Post on 20-Apr-2018
transcript
Place image here
Enterprise Discovery:
The Next Frontier
14 September 2010
2
Jeff Ghielmetti
Director, Collection and Forensics
Svetlana Godjevac, PhD
Sr. Manager, Iron Mountain Consulting
Greg Neustaetter
Director, eDiscovery Product Management
David Bayer
Director, eDiscovery Product Marketing
En
terp
ris
e D
isco
ve
ry:
Pre
sen
ters
3
Core Drivers for Enterprise Discovery
Increase Cost
Predictability
eDiscovery costs too much
Event driven charges are unpredictable
Point solution and multi-vendor
engagements are inefficient
Large matters adversely impact standard
discovery budgets
Be Prepared
Information sources must be mapped
Disposition policies need to be defined and
enforced
Legal holds must be transparently and
consistently applied
Data search procedures must be defensible
Simplify Workflow
Data collection needs to be technology-
based, defensible and non-intrusive
Relevant data should be directly delivered to
early case assessment and review
Inefficiencies of multi-application, multi-
vendor environments must be overcome
4
Discovery as critical business process
Know What
You Have®
Enact retention policies
Automate legal holds
Identify and collect data
Leverage early case assessment
Reduce data volumes
Review/produce documents efficiently
AutomateEnsure deployment of retention policies
and litigation holds; reproducible and
defensible processes, and systemic
cost reductions
IntegrateProvide functional interoperability and
seamless, high-quality data movement
across applications
TransformOperationalize governance
capabilities with discovery as a
consistent business process
Place image here
Enterprise DiscoveryFrom Point Applications to Integrated
Solutions
Jeff Ghielmetti
6
Corporate Challenges: Retention and Discovery
Corporate
Culture + Busy
Employees
Escalating Litigation
discovery need
Many IT Systems
Email,
SharePoint, Web,
Apps, Actg,
Storage, Eng,
DMS, Archives
IT has no funding and
long project cycle Corporate Security
Retention and collection is a low priority until there
is a “Compelling Event”
7
Examples: Retention and eDiscovery
Category Company A Company B Company C Company D
Company Type High Tech Banking Manufacturing Telecom
Number of Employees 37k 91k 25k 12k
Regulated No Yes No No
Culture - employee computer use Users have unrestricted use of computer
Users have restricted use of computer
Users have unrestricted use of computer
Users have unrestricted use of computer
Culture - business driven by technology and innovation
driven by control driven by technology and innovation
driven by technology and innovation
Culture - security Non-intrusive Intrusive and Controlling
Non-Intrusive Intrusive and Controlling
Infrastructure - Order Consolidated and well organized
Not well organized. Not consolidated. Multiple systems and subsystems.
Consolidated and well organized
Consolidated and well organized
Four companies – four totally different approaches.
8
Examples: Retention and eDiscovery
A consolidated approach would meet the needs of all four companies.
Category Company A Company B Company C Company D
Company Type High Tech Banking Manufacturing Telecom
Infrastructure - System Control Limited control Very controlled Limited control Limited control
Litigation Related Events -(negative)
No Yes No Yes
Litigation position re employees Minimize impact on revenue generating employees
Litigation issues more important than day to day activities.
Minimize impact on revenue generating employees
Litigation issues more important than day to day activities.
Preservation Strategy Replicate and Isolate. Leverage backup systems, and exchange
100 % archive and no destruction
Mix of replicate and isolate and forensic image individual machines
Full forensic image of all custodian systems
Retention Program Trying to implement for past 9 years
100 % archive and no destruction
Trying to implement for past 4 years
In place but ineffective
9
Integrated Discovery Meeting enterprise discovery imperatives head-on
Identify &
Collect
• Endpoint devices
(laptops, desktops)
• Pattern matching
algorithms for
intelligence
• Policy-based
identification and
collection
• Metadata based
repository
Archive
• Email, SharePoint,
network file shares,
additional data types
• Repository of record
• Retention policies
• Litigation holds
• Classification
Early Case
Assessment
• Transparently ingest
data
• Faceted search,
advanced analytics
• Identify and tag
documents
• Develop case
strategy
• Filter and reduce
data volumes
Review
• Load data discovery
applications and/or
3rd party collections
• High productivity,
scalable review
• Advanced analytics
• Multi-project/review
team support
• Automated workflow
Place image here
Enterprise DiscoveryEarly Case Assessment
Greg Neustaetter
11
ECA in the Enterprise
• ECA appliances and software must fit within the IT environment to be most successful
• A powerful approach to identification, collection, and preservation involves:
• Email and content archives for content from corporate email, file shares, and collaboration tools
• Endpoint data collection tools for PCs and laptops
• These solutions allow for search, but due to the massive data volumes don’t offer significant analytical capabilities and are more geared towards IT users
• ECA appliances give the legal user a way to analyze collected data, reduce data volumes, and define case strategy
12
ECA for Case Strategy
• Getting access to the data early provides an opportunity for legal teams to better define case strategy
• Figure out who is involved
• Evaluate search terms prior to a meet and confer
• Estimate the cost of document review
• Understand the composition of the collected data
• Advanced search and analytical capabilities reign in complex data sets
• Faceted search and filtering tools help to find the key participants
• Conceptual organization of data brings structure to help in understanding the collected data
13
ECA for Data Reduction
• The biggest cost in eDiscovery is the billable hours of external counsel
• Reducing data volumes is the most effective tool in reducing the cost of legal review
• Primary tools for data reduction in ECA tools
• File type filtering
• Date ranges
• Deduplication
• Inclusive keyword search
• Faceted search
14
Defensibility in ECA
• ECA when done without structure can be a risk to defensibility
• Improper handling of data quality issues
• Skipping of unsupported file types
• Failure to identify non-searchable documents
• Filtering relevant data due to over-aggressive search criteria
• Chain of custody
• ECA tools or users can take steps to limit the risks to defensibility
• Exception reporting and fixing data quality issues
• Support for wide variety of email and document formats
• Search and work product auditing and reporting with rich contextual details
• Random sampling
15
Transitioning from ECA to Review
• To avoid reprocessing data, ECA tools must export all of the raw ingredients needed for full scale review
• Native, near-native, extracted text files
• Load files with document metadata
• Even if two tools support the same load file format, transition may not be simple
• Differing metadata field definitions
• Mapping of metadata fields
• Loss of work product and advanced processing information
• Legacy load file formats
16
Enterprise DiscoveryCombining advanced technologies with integrated processes
File Systems
LaptopsDesktops
High Productivity Review
Archive for
Retention Policies,
Legal Holds
Policy-based Data Identification and
Collection
Early Case Assessment
Search, identify, and directly transfer
emails and documents between governance
and discovery applications
Deliver rich metadata across applications for
granular faceted search and analysis
Chain of custody reporting across
information lifecycle and discovery
Consistent workflow drives reproducibility
and predictability
Project teams that provide matter
management support 24x7 for large complex
reviews
Place image here
© 2010 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron
Mountain Incorporated. All other trademarks and registered trademarks are the property of their respective owners.
Search and Enterprise DiscoveryBest Practices
Svetlana Godjevac, PhD
“I’m feeling lucky”
18
eDiscovery search targets
Collection & Processing
Defining a corpus of potentially relevant data
Fact Finding
Locating all the relevant data
Hot Document
Locating a specific document
QC
Locating documents for purpose of exclusion
19
Creating search terms: understanding the corpus
Knowing the relevant professional jargon and subject matter is crucial.
In addition to interviews/depositions, acquiring that knowledge should include the process of sampling of the data per custodian, business practice, department or relevant business unit.
Sampling should be done to gather:
Referents – names of people, departments, projects, locations, roles, dates, times,
Relations – names of activities, processes,
Code names/neologisms – informal or idiomatic names of projects, people, rules, situations, action codes, dates, times, etc.
.
20
Creating search terms: knowing the search tool
Know your index
Indexes are not created equal. Each search system has its own indexing options. Each provider may turn on a different subset of options.
Know your search syntax rules
Search syntax is not always the same across different search systems, and not all syntactic rules are supported by all providers, even when they use the same search systems.
21
Query building
Ingredients:
key word(s) + operator + disambiguation
(bank OR account OR letter OR signature OR complaint)
(bank OR account OR letter) AND (signature OR complaint)
(bank OR account OR letter) w/25 (signature OR complaint)
(bank w/5 account) AND (letter w/10 signature) AND complain*
agreement
bank
account
signature
letter
complaint
…
AND
OR
NOT
w/10 – within 10 tokens
w/s – within a sentences
w/p – within a paragraph
occurs(bank,5)
*?
eggs AND (ham OR bacon )
(eggs AND ham)OR (bacon) Boolean operators
Proximity operators
Wild Card operators
Occurrence operator
22
Operator Effects
Inclusion• OR
• *
• ?
Exclusion• NOT
• FILTER
Restriction• AND
• w/10
• w/s
• w/p
23
How operators affect search results
NARROWEST
NARROW
BROAD
BROADEST
(bank OR account OR letter OR signature OR complaint)
(bank OR account OR letter) AND (signature OR complaint)
(bank OR account OR letter) w/25 (signature OR complaint)
(bank w/5 account) AND (letter w/10 signature) AND complain*
Inclusive operator
Restrictive operator
More restrictive operator
Multiple restrictive operators
24
How to choose most effective search terms
Narrow Broad
Number of interpretations according to Visual Thesaurus
25
Wild cards: use them sparingly
book* see* man*
book
book's
bookcase
bookcase's
bookcases
booked
bookend
bookended
bookending
bookends
bookie
bookie's
bookies
booking
booking's
bookings
bookish
bookkeeper
bookkeeper's
bookkeepers
bookkeeping
bookkeeping's
booklet
booklet's
booklets
bookmaker
bookmaker's
bookmakers
bookmaking
bookmaking's
bookmark
bookmark's
bookmarked
bookmarking
bookmarks
bookmobile
bookmobile's
bookmobiles
books
bookseller
bookseller's
booksellers
bookshelf
bookshelf's
bookshelves
bookshop
bookshops
bookstore
bookstore's
bookstores
bookworm
bookworm's
bookworms
see
seed
seed's
seeded
seedier
seediest
seediness
seediness's
seeding
seedless
seedling
seedling's
seeds
seedy
seeing
seeing's
seeings
seek
seeker
seeker's
seekers
seeking
seeks
seem
seemed
seeming
seemingly
seemlier
seemliest
seemliness
seemliness's
seemly
seems
seen
seep
seepage
seepage's
seeped
seeping
seeps
seer
seer's
seers
seersucker
seersucker's
sees
seesaw
seesaw's
seesawed
seesawing
seesaws
seethe
seethed
seethes
seething
seethings
man's
manacle
manacle's
manacled
manacles
manacling
manage
manageability
manageable
managed
management
management's
manager
manager's
managerial
managers
manages
managing
manatee
manatee's
manatees
mandarin
mandarin's
mandarins
mandate
mandate's
mandated
mandates
mandating
mandatory
mandible
mandible's
mandibles
mandolin
mandolin's
mandolins
mandrake
mandrake's
mandrakes
mandrill
mandrill's
mandrills
mane
mane's
manes
maneuver
maneuver's
maneuverability
maneuverability's
maneuverable
maneuvered
maneuvering
maneuvers
manful
manfully
manganese
manganese's
mange
mange's
manged
manger
manger's
mangers
manges
mangier
mangiest
manging
mangle
mangled
mangles
mangling
mango
mango's
mangoes
mangos
mangrove
mangrove's
mangroves
mangy
manhandle
manhandled
manhandles
manhandling
manhole
manhole's
manholes
manhood
manhood's
manhunt
manhunt's
manhunts
mania
mania's
maniac
maniac's
maniacal
maniacs
manias
manic
manics
manicure
manicure's
manicured
manicures
manicuring
manicurist
manicurist's
manicurists
manifest
manifestation
manifestation's
manifestations
manifested
manifesting
manifestly
manifesto
manifesto's
manifestoed
manifestoes
manifestoing
manifestos
manifests
manifold
manifolded
manifolding
manifolds
manikin
manikin's
manikins
manipulate
manipulated
manipulates
manipulating
manipulation
manipulations
manipulative
manipulative's
manipulator
manipulator's
manipulators
mankind
mankind's
manlier
manliest
manliness
manliness's
manly
manna
manna's
manned
mannequin
mannequin's
mannequins
manner
manner's
mannered
mannerism
mannerism's
mannikins
mannerisms
mannerly
manners
mannikin
mannikin's
manning
mannish
mannishly
mannishness
mannishness's
manor
manor's
manorial
manors
manpower
manpower's
manqué
manqué's
mans
mansard
mansard's
mansards
manse
manse's
manservant
manservant's
manses
mansion
mansion's
mansions
manslaughter
manslaughter's
mantel
mantel's
mantelpiece
mantelpiece's
mantelpieces
mantels
mantes
mantilla
mantilla's
mantillas
mantis
mantis's
mantises
mantissa
mantissa's
mantle
mantle's
mantled
mantles
mantling
mantra
mantra's
mantras
manual
manually
manuals
manufacture
manufactured
manufacturer
manufacturer's
manufacturers
manufactures
manufacturing
manure
manure's
manured
manures
manuring
manuscript
manuscript's
manuscripts
many
26
Quality control usually leads to iterative refinements
Search term creation is an iterative process involving 4 basic steps:
Search term creation
Search execution and report generation
Report analysis, results sampling and evaluation
Search term revision
27
Documentation: keep a trail of search runs
TERM POPULATION Doc
Count
Date Run No. of Hits Unique Hit
Doc Count
Term 1 Custodian 43 1590 7/01/2011 89 23
Term 2 Custodian 43 1590 7/01/2011 0 0
Term 1 Custodian 55 3260 7/01/2011 2114 907
Term 2 Custodian 55 3260 7/01/2011 32 11
Purpose:
Search term validation
Collection quality check (QC)
Audit trail
28
E-Discovery search - Summary
Science
ArtMagic bullet
Iterative process
Place image here
© 2010 Iron Mountain Incorporated. All rights reserved. Iron Mountain and the design of the mountain are registered trademarks of Iron
Mountain Incorporated. All other trademarks and registered trademarks are the property of their respective owners.
Enterprise DiscoveryReview Security in Complex Matters
David Bayer
30
Ironclad Security for Multiple Review Teams in Complex Matters
Review teams cannot view users and security policies not their own
Review teams cannot share work product that is derived from secured tags, folders, etc. Ex:
- Issue folders based on project-specific secured tag(s)
- Work folders based on project-specific secured metadata
Review team content-based work product cannot be accessed by users in other projects. Ex:
- Redactions
- Highlighting
Native documents and produced documents can be shared between review teams
Project document metadata work product can be shared with users in other parties. Ex:
-Non-search based Work Folders
-Tags
-Annotations
-Coding Fields
-Custom Metadata
Restrictions Permissions
31
Multiple Review Teams in Complex Matters
© 2
009 S
tratify
, In
c.,
Confid
entia
l &
Pro
prie
tary
32
Multiple Review Teams in Complex Matters
© 2
009 S
tratify
, In
c.,
Confid
entia
l &
Pro
prie
tary
33
Multiple Review Teams in Complex Matters
© 2
009 S
tratify
, In
c.,
Confid
entia
l &
Pro
prie
tary
34
Multiple Review Teams in Complex Matters
© 2
009 S
tratify
, In
c.,
Confid
entia
l &
Pro
prie
tary
35
Jeff Ghielmetti
jeff.ghielmetti@ironmountain.com
Svetlana Godjevac, PhD
svetlana.godjevac@ironmountain.com
Greg Neustaetter
greg.neustaetter@ironmountain.com
David Bayer
david.bayer@ironmountain.com
Thank you!