Where Is My Ripcord?
What Counsel and Compliance Officers Need to Do When They Find
Out the Company’s Data Has Been Shoved into the Cloud
Where Is My Ripcord?
What Counsel and Compliance Officers Need to Do When They Find
Out the Company’s Data Has Been Shoved into the Cloud
Tuesday, March 1, 2011 Web Seminar
Speakers
Speakers
Bob Owen (Moderator) Fulbright & Jaworski
David Kessler
Fulbright & Jaworski
Dan Regard
Intelligent Discovery Solutions, Inc.
Continuing Legal Education Information
Continuing Legal Education Information
We have applied for one hour of California, Minnesota,
Texas, and Virginia CLE and New York non-transitional CLE credit. Newly admitted New York attorneys may not receive non-transitional CLE credit. For attendees in other states, we will supply a certificate of attendance that may be used to apply for CLE credit with the applicable bar or other pp y pp
accrediting agency.
Fulbright will supply a certificate of attendance to all
participants who:
1. Participate in the web seminar by phone and via the web.
2. Complete our online evaluation, which we will send to you after
Administrative Information
Administrative Information
Today’s program will be conducted in a listen-only mode. To
ask an online question at any time throughout the program, simply click on the question mark icon located on the tool bar in the bottom right side of your screen. We will try to answer your question during the session.
E thi t d i i i W t di i
Everything we say today is opinion. We are not dispensing
legal advice, and listening does not establish an
attorney-client relationship. This discussion is off the record. You may not quote the speakers without our express written
permission. If the press is listening, you may contact us, and we may be able to speak on the record.
This Just In
This Just In
Google still working to restore Gmail service
Company says e-mails are not lost, but many still without
e-mail today
By Sharon Gaudin
March 1, 2011 11:46 AM ET
Computerworld - Two days after tens of thousands of
Google Gmail
users discovered their e-mail, chat histories
and contacts had disappeared from their accounts, the
problem still is not fixed.
Situation
Situation
You’re involved in an employee interview related to a
litigation. You find out that the employee has been using a web-based service to create and share certain business data. This is the first time you’ve ever heard of this use, or even of this ISP. This ISP has never been vetted by IT, Legal or Compliance.
What do you do now?
Agenda
Agenda
Intro
Is this Situation Realistic?
Why is it Happening?
Definition(s)
Cloud Computing
Litigation Reaction Plan
Identification
Preservation
Collection
Compliance Reaction Plan
SLA
Data Governance
Credit Card IT
Triage the Situation
Security
Retention and Disposal
What Are the Long Term
Plans?
How Do I Guide the Cloud
Information into Data
Governance Best Practices?
Types of Cloud
Types of Cloud
Software Hardware Platform Public Private HybridPurpose
Source
Platform HybridCase Examples
Case Examples
Saleforce ($25 per month)
Facebook (free)
Base Camp ($49 per month)
Base Camp ($49 per month)
Sugarsync (freemium)
Amazon Elastic Compute Cloud (EC2) ($1 per hour)
Basecamp
Basecamp
Data Ownership Policy What about subpoena?
Yes…
But…
Redundancy
Physical Security
Protected Billing Information
What if I want to delete? Cyber is hard
TRIAGE:
Or Do I Need to Jump Out of the Plane?
TRIAGE:
Or Do I Need to Jump Out of the Plane?
Find and Review Cloud Provider
Agreement
Emergency Preservation?
Is it Relevant/Material?
I it U i ?
Is it Unique?
Do I have automatic data loss? What are my self-help options?
Can I extract?
Can I change user behavior?
Disclosure or Representation Gap
eDiscovery Life Cycle
eDiscovery Life Cycle
Relevance Relevance Volume
IDENTIFICATION:
Measure the Data
IDENTIFICATION:
Measure the Data
What do I want to measure?
Content: Quantity, Quantity Business Purpose
Materiality / Relevance
How do I measure?
Review the Contract Talk to the Business People
who are using the Cloud
Ownership
Control (Right to Access) Security (Ability to Prevent
Access)
Jurisdiction (Physical Location) Privacy (Protected Data Status)
Talk to the Cloud Provider Cloud Legal/Business
IDENTIFICATION:
Review the SLA
IDENTIFICATION:
Review the SLA
What Are Your
Administrative Rights?
How can you get a copy of
your data?
your data?
Are there cost clauses for
preservation and collection?
What happens at
PRESERVATION and COLLECTION:
PRESERVATION and COLLECTION:
Dynamic Data with Little (or No) Controls
Copy (Administrative Rights)
Confidential / Secretive Preservation
Unknown Metadata
How do you establish integrity of process?
COMPLIANCE
COMPLIANCE
Can you quickly repatriate?
What do you mean by “Delete”?
What is the CP’s Disaster Recovery Plan?
After the Emergency
After the Emergency
Leave
Upgrade
Repatriate
Substitute
Adjust Future Behavior
Adjust Future Behavior
Root cause
Preferred outcome
Enabled outcome
Education
SLA Considerations
SLA Considerations
Duration
Termination
Security
L
ti
Location
Retention
Access
Subpoenas
Administrative control
Recap of Takeaways
Recap of Takeaways
A question of when… not if
Don’t compound the problem
Measure your data
C
id
bli ti
Consider your obligations
Advise the appropriate stakeholders
Take triage actions
Take corrective actions
Questions?
Questions?
Bob Owen (Moderator) Fulbright & Jaworski
David Kessler
Fulbright & Jaworski
Dan Regard
Intelligent Discovery Solutions, Inc.
Continuing Legal Education Information
Continuing Legal Education Information
If you are requesting CLE credit for this presentation, please
record the number given during the program and respond to the survey that Fulbright will email within the next day.
Completion of the above-mentioned survey is required in
certain states to obtain CLE credit.
If you are viewing a recording of this web seminar, most
state bar organizations will only allow you to claim self-study CLE credit. Please refer to your state's CLE rules. If you have any questions regarding CLE approval of this course in your applicable bar, please contact your bar administrator.
