So I’ve been spending a bit of time with the Federal Rules of Civil Procedure and I of course look for connections to the activities I’m involved in such as my day job as Chief Information Security Officer. A trend that I’ve commentated upon heavily over the past two years concentrates on what is being refereed to a “Cloud Computing.” Refer to this link for my opinion on the negative side to this form of virtual technology: https://michaelpeters.org/?p=532. Like all technologies, intelligent deployment and usage yields many positive attributes and the converse applies of course.

Now back to Federal Rules of Civil Procedure. Under rule 26 of the Federal Rules of Civil Procedure, all parties to a federal lawsuit are required to disclose, ideally, without awaiting a discovery request, a copy of all pertinent electronically stored information (ESI) that the disclosing entity has in its possession, custody or control and which it may use to support its claims or defenses.

The disclosing entity is required to produce the information in the form in which it is ordinarily maintained which should be in a reasonably usable format and or in the form specified in the request for production. Companies, or the responsible entity, must take measures to preserve ESI not only at the inception of a lawsuit, but whenever the threat of litigation is reasonably anticipated. In this respect, the entity is required to initiate a litigation hold and cease from further, routine or otherwise, destruction of company documentation which may be relevant to the threatened litigation or actual lawsuit. There is an emerging equilibrium between the company burden and the judicial expectations I wrote about here: https://michaelpeters.org/?p=816 that discusses in more detail the evolution of ESI litigation hold and E-Discovery production.

The interesting twist is that our Data is in part moving into these “Cloud” environments. Look no further than Google documents, Microsoft Live Office or the other plethora of mobile information producing devices pushing information into our social networks to see where discovery is going to go. Now consider that generally speaking, multiple copies of data may be created, stored, recompiled, dispersed, reassembled, and reused, our challenge now will be in the determination of what constitutes a “record” or a “document” for discovery purposes and this becomes exponentially more challenging in the cloud.

The legal requirements imposed by the Federal Rules of Civil Procedure on litigants who store information in these virtualized environments can therefore be quite problematic, as otherwise discoverable and relevant data may not be easily accessible by your technical staff or by the service providers. First, your information may not be properly preserved or it may be intermingled with other entities data making it difficult to observe territorial boundaries and the privacy of others. To avoid this pitfall, you should acquaint yourself with the service provider’s information retention policies. If litigation hold needs to be initiated it will most likely be imperative that data be properly segregated and retained. Serious penalties exist for failures to produce ESI and the loss of it due to a routine, good-faith operation of an electronic system will most likely not be an excuse.

Now back to the books.