Blame it on Target. Or Edward Snowden. But in case you haven't noticed, legal technology conversations lately aren't exactly obsessed with predictive coding right now. Instead, firms—and everyday citizens—are more likely to be discussing data breaches, cybercrimes, and concerns about confidential client information.
But according to a new survey by LexisNexis' Legal & Professional division, while law firms may be talking—they aren't doing very much about it. The company reports that 89 percent of the 300 legal professionals in 40 states and in 15 practice areas who were recently polled said their firms send confidential information to clients via unencrypted email—relying on a disclaimer at the bottom of the correspondence to serve as protection.
So what are the ramifications? How are law firms, corporate counsel and vendors responding to these sometimes contradictory technology challenges? We can get some clues from last week's Computer and Enterprise Investigations Conference, annually presented by Guidance Software.
For starters, the company has always thrown a broad cloth around its offerings. Founded in 1997, Guidance has targeted both electronic data discovery and other "digital investigations," and today offers a line of seven software under the "EnCase" brand (and a line of Tableau forensics products). The company says its EnCase Enterprise platform "is used by more than half of the Fortune 500," by the likes of Allstate, Ford, General Electric, Pfizer and Viacom, to name a few.
It's easy to see that Guidance, and its CEIC conference, covers a wide range of disciplines, including digital forensics, cybersecurity, e-discovery and litigation support, compliance and risk management, information and law enforcement.
Guidance President and CEO Victor Limongelli kicked off the 2014 four-day CEIC event with the opening keynote on May 19, explaining how the company has decided to transition to a "platform" approach for its EnCase suite of products. The concept is to move from a "closed" (self-contained) system to a more collaborative environment, where third parties can plug applications into the EnCase platform and, in effect, customize the operation to meet the specific needs of their organizations.
Perhaps Guidance is also reacting to yet another strong legal industry trend: bring your own devices. About a year ago, Guidance launched its EnCase App Central store (think Apple Inc.'s App Store). It offers apps from third-party developers that can be integrated into the EnCase platform, Limongelli explained. To date, more than 30,000 downloads from the EnCase App Central store, he told the audience.
"It's all about apps," observed San Francisco's Albert Barsocchini, director of strategic consulting at Minnesota-based NightOwl Discovery. He served as an associate general counsel at Guidance for eight years (2003-11). "EnCase is no longer closed," he said. Now, EnCase products are a foundation, and organizations can build systems on top of that foundation, said Barsocchini.
But don't think the company is throwing out its babies with the bath water. "With recent attention on data breaches, including Target Corp. and the controversy about Edward Snowden's disclosure of government documents, I expected to see cybersecurity take center stage," observed Boston's David Horrigan, an analyst and counsel at 451 Research.
Guidance has traditionally had three focus areas—forensics, cybersecurity and e-discovery," he said. "What surprised me was Limongelli’s strong focus on e-discovery, said Horrigan. "The keynote highlighted Guidance's new e-discovery offerings, including Linked Review, which we expect to be Guidance's answer to predictive coding," Horrigan noted.
U.S. law firms may be worried about the security risks of sharing confidential information online, but a new surveyby LexisNexis' legal and professional division reveals that they are not doing much about it.
Unencrypted email remains by far the most prominent way that law firms share privileged communications with their clients, with 89 percent of respondents reporting that it is the firm's primary method of distributing information.
In March, the company canvassed about 300 legal professionals in 40 states across 15 different practice areas. Results show that although respondents were aware of the risks, and wary of them, the most common method of securing documents and protecting privilege was the use of a confidentiality statement at the bottom of an email, with 77 percent of firms reporting this was their primary line of defense.
“There’s clearly a disconnect between expressed security concerns and measures law firms employ to protect their clients and themselves,” said Christopher Anderson, a senior product manager at LexisNexis, in a statement. “Relying on a mere statement of confidentiality when sharing privileged communications by email is a weak measure—and further it might protect the law firm but affords very little protection for the client,” he said.
A minority of law firms go a step further to protect their information, with 22 percent saying they use email encryption,14 percent using a password to protect documents and 13 percent employing a secure file-sharing site. At the reverse end of the spectrum, 4 percent of respondents said they take no measures at all to protect private information. “Law firms need to perform their due diligence, stay abreast of technology and ultimately protect their clients’ interest online just as they do in providing legal counsel,” said Anderson.
Attorney Marlisse Silver Sweeney is a freelance writer based in Vancouver. Twitter: @MarlisseSS.
Most law firms dish up technology by implementing and supporting systems in-house. They have little choice but to deal with upgrades and replacements because vendors continually displace "obsolete" older versions of applications and hardware. These upgrades are usually costly and disruptive. Certainly, some changes are warranted but much of the turmoil absorbs IT staff resources and creates little value for a firm. The advent of cloud computing and managed services is providing firms a viable alternative.
CLOUD AND MANAGED SERVICES DEFINED
In general, there are two types of cloud services. The first, often called Software as a Service, involves an application—or set of like applications—run by a third-party vendor and accessed through the Internet via a web browser. The second approach involves data that is stored or shared via a third party’s infrastructure and accessed via the Internet. Examples of this type of service (security issues aside) would be Dropbox or Apple's iCloud.
Let's focus on SaaS. With these services, firm personnel access an application(s) via the Web to perform their day-to-day work. Their work product and data is stored on the vendor’s systems. Several vendors have set up integrated application sets (suites) that include practice management, document management, time entry, and billing for law firms.
As attractive as cloud services seem, however, firm lawyers may be uncomfortable about having the firm's data completely managed and stored by an outside vendor. The use of managed services is one way to address this issue.
With managed services, the firm maintains ownership of server and data center equipment, but contracts to have the day-to-day operations and upgrades managed by a vendor. It is possible to set up these services so they mimic a cloud service—thus the term “private cloud.” There are many shades within the spectrum of managed services, with vendors owning more or less of the infrastructure and applications.
The advantages of cloud-based services are many. They include:
• Access from anywhere there are Internet connections. • Reduced need to manage IT infrastructure (servers and data storage) within your firm. • Application and hardware upgrades handled by the vendor. • Predictable (fixed) pricing—usually based on the number of users. • Reduced capital spending. • Business continuity built-in. • Good vendors provide 24/7 support.
Managed services have similar advantages. However, the level of benefits from reduced capital spending and avoidance of software and hardware upgrade hassles will depend on how much of the IT infrastructure and associated applications continues to be maintained in-house by the firm.
The other major advantage of both approaches is the potential impact on IT staff utilization. With in-house systems, as much as 75 percent of staff time is dedicated to maintenance. By moving to cloud or manage services this maintenance component can be dramatically reduced. Of course, IT staff will need to take on a bigger role managing the vendors. The change nevertheless should free up significant IT staff time for value-added services that help the firm make better use of technology, particularly in pursuit of superior client service.
CAVEATS
These services are not a magic bullet. No contract with a cloud or managed services vendor should be entered into without the proper due diligence. Most importantly, firms need to make sure the vendor is financially sound and has a good track record, that a sufficient level of technology infrastructure and back-up is in place, and that firm data will be properly secured. It is important to “kick the tires” by testing the service thoroughly before making a commitment. Understanding how to get firm data back when the service is no longer needed is also critical.
A firm’s telecommunications network is what connects it to these services. To get best performance, a firm will need a robust network infrastructure that provides a high-speed telecommunications network connecting all your office-based systems with the cloud vendor and the Internet.
Using cloud-based applications may mean that firms will have to give up some ability to customize software and hardware for particular firm and lawyer needs. For example, the ability to customize interfaces or financial reports may be limited, or lawyers may have to live with restrictions on how quickly old documents can be retrieved. At some firms, cultural preferences will have to be considered and carefully managed.
MAKING THE TRANSITION
Transitioning from in-house-based systems to a cloud or managed services platform will require thorough planning to get the most benefit and minimize disruption. This change will not only affect how people in the firm access systems and information, but may require people to learn new systems and new ways of working. Also, significant role changes may be required for the in-house IT staff. Anticipating these changes and their impact will be an important to achieving the benefits of the systems transition and a successful project.The following steps are recommended:
1. Identify the applications and systems that will be transitioned. Determine if the target will be managed services or a move to cloud applications. 2. Clearly document your firm’s requirements for performance, availability, security, and functionality for the systems and applications that will be moved. 3. Identify and choose the service vendor or vendor(s) based on the requirements. This is typically done via a "request for proposal" process. 4. Develop a detailed transition plan for each application. Determine the human impact and develop appropriate change management, communications and training plans. 5. Run a pilot test with either a small group of people and/or a particular application. Adjust your plans based on the results of the test. Include a test of the vendor’s back-up and recovery processes. 6. Rollout to the firm.
Depending on the number of applications and the size of the firm, a transition could take from six to 18 months. Success with this type of project will depend on strong support from firm management and strong project management from the IT staff (or consultant if the skills do not exist in-house). The cost will also be highly dependent on firm size, geography and the applications and hardware involved.
Cloud and managed services hold great promise for law firms and other businesses. The potential for improving a firm’s access to technology while scaling back on the need for in-house technology infrastructure makes these service compelling. Done correctly, firms will benefit tremendously by spending more time focused on their core business of delivering outstanding service and results to clients rather than distracting technology issues far removed from that core.
Philip Wisoff is a principal at MTC Services, based in the New York Metro Area.
I am on my way to Houston to meet with another eDiscovery / forensics / legal consulting Firm. We are going to be working with them on a few things that we have some experience with.
I am looking forward to meeting with Robin and Sharon for dinner tonight!
