Recently in Electronically Stored Information (ESI) Category

For the fourth consecutive year, FaceTime has commissioned a survey of IT managers and end users to track the use of Internet-based applications - things like IM, Skype, P2P, social networking and other Web 2.0 apps. We also surveyed employee attitudes toward use of those applications and their impact on IT and the organization in terms of security, data leakage and compliance.

 

As in prior years, the research was conducted among a large sample of corporate IT managers and end users across all size organizations in North America, UK and Europe. The research study includes compiled data from more than 500 IT managers and end users. The results are quite revealing.

 

 

AnyInternetAppsChart 

    • Use of consumer oriented Internet applications has reached 97% of organizations, up from 85% in 2007 and, on average, companies report 9.3 applications in use by its employees on the enterprise network
    • 73% of IT managers report at least one security incident as a result of Internet application usage; Viruses, Trojans and worms (59%) are most common, followed by spyware (57%) for a close second
    • 37% of companies report an instance of non-compliance; 27% report accidental data leakage
    • IT managers report an average of 34 incidents per month, and the largest companies project $125K monthly to remediate Internet usage related security, compliance and data leakage issues
    • 51% of end users access social media sites at least once per day and  79% of employees use social media (Facebook, LinkedIn, You Tube) at work for business reasons
    • Sixty-eight percent of IT managers have archiving and retrieval methods for corporate email. About half that many--31 percent--store IM communications. One in four has copies of audio conferences (25%), while slightly fewer (20%) archive corporate Web conferences
    • If requested by corporate attorneys to reproduce IM communications--in the event of a lawsuit, for example--51 percent of IT managers could not do it. Thirty-eight percent because they have no such capabilities and 13 percent could do it but not in any practical time frame
    • Unified Communications suites exist at about 29 percent of IT respondent organizations. Ten percent have deployed pilots to a limited number of users, while 19 percent have deployed UC for the majority of their endusers

We'll be delving into various aspects of this exhaustive survey in the coming weeks, to break down just what this data is telling us about what's happening on corporate networks and what it means to both IT managers and end users.

... or even what it is?

 

Back in the old days, TV networks would run public service spots before the nightly news saying: "It's 10 pm, do you know where your children are?" The fact that the spots ran for twenty years in cities like New York points out that it is easy to lose track of stuff, even important stuff.  Which brings me to ESI--Electronically Stored Information.  Not that it is as important as your kids, but in the discovery phase of a big lawsuit, it might seem that way.  And, like kids, ESI can be surprisingly easy to lose track of.

 

ESI is the catch-all term for the digitally stored files of litigants in a federal case.  During the pre-trial discovery phase of a lawsuit, all ESI is subject to discovery, meaning it all has to be checked for relevant information that the other side has requested to help it prove its case.  Only the relevant files need to be actually given to the opposing party, but all ESI has to be checked to make sure all the relevant files have been located and handed over.  It sounds simple enough, but it is hard if you are not prepared in advance and a lot can go wrong. 

 

When the e-discovery rules changed in late 2006, there was a lot of commotion about it, and a lot was written about the need for companies to have their ESI organized and well maintained in order to be able to respond to the tight discovery timelines set by the new rules. I don't think that message has really sunk in though.  And now that the rules are no longer "new," and the commotion has died down, it is easy for companies to lose track of whether they have really prepared to meet the current e-discovery challenges.  Yes, the e-discovery market is growing nicely, but more spending is not assurance that the companies really understand all the risks or even the problems they are trying to solve. 

 

As the resident lawyer at FaceTime, I am occasionally asked to talk about e-discovery issues with customers, or on a panel. Sometimes I can tell that a person I'm speaking with just doesn't want to have to deal with instant messaging in e-discovery, even when IM is used for business purposes in their company. To them, the most obvious way not to deal with it is to make it go away, or more precisely, to take the position that IM logs are not business records and therefore will not be saved. 

 

No saved IM records, no IM ESI, problem solved. 

 

There are undoubtedly circumstances where this is a sound policy, but what I've seen is that such a position is most often taken without enough attention to the reality of how easily IM logs are stored in hard-to-find places, and how difficult it is to effectively enforce a "no IM records" policy when employees use IM for business purposes and may need to refer to those logs the way they refer back to e-mail.  The company falls into the trap of mistaking its ESI policy, what the company wants its ESI to be, with the reality of what its ESI actually is -- i.e., what is actually saved, either inadvertently or surreptitiously against policy. 

 

The resulting danger is that the ESI is there, but the company doesn't know it exists until too late. My recommendation is usually that if IM is used for business, then it will generate business records that should be maintained and be treated on par with e-mail records for e-discovery purposes.

 

If the IM-savvy, and sometimes IM-dependent, companies that FaceTime deals with are still coming to terms with IM logs in regard to e-discovery, then I have to believe that companies in general have not moved much beyond e-mail archiving, if they have a proactive e-discovery solution at all.  To me, that's like being happy that one of your kids is watching TV with you at 10 pm. and forgetting about the one you haven't seen since yesterday.

FaceForward Authors

Kailash Ambwani
President and CEO
Brian Babin
Director of Product Management
Christopher Boyd
Sr. Director of Malware Research
Frank Cabri
Vice President of Marketing and Product Management
Sarah Carter
Marketing Manager, EMEA
Larissa Gaston
Director of Marketing Programs
Eric Young
Director of Field Engineering Services

October 2008: Monthly Archives

November 2008

Sun Mon Tue Wed Thu Fri Sat
            1
2 3 4 5 6 7 8
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30            

About this Archive

This page is a archive of recent entries in the Electronically Stored Information (ESI) category.

Compliance is the previous category.

Employee Behavior is the next category.

Find recent content on the main index or look in the archives to find all content.

Comment/Trackback Policy

This site supports an open comment policy. Rude, wasteful, off-topic, privacy-intruding or libelous comments will be deleted. Comments will remain open unless abused.