Managing Legacy Data: The Skeletons in the ESI Closet

Volume 37 Number 6

By

The authors are the President and Vice President of Sensei Enterprises, Inc., a legal technology, information security and computer forensics firm based in Fairfax, VA. 703-359-0700 www.senseient.com

Lawyers and their clients are looking for expert advice on how to manage legacy data. Law firm leaders and managers have a responsibility to their firms and to
their clients to be informed about how to properly store and steward electronic data. Traditionally, many law firms and their clients have simply kept everything.

After all, storage is cheap and many businesses have not wanted to spend adequate time, money and other resources to figure out what to do with all of the old data. 

The concerns and responsibilities surrounding historic files and emails have expanded beyond e-discovery advice into proactive information governance policies and procedures. Law firms and business organizations alike tend to keep data storage devices such as backup tapes, old CDs, thumb drives, cell phones, and other media well beyond what their compliance requirements or business needs dictate.

These so-called “skeletons in the closet” pose a major problem when the organization gets sued or subpoenaed because all that dusty, forgotten data is suddenly potentially discoverable. If a company has thousands or millions of backup tapes, the problem is greatly magnified. By being advised about and recommending proactive management of legacy data, law firms will be saving themselves and their clients distress and major expense down the road.

It’s an easy equation: the less data you have to search through, the more money and time you will save when preserving, reviewing and producing data in e-discovery. Law firm leaders have a responsibility to advise their firms, and lawyers have a responsibility to counsel their clients, about the dangers of legacy data and how to minimize them. We suspect that many lawyers and law firms are simply intimidated, feeling themselves unequal to the task because their level of technical knowledge is not very high.

Working in tandem with IT and consultants, lawyers and law firms can initiate responsible handling of legacy data. Even with respect to smaller law firms and smaller clients, action steps can be taken to proactively address legacy data concerns. Approaches for this include backup tape remediation, secure data destruction (shredding and melting of data media) and archiving. You also may have to deal with legacy data formats where software needs to be retained just to read the data, but that’s a whole different article. This article will share some of the useful tips, resources and strategies available for dealing with legacy data; ones which will help lawyers and law firms of all sizes get their own houses in order as well as aid them in appropriately advising their clients on information governance best practices.

So how do you get your client (or your partners and colleagues) interested in this very important issue? Start by asking them how much they enjoy risk. The answer is usually, “not much.” This opens the path to a conversation about how much legacy data actually exists in the organization, and how risk can be mitigated by proper management of it, and the potential consequences of a failure to do so. Having this discourse is probably the single most important step; identification of a serious problem and obtaining buy-in to resolve it.

Legacy data can be paper files, photos, etc. stored locally or at a warehouse (and what is THAT costing?). It can also be old data backup tapes, data on decommissioned servers, piles of hard drives, CDs, flash drives, old cell phones, PDAs, data stored on active systems, all of which may be unused and sitting for years.  It also may be data in the possession of third parties (in any of these formats).

Often, the organization does not have a records management/document retention policy (tsk, tsk). If one exists, it is frequently mildewed with age and generally ignored or forgotten. As law firms and their clients upgrade the technology they implement, they often give no thought to the archived data that remains from the previous technology regime. Then, when firms or companies merge or restructure, all of the existing data is thrown together without considering whether to “take out the trash.”

When the risks and potential consequences are explained and understood, you can often get folks to focus. Beyond the possible exorbitant costs incurred by e-discovery when legacy data is rife, there are also unneeded storage costs, the danger that orphaned and unguarded data may be leaked, and the possibility that unorganized and unmanaged data will somehow fall afoul of the very complicated regulations that govern data preservation in the compliance arena.

Is there a cost to suddenly wake up and smell the roses? Sure. If a law firm or one of its clients has mountains of legacy data that has gone unmanaged for years, it will take time and money to sort things out. You’ll have to do an ROI analysis along with the risk analysis to persuade all the stakeholders to sign off on an effort to govern the previously ungoverned data or dispose of it altogether.

Once you’ve gotten a green light, the real work begins as you identify all the reasons that certain data must be kept while the rest can be trashed. That’s a single sentence summarizing a huge effort. You’ve now got policies to write or to update and enforcement mechanisms to put in place. Does the entity have a litigation hold plan? Does it have a team to implement it?  For law firms, does the plan comply with every rule or procedure required by any state bar with jurisdiction over the firm?

This whole miserable, time-consuming process is often identified as “legacy data remediation.” For larger organizations, it involves complicated matrixes and sampling techniques beyond the scope of this article. For smaller law firms it might include very time-consuming processes and procedures that significant firm leaders will need to be involved in overseeing for months or years.  However, there is help available, such as companies and law firms that advise clients on tape remediation/restoration processes and strategies, including the following:

LeClair Ryan (www.leclairryan.com)  
Redgrave LLP (http://www.redgravellp.com/)  
Kahn Consulting (http://www.kahnconsultinginc.com/rim-services-hold-everything-legal-hold-backup-tape-remediation.php)   
Index Engines (http://www.indexengines.com/)
Litigation
Logistics (www.litlogix.com)  
Contoural (www.contoural.com)  

In addition, you can find policy/e-discovery help from the following resources:

ARMA (http://www.arma.org/)  
American Bar Association (http://www.americanbar.org/)   
The Sedona Conference (http://www.thesedonaconference.org/)  

Back Thru the Future (http://www.backthruthefuture.com/) is one of our favorite companies for the secure destruction of data—once you know what you want to get rid of!

We know the folks at Index Engines, which is a company that has an appliance and process for large-scale tape remediation, a patented technology. To quote from their website, “Index Engines technology scans tapes and then searches and extracts specific files and email without the original backup software. This allows you to only deal with relevant files (less than 1% of the tape content) and not the bulk of useless content. Index Engines intelligent tape discovery solution has made tape remediation an achievable project.”

Jim McGann, the Vice President of Marketing for Index Engines, has written several white papers on these topics. The title of one is “Make a Molehill Out of a Mountain,” which is precisely the advice we have offered our readers earlier in this article.

He opens that white paper with an imaginary (but very close to the mark) conversation with a data storage manager:

Q. “How many backup tapes do you have?”
A. “I have no idea. Probably thousands.”
Q. “Do you need to keep them?”
A. “No.”
Q. “Why don’t you recycle them?”
A. “Legal won’t let us.”

That is frighteningly like many conversations we have heard where the last line is always “Legal won’t let us.” In smaller law firms “Legal” might be dinosaur or pack rat partners who are either unwilling to modernize by letting go of the past, hesitant to allow anyone to help either them or the firm get organized, or simply too frightened of the unknown to dispose of anything.  There’s no question that “Legal” is the major roadblock here. As Jim points out, typically the amount of data that needs to be retained for current or future litigation purposes is less than 1%.

What about the rest? Well, automated tape processing can help a lot. Jim gives this example: “Assume a situation with 10,000 tapes in offsite storage. The first step would be to catalog the tapes to profile the content. Using a tape library, tape headers can be scanned in minutes, only requiring manpower to load the tapes.  Once the scan is complete, analyze the catalog and eliminate incremental backups, as well as backups of non-user data servers and blank tapes. This typically reduces the volume by 80%, turning a 10,000 tape job into a 2,000 tape job.”

You see the point—if you use efficient systems to achieve legacy data remediation, you do have to spend significant funds, but savings and risk mitigation are the huge benefits at the end of the process.

So what should your response be when you hear, “Legal won’t let us?” We think maybe it ought to be, “We’ll see about that

 

Advertisement

  • LAW PRACTICE MAGAZINE

  • LP on the Web

  • 2013-2014 Editorial Board