October 23, 2012

Outsourcing EDD Review Abroad

Law Practice Magazine

Law Practice Magazine Logo

 Table of Contents | Features | Frontlines | Technology | Business

January/February 2009 Issue | Volume 35 Number 1 | Page 28

Hot Buttons

Outsourcing EDD Review Abroad

If you’re bold enough to send electronic evidence review offshore, then exercise an extreme degree of due diligence, grill the offshore firm about security, and document every step you take.

Even though it may be akin to dancing in a minefield, some law firms have started sending electronic evidence review work to offshore firms. Are you bold enough to do it? Then you’ll want to exercise an extreme degree of due diligence, grill the offshore firm about security, and document every step you take.

There is a certain je ne sais quoi about dancing in a minefield. It is a reckless , daredevil sort of act. So why are law firms beginning to dance in a minefield by outsourcing the review of e-discovery data (EDD) abroad? The answer is simple. They feel the risks are outweighed by the savings in costs—and the retention of corporate clients bent on slashing those costs.

To make it crystal-clear how dramatically costs may be lowered, many experts agree that you’ll spend $7 to $10 per document for EDD review in the United States. Abroad, that cost can diminish to just $1 to $3 per document. No wonder corporate counsel, in particular, have looked with such favor on sending this work offshore.

Exact numbers for offshored EDD review are not available, but everyone in the industry agrees that it’s growing quickly. A lot of foreign countries are involved in EDD review, but none more than India, where legal process outsourcing (LPO) of all kinds is a burgeoning business.

Unsurprisingly, law firms have not moved to outsourcing EDD review as fast as corporations have. But that may change, since clients themselves are pushing the envelope by, in some cases, simply taking the review work away from their outside law firms and offshoring it directly.

This shift is a work in progress, sometimes requiring months of due diligence. So what should you be most keenly aware of if you’re considering the offshoring option?

Investigating Training and Security

For an example of what you should look for in an outsourcing firm, we turned to CPA Global, a well-respected LPO firm that has specialized in intellectual property outsourcing since 1969 and starting offering document review and evidence organization services a couple of years ago. Thanks to Brandon Daniels and Stephen Kong of CPA Global for answering our questions about their processes.

According to Daniels, CPA Global has over 400 associates in India, about 30 of whom are dedicated to document review. CPA uses only attorneys, not paralegals, although that is not true of all LPO firms. Sometimes, subject matter specialists who are not lawyers are also used. Each lawyer at CPA receives 200 hours of initial training and continuing legal education thereafter, as well as training in the handling of special data related to HIPAA, SOX, GLB, FERPA and the like. CPA’s process for screening applicants is rigorous, Daniels reports, so its acceptance rate is only 6 percent.

Daniels also says that currently most clients ask for hourly billing (not surprising in the legal field, of course). Interestingly, though, he’s seeing a drift toward per-document and fixed-fee arrangements for processing, hosting and reviewing.

So what should a law firm get for those dollars in terms of security? Keep in mind that, especially owing to still-tenuous ethics questions, it’s critical to consider the kind of physical and data security that might be necessary to outsource EDD abroad. These are the types of questions to ask prospective providers:

  • Physical security. Are there security guards, biometric access, segregated access rights to various portions of the building, checking of all bags, shredding of all documents, access controllers and access readers?
  • Data security. Is there a tightly configured firewall, state-of-the-art virus and malware protection, password control, automated operating system patching and Internet traffic monitoring? What about VPN-only access to client and third-party information, use of Citrix and “dummy terminals,” disabling of USB ports and drives, a prohibition against the use of portable storage devices, and strictly enforced confidentiality agreements?

Also, what certifications does the LPO provider have? CPA’s facilities are ISO 27001-certified, which is a growing international standard for information security management systems. It’s essential for U.S. law firms to get the answers to such questions to ensure that whatever LPO firm they choose meets similar standards.

Considering Murky Legal Issues

And now for some other issues to consider. One involves last year’s so-called Newman case, which attracted a lot of attention and was widely regarded as an anti-offshoring case. Here’s the background. On May 7, 2008, the Maryland law firm Newman McIntosh & Hennessey filed a complaint for declaratory judgment and injunctive relief in the U.S. District Court for the District of Columbia against President Bush, Indian outsourcing firm Acumen Legal Services and additional parties. The complaint sought guidance on whether transferring e-evidence to a litigation support service in India waives Fourth Amendment protections and constitutes waiving attorney-client privilege. Remember: The Fourth Amendment does not traditionally protect foreign nationals when the government is engaged in surveillance of electronic data submitted to foreign nationals. So, the Newman firm sought injunctive relief and declaratory judgment stating whether client data transmitted loses its Fourth Amendment protection when sent overseas; whether a law firm needs to ask for client permission before sending the information overseas; and whether the Administration has an obligation to establish protocols for such a process.

Acumen Legal Services filed a motion to dismiss. Confronted with that motion, Newman requested permission to further amend its complaint and expand the case into a class action on behalf of multiple U.S. law firms. The day after that permission was denied (and 13 days after Acumen filed its motion), the law firm withdrew its suit. The result: The offshore LPO industry and its proponents dodged a possible bullet—but also missed a chance for court clarification.

So what sayeth the American Bar Association? In August, the ABA Standing Committee on Ethics and Professional Responsibility released Formal Opinion 08-451, regarding a lawyer’s obligation when outsourcing legal and nonlegal support services. LPO companies were quick to trumpet the news that the ABA endorsed outsourcing in this opinion, including EDD review. However, while the opinion appears to be a win for law firms that choose to outsource work to U.S.-based firms and lawyers, it is a lot muddier when it comes to foreign firms.

In fact, after carefully reading the opinion from the point of view of a lawyer determining whether to outsource abroad, the more nervous we became about complying with the opinion. Although not everything is absolutely mandated, we are talking about the following being either required or advisable when outsourcing:

  1. Reference/background checks for the lawyers and their firms
  2. Interviews with the principal lawyers of the firm
  3. Assessments of their educational background
  4. Assessing whether the system of legal education is comparable to that in the United States
  5. Investigating the security of the provider’s premises and its computer security, perhaps even including its recycling and refuse disposal procedures
  6. Paying a personal visit to the provider’s facility
  7. Becoming familiar with the data laws in the provider’s country, including whether data might be subject to seizure by a court and whether adequate privacy laws are in force
  8. Learning whether the judicial system in another country would protect client data in the event of a dispute between the service provider and the lawyer
  9. Advising the client of the engagement and securing consent
  10. Exercising appropriate supervision of the work done
  11. Ensuring the provider does not work for adversaries of the lawyer’s clients

Some suggest that firms should also check the provider’s financial stability; the extent and quality of its infrastructure; whether it has experts in legal, outsourcing and project management; and its ability to interface easily with lawyers working on the project. Taken all together, the due diligence issues are a lot to chew on.

Many lawyers will no doubt conclude that it is simply safer to outsource here. But since money makes the world go ’round, it is equally likely that the growth of the foreign LPOs will continue. It’s just plain cheaper to do many things abroad. Remember, though, if that’s a route you want to go to keep clients happy by keeping costs down, be sure to exercise a very high degree of due diligence .

About the Authors

Sharon D. Nelson and John W. Simek are President and Vice President, respectively, of Sensei Enterprises, Inc., a computer forensics and legal technology firm based in Fairfax, VA. They are coauthors of The Electronic Evidence and Discovery Handbook: Forms, Checklists, and Guidelines (ABA, 2006).