In a Dec. 2008 report, Stamford, Conn.-based Gartner Inc. predicted that spending on e-discovery software technologies and service offerings will grow between 25% and 35% through 2012. A SearchStorage.com survey conducted this year showed that just 14% of the 657 respondents have implemented or will implement e-discovery tools this year.
One key change that drew the attention of corporate legal counsel were the 2006 amendments to the Federal Rules of Civil Procedure (FRCP), which govern civil actions in federal courts. For the first time, the rules spelled out obligations for preserving electronically stored information (ESI).
The industry generally defines the steps of the e-discovery process using the Electronic Discovery Reference Model (EDRM), released in 2006, thanks to the pioneering work of attorneys George Socha Jr. and Tom Gelbmann. Storage processes fall primarily into the left side of the model, where information management, identification, preservation and destruction occur. Those are processes companies are outsourcing less as budgets shrink and data archives grow.
"Because the amount of electronic information has gone up, we're seeing a big move to doing the front half of the EDRM in-house for cost savings," said Debra Logan, a Gartner vice president. "So they do collection, identification, preservation and some processing."
E-discovery technology can cut costs
Patrick Oot, director of electronic discovery and senior litigation counsel at Verizon, said using Guidance Software Inc.'s EnCase eDiscovery technology has meant significant savings in collecting all types of data. Because information is now gathered over the network, for instance, Verizon's security team no longer needs to travel to remote locations.
"Software is definitely replacing a lot of manual labor," Oot said.
Verizon's e-discovery team is making a case to save money on the right half of the Electronic Discovery Reference Model. The group claimed it would save $11 million in outsourced vendor fees over three years if Verizon switched to an in-house system, which would include infrastructure and software for data processing, hosting and review. The proposed litigation support application would require 5 TB to 10 TB of fast networked storage to host most of Verizon's document review needs.
"Obtaining capital expenses is very difficult in this climate," said Oot. "Our business case right now is under analysis by the finance group, and we're awaiting approval."
E-discovery's impact on data backup
E-discovery's impact on storage is primarily felt in the data backup environment, according to Brian Babineau, a senior analyst at Enterprise Strategy Group in Milford, Mass. Corporate counsel often issues a blanket order for IT to save everything -- email, files or databases -- for a specific time period, and most companies have traditionally used tape to preserve the data.
The problems begin when organizations save too much data for longer than they need to keep it, and that data is inaccessible or very expensive to find on tape. At that point, moving to disk-based backup is critical, Babineau said.
"Electronic discovery has provided another catalyst to go to disk-based backup," Babineau observed.
E-discovery has also forced storage teams to build systems of record and, more specifically, archived systems. Implementing an archive is important to ensure that important ESI will be accessible online, easier to search and easier to delete.
"They've had to segregate the backup and archive process as a result of this," Babineau said. "Most companies believe that archiving is saving old backup tapes for long periods of time. And it's not.
"Ideally," he continued, "I would prefer to go to my archive if I get a discovery request, as opposed to having to go sift through all of my backups."
Email archiving and e-discovery
The purchase of an email archiving system often represents the first substantial foray into e-discovery for storage professionals because e-mail is the most requested type of content from a litigation perspective. Even if they buy a product for a purpose other than e-discovery, they soon find it's a godsend in the EDRM's collection step.
The buzz word "e-discovery" wasn't top of mind when DeKalb County bought Symantec Corp.'s Enterprise Vault. Addressing the Georgia county government's email management woes was. Still, the storage staff soon saw requests that had taken eight hours or more to fulfill handled in minutes, and the county realized a return on its Enterprise Vault investment in less than year, according to Curtis Rawlings, the assistant chief information officer for DeKalb County.
"A lot of times, you buy a product for one thing, and you find another use for it," Rawlings said.
DeKalb County used to ferret out email from tapes, and if an employee had deleted a message before the email was backed up, it was lost. Now that the county has Enterprise Vault, management doesn't want IT to delete any messages, Rawlings said.
Of course, this creates larger data stores. "The only problem is that I have to buy more storage, but I don't have any problem retrieving it," Rawlings said.
DeKalb County now stores email on disk, but continues to back up the messages on tape so it won't have to worry in the event of a disk failure. Rawlings is pushing to establish retention policies in concert with the records center, so IT will be able to delete messages that aren't needed for regulatory purposes.
Bellevue, Wash., took its cue from the records management office and state-driven mandates, according to Shayne Williams, a systems administrator for the city. IT retains some content for seven years, some trial-related information longer, and data generated by councilors and directors permanently. The email-retention policy for ordinary employees is 90 days, unless they designate messages as records and place them into special folders, Williams said.
When the city of Bellevue purchased EMC Corp.'s EmailXtender archiving product, the IT department was keenly interested in boosting the performance of Microsoft Corp.'s Exchange Server and reducing the storage demands for email.
Using EmailXtender and disk-based backup, IT was able to slash the response to email requests from as many as four days to approximately two hours, Williams noted.
Deletion policies key to e-discovery strategy
The first EDRM step, information management, applies to both retaining content and deleting data that no longer has any business value or purpose in meeting regulatory demands, stressed Brian Hill, a senior analyst at Cambridge, Mass.-based Forrester Research Inc.
"There are so many organizations out there that take a 'save everything' approach," Hill said. "That's dangerous from a legal risk-mitigation perspective, and it ends up costing them quite a bit in total cost of ownership by taking up additional storage that's not required and slowing down application performance and searches."
Hill said organizations must recognize that all types of electronically stored information, not simply email, are potentially relevant to e-discovery. Some companies have dozens or hundreds of archives that vary depending on the type of content.
"Historically, most of the archiving and retention systems have been deployed in isolation from one another, so they have different classification schemes, different retention policies, different storage strategies and so forth," Hill said. "Simply finding that information, let alone disposing of it appropriately, is really hard because most organizations have a really fragmented infrastructure."
Hill said he encourages organizations to seek out vendors that have the ability to archive multiple content types and apply consistent retention and storage policies.
The preservation step of the EDRM demands that companies be able to prove to the court that relevant data has not been altered. Christine Taylor, an analyst at Hopkinton, Mass-based Taneja Group, said users can put litigation holds on the data in place or in a secure repository where users cannot remove or delete it.
Jerry Karth, a systems administrator at Key Energy Services Inc., said the Houston-based company opted for a document management system and write once, read many (WORM) technology to prove that images had not changed.
Michael Brooks, chief information officer at CVR Energy Inc., said he wants avoid having to declare certain pieces of information as records and move them to a separate records repository. The Sugar Land, Texas-based company uses Autonomy Corp.'s eDiscovery technology to index and search unstructured user data and EMC for disk-to-disk backup. The next step will be nailing down retention policies and locking documents in place, Brooks said.
"I want to be able to find data wherever it is and manage it wherever it is," Brooks said.
Being able to preserve information in place would eliminate the need to make extra copies of information. Single-instance storage technology is also commanding interest in e-discovery circles.
"What everybody is trying to do is get this universe of discoverable data down to manageable sizes," Taneja Group's Taylor said, "because it's enormously expensive to review this data."