Symantec
Law & The Data Explosion
Executive Summary
Electronically Stored Information (ESI) is fast becoming a critical source of evidence to support a wide
range of legal actions across Europe, the Middle East and Africa (EMEA). Yet is the challenge of picking
through thousands or even millions of electronic files to assemble a case or action at risk of slowing down
the legal process?
The following report explores the relationship between developments in the way the legal profession
locates, identifies and recovers this new breed of ‘digital evidence’ and the ever growing amounts of
data organisations are expected to store. In particular, a recent study of 5,000 lawyers in ten countries
conducted by Symantec, highlighted that problems related to ESI are impacting the legal process right
across EMEA. These problems were found to have affected every single lawyer questioned as they
struggled to cope with up to 50% more ESI per case than just five years ago.
1. TOO MuCH INfORMATION
Assembling the body of evidence required to mount a successful case has always been a challenge. In times gone by investigators would often have to pick through thousands of hard copy documents for the information that could prove pivotal to a legal matter’s success.
The rise of Electronically Stored Information (ESI) – in the form of emails, electronic documents etc – was originally heralded as an end to the legal paper chase. Advanced search technology would, in theory, enable investigators to search thousands of records simultaneously, allowing them to identify and recover all the relevant information they need in a matter of minutes.
In practice, however, the powers of search technology have been limited by two factors: exponential growth in the amount of ESI that organisations now hold, and poor data management. According to a 2010 study by IDC, the amount of ESI created and replicated will grow to 1.2 million petabytes (a petabyte is a million gigabytes) by the end of 2010. Yet the indications are that many organisations are not prepared for the challenges this level of growth entails. A recent Symantec survey of 1700 IT professionals revealed that 46 per cent of
organisations have no information management strategy. And when asked how their organisation took steps to preserve ESI that might be relevant to litigation (otherwise known as legal hold) 64 per cent said they used their back-up system to do this.
With the success (and cost) of legal casework, compliance and routine enquiries dependent on the rapid retrieval of accurate information, Symantec was keen to understand how this ESI ‘tsunami’ was affecting the legal process. It therefore commissioned an extensive study of 5,000 lawyers and legal professionals across ten countries in Europe, the Middle East and Africa (EMEA). The results were startling, revealing that problems identifying and submitting ESI had directly impacted the work of every single lawyer questioned across the territory. The following report explores two themes highlighted by Symantec’s study:
-•
The pivotal role that technology used to identify and recover ESI relevant to legal matters (otherwise known as E-Discovery) plays in the legal process•
Whether unmanaged growth in ESI, combined with lack of E-Discovery expertise among lawyers, risks bringing the legal process to a halt across EMEA2. A LOSING BATTLE
Far from being a theoretical or potential risk to the smooth-running of the legal process, difficulties and delays associated with ESI are a real and current concern to lawyers. Numerous case collapses, and widespread criticism of incidents such as Goldman Sachs delivery of five terabytes of information to the Financial Crisis Inquiry Committee, provide a vivid snapshot of limitations in many organisations E-Discovery capabilities. This anecdotal evidence was borne out by Symantec’s own study. Here, all 5,000 lawyers questioned across 10 countries admitted that they had either lost a case, seen one delayed or been sanctioned by a court or regulator within the past two years because of problems relating to ESI. Over half of those questioned also confirmed that they had been affected in the last three months, suggesting that this phenomenon is gathering pace.
Has a matter in which you have been involved ever been impacted, delayed or resulted in sanctions because of issues relating to ESI?
Many such problems are undoubtedly caused by poor availability of relevant ESI, such as those highlighted by the landmark Zubulake vs. UBS Warburg case in 2003-4. Here the bank’s failure to retain relevant emails in its backup for submission in a gender discrimination suit resulted in a $29.2 million verdict against UBS Warburg. More recently, high profile cases against Siemens and British Airways have also collapsed as problems with E-Discovery resulted in investigators either being unable to locate relevant data, or failing to submit ESI that later came to light.
These cases have played a vital role in defining organisations’ responsibilities relating to the storage of ESI. Zubulake vs UBS Warbug established, for example, that organisations have a duty to retain relevant ESI during the course of litigation, and lawyers must monitor their clients’ compliance with its preservation and production. But the fear of sanction this and other test cases has provoked within organisations has arguably led to over-sensitive data retention policies that can occasionally have the opposite effect to those which were intended.
We have seen above that many organisations are retaining too much ESI as ‘legal hold’ through ineffective use of their back-up systems. 85 per cent of global backups, according to Symantec’s own research, have infinite retention or are on legal hold. Recent estimates suggest that this could amount
to as much as 38 petabytes of data. And if ESI is indeed on indefinite hold within corporate archives in such quantities, it is certainly possible that the scale of retention is hampering the legal process.
Magnitude of growth ESI volumes (EMEA)
Lawyers across EMEA certainly echoed the view that data growth is a growing problem. To test the IDC figures cited in the previous section in the context of the legal sector, Symantec also questioned lawyers across EMEA on their perception of the issue. 56 per cent replied that the amount of ESI they processed per legal matter had grown by between 25 and 50 per cent in the past five years. While 19 per cent had experience 50-75 per cent growth.
The majority of this audience also agreed that the magnitude of ESI growth they had seen over the past five years had become the single biggest barrier to effective E-Discovery. 60 per cent of EMEA lawyers admitted that they struggled with the volume of ESI that now had to be searched per legal matter. This was more than 30 per cent ahead of the second most significant problem, which was insufficient time to investigate ESI thoroughly (29 per cent).
With information growth showing no sign of slowing down, the smooth-running of the legal process across EMEA and beyond depends on organisations and their lawyers getting to grips with their E-Discovery problem.
1. YES - within the past 3 months
2. YES - within the past 6 months
3. YES - within the past year
4. YES - within the past 2 years 5. NO 1. 0-25% 2. 25-50% 3. 50-75% 4. 75-100% 5. More than 100%
3. THE RISE Of ‘DIGITAL EVIDENCE’
While the increased digitisation of all areas of commercial and public life is clearly slowing down some aspects of the legal process, advances in E-Discovery have also contributed to a significant number of legal successes.Few lawyers would deny that ESI often represents a hugely fertile source of potential evidence. Indeed 91 per cent of the lawyers Symantec polled said that ESI was either critical or important to them in successfully carrying out their day-to-day roles. And for every high profile case that makes headlines after collapsing due to the non-availability of vital ESI, there are many more that progress successfully after investigators use E-Discovery to locate the email or document that swings a matter in their favour.
When asked they had ever succeeded in a legal matter because of ESI identified and collected during an investigation that was later submitted as evidence, 98 per cent of the lawyers that Symantec questioned said they had. 44 per cent of those respondents went on to confirm that they had enjoyed such a success in the past three months. While these figures were marginally lower than among lawyers who believe they had been negatively affected by ESI, they nevertheless show the positive impact E-Discovery makes in many instances.
4. THE APPLICATIONS Of ‘DIGITAL
EVIDENCE’
Symantec also used its research to assemble a picture of the full range of legal matters in which organisations make use of ESI. High profile court cases have historically dominated the discussion surrounding E-Discovery, even though court proceedings represent less than a tenth of legal activity. Symantec’s research indicated, however, that while 82 per cent of lawyers searched ESI in response to litigation, E-Discovery technology’s internal applications were marginally more important.
Foremost of these was ESI’s role in demonstrating organisations’ financial wellbeing. 89 per cent of lawyers questioned by Symantec said E-Discovery played a pivotal role in producing the data required to respond to requests for information relating to financial transactions and due diligence. Compliance was also a key concern, with 86 per cent of respondents confirming that ESI located through E-Discovery was frequently used in organisations’ routine compliance checks.
A large part of lawyers said that they and the organisations they worked for used ESI recovered through E-Discovery when it was necessary to scrutinise the behaviour of their employees. 70 per cent admitted ESI has been submitted as evidence in human resources investigations. Its use beyond the sphere of civil law was, however, found to be marginal, with only 16 per cent of lawyers making use of ESI when responding to requests for information relating to criminal investigations.
5. THE CHANGING fACE Of EVIDENCE
In the sections above we have clearly outlined the importance of ESI to the success and failure of the legal process. We have also set out an overview of the variety of scenarios in which ‘digital evidence’ – defined here as ESI recovered through E-Discovery which is later submitted as evidence in a legal matter. What remains unanswered, however, is what forms this ‘digital evidence’ takes. The overwhelmingly paper-based, written evidence that dominated legal proceedings until a few years ago has been replaced by a vast, and rapidly changing array of media. And if the letter and filing cabinet has been usurped by the email and the laptop, what implications does this have on the legal process?The experiences of the lawyers questioned by Symantec in its research confirmed that today’s legal professionals must deal with information in a much greater range of forms than ever before. Everything from word processing documents and databases to instant messaging history was found to have been deemed relevant to a legal matter in some degree.
Which form of ESI do you believe would be most useful to you and/or your team when searching for information relevant to a legal matter?
The order of importance in which respondents ranked various types of ESI broadly reflected their importance in day-to-day business discourse. Emails were by far the most highly ranked file type, with 16 per cent of lawyers saying they commonly searched it, closely followed by word processing documents at 10 per cent. Spreadsheets and databases were less commonly searched (2 per cent and 8 per cent respectively).
The sheer range of types of ESI that must now be searched during the E-Discovery process has also contributed to the difficulties lawyers face. For example, only 6 per cent of respondents to Symantec’s research said that they searched multimedia (audio and video files) as a priority. Yet 14 per cent of the same sample stated that processing multimedia file types posed the most significant obstacle to them conducting investigations effectively. Archive data that turned out to be inaccessible, as it was stored in proprietory or obsolete file formats was an even greater problem. 22 per cent of lawyers questioned said that this was their greatest challenge when it came to identifying relevant ESI.
Another noteworthy finding was that, despite many organisations’ practice of using their backup systems to enforce legal holds, only 12 per cent of lawyers said they habitually searched file backups when conducting investigations. This suggests that not only does this practice constitute inefficient information management, it is also an ineffective way of making ESI available in the event of a legal investigation.
More disquieting still was the revelation that the form of ESI most commonly searched during legal investigations is a type not routinely backed up at a corporate level. 31 per cent of lawyers questioned said that the single most useful source of ESI was none other than the hard disk drives of individual computers.
When asked why they defaulted to searching individual computers when searching for ESI, lawyers stated that they felt the laborious task of picking through the contents of hard drives yielded better results. 37 per cent felt that it was the fastest method of locating relevant ESI, while 24 per cent said that it allowed them to undertake more specific searches for information.
These findings show that ESI critical to the success of legal matters tends to be located outside of the corporate archive. Consequently, lawyers charged with locating it must deploy detailed searches at the level of individual computers, believing that the labour intensive approach yields better results. This revelation, combined with the insight above that lawyers are struggling to process ever growing amounts of ESI, underlines the need for E-Discovery technology equally capable of searching centralised archives and individual endpoint devices.
The lawyers Symantec questioned were equally unequivocal about the value of better technology when asked what they believed would improve the E-Discovery process. Here, 57 per cent of respondents replied that they preferred improvements to search technology used to identify, preserve and process ESI over regulatory change (18 per cent) or greater standardisation of technology.
What do you believe would alleviate the present challenges relating to ESI? 1. Emails 2. Digital Photographs 3. Word Processing Documents 4. Instant messaging histories 5. Spreadsheets 6. Internet browser histories 7. Digital audio files 8. Databases 9. Sharepoint content 10. The contents of 11. System or file backups 12. Social media (Facebook,
individual hardrives
internal wikis, etc.)
1. Better regulatory framework for dealing with ESI at a national level 2. Greater consistency of legislation relating to ESI at an international level 3. Greater standardisation of
technology
4. Improvements to search technology used to identify, preserve and process ESI
6. ARE yOu PREPARED fOR THE INfORMATION REVOLuTION?
As we have seen, the proliferation of ‘digital evidence’ has proven to be both a challenge and an opportunity to the legal profession. The development of technology capable of storing vast quantities of corporate data has considerably widened the range of information available to lawyers when they assemble complex cases. Yet the unchecked growth of these archives can confront even those investigators armed with sophisticated E-Discovery solutions with a task equivalent to finding the proverbial needle in a haystack
Before the problems highlighted throughout this report can be resolved, organisations need to re-evaluate their approach to storing and searching unstructured data in two ways: -
1.
The E-Discovery process can only be manageable if organisations take a strategic view of information management. This means taking proactive steps to reduce data duplication, appropriate use of backup, and the deletion of information that is no longer needed2.
To be successful, the E-Discovery process needs to extend beyond the archive. Search and discovery solutions must be able to locate, recover and preserve ESI from individual endpoint devices. Without these capabilities, investigators will be forced to rely with the time-honoured, but laborious and expensive task of searching individual hard disk drivesSymantec’s Enterprise VaultTM and its new enhanced Discovery solutions supports both of these requirements. Providing
expanded content collection capability for managed and unmanaged content it enables investigators to discover and collect unstructured information inside and outside the company archive. It also provides deduplication in both review and export reducing volumes of data sent. This design introduces considerable efficiencies to the E-Discovery process, and Symantec estimates it could reduce the cost of legal processing fees per gigabyte of data by between 50 and 90 per cent.
Successful E-Discovery is all about easing the path of the legal process by feeding it with the right information, in the right format, in as little time as possible. Poor information management can and does hinder it, but as this report has shown, adroit application of the appropriate technology can make all the difference.
