Cloud-based business email and business documents are on the rise. Radicati Group estimates that nearly 40% of business email accounts will be cloud-based by 2017. 37% of enterprises expect to use Microsoft O365 applications in the next 24 months. With email and business documents driving most of eDiscovery data, what should you do to prepare for discovering data from increasingly “cloudy” sources? We frame the important issues and best practices in what follows.
Does your cloud data source preserve metadata?
Metadata is critical for eDiscovery but it is unclear if cloud sources preserve dates consistently. Salesforce.com, for example, recommends that its customers backup data and points out that “to preserve old/original create dates, request that Salesforce.com enable Create/Audit Fields for you before restoring.” In other words, if you are not careful, data restored into Salesforce.com backups may be not be defensible for eDiscovery. Similarly, transfers into Box.com need special care to ensure that original and modified dates are preserved – in particular, FTP and browser uploads into Box.com do not preserve creation dates. Version history for files is another aspect worth looking into. Many editions of Box allow only up to 10 revisions of a file – any more edits will overwrite prior versions.
Best practice: Given these challenges, it might be worth looking into an archiving solution to ensure preservation of metadata.
How long does your cloud data source hold backups?
In Brown v. Tellermate, it turned out that the defendants failed to preserve Salesforce.com data in a defensible way even after being served the complaint. The plaintiffs (“Brown”) were former sales reps of Tellermate and complained that their age had been the cause of termination. They requested disclosure of sales performance data for themselves and younger employees from Tellermate’s Salesforce.com system. It turns out that
- An enterprise’s admin users and current employees can change Salesforce.com data at any time
- User accounts in Salesforce can be reassigned or de-activated - there is no guarantee that data in such accounts remain immutable. Plaintiff Brown’s accounts were reassigned by Tellermate.
- Salesforce.com holds backups for only 3 to 6 months from the current date
Similar considerations apply to cloud-based instant messaging solutions, email and transient sources like Twitter and Salesforce.com Chatter.
In short, unless an enterprise is diligent about exporting cloud data and storing it in an immutable fashion, it is vulnerable to missing its obligation to preserve data in the event of a complaint. The judge in Brown v. Tellermate noted: “….Tellermate did not do …“data export” when the preservation letter was received…and because salesforce.com deleted any backups that were more than 6 months old, it now appears to be impossible for Tellermate to produce salesforce.com information whose reliability can be guaranteed.”
Best practice: Given these challenges, an archiving solution is the proven approach to data preservation. If you do not own an archive, you should consider “collecting to preserve” into your eDiscovery solution from your cloud data sources as soon as you become aware of a complaint.
How diverse is your data?
The “80-20 rule,” unfortunately, doesn’t apply to eDiscovery. Meaning: any data, however, insignificant in terms of its overall share in your environment, might be considered discoverable. So, while you may rush to a one-stop shop for cloud-based email and collaborative applications, your historical files and emails in on-premises data sources and email are still relevant for eDiscovery. I have seen recent cases in financial services that call for 7-10 years of historical data and most of it will remain on-premises for the foreseeable future.
Best practice: Given the “look back” requirement of eDiscovery, consider solutions that have a comprehensive approach to collecting both cloud and on-premises data.
How quickly can you get the data out of your cloud sources?
Several customers have pointed out that searching and exporting from cloud-based email and collaboration applications takes too long and hinders their ability to meet eDiscovery timelines.
Best practice: Test search and export performance for eDiscovery scenarios (lots of custodians, lengthy date ranges) before signing up for cloud-based email and collaboration suites.
These are some issues that we have encountered in our experience. What do you think? We would love to hear from you.