What's in a Cloud?

By Daniel Kavan, Electronic Evidence Consultant at Kroll Ontrack

The term “cloud” simply refers to the Internet. Cloud computing means utilising computer services via the Internet – most commonly data storage and processing power (Infrastructure as a Service, or IaaS) and software applications (Software as a Service, or Saas). Organisations looking to cut the cost of data storage, improve the efficiency of their servers and integrate with partners more easily are increasingly turning to cloud computing solutions. Companies of all sizes already use cloud environments – whether private, public or community clouds – to house electronically stored information and run essential business functions remotely. This broad-spectrum adoption illustrates the substantial cost and efficiency benefits that cloud technology affords.

Individuals are also benefiting from cloud-based solutions. Webmail services have been around for 15 years (Hotmail, the first popular webmail service started in 1996)¹, and other consumer applications are becoming more popular – take for example recent launches of Apple’s iCloud storage solution and Microsoft’s Office 365, an online Office suite.

Introducing C-Disclosure

But the difficulties and challenges that come with converting to virtual environments are still emerging, leaving many organisations feeling uneasy. Apart from important contractual considerations when entering into agreements for cloud services, probably the biggest legal issue in cloud computing is in relation to finding evidence held in the cloud. How does e-disclosure in the cloud differ from e-disclosure in on-premise data locations? And how can the cloud be used to help battle the ever-growing burden of dealing with large volumes of electronically stored information (ESI)?

There is a key distinction in how cloud computing affects e-disclosure: leveraging the cloud for core IT functions – such as e-mail or document retention – versus deploying a cloud-based SaaS solution to facilitate the processing, review, analysis and production of documents during e-disclosure.

The difficulties and challenges that come with converting to virtual environments are still emerging, leaving many organisations feeling uneasy.

Identification, Preservation and Collection of Evidence in the Cloud

Imagine an organisation which utilises the cloud for a variety of its document handling, and has a sudden obligation to disclose documents to a regulator or another party in litigation. The first step in the scoping exercise is the identification of where potential evidence might be. Preparation for this type of situation is the key. Pre-emptive data mapping is essential so you know, as far as possible, what information is stored where.

It is also important to consider what might need to happen when the organisation places a legal hold on its cloud-based ESI. When IT is in-house, this might trigger actions such as taking backup tapes out of circulation, and automatic deletion routines being halted for data accessible to relevant individuals. As far as possible, this approach should be reflected in the SaaS environment.

When it comes to collecting electronic evidence, traditionally the solution has been to either instruct local IT resources to implement collection or to invite computer forensics consultants onsite to assist. Such an approach may be challenging, if at all possible, when the data is stored with a third party that stores others’ confidential data. Not to mention in a potentially in a hard-to-reach location. It is important that the cloud provider cooperates in extracting the necessary data in a forensically sound manner and at a reasonable and proportional cost.

The best approach to overcome these challenges is planning from the outset of introducing the cloud, and incorporating cloud data and services into data management plans; including data retention policies, security policies, business continuity policies and discovery response plans. Discovery response plans should address how litigation holds will be implemented and data reserved or extracted for use in legal proceedings.

Using the cloud to Process, Review, Analyse and Produce Evidence

It is clear that the cloud can bring significant challenges in identifying, collecting and preserving evidence. However, cloud technology has also helped make e-disclosure more efficient.

Harnessing the cloud to help with e-disclosure isn’t new. The cloud has been used to manage documents for disclosure electronically for more than ten years. For example, our very own online, hosted review platform was first released to assist lawyers in reviewing documents in 2001.

Cloud-based solutions such as this allow lawyers to securely offload the infrastructure-hungry process of extracting and indexing large volumes of electronic documents for searching and review, and store the resulting documents in a system that allows a collaborative review process. Outsourced electronic disclosure providers allow law firms to benefit from the efficiencies of the latest document review technologies, accessible from anywhere in the world, with no upfront capital cost to lawyers or their clients.

The Silver Lining

Cloud computing is just a fancy name for what you are likely already doing, whether on a personal, corporate IT or evidence management level. The outlook is cloudy with the adoption of SaaS and other uses of the cloud increasing. Accordingly, it is important to understand and prepare for the need to harvest information from the cloud, and to consider leveraging the power of the cloud to manage the resulting evidence.

Daniel Kavan is an Electronic Evidence Consultant at Kroll Ontrack.

Disclaimer
This document is neither designed nor intended to provide legal or other professional advice but is intended merely to be a starting point for research and information on the subject of legal technology. While every attempt has been made to ensure accuracy of this information, no responsibility can be accepted for errors or omissions. Recipients of information or services provided by Kroll Ontrack shall maintain full, professional, and direct responsibility to their clients for any information or services rendered by Kroll Ontrack.

¹Dick Craddock, A short history of Hotmail.