eDiscoveryDaily
SCOTUS Says Warrantless Access of Cell Phone Locations Violates Fourth Amendment: eDiscovery Case Week
eDiscovery Case Week continues! We’re catching up on cases leading up to our webcast tomorrow where Tom O’Connor and I will be talking about key eDiscovery case law for the first half of 2018. With that in mind, this is a key case decision that happened when I was on a family vacation last month. Did you miss it? In case you did, here it is.
In Carpenter v. U.S., No. 16–402 (U.S. June 22, 2018), The United States Supreme Court (SCOTUS) held, in a 5–4 decision authored by Chief Justice Roberts, that the government violates the Fourth Amendment to the United States Constitution by accessing historical records containing the physical locations of cellphones without a search warrant.
In 2011, Timothy Carpenter was arrested on suspicion of participating in a string of armed robberies at RadioShack and T-Mobile stores in Michigan and Ohio. In the course of the investigation, FBI agents acquired transactional records from Carpenter’s cell phone carrier. The government sought this data pursuant to the Stored Communications Act of 1986, which allows law enforcement to obtain communications records by demonstrating “specific and articulable facts” that the records are relevant to an ongoing investigation, rather than probable cause that a crime has been committed. The trial court denied Carpenter’s motion to suppress the records, and a jury convicted him of firearms violations and violations of the Hobbs Act. On appeal, Carpenter maintained that the acquisition of his cellular data without a warrant violated his Fourth Amendment rights, but the Sixth Circuit held that such a seizure did not constitute a “search” under the Fourth Amendment. Carpenter petitioned to have the case heard by SCOTUS, which heard arguments in November 2017.
The Court issued its decision on June 22, 2018, with the court split 5–4 to reverse and remand the decision by the lower courts. In a very lengthy ruling, Chief Justice Roberts wrote the majority opinion, with associate Justices Ginsburg, Breyer, Sotomayor, and Kagan joining Roberts’ opinion. The majority determined that the third-party doctrine applied to telephone communications in Smith v. Maryland could not be applied to cellphone technology and ruled that the government must obtain a warrant in order to access historical cellphone records. Roberts argued that technology “has afforded law enforcement a powerful new tool to carry out its important responsibilities. At the same time, this tool risks Government encroachment of the sort the Framers [of the US Constitution], after consulting the lessons of history, drafted the Fourth Amendment to prevent.”
Roberts also considered that “detailed, encyclopedic and effortlessly” tracking a person by cell towers was similar to that of using a Global Positioning System (GPS) tracking device as determined by United States v. Jones. Roberts stressed that the decision is a very narrow ruling; it does not affect other parts of the third-party doctrine, such as banking records, nor does it prevent collection of cell tower data without a warrant in emergencies or for national security issues.
Justices Kennedy, Thomas, Alito, and Gorsuch each wrote dissenting opinions. Justice Alito wrote in his dissent:
“I share the Court’s concern about the effect of new technology on personal privacy, but I fear that today’s decision will do far more harm than good. The Court’s reasoning fractures two fundamental pillars of Fourth Amendment law, and in doing so, it guarantees a blizzard of litigation while threatening many legitimate and valuable investigative practices upon which law enforcement has rightfully come to rely.”
So, what do you think? Does this ruling appropriately limit law enforcement use of private cell phone location data without a warrant or does it hamstring the ability for law enforcement to adequately investigate suspects? Please let us know if any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
Court Declines to Compel Defendant to Produce Direct Messages Between its Employees: eDiscovery Case Week
eDiscovery Case Week is here! We got a head start on it by catching up on a case on Friday, leading up to our webcast on Wednesday where Tom O’Connor and I will be talking about key eDiscovery case law for the first half of 2018. With that in mind, let’s discuss a key case regarding custody and control by Twitter of the direct messages of its employees.
In Shenwick v. Twitter, Inc., No. 16-cv-05314-JST (SK) (N.D. Cal. Feb. 7, 2018), California Magistrate Judge Sallie Kim ruled on several discovery disputes between the parties, including denial of a request by the plaintiffs to order the defendants to produce protected direct messages of individual custodians who are not parties.
In this securities class action on behalf of all persons who purchased or otherwise acquired common stock of the defendant, there were six issues in dispute. One key dispute involved a request from the plaintiffs that the defendants search Twitter private direct messages that each custodian sent and received. The defendants had agreed to provide direct messages for individual defendants Anthony Noto and Richard Costolo only (who had consented to their production). The defendants argued that the Stored Communications Act prevents the disclosure of direct messages from anyone other than a named individual defendant.
In agreeing with the defendants, Judge Kim stated:
“’The Stored Communications Act prevents ‘providers’ of communication services from divulging private communications to certain entities and individuals… Courts have held that the Stored Communications Act prevents a court from enforcing a subpoena issued to a third party ECS or RCS for the protected information.’ Crispin v. Christina (sic) Audigier, Inc., 717 F.Supp.2d 965, 971-72 (C.D. Cal. 2010)… Plaintiffs are correct that a court can compel a party to produce information within the party’s custody and control, but they confuse the identity of the party with the identity of the individual custodians. Here, for purposes of analysis, the Court will treat Twitter as if it is separate from the individual custodians who have direct messages stored with Twitter. The individual custodians other than Costolo and Noto are not parties. In other words, because Defendants claim, without opposition, that Twitter did not require its employees to use direct messages for communications, the Court must evaluate Twitter separately from the individual custodians who have privacy rights protected by the Stored Communications Act. The two named individual defendants, Costolo and Noto, are allowing discovery of their direct messages, as Plaintiffs can issue to them requests for information pursuant to Rule 34 and obtain their direct messages… Plaintiffs merge Twitter and its individual custodians’ rights. They are not the same. If Plaintiffs issued a third party subpoena to a company—not Twitter—for direct messages that the individual custodians sent and received, there is no question that the Court could not enforce such a subpoena. Under the same reasoning, the Court cannot compel Twitter, a party in this litigation, to produce protected direct messages of individual custodians who are not parties simply because Twitter is also the provider of the direct messaging service.”
Ruling on other disputes, Judge Kim: 1) ordered the defendants to search the files of an additional custodian, Jack Dorsey, co-founder of Twitter and former CEO; 2) denying without prejudice the plaintiff’s request that the defendants produce documents from Falquora, Twitter’s internal message board; 3) ordered the defendants to produce documents in unredacted form that were covered by a stipulated Protective Order; 4) denying the plaintiff’s motion to compel documents containing terms “DAU” (daily active users) and “MAU” (monthly active users) WITHOUT PREJUDICE as potentially overbroad (allowing the plaintiffs to re-file the motion with a more specific, targeted approach if they are concerned the other requests for production are not yielding relevant documentation); 5) that the search “engag*” be conducted for documents with that term within 10 words of 20 terms proposed by defendants and up to 10 additional terms proposed by plaintiffs; and 6) denying WITHOUT PREJUDICE the plaintiff’s motion to compel the defendants to produce documents concerning Defendants’ efforts to “maintain, search for and preserve all documents” (which the defendants deemed to be privileged).
Despite the six issues being ruled on, Judge Kim stated “it is clear that the parties have worked hard in meeting and conferring to narrow the issues of dispute. The Court commends the parties for doing so and for presenting the remaining issues for dispute in a clear and cogent matter. The Court is confident that the parties will continue to meet and confer in good faith, narrow the areas of their dispute, and only present to the Court matters which they cannot resolve and which are significant.”
So, what do you think? Should the direct messages of Twitter employees have been ruled out of the custody and control of Twitter? Please let us know if any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
Don’t Be “Chicken”! Consider Having a Good Protocol for Handling eDiscovery: eDiscovery Case Week
We’re getting a head start on next week’s shark week, er, case week here on the blog! With that in mind, we’re catching up on a couple of cases leading up to our webcast on Wednesday where Tom O’Connor and I will be talking about key eDiscovery case law for the first half of 2018. With that in mind, let’s discuss the most notable search methodology order having to do with broiler chicken litigation ever!
In the In re Broiler Chicken Antitrust Litigation, No. 1:16-cv-08637 (N.D. Ill. Jan. 3, 2018), Illinois Magistrate Judge Jeffrey Gilbert appointed a special master (noted Technology Assisted Review expert Maura Grossman) to help the parties resolve eDiscovery disputes. Judge Gilbert and Special Master Grossman issued a very detailed procedure (Order Regarding Search Methodology for Electronically Stored Information) for how the parties were to conduct TAR, including search, validation and document sourcing approaches, split into three primary sections: (1) how the parties will act, (2) what search technologies will be used, and (3) an outline of a document review validation protocol.
In this class action lawsuit filed on September 2016, the plaintiffs alleged that companies in the broiler chicken industry were colluding to limit the supply of chickens to raise, by almost 50%, the prices consumers would need to pay for chicken. In February 2017, the plaintiffs filed their first set of requests for production. With 3 putative plaintiff classes, nearly 30 defendants, multiple theories of liability, and activity covering close to ten years in a $20 billion plus dollar industry, Judge Gilbert appointed Special Master Grossman in October 2017 to address and resolve disputes regarding eDiscovery, which led to this order right after the first of the year.
The order set forth expectations with regard to:
- Transparency and the use of culling technologies prior to search, including de-duplication, email threading, email domains, targeted collections, exception reporting and other culling;
- Search methods, divided into “TAR/CAL” (Technology Assisted Review/Continuous Active Learning) and Keyword Search Processes;
- Document review validation protocol involving specifications for QC sampling, regardless whether TAR or “exhaustive manual review” was used.
The Order also included an appendix, detailing the recall estimation method for a review process involving TAR as well as the method for manual review.
In terms of a model protocol to not only cover how to conduct TAR and/or keyword search, but manage eDiscovery in general, this is a terrific protocol which will certainly be referenced for some time to come.
So, what do you think? Have you been involved in a case where the court ordered a protocol for managing eDiscovery? Please let us know if any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
Want to Learn More About the Sedona Conference Primer on Social Media? Check Out this Video: eDiscovery Best Practices
As we discussed earlier this month, The Sedona Conference® (TSC) and its Working Group 1 on Electronic Document Retention & Production (WG1) have announced the publication of the Public Comment Version of The Sedona Conference Primer on Social Media, Second Edition. Want to learn more about it without reading the 58 page PDF file? Check out this video.
On the blog Techno Gumbo which is maintained by my buddy and colleague Tom O’Connor and the Gulf Coast Legal Technology Center – “gumbo”, from New Orleans, get it? – Tom has just posted a video chat between his wife Gayle O’Connor and noted thought leader Craig Ball regarding the Primer, downloadable here. Both Gayle and Craig have informed perspectives on the topic – Gayle, because of her experience in providing marketing assistance (including social media marketing) to attorneys and legal vendors and Craig, because of his experience as an attorney and Special Master focusing on eDiscovery issues.
Interestingly, both Craig and Gayle had high praise for the Primer. Craig noted that he was “pleasantly surprised” and stated that it was a “very high-quality document”, “carefully thought out”, “very current”, “useful in its structure” and “tremendously balanced for the most part in terms of the interests of requesting parties and producing parties”. Gayle noted that she was “very, very impressed in how they included everything that’s going on these days”, including updates (from the 2012 edition) to reflect the new Federal rules, the ABA guidelines regarding technical competence for attorneys and even the General Data Protection Regulation (GDPR). Both Craig and Gayle also particularly noted coverage of messaging and messaging apps in addition to the traditional sources of social media, such as Facebook, Twitter, LinkedIn and Instagram and they discussed the challenges and considerations associated with social media in eDiscovery in general.
I won’t be “that guy” and spoil the whole conversation; instead, feel free to check out the discussion here. Gayle has also written an article about the Primer on the ACEDS site, which you can check out here.
TSC has scheduled a webinar on the public comment version of the Primer for Wednesday, August 8, at 1 pm EDT. You can register for the webinar here – it’s free of charge to judges, court staff, all other full-time government employees, and to accredited law schools and a minimal charge (no more than $99) for regular folks. As for the public comment period, it’s open for public comment through September 10, 2018. Questions and comments regarding the Primer may be sent to comments@sedonaconference.org.
So, what do you think? Do you have challenges in handling social media in litigation? Please share any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
Women in eDiscovery and South Texas College of Law Team Up for Another Houston Conference: eDiscovery Best Practices
Last year, I was honored to participate in the inaugural eDiscovery “Legal Technology Showcase & Conference” at South Texas College of Law in downtown Houston, hosted by the Women in eDiscovery (WiE), Houston Chapter. The event was such a success they’re doing it again this year!
On September 27, WiE Houston, in partnership with South Texas College of Law and the Association of Certified E-Discovery Specialists (ACEDS), will be hosting the second annual “Legal Technology Showcase & Conference”. The one-day technology showcase will bring together legal thought leadership, innovative technology providers, practitioners, legal support staff and law school students in one venue to network and collaborate on current legal industry trends and innovative technology products.
Thanks to South Texas College of Law, ACEDS, conference sponsors and technology exhibitors, the event is free to attend and open to all professionals within the legal industry including attorneys, litigation support and legal operations professionals, paralegals, legal IT staff, court reporters, consultants, recruiters and vendors.
The conference will feature several educational sessions (with CLE credit!) led by industry experts and thought leaders along with a full day of technology exhibits from leading legal technology providers. The event agenda includes a continental breakfast, welcome keynote, 3 educational sessions, lunch, all day exhibitions, and a post-event happy hour. Attendees will also have the opportunity to enter in a drawing to win a CEDS scholarship courtesy of ACEDS.
The agenda and speakers will be updated as they are finalized, though a preliminary agenda and speaker list are available.
I’m excited to be one of the speakers again this year on the panel discussion AI and TAR for Legal: Use Cases for Discovery and Beyond at 2:30pm and CloudNine is also a Premier Platinum Sponsor for the event (as well as an Exhibitor, so you can come learn about us too).
The conference runs from 8:30am to 5:00pm, with a networking happy hour from 5:00pm to 7:00pm. Both events are at South Texas College of Law in downtown Houston. If you’re in Houston (or could be on that day), click here to register for the event. Based on last year’s turnout, it’s going to be BIG, so register early to save your spot!
So, what do you think? Are you going to be in Houston on September 27? If so, come join us! Please share any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
Public or Private Isn’t the Only Question You Should be Asking about Cloud Solutions: eDiscovery Best Practices
In yesterday’s post detailing the discussion of industry experts regarding the adoption of cloud technology within the legal industry, several points of discussion were discussed, including the differentiation between “public cloud” and “private cloud”. It’s important to know the difference between the two implementations and why you might consider selecting one over the other (and what you need regardless of which one you select). But, public or private cloud isn’t the only question you should be asking about a cloud solution.
To begin to understand what we’re talking about, it’s important to define three terms typically related to cloud computing: Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS):
- Infrastructure as a Service (IaaS) is a service model that delivers computer infrastructure on an outsourced basis to support enterprise operations. Typically, IaaS provides hardware, storage, servers and data center space or network components.
- Platform as a service (PaaS) is a category of cloud computing services that provides a platform allowing customers to develop, run, and manage web applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app.
- Software as a service (SaaS) is a software distribution model in which a third-party provider hosts applications and makes them available to customers over the Internet.
This diagram, courtesy of the site virtualclouds.in, does a good job of illustrating examples of each.
As you can see, the software application residing on top of the cloud platform and infrastructure are separate and unique and don’t necessarily have to be from the same provider. Sometimes they are, like in the case of Office 365 hosted in the Microsoft Azure platform; other times they aren’t, like in the case of Salesforce.com hosted in Amazon Web Services (AWS).
Here’s another diagram, courtesy of YourDailyTech, which illustrates the different components to the solution and what you manage in a) an on-premise implementation, b) an IaaS implementation, c) a PaaS implementation and d) a SaaS implementation.
As you can see, there’s a lot of components to manage. A lot of organizations are managing many (if not all) of those components anyway to support various internal needs for their organizations, but many organizations are turning to IaaS, PaaS and SaaS implementations for at least some of their solution choices. The choices they make are based on several factors, including costs and security requirements. There’s no right or wrong answer here – each choice can be appropriate depending on the organization and its needs.
However, you know the saying that a chain is only as strong as its weakest link? Well, that holds true for cloud solutions as well. Whether you favor a public cloud or a private cloud approach, you still have to vet the software provider on top of that public or private cloud infrastructure. Obviously, when evaluating comparable software solutions, it goes without saying (but I’ll say it anyway) that you should look at the features of the different solution choices and evaluate them against the needs of your organization.
But, you shouldn’t stop there. You also want to evaluate the companies offering the different solution choices as well. How long has each company been in business? What’s the average tenure of their top leadership team? What’s the average tenure of their support and services teams? You don’t want to select a “fly-by-night” company that could be gone tomorrow or a company that has a “revolving door” in key positions where you’re continually dealing with someone new in support or services. Familiarity breeds…comfort – not contempt (at least when it comes to a cloud SaaS provider).
So, what do you think? How closely do you vet the SaaS company providing the solution in a cloud solution selection? Please share any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
The Speed of Migration of Legal to the Cloud is Debatable: eDiscovery Trends
How fast is the legal industry moving to the cloud? And, what is holding some law firms back from migrating to the cloud? These and other questions were discussed in a recent online discussion among industry experts.
In an article sponsored by ReplyAll on Bloomberg Law (Live Conversation: Making Sense of Legal’s Migration (or Not) to the Cloud), Zach Abramowitz moderated the discussion and introduced the topic as follows:
“The migration of the legal industry to the cloud has been, much like the word migration would suggest, slow and deliberate. Although Fortune 500 companies are using cloud based technology to track everything from their back office to their marketing and sales teams — and (as anyone who’s been through an airport can tell you) all the biggest tech companies in the world like Microsoft, Amazon and Alibaba are competing to offer you cloud storage and related services — many law firms are still insisting on keeping client data behind the firewall… Many of the best legal technology start-ups tell me that their #1 obstacle in selling their product is law firm resistance to the cloud. So, as we kick off this conversation, the question I’d like to start tackling today, is what should be the industry standard (we can discuss that too), but also begin by trying to better understand the disconnect between law firms and the rest of the world. With all the information available, is it rationale for law firms to still hesitate when it comes to the cloud?”
Panelists included:
- Alma Asay, Founder of Allegory which was acquired last year by Integreon (where Alma is now the Chief Innovation Officer)
- Dan Baker, Chief of Staff and Director of Legal Operations at Ancestry.com
- Adam Cohen, Managing Director at Berkeley Research Group
- Heidi Fessler, member of the Litigation Department and the eDiscovery, Data and Document Management Practice Group at Barnes & Thornburg
- Bryon Bratcher, Managing Director at Gravity Stack LLC and formerly Director of Practice Solutions at Reed Smith LLP
Here are some of the observations from the panelists:
Asay: “Law firms regularly use private cloud providers, we simply don’t call them that. Legal service providers like Integreon regularly host data for their clients, effectively offering private cloud services, and are well adopted by law firms… Law firms know that they will fight tooth and nail against turning over their clients’ data, and they’re quite sure that service providers that specialize in the legal industry will fight just as hard (or risk never having another client). However, law firms have been less sure about how big companies servicing many different industries would proceed in the face of an order to release data in their possession. This is an issue that has come up time and time again, even as great strides have been made by law firms to understand and accept the benefits of the cloud… I think you’d be surprised how many professionals inside law firms quietly are advocating to use the cloud and recognize the benefits over hosting data inside the law firm, but they don’t feel empowered to execute until the banks do. Just as (supposedly) no one ever got fired for choosing IBM, there is still a sense that no one gets fired for NOT choosing the cloud.”
Cohen: “I think this (the question whether Amazon is handing over client data} is a real issue for some, but it’s not the overriding issue, which is a fundamental ignorance as to the allocation of risk in the cloud and how to deal with it. If you don’t understand the services you are buying, then you can’t assess security appropriately–something lawyers are required to do by virtue of their professional responsibilities.”
Cohen also quoted the headline from this press release “Threat Stack Analysis Reveals 73% of Companies Have Critical AWS Cloud Security Misconfigurations” where Threat Stack, a cloud security and compliance management company, announced the findings of an analysis of more than 200 companies using AWS that revealed nearly three-quarters have at least one critical security misconfiguration, such as remote SSH open to the entire internet.
Baker: “The concern – benchmarked with several large firms – is that cloud solutions may result in a scenario where the cloud provider could read the law firm’s files/email, if the provider wanted to. This could violate privilege or provide alternate, and unexpected, routes of discovery…{With regard to a question from Abramowitz as to whether public cloud providers simply change their terms of service to get law firms comfortable or is legal such small fry for them that they wouldn’t bother} Through a certain lens, yes. Through another lens, there’s booming growth in legal tech – especially surrounding contract and litigation discovery. I expect that public cloud providers will need to update their terms of services to get law firms more comfortable, and that it will be the discovery firms driving the change.”
Bratcher: “Ultimately many law firms are adopting a hybrid approach between a private cloud with a smaller public provider coupled with a cloud area with the larger public providers like AWS or Azure. I would see that trend continuing for the foreseeable future.”
Fessler: “It is hard for those outside of the law firm environment to understand the level of reticence to adopt “new” technology within the legal world. Most attorneys feel an enormous responsibility to keep their client data secure and under their personal lock and key. Unfortunately, this perception of control and security does not equate with fact. It is still common to find otherwise sophisticated attorneys who refuse to use eDiscovery tools and technology and instead running review using Excel spreadsheets. At times this hesitation is also the result of a misdirected drive to reduce legal spend.”
These are just a few snippets from an overall interesting conversation regarding legal’s adoption of the cloud. Click here to view the entire conversation. Tomorrow, I’ll have some thoughts about cloud selection and why the question of private or public cloud isn’t the only one you should be asking.
So, what do you think? Do you think that the legal industry is still slow to adopt the cloud? If so, why do you think that is? Please share any comments you might have or if you’d like to know more about a particular topic.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
FTC Cracks Down on Privacy Shield Posers: Data Privacy Trends
Did you ever wonder what happens if a company falsely claims that they are certified compliant with either the EU-U.S. or Swiss-U.S. Privacy Shield framework? Or falsely claims that they are in the process of being certified compliant? Apparently, the Federal Trade Commission (FTC) gets on their case about it.
According to ACEDS (California Company Settles FTC Charges Related to Privacy Shield Participation), ReadyTech Corporation, a California company, has agreed to settle Federal Trade Commission allegations that it falsely claimed it was in the process of being certified as complying with the EU-U.S. Privacy Shield framework, which establishes a process to allow companies to transfer consumer data from European Union countries to the United States in compliance with EU law (we covered details of the framework when it was introduced over two years ago).
“Today’s settlement demonstrates the FTC’s continuing commitment to vigorous enforcement of the Privacy Shield,” FTC Chairman Joe Simons commented. “We believe Privacy Shield is a critical tool for ensuring transatlantic data flows and protecting privacy that benefits both companies and consumers.”
According to the FTC’s complaint, the Commission alleges that ReadyTech, which provides online training services, falsely claimed on its website that it is “in the process of certifying that we comply with the U.S.-E.U. Privacy Shield Framework.” While ReadyTech initiated an application to the U.S. Department of Commerce in October 2016, the company did not complete the steps necessary to participate in the Privacy Shield framework. The Department of Commerce administers the framework, while the FTC enforces the promises companies make when joining the Privacy Shield.
The FTC alleges in its complaint that the company’s false claim that it is in the process of certification violates the FTC Act’s prohibition against deceptive acts or practices.
As part of the settlement, ReadyTech is prohibited from misrepresenting its participation in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including but not limited to the EU-U.S. Privacy Shield framework and the Swiss-U.S. Privacy Shield framework. It also must comply with standard reporting and compliance requirements.
This is the FTC’s fourth case enforcing Privacy Shield. It continues the FTC’s commitment to enforcing international privacy frameworks, making a total of 47 cases enforcing the Privacy Shield, the predecessor Safe Harbor framework, and the Asia Pacific Economic Cooperation Cross Border Privacy Rules framework.
As you may or may not know, CloudNine is certified for both the EU-U.S. and EU-Swiss Privacy Shield Frameworks (so, yes, at CloudNine we are “certifiable”). :o) Periodically, you have to recertify – in fact, I just completed the recertification process for CloudNine a while back. It’s good to know that somebody is checking up on companies to make sure that their claims of being privacy shield compliant are valid.
So, what do you think? Is your organization privacy shield certified? Are your providers certified? Please share any comments you might have or if you’d like to know more about a particular topic.
P.S. — Happy Birthday, Kiley! You’re now officially a teenager! 😮
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.
Court Rules Search Terms Overly Broad Under Rule 26 in Convertible Top Patent Case: eDiscovery Case Law
In Webastro Thermo & Comfort v. BesTop, Inc., No.16-13456 (E.D. Mich. June 29, 2018), Michigan Magistrate Judge R. Steven Whalen ruled in favor of the plaintiff’s protective order, requesting the narrowing of search terms for ESI production in this patent dispute.
Case Background
The plaintiff manufactures an automobile roof and also a roof-opening mechanism for which it has a patent and claimed that the defendant manufactures a roof-opening mechanism under the name “Sunrider for Hartop” that infringes on their patent. The defendant contended that its Sunrider product is based on prior art, invalidating the plaintiff’s patent.
The defendant requested emails during discovery, but the plaintiff claimed the total emails generated and received by these companies was voluminous and many would encompass matters having nothing to do with this lawsuit. The ESI order from the court contemplated that search terms should be narrowed to exclude extraneous and irrelevant information and that production requests should be limited to eight key custodians and ten search times on each side.
However, the plaintiff contended that the defendant’s proposed search terms were “overbroad, indiscriminate, and contrary to BesTop’s obligations under the Court’s ESI Order,” and despite pre-motion communication between counsel, the parties were at an impasse, leading to the plaintiff seeking a protective order “sparing Webasto from unduly burdensome email discovery, until such time as BesTop propounds reasonable email search requests containing appropriate narrowing criteria.” The plaintiff also requested an order requiring the defendant to cover costs associated with the plaintiff’s production.
Judge’s Ruling
Judge Whalen stated in his discussion, “The majority of BesTop’s search terms are overly broad, and in some cases violate the ESI Order on its face. For example, the terms ‘throwback’ and ‘swap top’ refer to Webasto’s product names, which are specifically excluded under…the ESI Order. The overbreadth of other terms is obvious, especially in relation to a company that manufactures and sells convertible tops: ‘top,’ ‘convertible,’ ‘fabric,’ ‘fold,’ ‘sale or sales. Using ‘dwg’ as an alternate designation for ‘drawing’ (which is itself a rather broad term) would call into play files with common file extension .dwg.”
Judge Whalen continued: “Apart from the obviously impermissible breadth of BesTop’s search terms, their overbreadth is borne out by Mr. Carnevale’s [plaintiff’s attorney] declarations, which detail a return of multiple gigabytes of ESI potentially comprising tens of millions of pages of documents, based on only a partial production. In addition, the search of just the first 100 records produced using BesTop’s search terms revealed that none were related to the issues in this lawsuit. Contrary to BesTop’s contention that Webasto’s claim of prejudice is conclusory, I find that Webasto has sufficiently ‘articulate[d] specific facts showing clearly defined and serious injury resulting from the discovery sought….’”
Counsel for the parties was ordered to meet and confer in order to show a good-faith effort in focusing and narrowing the defendant’s search terms, so that the plaintiff’s production of ESI would remain relevant within the meaning of Rule 26 and exclude ESI that would have no relationship to this case. The defendant was also ordered to submit an amended discovery request with the narrowed search terms within 14 days, after which, a new deadline for production of the ESI would be determined.
Because the opportunity was granted to the defendant to reformulate its discovery request to conform to the ESI Order, the plaintiff’s request for cost-shifting was denied, but Judge Whalen indicated the court “may reconsider” if the defendant “does not reasonably narrow its requests”.
So, what do you think? Is this ruling within the correct interpretation of proportionality under FRCP 26? Please share any comments you might have or if you’d like to know more about a particular topic.
P.S. – The case style refers to the plaintiff as “Webastro”, while the body of the order correctly refers to the plaintiff as “Webasto”.
Case opinion link courtesy of eDiscovery Assistant.
Sponsor: This blog is sponsored by CloudNine, which is a data and legal discovery technology company with proven expertise in simplifying and automating the discovery of data for audits, investigations, and litigation. Used by legal and business customers worldwide including more than 50 of the top 250 Am Law firms and many of the world’s leading corporations, CloudNine’s eDiscovery automation software and services help customers gain insight and intelligence on electronic data.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by CloudNine. eDiscovery Daily is made available by CloudNine solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Daily should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.