FRAMINGHAM (09/30/2010) - When Jonathan Chow, chief information security officer at NBC Universal, found his department's services in increasing demand, that wasn't necessarily a good thing.
He says demand for e-discovery services was increasing 30% to 50% annually in the early and middle parts of the past decade, and he was seeing a dramatic rise in the hours spent supporting e-discovery as his department collected and culled through some of the electronically stored data needed by the company's legal staff.
The information security department, part of corporate IT, owns the e-discovery function and uses it not just for litigation support, Chow explains, but also for M&A activities and internal investigations generated by HR or corporate security, for example.
"We used to handle those occasional queries on an ad hoc basis, but as the number of e-discovery requests grew, this became a much larger and much more time-/resource-intensive process to manage," he said via e-mail. "It was obvious that we could more affordably conduct our e-discovery in-house, assuming we could find the best solutions to support our process."
So Chow moved e-discovery in-house in 2007.
Others are following a similar course. Analyst firm Enterprise Strategy Group (ESG) and Clearwell Systems Inc., an e-discovery software company in Mountain View, Calif., surveyed about 100 Fortune 2,000 enterprises and government agencies late last year and found that some 73% plan to bring e-discovery in-house.
Discovery is the part of the pretrial process in which both sides request information, data and documents from each other as each tries to find, or discover, facts pertinent to the case. Electronic discovery is the part of this longstanding legal process that refers to any information stored electronically.
High costs, increasing reliance on e-discovery
Several factors are driving this trend of bringing the e-discovery function in-house, including an anticipated rise in lawsuits, investigations and inquiries, as well as the high costs of outsourcing the task. Whatever the drivers, the shift means that IT departments are now implementing and maintaining the systems, and in some cases administering the searches themselves.
"A decade ago, e-discovery was more the exception rather than the norm, so companies did not have to go through it regularly. They weren't familiar with it, they didn't have the staffing, nor did they want the staffing to support it, because it wasn't something that happened frequently," explains Brian Babineau, a senior consulting analyst at ESG.
"Now it's become mainstream. Now every litigation or regulatory action is asking for some electronically stored information, and because of that frequency and because it's becoming more of a standard business process, it now makes sense to evaluate whether you should staff it and build some competencies internally," he says.
This shift stems in part from changes to the Federal Rules of Civil Procedure, established in the 1930s to govern civil lawsuits, says Gartner analyst John Bace. The rules were last updated in 2006 to more broadly include electronic records in discovery, the process by which the parties engaged in lawsuits produce information demanded by others involved in the legal action.
Bace says companies are recognizing that they pay a premium to have vendors handle e-discovery searches, which are often billed by the gigabyte. He says companies also realize that they have less control over their data when they turn over material to outside firms -- a loss of control that can expose them to more legal risks.
A new IT specialty
John Kostuch developed an expertise in e-discovery while under the gun. His company was facing a regulatory inquiry back in 2003 and decided to search its electronic records using its own staff. In response, Kostuch and seven other IT workers worked in three shifts around the clock for three weeks to produce the required data.
From that early experience, Kostuch has developed a niche working in e-discovery. He is now an IT security analyst and technology consultant at that company, which he declined to name, but has since deployed more sophisticated e-discovery tools. His responsibilities today include working with the company's legal department to search stored data for required documents.
"Legal comes to me because I know where the data is," he says.
Kostuch is an emerging breed of IT worker: part technologist, part legal aide. This position is in fact becoming recognizable enough to earn its own titles, which include e-discovery manager, e-discovery director, e-discovery analyst and e-discovery technician. According to a 2009 ESG report, 22% of the approximately 100 companies surveyed said they have employees with e-discovery manager titles. Other organizations have staff performing the function but without a formal title to go with it, experts say.
"Some companies have a legal liaison position that's formal, and some have the function occurring but it's not properly recognized," says Murray Krehbiel, principal consultant at Krehbiel Consulting.
Some companies place this emerging position within the IT or information security departments; others put it within the corporate counsel office. Gartner analyst John Bace says that where the function resides is usually related to the company's culture and its needs regarding e-discovery. Either way, though, he agrees that given the increasing importance and prominence of this function, a professional who can combine technical and legal skills is required.
In addition, these specialists have to be skilled in data management and governance if they want to succeed in the emerging role, says Tim Herbert, vice president of research for the Computing Technology Industry Association (CompTIA).
"The volume of data will continue to grow," he says, "and the trend points to more specialization."
For his part, NBC Universal's Chow says an analysis of expenses showed that his company, which had used a combination of internal tools and outside help, could be more cost-effective by going in-house.
NBC Universal uses Clearwell's e-Discovery Platform to collect the data and perform the initial culling, which allows it to handle 100% of the early phases of e-discovery requirements before turning over documents for lawyers to review, Chow says.
"Ultimately for my team, the decision to take e-discovery in-house was about efficiency," he adds.
Michael Royer, an IT director at a global entertainment company he declined to name, remembers the early days of electronic discovery, about 10 years ago, when his company's lawyers would "come down to IT asking to find an e-mail."
"The standard IT response was, 'We can't do that,' " he says. The systems back then weren't designed to execute searches, he says, nor were policies established to cover such requests.
"Every single request became a new dialog with HR or legal or wherever the request was coming from -- when could it be done by, what was needed -- because everything was a one-off," Royer says.
As a result, Royer's employer often ended up hiring outside vendors to search through electronic records for the required data -- an expensive option.
Stemming a 'ridiculous' cost
By 2005, Royer says, IT realized that it had to take over this service if for no other reason than to reduce what he calls the "ridiculous cost" of outsourcing the e-discovery function.
"We had to find a way to provide a better IT service to reduce the amount of data to hand over, to see how much more of that review cycle we could pull [in-house] with our legal team before they send it out to outside counsel," he says. "It was an IT initiative to say, 'We've got to do this better to cut this cost.' "
Royer says IT's initial implementation focused on giving the company's in-house legal team the technology to search and hold e-mails. A hold keeps the data from being moved into long-term storage. Now, with that done, IT plans to add features so the legal department can perform e-discovery searches and holds on additional data sources and repositories, such as file servers and backup tapes.
Royer could not disclose actual figures, but he says that bringing some of the e-discovery functions in-house immediately reduced the amount of material the company had to send to outside counsel for reviewing. In fact, he says it cut the amount "by well over 75% on the next four litigation matters that arose post-implementation. These matters arose within the first six months of go-live, and the cost savings put us into a 300% ROI within that same time frame."
The move to bring e-discovery in-house also corresponds with a broadening in how companies define e-discovery, says Jonathan Gossels, president and CEO of SystemExperts Corp., a security consulting firm in Sudbury, Mass. Companies now realize that they need the ability to search electronic records not just in response to legal action, he says. They also need it for regulatory requests and inquiries and for their own internal investigations, such as potential security breaches or personnel violations.
"That's why it makes perfect sense to bring it in-house. It's the recognition that they need it to run their day-to-day business," he says, noting that customers are increasingly defining the function as "discovery and investigations."
A need for analysis, governance
Not all companies are ready to bring e-discovery functions entirely in-house, Bace says. "Not many companies have done that sort of analysis. It's only those who are in a perpetual state of litigation who have thought things through," he explains.
In fact, many companies still need to get a good handle on information governance before they can determine how much of the e-discovery capability they should have under their own purview, he says. Governance refers to the process, procedures and policies that are in place that dictate what information the company stores, where and how it is stored, and when it should be deleted. Gartner analyst Debra Logan says probably fewer than 10% of companies do a really good job at information governance -- and even those companies aren't as comprehensive as they could be.
Moreover, Gartner research predicts that it will be several years before e-discovery software reaches mainstream adoption.
Murray Krehbiel, principal consultant at Krehbiel Consulting, an El Dorado Hills, Calif.-based firm specializing in e-discovery, makes similar observations.
"Companies still run the gamut. Some of them are unprepared and don't have a formal process for dealing with e-discovery, but the ones that are forward-looking and being very smart about it are staffing it with a hybrid person able to straddle the IT and legal departments," Krehbiel says.
Case in point: Microsoft
Joe Banks, litigation program manager at Microsoft, says the company started to look more closely at litigation costs over the past two years and found that "discovery just leaps off the page. It was exorbitantly expensive, and the trend was just going up. So we wanted to figure out ways to cut costs."
As a result, Banks says, Microsoft invested in e-discovery software. (Banks declines to name the product for publication but says it's not a tool from Microsoft.) He says that although he hasn't seen a product that provides an end-to-end solution, technology improvements in recent years have made bringing e-discovery in-house even more advantageous for companies such as his.
Banks says Microsoft has started to perform pieces of the e-discovery process internally. The company does its own data minimization, which culls through the raw data using specific search parameters; that reduced volume of data can then be handed over to attorneys for review. Banks says he expects Microsoft to increase the percentage of the culling it does internally and, as the technology improves, possibly bringing some of the review process in-house, too.
Although he declines to discuss actual dollar savings, Banks says that having this capability allows Microsoft to do some early case assessments, which gives attorneys and executives insight into culpabilities and defenses, case strengths and weaknesses.
Advances in technology have helped make it more cost-effective to perform many searches in-house, Banks says, for Microsoft and for just about everyone else. "And when you combine that with the economic factors of the past two years, where people were forced to find ways to cut costs, it was just a natural inflection point for corporations to re-examine the old model."
Sign up for MIS Asia eNewsletters.