This was the second year that Ing3nious has held a retreat on the east coast, with other events organized by Chris LaCour held in California going back five years. 
The event was held at the Wequassett Resort in Cape Cod. As always, the event was well-organized and the location was beautiful. Luckily, the weather was fantastic. My notes below only capture a small amount of the information presented. There were often two simultaneous sessions, so I couldn’t attend everything.
Keynote: Away with Words: The Myths and Misnomers of Conventional Search Strategies
Thomas Barnett started the keynote by asking the audience to suggest keyword searches to find items discussing the meaning of existence. He then said that he had in mind “to be, or not to be” and pointed out that it contains only stop words. He then described unsupervised (clustering) and supervised (predictive coding) machine learning. He talked about entity extraction, meaning the identification of dates and names of people and companies in a document. He talked about sentiment analysis and how a person might change their language when they are doing something wrong. He also pointed out that a product may have different names in different countries, which can make it easy to miss things with keyword search.
Advancing Discovery: What if Lawyers are the Problem?
I couldn’t attend this one.
Turbulent Sea in the Safe Harbor. Is There a Lifeboat for Transfers of EU Data to the US?
Max Schrems complained to the Irish Data Protections Commissioner 22 times about the Safe Harbor Privacy Principles failing to protect the privacy of E.U. citizens’ data when companies move the data to the U.S.. After Snowden released information on NSA data collection, Schrems complained a 23rd time. Ultimately, a judge found the Safe Harbor to be invalid.
Companies must certify to the Department of Commerce that they will adhere to the Safe Harbor Privacy Principles. Many e-discovery service providers were pressured to certify so they could bring data to the U.S. for discovery even though e-discovery usage of the data would involve very bad privacy violations.
Some argue that there is no other legal mechanism that could work for bringing data to the U.S. because the U.S. government can pick up everything, so no guarantees above privacy can be made. The best option would be to get consent from the person, but it must be done in a very clear manner specifying what data and who will see it. An employer asking an employee for consent would be seen as coercive. It will be hard to get consent from someone if you are investigating them for criminal activity.
There is really no way to move data from Europe to the U.S. for litigation without violating the law. Consent would be required not just from the custodian but from everyone in the emails. Some countries (France, Germany, and Switzerland) have blocking statutes that make taking the data a criminal offense.
Ethics: eDiscovery, Social Media, and the Internet of Things
I couldn’t attend this one.
Understanding the Data Visualization Trend in Legal
I was on this panel, so I didn’t take notes. I did mention Vischeck, which allows you to see what your graphics would look like to a color-blind person.
Information Governance – How Do You Eat an Elephant?
I couldn’t attend this one.
Email Laws, IG Policies and the “Smoking Gun”
There has been confusion over what should be considered a record. In the past, emails that were considered to be records were printed and stored. Now email should be considered to be a record by default. 30-day retention policies are hard to defend. Keep deleted emails for 60 days and use analytics to identify emails that employees should not have deleted so they can be saved. Use automated logging to show compliance.
Protecting Enterprise Data Across Partners, Providers and the Planet
I couldn’t attend this one.
Defeating Analysis Paralysis – Strategies and Success Stories for Implementing IG Policies and Using TAR / Data Analytics
Berkeley Research Group finds that most companies are still keeping everything. The longer data is kept, the less value it has to the company and the more risk it poses (ediscovery cost and privacy issues if there is a breach). Different departments within the company may want different retention rules. Breaches cost the company in lawsuits and in reputation. The E.U. requires breach notification within 24 hours.
Having employees tag documents gives low-quality tags (they aren’t lawyers), but retention based on those tags is good enough to satisfy the court. Need employees to follow the retention policy, so keep it simple. Some speculate that insurance providers may end up driving info governance by forcing their clients to do it.
The Coalition of Technology Resources for Lawyers found that 56% of legal departments are reporting that they use analytics. Clustering can help with investigation and determining search terms. Look at email domain names (e.g., nytimes.com) to cull. Note that email journaling keeps everything. Analytics technology has improved, so if you were disappointed in the past you might want to try it again.
How Automated Digital Discovery is Changing eDiscovery as We Know It
I couldn’t attend this one.
Creating Order Out of Chaos: Framing and Taming Data Discovery Challenges in Expedited Matters
This panel started by walking through a (hypothetical?) investigation of a head of operations who left and joined a competitor in violation of a non-compete agreement that was determined to be unenforceable. Did he transfer company data to the competitor?
Look for evidence that USB devices were used on the company laptop. Unfortunately, you can’t tell what was copied onto them. Look for attempts to hide what was done, such as removal of USB insertion data from the current registry (but failing to remove from the registry snapshot). Look at the WiFi connection history for connections to the competitor’s network. It is very important to explain the situation to the forensics person and communicate with him/her frequently about what you each have found in order to develop a picture of what actually happened.
If you hire someone from a competitor and there is suspicion that they took data from their previous employer, ambush them and take all their devices before they have a chance to destroy anything. This will show the judge that you were not complicit.
When investigating someone who quit on bad terms, look for deals with “special terms” or side letter deals — they may be a sign of fraud. Be careful about any applicable European laws. Europe says you can’t move the data to the U.S., but the SEC doesn’t care. Can you use a review tool in the U.S. with the data in Europe? Officially, no, but it is less bad than moving the data. Everyone says you can’t produce the data from Europe, but everyone does.
Make sure your agreements are up to date and are written by the attorney that will litigate them.
Just Patch and Pray?
A study by Verizon found that 90% of breaches are caused by employees. Info governance can reduce risk. Keeping everything is risky due to e-discovery, risk of breach, and having to explain loss of old data to customers.
Email problems include bad passwords, use of the same password on multiple websites so having one hacked can allow access to others, and getting inside the network (emailed malware). 2-factor authentication is recommended. Don’t send an email to the SEC with BCC to the client or the client might hit reply-all and say something problematic — instead, email only the SEC and forward a copy to the client later.
Mobile technology can create discovery headaches, needs to be managed/updated/wiped remotely, and can easily be lost. Encrypt, audit, and apply anti-malware. BYOD should be limited to enterprise-ready devices. Avoid insecure WiFi. Control access to enterprise data. Secure data in transit. Ensure that devices get updated/upgraded.
Unaware or non-compliant employees need training. When training to spot phishing emails, services can test the employees by sending phishing emails that report who clicked on them.
Vendors and third parties that handle enterprise data can be a problem. Regulators require vendor oversight. Limit access to necessary systems. Segregate sensitive data. Beware of payroll vendors and the possibility of identity theft from the data they hold. Make sure cybersecurity insurance policy covers vendors.
Employees want data access from anywhere. Encrypting email is hard — better to use collaborative workspaces. Home networks should be protected. Don’t use the neighbor’s Internet connection.
After having a breach, 39% of companies still don’t form a response plan. There is no federal data breach notification law, but many states have such laws. You may need to notify employees, customers, and the attorney general in some specific time frame. Also notify your insurance company.
Mergers & Acquisitions: Strategy and Execution Concerns
I couldn’t attend this one.