such as memory sticks and mobile phones. In totality it includes an unfeasibly large and complex volume of files. SRM was recently involved in an eDiscovery case where the original ESI involved 1.2TB of data which, in this particular instance, was reduced to 160GB. Although hundreds of gigabytes is more usual, this is still more data than can effectively be processed in a legally acceptable manner without the use of sophisticated management and tools.
Yet many who engage with eDiscovery Platforms find the process is unsatisfactory. They may require assistance with the forensic discovery of electronic documents or need more support in managing the information security risks surrounding the placing of confidential information on a Cloud or server based platform. They may feel their technology partner is unsupportive or that the cost of the exercise lacks transparency. Ultimately, some are worried about the security issues of releasing sensitive information to a third party.
eDiscovery projects require extremely high levels of skill, technical expertise and diligence. At SRM we work in conjunction with the legal team to advise and execute the eDiscovery requirement for their client. We define each stage and advise on the ongoing process and progress giving a full breakdown of costs for each stage. Our service is at the cutting edge of eDiscovery technology, saving the clients time and money while achieving best results. We also work effectively and strategically to ensure that disruption to the client’s business is minimal.
When such large volumes of data are made available to a third party, trust is crucial. Our eDiscovery team includes individuals who have worked with the police, MOD and FTSE100 companies. We are the leading PCI Forensic Investigation company in the UK and cyber security supplier to HM Government.
SRM provides a range of highly professional cost-effective solutions, suitable for all sizes of law firms. From the provision of a low cost ‘E-Discovery Lite’ package to the involvement of Expert Witness Forensic Consultants or the use of a Virtual Chief Information Security Officer VCISOtm.
Can Decision Cycles help us maintain the initiative in cyberspace?
As our world gets increasingly complex we must choose the levers we use to influence it with care. One way to look at this is through the lens of decision cycles.
For those not familiar with this concept, decision cycles are the cyclic process through which we perceive a stimulus, understand its implications, decide on a response and implement that decision. (There are a number of models and references). Simplistically, if we can make effective decisions quicker than our opponents, then we will, theoretically, hold the initiative.
The decision cycle lens is a useful one for those responsible for making decisions about cyber related issues as it throws any dangerous policies into harsh relief.
Most businesses work in a world where their policies, and here I’m talking about management intent rather than paperwork, refresh on a 12 month cycle based on standards which tend to refresh on a 5 year cycle. I note many will be smiling ruefully at this optimistic view!
In today’s information environment many of our risks are changing on a much smaller (faster) cycle, measured in days and weeks rather than months. Our operational tempo is defined not just by the speed of change, but by the way that the speed of change is accelerating.
This presents us with an exciting challenge; if we rely on static policy and processes – and many organisations still do – then we must expect our adversaries to outmanoeuvre us, and our risks to out evolve.
Where does this take us? Decision Cycle theory gives us a number of areas where we can hard wire agility into our business systems.
* Firstly, we can ensure that our warning, reporting, alarm and monitoring systems (Technical and Procedural) are tuned to report those events that most concern us.
* Secondly, we can ensure that we fully understand our own vulnerabilities and sensitivities, and the impact that adverse events will have on our operations. We can test and exercise those scenarios that most concern us. We can challenge our own assumptions. This will enable us to understand impacts and qualify outcomes more quickly.
* Thirdly, we do need to understand our own options, their limitations, and review these on a regular basis. This will enable us to make decisions more quickly.
* Finally, we need to ensure that our implementation of these decisions are well planned and where possible, practiced. We must also review effectiveness at every level and make changes that are required at any part of the cycle.
All of this would seem to be common sense… though is often not done in practice. There are many reasons for this, ranging from technical inertia to process stagnation. The important thing is that we acknowledge and track our challenges – then we can mitigate the changing risks.
If we are able to design agility into our business systems and processes, and if we tune our organisations so that we can take a proactive posture, then we can keep the initiative. The simple decision cycle model then gives us an easy way to challenge our posture on a regular basis to establish where and when change is required.
This is not rocket science, but many of us do seem to find it surprisingly hard. This simple model is one way of stepping forward and bringing effect to bear in our defence.
eDiscovery and eDisclosure: why, what, how and who?
For many years the terms eDiscovery and eDisclosure have been used interchangeably. The general rule was that eDiscovery was a US term while eDisclosure was more commonly used in the UK. Recently, however, the terms have taken on more precise meanings. Both eDiscovery and eDisclosure relate to the processing and production of Electronically Stored Information (ESI) data, usually for legal proceedings.
Nowadays evidence is not limited to written correspondence. It can take the form of emails, texts, voicemail messages, word-processed documents and databases and documents stored on portable devices such as memory sticks and mobile phones.
Added together these can amount to hundreds of thousands of documents relating to multiple sources; not all of which has any relevance to the legal matter in hand. So they need to be sorted in a legally recognised way, in their original state and in a way that maintains the integrity of the data.
eDisclosure describes the ‘what’ element of the process. In short, it describes the provision of ESI in a format that can be shared by lawyers for production in court. It is a specific term used in the Civil Procedure Rules of England and Wales but is also widely used by those involved in the processing of ESI for legal purposes. The reduction of the volume of data needs to be processed so that all potentially relevant files are available in one place to the opposing counsels and the court.
eDiscovery describes the ‘how’ element of the process. Not all eDiscovery cases lead to legal proceedings. eDiscovery is the process of utilising tools to discover relevant data required to secure interrogation, efficient expert analysis and surety of deliverables which face the ultimate test of court acceptance. It involves the sifting of data for relevance, the redaction of files and the reduction of the sheer volume of data. In a recent eDiscovery project conducted by SRM’s specialist team 1.2TB of data was reduced to 160GB.
eDiscovery and eDisclosure projects require extremely high levels of skill, technical expertise and diligence. At SRM we work on behalf of the client but in conjunction with the legal team to advise and execute the eDiscovery requirement. We define each stage and advise on the ongoing process and progress giving a full breakdown of costs for each stage. Our service is at the cutting edge of legal technology, saving our clients time and money while achieving best results. We also work effectively and strategically to ensure that disruption to the client’s business is minimal.
When such large volumes of data are made available to a third party, trust is crucial. Our eDiscovery and eDiscovery team includes individuals who have worked with the police, MOD and FTSE100 companies. We are the leading PCI Forensic Investigation company in the UK and cyber security supplier to HM Government.
Client files on home computers must be encrypted
Barrister fined by ICO for data protection breach
A recent ruling by the Information Commissioner’s Office highlights the responsibility of professionals to safeguard client data held on their home computers. Because while work systems are usually well-protected, oversights on non-work systems can put clients’ data at risk. The ICO has just released details of a penalty imposed on a barrister who had created work documents on her home computer but had not encrypted these files.
The case for the prosecution: a lady barrister held sensitive client information on a desktop which was also used by her husband. Although the computer was password protected the files were unencrypted. This ignored the guidance issued in January 2013 by the Bar Council and her Chambers that a computer used by family members or others may in addition require encryption.
The barrister’s husband updated software on the shared desktop and to back up the files temporarily uploaded them to an online directory to back them up. He assumed the documents were safe.
However, the documents were visible to an internet search engine and 15 documents were cached and indexed. Six of the 15 documents contained ‘confidential and highly sensitive’ information relating to clients involved in proceedings. Although the husband immediately removed the files from the online directory and the internet service provider removed the cache the next day, the ICO found that the barrister contravened the provisions of the Data Protection Act.
The contravention was considered to have run from the date of the January 2013 Bar Council guidance to 5 January 2016 when remedial action was taken. The files contained confidential and highly sensitive information relating to between 200 and 250 individuals.
Due to the number of individuals affected and the sensitive nature of the information, the ICO consider the contravention sufficient to cause ‘distress’ to the clients and that there were justifiable concerns that the information would be further disseminated, ‘even though those concerns did not actually materialise’.
The Commissioner considered that, in her defence, she did not intend to contravene the DPA, and her actions were a ‘serious oversight’ rather than deliberate intent to ignore or bypass the DPA, she should have realised that there was a risk. Taking all this into account the Commissioner decided on a penalty of £1,000.
When the new Data Protection Bill and the EU General Data Protection Regulation (GDPR) come into effect in May 2018 the ICO will have the right to impose significantly larger fines. The scale will be much higher than under current legislation. At the moment the theoretical maximum the ICO can impose is £500,000 but under GDPR it will be 20 million Euros. This equates to a 79 times increase. Theoretically, therefore, the barrister could have been fined up to £79,000 if the contravention had occurred next year.
So while organisations are working toward the new compliance, it is important that individuals also realise that the same principles apply to home computers. Security protocols should be clearly outlined in every corporate strategy and be made known to all individuals working remotely.
SRM has operated in the information security environment since 2002 and our consultants are skilled at performing security assessments and managing strategic compliance projects. Our GDPR team is GCHQ trained and works with clients to achieve all types of ongoing compliance.
It’s not a question of if, but when
Why board level commitment is a vital part of cyber defence
It is difficult to defend against an attacker who only needs to succeed once. Security systems might defend an organisation 99 times out of 100 but faced with a relentless campaign which identifies and targets any cracks, it is almost inevitable that at some point, somewhere, the attacker will succeed.
Data and personal information are valuable commodities and their theft is the most common form of cyberattack. Recent high profile hacks have demonstrated the vulnerability of even very large organisations like TalkTalk and the NHS. These prompted the Government in November 2016 to announce a £1.9 billion investment to help UK businesses protect themselves.
Imminent new legislation is also in place to help provide organisations with a robust data protection framework in which to operate. If the hackers are the criminals, these are the laws that the relevant authorities (the Information Commissioner’s Office) enforce. Failure to comply with the new Data Protection Bill and General Data Protection Regulation (GDPR) from May 2018 will result in significantly higher levels of fines. And this has certainly focused the attention of many of the FTSE 350 boards surveyed in the recent Government Cyber Health Check.
The report found that awareness of GDPR is good, with 97 per cent of firms saying they are aware of the new regulation. But levels of readiness vary. 71 per cent said they are ‘somewhat prepared’ to meet the requirements of GDPR but only 6 per cent are confident that they are fully prepared.
This is perhaps not surprising given that only 13 per cent say that GDPR is regularly considered at board meetings. This is dangerous thinking. When it comes to data protection it is simply not reasonable or effective to make it the sole responsibility of the IT department. The same is true of cyber defence. These are board level issues and need to be embedded into the board’s approach.
It is no longer acceptable to simply be reactive; every board should be proactive and include an assessment of the current risk and review any potential security issues on its agenda on a regular basis. A security sub group can effectively manage this vital aspect of the business but it must have board level endorsement and input. The aim should be to implement a company-wide cyber security strategy which is constantly challenged and re-enforced.
Given the fact that the threat landscape is always changing, another essential element of every organisation’s cyber defence should include a strategic plan in the event of breach. To minimise its impact swift remedial action is vital. A strategic plan will help to ensure effective business continuity and protect from loss of income and reputation. This plan may include working with Retained Forensics (PFI) experts. Not only can they assist the board in the implementation of a robust and strategic defence, but if (or when) a breach occurs their detailed knowledge of a company’s systems will ensure business continuity and minimise the damage to finances and reputation.
How a retained PFI can mitigate risks
Government 2017 Cyber Security Health Check reveals many FTSE 350 companies are not prepared