It pointed out the privacy pitfalls of social networking for individuals and companies, and used a couple of examples of people who had posted stuff they really wished they hadn’t, such as posting a picture of themselves at a party (in full fairy regalia no less) after they had called in sick.  That is, let us say, somewhat careless and a lot naive. 

There will be no prizes for guessing the ages of the individuals who do this kind of thing, one need only look at the demographics of the Facebook population.  Youth is not the sole province of stupidity, stupidity has major branches in all ages, nations, races and creeds.  Perhaps what I am talking about here is inexperience or an inability to learn from it.  Its been a long time since most people  my age have turned up anywhere in full fairy regalia, though I do have a Halloween picture from when I was five, dressed as Glinda the Good Witch, or a reasonable approximation thereof.  The thought of my own youthful indiscretions recorded forever on a social networking site sends a shiver down my spine.  If I do ever don a Glinda costume again, it will be after I’ve won ‘Britain has talent’, and ala Susan Boyle, I’ve landed the part in Wicked.  So, never.

Kids these days, eh?  It must be because Digital Natives are so different from ‘us’.  NOT.  This sort of posting-a-picture-your-friend-took-of-you-unconscious-on-the-sofa story proves that people really don’t change and there are many out there committing the same indiscretions that you and I did, except many of them are doing it for all the Web 2.0 world to see.  Its like running with scissors:  all parents say not to do it, but younger people  think they are immortal and invincible, not to mention having superpowers.  None of their friends has ever put an eye out or gotten into hot water over a Facebook posting.  Why are you buggin’  me about it, Mom?

All of this demonstrates once again how important it is to have company policy regarding the use of social media.  Don’t Twitter about trade secrets, for example, or about the fact that your boss is an ogre and your company run by people who could not organize a drinking competition in a brewery.  Behavior that puts your business at risk needs to be a sackable offence.  It would seem to be common sense, but I’ll bet some are doing it, as some are posting pictures of themselves doing something else while they are bunking off work. 

Your policies should reflect the distinction between public and private.  Risks to the business should be mitigated with guidelines, the simpler the better.  Most people have a sense of where the line is, although it is not a very bright one. They can be trusted not to cross it, mostly.  Behavior that is illegal immoral or just plan daft in the workplace is out of bounds no matter what medium you are communicating in.  And if you do get employees harrassing each other in email, or planning to cook the books onTwitter, or any other form of electronic media that leaves a record, that’s a good thing:  it makes them easier to track down, fire and prosecute. 

The biggest challenge for all of us whether we be digital natives or not, is deciding on the line we wish to put in place between our personal and professional lives.  That’s going to take a while.  People will make mistakes and they’ll pay for them.  That’s just Life.

Meanwhile, how about using this rule:  Before you email, blog, Twitter, update your status on Facebook or anything else, imagine yourself on the witness stand with this being read out in open court.  And oh, yeah, your Mom is in the courtroom.  She’s waving a pair of scissors and saying ‘You never listen and NOW look what’s happened.”  That ought to keep everyone in line.

Not so much.  At last weeks’ Governance Risk and Compliance Summit in Chicago, I learned that there are still many IT types being handed instructions like, ‘Keep all the responsive data’, ‘Data retention policy is your job because data management is your job’, ‘Its up to YOU to create an e-mail usage policy’.  Because the dialog has started, at least among our clients, I also had a chance to hear it from the lawyer’s point of view. 

They are being told things like “Well, we ran the searches you asked for with the keywords you asked for and we got 10 million hits.  They’re here:  c:/lawyer_archive/XYZ-SNAST4.6.27.9/that_ought_to_keep_you_troublemakers_busy_for_a_while.  Let us know if you need any help.” 

Those aren’t dialogs, they are a lazy cop-outs and/or a grave lack of understanding of what really needs to happen.  I used the word grave with intent.  Not understanding technology is becoming a handicap for lawyers and indeed at least one high profile Magistrate Judge has stated that lawyers need to understand technology to do their jobs.  Electronically stored information is now the predominate form of business record.  Lawyers (partners, not junior associate spear carrying types) who know this area stress the need for involvement from senior litigators, because e-Discovery is can often be a strategic issue in preparing a case.

 In dealing with e-Discovery, retention and policy issues, our cardinal piece of advice remains to set up an on-going dialog with one another:  legal and IT. Hey, you might even want to include those much maligned but sadly necessary ‘business users’ at some point. Many companies do already do this, don’t get me wrong, and we are seeing the creation of more positions that are liaison positions, permanent links between the two groups.    But there is still a long way to go.

Here’s some do-it-yourself advice if you need it, particularly if you are from IT and are feeling overwhelmed with the tasks you may be being given to do around e-Discovery. 

Begin by familiarizing yourself with the e-Discovery Reference Model (www.edrm.net).  You can read all about it there, but I use it to explain the process to IT clients and demonstrate to the lawyers which technology can be used for what part of the process.  The EDRM is vendor neutral, the steps are explained in a wiki on the site, and it really does  help to clarify and explicate the issues.  There are Those Who Say that the model is too simple and doesn’t include things like ‘early case assessment’ (ignore this if you are a novice.)  But we still find it very useful, despite its relative simplicity, and those that do the most complaining are the vendors that can’t sell what they have based on the model.  Simple explanations are always the best, IMHO, and if something cannot be explained simply, then the person doing the explaining doesn’t really understand what they are talking about in the first place.  Either that or they are trying to confuse you into a panic-y state to soften you up for something, usually signing a contract.

So, I will continue to repeat myself, even though I feel I must be boring everyone into a stupor.  My advice does meet my own criteria after all, in being simple:  go knock on the door of your inside counsel and start a dialog.  If you are a lawyer, don’t expect your IT partners to understand what you are talking about when you say ‘Save responsive documents’.  If you do, don’t be surprised when they then complain that the ‘litigation hold policy’ is costing them too much and taking too much of their time.  It is not reasonable to ask them to do this:  storage of electronic information is NOT cheap, despite any rumours you may have heard.  Neither legal or IT should return to their respective tribal habitats until both sides are sure they understand what is being said.  House counsel and in-house IT are on the same side.  Indeed, according to The Sedona Collaboration Proclamation(www.thesedonaconference.org/), you should even be co-operating with your adversaries, on discovery issues anyway, and save the fighting for the substantive issues of the case.  See?  I can speak a bit of Lawyer.

The evidence from the conference is clear.  Two and a half years after the changes to the Rules of Civil Procedure, the respective responsibilities of legal and IT still are not being carried out by many because they don’t understand them.  Only dialog between legal and IT will change that.

For those of you who are interested, please pay attention to how many times I can work this very trendy phenomena name – Twitter – into my post without actually having to figure out how to participate in it, i.e., Twitter, (or maybe Tweet) it or understand more about it than I already do and just wait for the hits to roll in. That’s leverage.

Last week, my boss sent me a link to a site called lawyersusaonline.com. Who says all lawyers are technophobes and Luddites? Not me. Some of the most go-ahead technologists I know are lawyers. She asked me if it was worth a First Take (a kind of publication we do to get our first thoughts about newsworthy items into the public domain). Here is the relevant para from the post:

Twitter posts are like any other electronically stored information,” explained Douglas E. Winter, a partner at Bryan Cave in Washington, D.C. and head of the firm’s Electronic Discovery unit. “They are discoverable and should therefore be approached with all appropriate caution.”

Winter said tweets could pose a myriad of legal problems, from the unauthorized posting of copyrighted material to the disclosure of trade secrets or confidential information to explicitly actionable behavior like libel.

I told her that this was not a newsworthy item. She can’t have known: most people who don’t actively follow e-discovery or privacy issues might not.

The reason this is not newsworthy but is worth a blog post and why the Bryan Cave post is a bit behind the times as well, is that simply put, ‘everything that exists is discoverable’ at least pretty much. This would apply to any tweets that had been stored by a company or a user or anyone else. Attorney client communications, data deemed to be inaccessible for technical reasons and a few other kinds of electronic data may be protected, by a specific legal principles or by time and cost constraints. Information deemed to be privileged may also be withheld, but note that you can only do that AFTER there are lawyers involved, meaning you are already in the soup. At that point, you are paying a legal professional to actually read stuff and determine its status in a given case. You’ll already be writing checks.

I’m not claiming this is an exhaustive list, but certainly if something exists, it is subject to legal discovery. Persons outside your company (or not you, in the case of e-mail and other more personal forms) can look at it if they can convince the judge they have a reason. If someone has been up to no good, or are even accused of being up to no good, or wants to prove that they have not been up to anything even remotely unsavory, you can pretty much count on the information being subject to disclosure. It won’t often happen, in fact in the grand scheme of things, it rarely ever does, but it could be.

So you do need a Twitter policy, but that policy mostly consists of common sense. And of course, everyone is likely to act reasonably most of the time. But. The piece goes on to suggest that ‘data needs to be preserved’, implying that we should all be saving Tweets, I guess. That’s where the confusion comes in. The juxtaposition of these thoughts might lead you to believe that it is standard legal advice is to ‘save everything’. As it happens, it often is standard legal advice to save everything. There are very few instances, however, in which you are required to ‘save everything’. If you are covered by the SEC rules that all broker dealer communications be saved for a period of three years, you’d better be doing something about your broker’s tweets.  In a way, you’re lucky if you are covered by that rule.  Most of us wish the rules were as clear for us.  As one SEC official allegedly put it:  when we said everything, we meant everything.  If someone throws a brick through your window, with a note tied to it, you need to save the note, the brick and the string.  But alas, that is not most of us, and we must decide, ourselves, what happens to the note, the brick and the string.

A well thought out, consistent policy, one that is enforced, for all electronic communications, is what you need. And you do need to seek legal advice, as well as best practice advice. Gartner does not give the former, but we do give the latter. We would always recommend that any policy be vetted by legal counsel or outside counsel. However, a policy you craft yourselves, with business leaders and house counsel, using best practice advice from Gartner, the Sedona Group, an ABA publication or a myriad of other sources is going to be a great deal cheaper than some other alternatives.

The law firm of Brian Cave advises us to be cautious, therefore, in our communications. That’s great advice. But how many of you can honestly say your are ALWAYS cautious? Have you ever sent a negative email about a colleague or your company? Attached a copyrighted document to an email, even though you did not have permission to do so? Twittered sarcastically? Posted something on Facebook (like a picture of yourself on the beach when you had called in sick at work?) that may have come to the attention of H.R.? (What? They can look at my Facebook? Yeah, given the right set of circumstances, ‘they’ can and so can the jury).

So, do be cautious but being cautious does not involve a policy of saving everything forever just in case.

As the lawonline post points out ‘de-contextualization’ on media like Twitter is a lot more likely, due to the limited bandwidth. So if you leave it hanging around and it does become subject to discovery, there is gonna be lots more explaining to do. And if you do have a policy, be sure to enforce it, because having an un-enforced policy is worse than no policy at all. Here’s my tip of the day – users don’t go and clean up old email files or any other kind of files even if you ask them nicely. Sometimes they don’t act reasonably or even in their own best interests. Enforcement is a function of legal consideration coupled with IT implementation.

As recently as late last year, I was a confirmed cynic, dismissing the whole ‘blog’ thing as an exercise in self promotion, a shameless display of one’s personal life and habits for all the world to see, a sign of the dissolution of consensus and the body politic, as we fragmented into a ba-zillion little self interest groups, gazing lovingly at our own navels and calling it ‘social software’. I had better things to do than either write blogs or read them. Anyway, where would I have started? There were and are so many of them. Then I read ‘How the Internet is Destroying Our Culture’ and become truly unbearably smug, as it seem to crystallize and confirm my own mushy and half formed opinions about the utter uselessness – nay DANGER – of it all.

How much more mistaken could I have been? Thanks to colleagues, many of whom I count as friends, I had the scales fall from my eyes. What sealed the deal for me, after a long and somewhat heated exchange with Gene Phifer, Daryl Plummer, Ray Valdes, Tom Austin and other Gartner analysts, was when someone pointed out that Our Competitors, bloggers to a (wo)man, had readership in the millions, while they, and I, with what we think of as more to offer, had readership in the thousands. If we were lucky. With our content locked behind the firewall of Gartner’s subscription model, you had to pay to find out HOW SMART WE WERE. But you’d have to take that on faith, cause of course, you’d never heard of us, cause our content was locked behind the firewall. DUH!

So here I am, writing my first blog entry.

Besides confessing my sins, my main subjects in this blog will be those that I cover for Gartner and probably the occasional rant about something that really bothers me, which I am of course discouraged from doing by my boss, my colleagues and my editors, when publishing ‘officially’ for Gartner. Another opportunity missed in my anti-blog days: Cheap Therapy.

Right now, my main area of interest and research are around the topics of e-Discovery, Information Governance, Legacy Content Management, Records Management, Content Archving and a few other things as well. In e-Discovery in particular, I feel that there are vast gaps of understanding and knowledge between the technical and legal communities and that we must get to grips with a problem that has huge implications for our justice system in the United States, not to mention business competitiveness. In the (related) area of information governance, I like to think about things like what companies should do with their e-mail (don’t save it all, but don’t throw it all away, either), legacy documents (what is in that 10 Terabytes of stuff on the SAN and the file servers, anyway?) and legacy content.

I don’t see any of these issues as issues for IT, but ones that effect all of us in business, politics, you name it. To the extent that we are alive now, we must all deal with the issues of how much information is too much, who to trust in the vast universe of content on the internet, how we make personal or business decisions, when we feel we can never have a complete picture. And oh, yea, how about all those right or left or center wingers, flaming away over there on those other blogs/wikis/twitter sites?

Like it or not, we’re all blogging now, including lawyers discussing e-discovery and other topics I’m interested in.

One of the best (laywer) sponsored sites for e-discovery (let’s give the people some value here, I haven’t compromised my original anti-blogging principles THAT badly, I still want to write stuff worth reading) is this one, http://www.ediscoverylaw.com/articles/ediscovery-case-database/ at K&L | Gates – W.H Gates Sr founded firm in case you are wondering if they are related.  It contains reasonable synopses of e-discovery decisions and you can also download the full text of most of them from there, if you are stuck for something to do on a rainy Saturday afternoon.  They can be surprisingly amusing.

Excuse me, while I go and figure out how this software works. Tell me it has a spell checker.