Ira Winkler on e-discovery, corporate counsel and the security pro's real role in risk mitigation
While security professionals typically think of computer hackers, malicious insiders, naive employees, or the like as the greatest threat to an organization, I am quickly learning that arrogant lawyers can be the most devastating threat an organization can face. Frankly, the lawyers should be non-issues, but they can get their companies involved in things that should otherwise be avoided.
Clearly, the underlying threat is e-discovery. Information security staff traditionally look at their role in the e-discovery process as ensuring the integrity of the data, making sure that the data is available, providing tracking of that data, etc. However, there is a more fundamental question that has to be asked, which is whether or not you should be involved in the discovery process to begin with. I know that this sounds simple, and most security professionals take the cliche attitude that, “Theirs is not to reason why, theirs is but to do or die.”
Also see Winkler’s I Was Wrong; There Probably Will Be an Electronic Pearl Harbor
As a security executive, you have to understand that you are a risk management professional. Risk management implies that you are to attempt to prevent loss, if at all possible. If you are asked to assist in the e-discovery process, at some point before you execute the process, you might want to determine what is there to be exposed in the process. Frequently, the exposing of the data can be devastating to an organization, even if it means that you have to pay someone off that you otherwise wouldn’t.
Many people are intimidated by their organization’s lawyers. They just want to follow orders and gather the data. However, at some point a responsible executive has to question whether or not the pending lawsuit is worth the potential loss. Once the data is exposed to the legal process, it can be released to the general public. The repercussions of the exposure can be the exposure of data to your competitors, embarrassing information, or potentially exposure to even bigger lawsuits.
Frankly you would expect a responsible legal team to foresee these potential problems. However, that assumes that the lawyers are rational and consider all issues. The reality can be far different. There are the stereotypical arrogant lawyers, who believe that they are invincible. When they work inside of a large corporation, with unlimited financial resources, the arrogance gets even worse. They believe that they can outspend their adversaries and force them into submission. To actually give in and pay people off can be perceived as a sign of weakness, and damage their ego.
I first witnessed this first-hand and watched a large company lose tens of millions of dollars of business from a larger company, because they didn’t want to agree to some common legal terms. The quote I was given was, “We’re a large company. We don’t agree to things like that.” It was irrelevant that the potential customer could have swallowed the company whole without thinking about it at the time.
In the end, tens of millions of dollars of business was lost, because of the arrogance of a single corporate attorney, and no managers wanted to elevate the issue to senior management and challenge a lawyer. The corporate legal department would have been paid for several times over if the lawyer just tried to achieve a compromise.
The previous example doesn’t involve e-discovery, but it is iconic as to what happens when arrogant lawyers go unchallenged. However, I became involved with such an example recently when a small company sued a mega company for approximately $15M. The lawyers for the mega company adopted the strategy of trying to cause the small company to spend themselves into oblivion. It doesn’t matter that the large company is clearly in the wrong, and there is more than enough proof to prove them wrong.
The attorneys didn’t consider that there was another pending lawsuit, and that evidence from the lawsuit I was involved with made the other case indefensible. To avoid paying $15M, the company ended up paying off approximately three times that settle the other lawsuit.
That, however, is the least of their problems. I have so far not named the mega company, as I have been asked not to by my client, the smaller company, at the moment. However, it will soon become very well known. There is a court order being implemented to dedesignate (unclassify) previously protected documents. This information will very possibly lead to one or more class action lawsuits. At this point, it is also possible that given other pending actions, that executives of the company can suffer other penalties.
Large companies are sued all of the time for both legitimate and absurd reasons. If large companies paid off every petty lawsuit, they would become a patsy for everyone who wants money. However at a certain point, whether or not a lawsuit has merit, when the e-discovery process starts, risk management has to be involved. This cannot be an issue left for arrogant lawyers to decide.
How do you know if they are arrogant? Frankly, when you talk to them, you should know. If you hear them talk disdainfully of the opposition that is a clue. If you hear them talk about the weaknesses of the opposition, and why they will succumb to the lawyer’s legal strategies of manipulating the legal process to their advantage, that is a clear sign that you are dealing with a person who cares more about their own ego, than the organization.
More importantly, you have to examine how they respond to the possibility that the data being released in the e-discovery process will be released to the world. Do they respond that this will never happen? Do they respond that they will make the discovery process so convoluted that the opposition will not find anything of value? Most importantly, do they even know what they are disclosing?
The last question is possibly the most critical. The reality is that in the e-discovery process nobody really knows what they are releasing. Organizations do try to make the data convoluted. I have seen companies try to image the data so that you cannot search the data with text based tools. There seems to be an attitude that if we can’t find the data, they can’t either. That is not they case.
There is a quote that I believe is from George Bernard Shaw that goes, ‘Never wrestle with a pig. The pig likes it and you will always get dirty.’ The problem is that when you have an arrogant lawyer, they antagonize the opposition. This antagonization causes the opposition to work as hard as they can to hurt you. While many small opponents will succumb to strong arm legal tactics, sometimes you are just antagonizing a pig. They get more motivated to find harmful documents buried in a proverbial haystack than your own people.
Also see Legal is from Mars, Security is from Venus
Security professionals need to provide some sanity to the e-discovery process. They need to look at e-discovery as not just a process, but a threat to the organization itself. If the lawyers you are dealing with are reasonable and acknowledge that any release of information is a potential threat, then that’s great. However, if the lawyers’ attitude is that you should trust them because they can handle the situation, you are in trouble.
