Applying E-Discovery Best Practices to Cloud Computing

What implications will cloud computing have for civil litigation? This was the question posed by David Campbell, chair of the Advisory Committee on Civil Rules and professor Richard Marcus, associate reporter of the Advisory Committee in a June 29, 2011, memorandum to the participants of a "mini-conference" of the discovery subcommittee of the Committee on Rules of Practice and Procedure of the Judicial Conference of the United States. The conference convened on Sept. 9 to discuss the possible amendment of the Federal Rules of Civil Procedure to better address issues regarding preservation and sanctions in e-discovery.

The minutes of the mini-conference

According to the minutes of the mini-conference, attendees agreed that advancements in research since the Supreme Court approved the e-discovery amendments to the Federal Rules of Civil Procedure have led to new challenges in e-discovery and preservation. Included among those advancements is cloud computing. The conference addressed cloud computing, calling it, along with social media, a "second generation" issue. One attendee noted the move to cloud computing will likely make the preservation and collection process "more settled," and recognized that e-discovery vendors will in the long run evolve to handle e-discovery in the cloud.

However, U.S. District Court Judge Shira A. Scheindlin of the Southern District of New York, known for her expertise in e-discovery, recently raised the issue of the discovery consequences of storing ESI in the cloud. As Scheindlin remarked, "everyone now is talking about cloud computing, nevertheless ... many people don't know specifically what cloud computing is."

So, how will companies storing information in the cloud fulfill their obligations pursuant to this agreement the Federal Rules of Civil Procedure? The answer is not as complicated as it seems, nevertheless as with any defensible e-discovery strategy, it requires an in-depth understanding of the cloud computing model.

What is cloud computing?

What is cloud computing? Simply put, the cloud is storage of data over the internet. The National Institute of Standards and Innovation defines cloud computing as "a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction." Most people who own a personal computer use cloud computing. Google's Gmail is one example where users can access email on their laptops, desktops, and PDAs from anywhere in the world. The server and email management software is all in the cloud and managed by Google, the cloud service provider.

From a business perspective, cloud computing creates a virtual environment where data and information innovation resources are housed outside of a company's own data center and accessed over the internet. Cloud computing vendors use a global network of locations to house servers and may move data from one server to another to optimize storage space. Remarkably, cloud computing is reported to be able to reduce a company's information research floor space by 80 percent and save significant costs.

The convenience

Despite the convenience and the costs saved by storing data in the cloud, the identification, preservation, and collection of ESI stored in the cloud can be complicated. Nevertheless, by applying traditional best practices in e-discovery to cloud computing, companies can minimize risks and avoid adverse consequences.

Understanding the client's data management systems is the first step to e-discovery and will always be a critical component of any defensible e-discovery strategy. Traditionally, counsel will consult with the client's IT personnel to understand the company's information innovation systems. Counsel and the client can create a data map outlining what data is available within an organization and where ESI resides. A data map can be created at any time, even earlier the client is involved in litigation.

With cloud computing, where data is not located in-house, data mapping requires a different approach. Counsel should first identify the client's cloud service providers and understand where the client's data is physically located. Earlier litigation, counsel should fully understand the client's cloud service providers' document archival and retention capabilities. For instance, some cloud service providers may not automatically preserve metadata, causing spoliation and exposing the lawyer and the client to sanctions by the court. Should the contingency arise, metadata in the cloud may be inseparable among customers of the cloud service provider. As a result, production of one company's metadata could possibly disclose the metadata of another client.

Such provisions and defined capabilities will help the client avoid adverse consequences, including a court holding that ESI stored in the cloud is within the control of the client, in spite of the client's inability to compel the cloud service provider to preserve it. The provider should as well agree to execute data retention and preservation policies previously and afterwards the client anticipates litigation. The contract should set forth policies related to the preservation of data and metadata in the normal course of business.

The cloud is nearly non-existent

Case law regarding e-discovery in the cloud is nearly non-existent. But, as companies continue to use this advanced innovation, federal courts will likely address e-discovery issues in the cloud and analyze the adverse consequences of cloud computing. Meanwhile, counsel can continue to apply the Zubulake reasonableness standard and traditional best practices to e-discovery in the cloud.