Netmail Blog

InfoSec for eDiscovery

Posted by Benjamin Wright

Nov 15, 2017 3:42:11 PM

InfoSec for e-Discovery

The security and confidentiality of records produced in eDiscovery are becoming more urgent issues. These issues can be addressed with Netmail’s Hadron federated search tool.

Traditionally eDiscovery in a lawsuit means records are physically delivered from the producing party into the possession of the requesting party. The records can contain highly sensitive data, such as medical details, trade secrets, personally-identifiable information about consumers and the like.

In the old days, records produced under eDiscovery were printed on paper or recorded to a stand-alone CD, which was viewed from a stand-alone PC. They were easily kept secret and secure in a locked safe or office.

But today they are delivered in electronic form such that the requesting party stores and/or accesses them by way of a network. That network might be the local (Internet-connected) network within a law office, or cloud services performed on behalf of the law office. In any case they are vulnerable to hackers.

Network security is not like physical security. Good network security requires sophisticated resources. But even sophisticated organizations can be breached, as has been demonstrated by many high-profile data breaches like Equifax, Target stores, and Office of Personnel Management.

REQUESTING PARTIES LACK SECURITY EXPERTISE

eDiscovery thought leader Craig Ball observes that many of the parties -- like plaintiff law offices -- requesting eDiscovery simply do not have the expertise to protect the records they are requesting. See “Cybersecurity’s a Pain Point for Plaintiffs,”  May 31, 2017.

Ball argues that the parties producing records are therefore justified in delaying the production of records – maybe indefinitely – until the requesting party can prove it has a good security program: policy, staff, training, encryption, two-factor authentication, audit and so on. Proving such security is a tall order for many law offices.

But security concerns should not be allowed to frustrate otherwise legitimate eDiscovery demands. This is where Netmail’s Hadron can step in. It enables an alternative process. Instead of transferring possession of records to the requesting party, Hadron can make records available to the requesting party, but under the security umbrella of the producing party, the party that created and possessed the records in the first place.

FEDERATED SEARCH

In accordance with an approved and supervised eDiscovery plan, the requesting party could use Netmail Hadron to access records within the producing party’s IT domain.

Netmail Hadron can locate data in many different formats, such as email, PDFs, office documents, and unstructured data. It can search through different platforms, whether they be on premise or in a third party cloud. These platforms can include Exchange, Sharepoint, PC harddrives, Box, Office 365, and more. Netmail Hadron creates an audit trail to show what was searched, when it was searched and what the results were.

Netmail Hadron can show who accessed which records and when they accessed them.

The requesting party could only access permitted record sources (such as email archive or PC harddrives) using permitted search queries. But at the same time Netmail Hadron could maintain the confidentiality of the requesting party’s work, preventing the producing party or anyone else from snooping on details without permission. Hadron could allow the requesting party to save search results and leave confidential notes and audit trails within searches.

Hadron could confirm that no records actually left possession of the producing party. Thus the normal security that the producing party applies to the records would remain in place.

NEW KIND OF COOPERATION REQUIRED

The eDiscovery process proposed here is not the traditional process. It requires a new kind of cooperation by the producing party. But eDiscovery has always required cooperation. Cyber security issues are now forcing us to venture into a new mode of cooperation.

==

This is the second in a series of blog articles about new advances in eDiscovery.

==

Benjamin Wright is a practicing attorney based in Dallas, Texas, and an instructor at the SANS Institute teaching a 5-day course titled “Law of Data Security and Investigations.” http://benjaminwright.us

 #netmail #hadron #eDiscovery #darkdata #cybersecurity

 LEARN MORE

Topics: compliance, Netmail, eDiscovery, Software, New Release, Exchange, SharePoint, Audit, Dark Data, Box, Hadron, Target, Equifax, Office

    

Subscribe to Email Updates

Recent Posts

Follow Me