As workplace records are kept in more digital locations than ever before, e-discovery experts say companies should ask themselves in advance about the degree of control they have over data stored in third-party cloud servers, instant messages, social media posts, and shared audio files.
More and more companies are using remote networks or cloud services to store their data, but according to Peter Gronvall, managing director in the legal technology solutions practice at Navigant Consulting, many don’t know how to access that data when they’re asked to present it for litigation purposes.
Companies are faced with “a stack of difficulties” when trying to get cloud service providers to produce back to them their own data, said Gronvall, who presented a session on cloud computing at Ontario e-Discovery Institute 2015.
“This has been an enduring problem and I think it’s becoming even more problematic,” he said.
“We’ve seen this huge challenge where our clients are continually frustrated because they cannot get to their own data because they reside in a cloud service provider, who by the way just keeps reminding the clients, ‘We’re not a data production company, we’re a data storage company.’”
Karen Groulx, a partner at Dentons LLP, said these concerns come as a growing number of companies are turning to third-party cloud services for data storage purposes.
“I find it shocking in terms of the growth of the [cloud] industry and how many different types of industries rely on cloud computing and are dependent on third-party providers, basically giving up a large portion of control over their own data,” said Groulx, who added that large companies such as Amazon, Instagram, and Pinterest rely on third-party storage services.
Companies that use cloud services cannot always answer questions around who controls their data, where exactly it resides, or how they can request that data and pull it out for litigation or regulatory purposes, Gronvall said.
Gronvall suggested that companies build litigation readiness into their relationship with cloud service providers, adding that they should also think about ways to make production as low-cost as possible for their third-party service providers.
This is especially important as more small- and medium-sized law firms move from having their own e-mail servers to cloud services such as Office 365, according to Kevin Lo of Froese Forensic Partners Ltd.
When businesses are signing a contract with cloud services, they have to know the limits of their control over their data, said Lo, who added the fact that many cloud computing services are global brings its own set of complications.
Lo said some of his clients have in the past obtained a court order asking their service providers to produce their data, only to obtain incomplete production. When the client complained about the limited scope of the production, Lo said a service provider told them they were only entitled to e-mail production within their jurisdiction.
“You run through those kind of challenges,” he said. “The cliché is that the digital divide is gone, but in reality, it’s still very compartmentalized.”
Part of the trouble with cloud computing is also that the metadata that can be extracted from cloud storage is different from the metadata that would be available on a hard drive of a personal computer, Groulx said.
To add to the complexities, companies are increasingly ditching established modes of workplace communication channels such as e-mail for instant messaging services, according to Lo, who said e-mail is now seen as “passé” and rarely contains smoking-gun materials anymore when reviewed for litigation purposes.
“People are so disciplined on e-mail now. Back in the days, e-mail was just a juicy box of evidence,” he said. “Now you get all kinds of secondary channels of communications in the company,” he said, noting that e-mail is now increasingly being used to intentionally put something on the record.
Instant messaging services such as Slack are entering workplaces. Those messages may or may not be deemed business records subject to production, Gronvall said. He added it’s important for companies to decide in advance if instant messages are to be considered business records, and if they’re not, to have a policy in place to delete them.
Gronvall also said his company has seen a “real uptick” in the use of audio or paper communication in the workplace. “We all know that there are intelligence agencies that have gone back to using typewriters for obvious reasons,” he said.
And then, of course, there’s the use of social media and how best to preserve information that might become important for litigation. “Clients ask me, ‘Kevin, what’s the best way to preserve social media?’” Lo said. “Unfortunately, my recommendation often times is very low tech — take a screen shot and endorse it.”
When clients ask how do they endorse the social media screen grab, Lo said his response is equally low tech: “Print it out, take a pen, and write what time and day it is.”
That’s often the best recourse because by the time an e-discovery expert gets in touch with a social media network and works around how to get that data, the post may have been deleted or the account closed altogether, Lo said.
“It’s so dynamic, so we have to go back to Flintstone-type technology to deal with this,” he said. “We obviously have to shift the way we think about digital evidence.”
