Storage on Trial

Computerworld - What is a data-retrieval plan worth to a company caught up in litigation? For Morgan Stanley, $15 million.

In 2006, the Wall Street firm agreed to pay that sum in fines to resolve an investigation by U.S. regulators into its failure to retain e-mail messages.

E-mail played a central role in the (later overturned) $1.58 billion judgment in favor of Ronald Perelman in the case of MorganStanley v. Coleman. Perelman is a billionaire investor who said he was defrauded by the firm over the sale of a business. The judge, frustrated by Morgan Stanleys inability to produce e-mails demanded by Perelmans lawyers (the firm said backup tapes had been overwritten), took the unusual step of shifting the burden of proof to Morgan Stanley, so that the firm had to prove its innocence.

The case was sobering for some, but the vast majority of companies still arent getting the message. In fact, in one survey, some 94% of those responsible for e-mail policy said they dont feel their organizations are fully prepared to meet the revised Federal Rules of Civil Procedure (FRCP), which require companies to be able to quickly find electronic data when ordered by a federal court. The survey was conducted by archive outsourcing firm Fortiva Inc. three months after the new requirements took effect Dec. 1, 2006. In another finding, only 38% of the 118 respondents said they were familiar with the changes.

See our entire feature package about "Storage On Trial"

Companies in regulated industries, such as financial services, health care, pharmaceuticals and telecommunications, are more likely to find themselves in the cross hairs of lawsuits, but all U.S. companies risk an e-discovery legal challenge. More than 60% of organizations have been ordered by a court or regulatory body to produce corporate e-mail, according to Osterman Research Inc. in Black Diamond, Wash.

And when an e-discovery request lands at your door, you had better be able to show that you can produce documents in a reasonable time frame. Heavy fines and penalties may be levied by the court, which in the case of Serra Chevrolet v. General Motors were as high as $50,000 per day for each late response to a discovery request. Whats more, companies may have to reach back three to five years for relevant e-mail, because some cases can take years to reach the courts.

Most companies today find themselves in one of two situations, says Alan Armstrong, vice president of business development at Ontario-based Fortiva. Larger companies are in a constant cycle of litigation and are so busy that they are reactive, he said. If they could get ahead of the curve, they could save a lot of money, but getting ahead is always a challenge.

Other companies havent faced any lawsuits since the new FRCP requirements took effect, but they need to weigh the risks and benefits of indexing stored tapes while introducing new e-mail archiving procedures.

In either case, heres how to prepare so you can quickly  and economically  lay your hands on what you need.

Create a Data-Retrieval Plan

A data-retrieval plan includes an understanding of what data and e-mail the company has and where it is located, as well as a strategy for preserving and identifying that data and being able to collect it when needed. It may also include methods for reviewing and producing documents in-house.

The more relevant the information that you start with, the more quickly you can find a subset of information, explains Brian Babineau, a senior analyst at Enterprise Strategy Group Inc. in Milford, Mass.

The IT department, business units and corporate counsel all share responsibility for data and e-mail. But corporate counsel is ultimately responsible for managing litigious risk, says Babineau. Counsel should lead planning for data retrieval  a process that includes determining where records are kept and for how long  with input from IT, records managers and business analysts. In a regulated industry, the compliance officer should also be involved in data-retrieval planning.

Weigh the Risks

One of the biggest costs involved in e-discovery during litigation is restoring backup tapes and searching through myriad files to find the few e-mails that support or defend against a legal argument. Not only will tapes need to be searched and restored ($300 to $500 per tape), then indexed and proc­essed ($1,500 to $2,000 per gigabyte), but attorneys must be hired to review those processes and verify the chain of custody (priceless). The proc­ess could take weeks or longer.

Legal counsel must balance the cost of resurrecting stored tapes against the potential legal risk.

A company should look at the applications that generate the most critical business records  financials, executive e-mail or senior-level employee e-mail, Babineau says. Then look at those tapes and where they reside, see how much it would cost to archive them, and balance that cost against the likelihood that youll face a discovery request, he adds. Companies such as Index Engines Inc. in Holmdel, N.J., specialize in indexing tape without restoring it.

In an industry thats highly regulated, I would certainly recommend bringing some of that information back to make it more searchable, reducing the chance of exorbitant legal and search fees down the road, he adds.

But less-regulated companies that have large amounts of stored tapes may want to wait on indexing, Babineau says. If you havent been through a discovery yet ... I dont think its necessary to go back and restore all those tapes to an online format as a preemptive strike, he says. Instead, start archiving e-mail from today forward.

Archive, Dont Store, E-mail

Archiving provides a fast, economical way of searching e-mail. By extracting a subset of important e-mail and moving it to a secondary device, organizations can keep more of the right information online for longer periods of time.

The approach we recommend is to take the burden off of the Exchange [server], Fortivas Armstrong says. Separate the transactional activity of the e-mail system, and take e-mail older than three months out of [the system] and put it into an archive. Then apply retention policies set by the legal team. This is where legal and business has a real discussion. How do we balance asset and liability?

There are dozens of archiving software systems and appliances available from storage vendors, as well as archiving services from outsourcing providers. Determining the right course depends on the size of the company and IT resources available. Many systems can also archive instant messages, which can also be included in discovery requests.

All solutions need to be flexible enough to deal with any situation, says Lori Ann Wagner, a partner at Redgrave Daley Ragan & Wagner LLP, a Minneapolis-based law firm specializing in e-discovery and records management. You cant pull all information out and stick it into a static discovery base and always pull from those.

Its also important to preserve e-mail as metadata or in a format-neutral way, she adds. You never know what type of format the court will ask for. Archived e-mail must be fully auditable to hold up in a legal argument. Archiving software provides audit trails and reporting capabilities to verify the chain of custody and prove that no tampering has occurred.

If a discovery request is submitted for electronically stored information, discovery software, which sits on top of electronic archives, can provide both basic and advanced search and retrieval functions and eliminate duplicate content. While they can greatly reduce the pool of information that attorneys must review, such products are still relatively new.

I have not personally worked with a company yet, including many in the Fortune 100, that has employed the e-discovery software that comes with the archiving tools to identify and collect evidence, Wagner says. But theyre in the process of looking at those. Its a very hot market.

Most of the processing of evidence  merging e-mail with other company data, assigning a numbering scheme to data and transferring to the required format  should be done by an outside service, Wagner adds.

Purchasing archiving software and storage devices doesnt have to break the budget, especially with cheaper, effective disk-based storage. It can actually be economical, explains David G. Hill, principal at storage management consulting firm Mesabi Group LLC in Westwood, Mass. If theyre boiling [archived data] off of their production database, it makes the production database smaller, he says. Plus, its easier to back up and more cost-effective.

Who Should Pay?

The issue of who pays for data retrieval software, hardware and services remains an arm-wrestling match between the legal and IT departments.

IT has to put [data retrieval] in its budget for hardware and software and be able to charge it back to the business unit or legal department, depending on the circumstance, Hill says.

In our opinion, corporate counsel should start investigating budgeting for what we call electronic discovery technology investment, Babineau says. Theyre ultimately responsible for managing litigious risk  and part of that is the cost to defend or support an argument. But IT should look at how to run their normal operations more efficiently with electronic discovery in mind.

Budget bickering aside, industry watchers agree that its better to pay for a data-retention tools upfront than it is to pay later. You know this is a pending threat, Armstrong says. Is it the hurricane for which you dont want to have insurance?