The Hidden Liability in Legacy Data

IT organizations around the world are charged with protecting corporate data assets. All data, including sensitive executive e-mail and intellectual property documents, is managed by IT for the purpose of safekeeping. Lawyers and legal staff are now starting to participate in the process of managing corporate records. Policies are being developed that help manage the corporate liability around data and ensure that information is not only protected and available, but also handled according to corporate policy. This emerging area is known as Information Governance.

Wikipedia defines Information Governance as “the set of multi-disciplinary structures, policies, procedures, processes and controls implemented to manage information on all media in such a way that it supports an organization's immediate and future regulatory, legal, risk, environmental and operational requirements.” Organizations that face frequent litigation or regulatory oversight are quickly implementing information governance strategies. However, these strategies commonly focus on the current or online data assets, and often neglect the hidden data. The latter is found in historical archives that typically consist of legacy backups of corporate networks. It is common for large organizations to have tens or hundreds of thousands of backup tapes stored in offsite vaults gathering dust. These vaults are protecting the tapes from corrosion and destruction, ensuring they are kept in readable condition. Since these corporate records are not going anywhere, they need to be included in the information governance strategy in order to control the potential hidden liability. Out of sight cannot be out of mind.

Challenges Surrounding Backup Tapes

Most organizations don't know how many tapes they have, where they are located, and what content exists on them. The sheer volume of unknown data is a massive liability for corporate legal departments. As such, many organizations are beginning to develop a roadmap to address this liability and get these legacy records off tape and under control.

Tapes have been used over the years to back up corporate records. They are inexpensive and convenient for IT. Although many firms are moving away from tape to newer, more convenient methods of backup, many historical tapes exist and are still being generated daily. As a result, organizations are faced with large volumes of legacy tapes that potentially contain massive volumes of liabilities.

Why worry about these tapes? Can't the liability be hidden behind the undue burden argument, where lawyers can argue in the courts that it is extremely complex and expensive to search and collect unstructured files and e-mail from backup tapes? Not anymore. You can easily find many cases where the judges have issued fines and sanctions against plaintiffs that came to court without the relevant data to support the case. Judge Shira A. Scheindlin, of the well-known Zubulake e-discovery cases, and more recently The Pension Committee of the University of Montreal Pension Plan, et al. v. Banc of America Securities, et al., No. 05 Civ. 9016 (SAS), found six of the plaintiffs “grossly negligent” because they “fail[ed] to institute a timely written litigation hold, [failed] to collect or preserve any electronic documents prior to 2007, continued to delete electronic documents after the duty to preserve arose, did not request documents from key players, delegated search efforts without any supervision from management, destroyed backup data potentially containing responsive documents of key players, and/or submitted misleading or inaccurate declarations.”

It is also well documented that if relevant data is not obtainable on corporate networks, then backup tapes are the next source for ESI collection. At the 2010 Georgetown eDiscovery Institute, Judge Scheindlin reiterated her Pension Committee opinion to “preserve backup tapes when they are the sole source of relevant information or when they relate to key players, if the relevant information maintained by those players is not obtainable from readily accessible sources.” Judges have become aware of tapes and are requiring collection of data from this source. Additionally, the complexity and expense around backup tape collection has been reduced significantly due to new technology that eliminates the technical requirements for restoring content. Companies that are not taking note of this trend and continue to ignore tapes and rely upon the burden argument are heading down a very risky path. If they don't take action on these legacy records now, they will have to in the near future ' and it will be a more expensive and painful process.

What Makes Tapes Complex?

Why do backup tapes have the perception of being complex and difficult to deal with? Because data that is archived to tape is backed up in a proprietary format. Vendors like EMC, IBM, and Symantec have proprietary backup software that gathers unstructured files and e-mail into a container and moves them to tape. The engineering behind the backup software aims to protect data being backed up to enable recovery in the face of disaster. This turns tape into a container to which only the software vendors have access. The method of getting specific files and e-mail from tape has been to utilize the specific version of the specific backup software, restore all the data from tape (even if you only want one e-mail), index it, search and find what you need, and move it to a review platform. This process is complex and time consuming. If you have tapes that are more than a few years old, it is extremely difficult to find relevant data because the backup software used to make the tape is now out of production and not readily available. This is why specialized vendors exist: to restore tapes for discovery.

What Has Changed?

Technology has saved the day here. New approaches that eliminate the complexity of backup tape discovery are now available. As referenced in “Using Software to Sift Digital Records,” by Nathan Koppel, in the Nov. 23, 2010 issue of The Wall Street Journal, this technology makes discovery of content simple and affordable and enables organizations to implement their data policies on legacy tape. IT and legal can now work together to implement policy concerning what to keep, and more importantly, how to shred or destroy what they do not keep. This same technology is well understood by the courts and has had a significant impact on the undue burden argument. It is now only a matter of time before this legacy content is processed and the appropriate information governance actions are taken in order to control the hidden liability locked in these archives.

Now, technology can simply scan the tapes and enable full discovery of the content and other parameters, such as date ranges, custodians, locations and more. The key here is that once the relevant data is found, and the duplicates and irrelevant files and e-mail are set aside, it can be extracted from the tape. Since typically less than 5% of the tape content is of interest, this process is significantly more cost-effective compared with the old method of restoring all of the content. IT organizations can now use in-house resources to make legacy data discoverable. Legal teams can now search and find what they need according to policy. Data that does not need to be kept according to policy can be discarded. The liability is managed, and the added IT expense of storing these tapes in offsite storage is eliminated.

Why Embrace Tapes?

Tapes contain a wealth of knowledge. Valuable corporate records are archived on tapes. These archives are point-in-time snapshots of network data. By embracing this fact, legal teams can clearly benefit from the reliability of tape content. Consider the following:

• Backup tapes are a true snapshot of everything on the network within a specific point in time. If you want to collect an e-mail from John Doe in June 2006, you can easily pull the backup tape from this timeframe, search and extract the specific e-mail. That e-mail will be exactly as it was on the date in question.
• Since tapes are a proprietary container, they are tamper-proof. When a litigation hold is requested, tapes are the more reliable source versus online network data. Asking a user not to delete e-mail or change files is risky. Why not go to the backup tape, where you know the data is secure and untamperable?
• Backup tapes contain a wealth of corporate records. Archives and records management systems are being deployed in many organizations in order to comply with new information governance strategies. These archives create value over time as data trickles in. Why not leverage the historical records on tape and back fill the archives with relevant records? This will give the archive immediate value and make legacy data available for the business processes for which it is required.

Many organizations are changing their perception of tape. Tape has gone from foe to friend. Having once seen tape as threat, IT and legal teams are now proactively dealing with tape-bound legacy data and taking advantage of it. Applying corporate policy to legacy tape data is now possible and economical. Companies will benefit from proactive initiatives that discover tape data and turn this legacy data into a corporate asset.

IT organizations around the world are charged with protecting corporate data assets. All data, including sensitive executive e-mail and intellectual property documents, is managed by IT for the purpose of safekeeping. Lawyers and legal staff are now starting to participate in the process of managing corporate records. Policies are being developed that help manage the corporate liability around data and ensure that information is not only protected and available, but also handled according to corporate policy. This emerging area is known as Information Governance.

Wikipedia defines Information Governance as “the set of multi-disciplinary structures, policies, procedures, processes and controls implemented to manage information on all media in such a way that it supports an organization's immediate and future regulatory, legal, risk, environmental and operational requirements.” Organizations that face frequent litigation or regulatory oversight are quickly implementing information governance strategies. However, these strategies commonly focus on the current or online data assets, and often neglect the hidden data. The latter is found in historical archives that typically consist of legacy backups of corporate networks. It is common for large organizations to have tens or hundreds of thousands of backup tapes stored in offsite vaults gathering dust. These vaults are protecting the tapes from corrosion and destruction, ensuring they are kept in readable condition. Since these corporate records are not going anywhere, they need to be included in the information governance strategy in order to control the potential hidden liability. Out of sight cannot be out of mind.

Challenges Surrounding Backup Tapes

Most organizations don't know how many tapes they have, where they are located, and what content exists on them. The sheer volume of unknown data is a massive liability for corporate legal departments. As such, many organizations are beginning to develop a roadmap to address this liability and get these legacy records off tape and under control.

Tapes have been used over the years to back up corporate records. They are inexpensive and convenient for IT. Although many firms are moving away from tape to newer, more convenient methods of backup, many historical tapes exist and are still being generated daily. As a result, organizations are faced with large volumes of legacy tapes that potentially contain massive volumes of liabilities.

Why worry about these tapes? Can't the liability be hidden behind the undue burden argument, where lawyers can argue in the courts that it is extremely complex and expensive to search and collect unstructured files and e-mail from backup tapes? Not anymore. You can easily find many cases where the judges have issued fines and sanctions against plaintiffs that came to court without the relevant data to support the case. Judge Shira A. Scheindlin, of the well-known Zubulake e-discovery cases, and more recently The Pension Committee of the University of Montreal Pension Plan, et al. v. Banc of America Securities, et al., No. 05 Civ. 9016 (SAS), found six of the plaintiffs “grossly negligent” because they “fail[ed] to institute a timely written litigation hold, [failed] to collect or preserve any electronic documents prior to 2007, continued to delete electronic documents after the duty to preserve arose, did not request documents from key players, delegated search efforts without any supervision from management, destroyed backup data potentially containing responsive documents of key players, and/or submitted misleading or inaccurate declarations.”

It is also well documented that if relevant data is not obtainable on corporate networks, then backup tapes are the next source for ESI collection. At the 2010 Georgetown eDiscovery Institute, Judge Scheindlin reiterated her Pension Committee opinion to “preserve backup tapes when they are the sole source of relevant information or when they relate to key players, if the relevant information maintained by those players is not obtainable from readily accessible sources.” Judges have become aware of tapes and are requiring collection of data from this source. Additionally, the complexity and expense around backup tape collection has been reduced significantly due to new technology that eliminates the technical requirements for restoring content. Companies that are not taking note of this trend and continue to ignore tapes and rely upon the burden argument are heading down a very risky path. If they don't take action on these legacy records now, they will have to in the near future ' and it will be a more expensive and painful process.

What Makes Tapes Complex?

Why do backup tapes have the perception of being complex and difficult to deal with? Because data that is archived to tape is backed up in a proprietary format. Vendors like EMC, IBM, and Symantec have proprietary backup software that gathers unstructured files and e-mail into a container and moves them to tape. The engineering behind the backup software aims to protect data being backed up to enable recovery in the face of disaster. This turns tape into a container to which only the software vendors have access. The method of getting specific files and e-mail from tape has been to utilize the specific version of the specific backup software, restore all the data from tape (even if you only want one e-mail), index it, search and find what you need, and move it to a review platform. This process is complex and time consuming. If you have tapes that are more than a few years old, it is extremely difficult to find relevant data because the backup software used to make the tape is now out of production and not readily available. This is why specialized vendors exist: to restore tapes for discovery.

What Has Changed?

Technology has saved the day here. New approaches that eliminate the complexity of backup tape discovery are now available. As referenced in “Using Software to Sift Digital Records,” by Nathan Koppel, in the Nov. 23, 2010 issue of The Wall Street Journal, this technology makes discovery of content simple and affordable and enables organizations to implement their data policies on legacy tape. IT and legal can now work together to implement policy concerning what to keep, and more importantly, how to shred or destroy what they do not keep. This same technology is well understood by the courts and has had a significant impact on the undue burden argument. It is now only a matter of time before this legacy content is processed and the appropriate information governance actions are taken in order to control the hidden liability locked in these archives.

Now, technology can simply scan the tapes and enable full discovery of the content and other parameters, such as date ranges, custodians, locations and more. The key here is that once the relevant data is found, and the duplicates and irrelevant files and e-mail are set aside, it can be extracted from the tape. Since typically less than 5% of the tape content is of interest, this process is significantly more cost-effective compared with the old method of restoring all of the content. IT organizations can now use in-house resources to make legacy data discoverable. Legal teams can now search and find what they need according to policy. Data that does not need to be kept according to policy can be discarded. The liability is managed, and the added IT expense of storing these tapes in offsite storage is eliminated.

Why Embrace Tapes?

Tapes contain a wealth of knowledge. Valuable corporate records are archived on tapes. These archives are point-in-time snapshots of network data. By embracing this fact, legal teams can clearly benefit from the reliability of tape content. Consider the following:

• Backup tapes are a true snapshot of everything on the network within a specific point in time. If you want to collect an e-mail from John Doe in June 2006, you can easily pull the backup tape from this timeframe, search and extract the specific e-mail. That e-mail will be exactly as it was on the date in question.
• Since tapes are a proprietary container, they are tamper-proof. When a litigation hold is requested, tapes are the more reliable source versus online network data. Asking a user not to delete e-mail or change files is risky. Why not go to the backup tape, where you know the data is secure and untamperable?
• Backup tapes contain a wealth of corporate records. Archives and records management systems are being deployed in many organizations in order to comply with new information governance strategies. These archives create value over time as data trickles in. Why not leverage the historical records on tape and back fill the archives with relevant records? This will give the archive immediate value and make legacy data available for the business processes for which it is required.

Many organizations are changing their perception of tape. Tape has gone from foe to friend. Having once seen tape as threat, IT and legal teams are now proactively dealing with tape-bound legacy data and taking advantage of it. Applying corporate policy to legacy tape data is now possible and economical. Companies will benefit from proactive initiatives that discover tape data and turn this legacy data into a corporate asset.