Category Archives: Implementation

eDiscovery California: Formal Opinion Interim No. 10-0001 (Social Networking) Raises an ‘Adject’ Issue

MP900442339First, my disclaimer:  This is a State Bar of California Opinion – and I'm Vice-Chair of their Law Practice Management & Technology Section Executive Committee (LPMT).  I want to remind you, "This blog site is published by and reflects the personal views of Perry L. Segal, in his individual capacity.  Any views expressed herein have not been adopted by the State Bar of California's Board of Trustees or overall membership, nor are they to be construed as representing the position of the State Bar of California."

The last time I analyzed one of these, it pertained to VLOs.  I found that Opinion much more difficult to address.  Formal Opinion Interim No. 10-0001 (Social Networking) is easier in some respects, because its main purpose is to apply current California rules (specifically, Rules of Professional Conduct:  Rule 1-400 Advertising and Solicitation and sections of the Business and Professions Code) to what it refers to as, "social media websites".  That's where the trouble begins; with the adjective.  We'll get to that in a moment.

There's no reason for me to do a dissertation on 1-400.  California attorneys should already be familiar with this Rule (or they can look it up, above).  Suffice it to say, for our purposes, this can be like Jeopardy, because we need ask ourselves two questions:

  1. What is a communication?
  2. If a posting is determined to be a communication, is it an advertisement or solicitation?

The only major problem I have with the document is Footnote Two on Page One (link opens the 6-page PDF).  It attempts to describe Facebook "friending" as an example of what it considers a "controlled" group.  It doesn't seem to take into account that, like Twitter, et al, your control group can republish your post (e.g. Re-tweeting).  My view?  Continue to treat your posts as if they're visible to the entire world!

Page Five reminds us of Rule 1-400(F):  "…the Committee notes that a true and correct copy of any “communication” must be retained by Attorney for two years. Rule 1-400(F) expressly extends this requirement to communications made by “electronic media.” If Attorney discovers that a social media website does not archive postings automatically, then Attorney will need to employ a manual method of preservation, such as printing or saving a copy of the screen."  [italics added]

Gulp!  How many of you remembered that part of the Rule?

Concluding, the Opinion has an adject(ive) issue.  It refers to "social media websites", but it also refers (as it should, in my opinion) to general attorney websites.  If I were to make one glaring modification to this document, it would be to find the phrase, "social media website(s)" wherever it appears, and replace it with, simply, "websites".

The qualifier serves no purpose.

By the way, if you'd like to comment on the Opinion, the 90-day period is open through 5pm, July 2nd, 2012.

Leveraging ActiveSync to Emulate MS Exchange, Part II – Sync Devices

Ok…so you've spent the weekend dutifully configuring your primary database and cloud configuration a la Part I, eagerly (at least, that's what I tell myself…) anticipating Part II; my instructions on how to synchronize your email, calendar & contacts with virtually all of your secondary devices.

The cool thing is, virtually any default or add-on app that supports Microsoft ActiveSync will work with this process.  For example, if you have an Android smartphone or tablet, you can configure Corporate Sync to use the default modules that came stock with your device – at no cost.  Or, since this process sits on a Hotmail backbone, you can use Microsoft's own Hotmail App

But, for a lot of us, we want robust functionality on our mobile devices.  After all, many of us spend more time using those products than our traditional desktop devices (pretty soon, the term 'desktop' won't even be accurate, anymore).  If, like me, you're one of those people, you may want to invest in apps geared to the power-user, such as Touchdown.

However, keep in mind; this is a Microsoft backbone, but it's a free backbone.  Regardless of whether the apps support ActiveSync, their technical support will not be obligated to assist you with the configuration because their products are meant to support true Exchange ActiveSync.  If you experience difficulty, you'll have to throw yourself on the mercy of the particular provider, or hit the support forums.

Basic configuration is actually fairly easy.  Let's take a look at a portion of the default Android Corporate Sync configuration screen:

Droid Corp Sync_75

You have the option of selecting your three sync modules separately.  This is helpful because, for example, I didn't want to use the default settings except to maintain a default copy of my contacts (which is enabled, above).  Then, you simply input your display email address and point to the Hotmail server.  As mentioned in Part I, always make sure you have SSL enabled.  Last (not visible here), input your Hotmail Login ID and password.  That's it!

Now, if you've decided to go the power-route, here's an example of the more robust configuration options available to you in Touchdown:

TD Account AS_75

As you can see, here you must specify ActiveSync, rather than Exchange.  Also, it assumes a domain – which you don't have – but it'll still work with your Login ID.  Sometimes, you need to input the backslash in front of the ID in order to correct for the lack of domain, so if it doesn't work the first time, play around with it a little bit.  You also have a choice of more than one 'reply-to' address.

Server configuration is virtually the same as under the default app above, except Touchdown combines all of the modules under a single icon.  Also, see how it confirms Microsoft IIS/6.0.2.5.

TD Connection AS_75

Now, the power user is ready to access the Advanced tab and configure the numerous options available.  Yes, it really is that easy!

So, what have we accomplished?

  • First, we've established a virtual database that can be archived on the fly and/or exported from the cloud at any time; extremely important if there's a server outage,
  • We're using SSL for better security, and of course, encryption options are available to us as well,
  • Any email, calendar entry or contact that is created, added or modified at one source is automatically propagated to all other resources,
  • Calendar invitations are seamlessly integrated,
  • No need to bcc: ourselves on every sent message,
  • Ability to work seamlessly in standalone mode with auto-sync once re-connected.

Dare I say…everything but the kitchen sync!  Yeah, I had to say it…I feel shame…

Leveraging ActiveSync to Emulate MS Exchange & Sync Multiple Devices – Part I

MP900448358In order to make great (information) soup, start with the right (data)base.

As promised, this is the first in a short series on how to leverage available software technology to sync Calendar, Contacts, Email and more on virtually all (or most) of your devices.  Now, we all know there are many different ways to accomplish this, however, this is aimed at the individual – or small business or law firm – who can't afford expensive hardware or software, is nervous about the cloud (for good reason) but would like a robust, alternative method to manage their data dependably, automatically and securely.  In other words, they don't want to be up at night worrying about it nor spending the day trying to figure out why it doesn't work!

What do most individuals and businesses in this 24-hour-a-day world want from their technology, anyway?

  • Access to my data 24-hours-a-day! (That was a gimme)
  • Rapid auto-sync (I enter/modify a contact on my smartphone and within five minutes, it propagates to all of my other devices)
  • I reply to an eMail message and it syncs everywhere without having to cc: myself at other locations/accounts (I hear complaints about this all of the time)
  • I receive a calendar appointment and can seamlessly add it to my device's calendar, then it propagates…
  • I generate calendar appointments that others may seamlessly process as well
  • If my server/cloud connectivity is severed, I have access to – and can process – all of my data up to that moment, modify it or generate more, then sync it when connectivity is restored (this is also important while traveling, isn't it?)
  • Ability to mirror/archive/backup the database (if this isn't on your list, it should be)
  • Ability to access the data securely

…and more, of course.  Many products provide some, or all of these features – the problem is, many of them do it in completely different ways, including for each separate function (e.g. calendar or contacts) and don't 'talk' to other devices very well.  The goal is to make the process as seamless as possible.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

I'm hitting for averages here, folks.  There are a lot of Operating Systems and hardware out there.  On PC, we have Windows, MAC, Linux, etc.  With tablets we have MAC, Blackberry, Android, etc.  Smartphones?  Well, there are four primaries; iPhone, Android, Blackberry & Windows.

We know that most PCs are Windows-based (no knock against Macs, it's just the way it is) and the majority of businesses use them.  iPhones and Androids are duking it out, with Blackberries still in the hunt and the new version of Windows phone making a splash.  We also know that a majority use Microsoft Office-based products (even many Mac users).  So, there's no way I'll make everyone happy.

The example I'll use for our purposes is a Windows-based PC, hosting Outlook 2003, 2007 or 2010.  You'll also need a Hotmail/Live Mail cloud component; however, this doesn't mean you'll be changing your existing email setup; you'll be supplementing it.  Last, you'll install the Outlook Hotmail Connector, which allows you to create a virtual database within Outlook.  This will serve as our primary device.  For security, I recommend that it be static, if possible.  Any mobile device, from laptop on down, runs the additional risk of being lost or stolen with your entire database living on it.  Not a pleasant thought.

Is there a method to my madness?  Yes.  The more one can accomplish under a single vendor, the better the results.  In this case, all database components are Microsoft, which makes the process seamless (remember, we're going to be communicating with a lot of devices).  Also, SSL capability was implemented in 2011, meaning your connection to the cloud will be much more secure, whether via Outlook, the Web or your secondary devices.

Once you have your components up & running, you have a choice:

  1. Use Hotmail to "fetch" your emails from your existing database, or,
  2. Forward your emails from your existing database to Hotmail.

Both methods are fine, but I recommend forwarding your emails.  With fetch, Hotmail must make an inquiry and "pull" your messages over.  There will usually be a time delay, which won't be sufficient for those of us who need our messages in real-time.  Forwarding doesn't normally cause a delay; emails are forwarded as they arrive, so this is preferable.  The good news is, you'll have another backup of your messages with your service provider.

As for contacts and calendar, you'll want to import them into your Outlook database as well.  Once completed, you can customize your settings in the cloud.  I recommend disabling as many 'bloatware' features as possible.  After all, you're looking to create a slick, business-like database.  What you do want to enable is your SSL functionality.  One way to verify this is to make sure you may only access it online via https://.  If it works via http://, your security isn't properly configured.

I know this is a lot of detail, but if you're willing to take some time and make the effort, you'll have an excellent base.  In Part II, I'll examine how you'll exploit various flavors of ActiveSync (Corporate Sync on some devices) to sync your data over mutiple platforms.

That's when the fun begins…

A Titanic Failure of Disaster Planning

MP900407559As we mark the 100th anniversary of the sinking of the Titanic, questions that were raised then are being repeated now; how did this happen?  Obviously, I'm not going to cite all of the opinions, but as one can imagine, blame is assigned virtually everywhere.  Regulation (or lack, thereof) is to blame.  Management is to blame.  You know what I think?  They all miss the point, entirely. 

Why?  Because 1,500 people are dead, that's why.  Titanic was doomed before it ever left port.  One thing we can state with certainty; it was known that if the ship sank in an isolated area, then there wouldn't be enough lifeboats on-hand to save all of the lives on board.

Analysts point to a comedy of errors that, if they hadn't occurred in sequence, then Titanic wouldn't have sunk.  There's that word, if, again.  But this flies in the face of competent disaster planning.  We already know that if events occur as expected, then there won't be a disaster.

Let's enter the equation at the real-time departure of Titanic in its actual condition (meaning, not enough lifeboats).  Here are some of the assumptions that might have been made:

  • The ship will not sink
  • The number of lifeboats are an acceptable risk versus the unlikely possibility the ship might sink
  • Other disasters may occur (e.g. boiler explosion), but the ship won't sink and there are sufficient lifeboats
  • Even if the ship were to sink, it will sink very slowly – or close to land – allowing landed resources or other ships to respond in sufficient time
  • The experts on board – and in the surrounding area (such as the California, or wireless operators) – will act predictably (i.e. not make any mistakes), thereby avoiding errors
  • Icebergs will be exactly where we expect them to be

Here's a question I haven't seen (although I'm sure someone has probably raised it):  Even if the ship had sufficient lifeboats on board, would the crew have been able to launch all of them in the rapid time that titanic sunk (estimated at 2 hours, 40 minutes)?

A good risk management team understands the first rule of disaster planning – follow Murphy's Law:  If anything can go wrong, it will.  The second rule?  Follow-up with O'Toole's Commentary:  Murphy was an optimist.

  1. No plan will ever be correctly analyzed unless it begins with an honest assessment of the following question:  What can go wrong?
  2. The rest becomes a matter of probability.  What is the likelihood that anything (and everything in-between) on the list created by question one might go wrong.

Then, it's a matter of prioritizing between several factors, such as time needed to address & correct, manpower required, cost vs. budget, insurance, politics, etc.

I wish we could go with something more simplistic:  The chance of the bread landing with the buttered-side down is directly proportional to the cost of the carpet…

The Bench: #California Judicial Council Kills ‘Tower of Babel’

Home-alone

Project:  California Court Case Management System

Number of Years in the Making – Ten

Number of Computer Systems Utilized State-Wide – 70

Initial Cost Estimate – $260 million

Amount Spent to Date – $560 million

Amount Still to be Spent – $8.6 million

Estimated Cost to Complete – $2 billion

Number of Counties Upgraded – Six out of 58

Cancellation Date – Tuesday, March 27, 2012

Effect on the California Court System – PRICELESS!

Why #Smartphones & #Tablets Don’t Come with Seat Belts & Airbags

MP900308899This weekend, I was mulling over the question of how responsible we are – individually – for our online privacy.  That's not an easy question to answer on a global basis.  Coincidentally, I came across a couple of recent articles on the subject.  What makes them interesting – and perhaps a bit distinctive – is that each addresses how much fault should be apportioned to the end-user.

Information Week comes right out and says so in their article, "Google's Privacy Invasion: It's Your Fault".  The New York Times Bits Blog is more subtle in their take, "Disruptions: And the Privacy Gaps Just Keep On Coming."  At least they spread the blame around, somewhat.

I waded into the issue myself about three weeks ago with my, "Beware the Ides of Google" post, when I pointed out that these companies give us all this free stuff for a reason.

However, they don't exactly fall all over themselves to clearly explain to the general public why they give us all this free stuff, either.  I bet if I asked the average person, "How does Google (or Yahoo, or Facebook, or…) make money?", they wouldn't be able to articulate it very well (save for possibly being able to say that they make their money through 'advertising', whatever that means to them).  The better question to ponder is, how these companies use your information to make money.

Everyone's screaming for 'the government' to regulate these matters; and 'the government' has responded with clunky, well-meaning and/or self-serving attempts like SOPA.  No doubt, to a certain extent, the end-user is responsible for their own security, but I really like the way the NYT article attempts to equate the issue to how government, safety advocates (Ralph Nader, anyone?) and the general public drove (pun intended) the automobile industry toward seat belts, air bags and center tail lights.

I don't agree with it, but I really like it.

In my opinion, the reason this type of equivalency doesn't work is that the general public understood seat belts, air bags and tail lights.  They could easily envision a head-on collision (in fact, they didn't have to envision it, since car crashes are reported in gory detail nightly on the evening news).  On the other hand, they don't have a clue to life how their information is lifted from their devices and deposited in the hands of others; nor how, in a technical sense, to stop it.

In other words, the general public wants security protection, but they don't really know how to ask for it.  Even if they install software or hardware that tells them they're more secure, they have no idea how to confirm that it's true (and many times, it's not, either because the stuff just doesn't work, or through lack of understanding, they either fail to complete the set-up process or complete it incorrectly).  Ask me how many times I see unsecured wireless routers in range that are named LinkSys or Belkin.  The purchaser plugged the thing in and went on their merry way, oblivious to the fact that it must be configured.  But, they sleep better at night because they think they're secure.

To one extreme, the opinion is that the responsibility falls squarely on the end-user.  To the other, the opinion is that Google, Facebook, et al, are techno-heroin.  They hook the public, then when everyone's an addict, they siphon off private information.  When the public inevitably complains, they retort, "You don't like it?  Stop taking heroin!"

Maybe the solution is A.A. for the Internet…

#Security Questions that AREN’T SECURE, DAMMIT!!!

MP900438619

/Rant ON

Note to the people who create security questions for our online accounts; the whole point of providing this service is to let us select questions that nobody else knowsor may easily discover!!!  With this in mind, please refrain from creating questions that require as answers:

My mother’s/father’s middle names
My mother’s maiden name
Any of my grandparents’ names
The names of any of my pets
My siblings’ first names
My siblings’ middle names
The cities in which any of my family members were born
The schools I attended
My favorite sports team(s)
My favorite sports team(s) as a child
My best friend, growing up
My favorite…anything!

You’re a bank, for Pete’s sake, and you can’t figure out that most of this information may be gleaned from a simple Google search, a Twitter, Facebook, LinkedIn or other social media posting (for those of you who over-share), friends & family members and/or public records!?!?!?

Right, then. Please handle by c.o.b., Friday. Thanks for your anticipated cooperation.

/Rant OFF

e-Discovery California: Proposed Formal Opinion Interim No. 10-0003 (VLO) is the Right Answer to the Wrong Question

42.  (That's for those of you who picked up on the 'Hitchhiker's Guide to the Galaxy' reference).

I usually don't feel it necessary to refer you to my disclaimer but, because this is a State Bar of California opinion – and I'm Vice-Chair of their Law Practice Management & Technology Section Executive Committee (LPMT) – I want to remind you that:

MP900442177
"This blog site is published by and reflects the personal views of Perry L. Segal, in his individual capacity.  Any views expressed herein have not been adopted by the California State Bar's Board of Governors or overall membership, nor are they to be construed as representing the position of the State Bar of California."

The LPMT Executive Committee may publish its own, 'official' comments, to which I may also contribute.  That being said…

Technology is an extremely logic-based discipline, in its purest form; or it should be, at least.  Indeed, like the practice of law, success or failure is predicated upon compiling and understanding a particular set of facts, then realistically acting upon those facts.  Note my emphasis on the word, 'realistically'.  If I wish to suspend disbelief and begin with a set of unrealistic criteria, I may be equally able to formulate a reasonable solution, assuming it's possible to locate someone – or something – that fits the original, unrealistic premise.

This is my assessment of Formal Opinion Interim No. 10-0003 (Virtual Law Office).  It's actually a very well-crafted opinion, but it's based on a 'Statement of Facts' that, to me, are an unrealistic portrayal of how an attorney practices – or would practice – law.

First, there's no reason for me to re-invent the wheel.  For another excellent nuts & bolts assessment of the opinion, please see Stephanie Kimbro's post on her Virtual Law Practice blog.  She's an authority on the Virtual Law Office and is also cited as a resource on page one of the opinion itself.

From a pure cloud security standpoint, this is an excellent document and a perfect complement to opinion 2010-179 on wireless networks.  In fact, I would recommend that practitioners ignore the hypotheticals for a moment (especially if they're pressed for time) and proceed to the Discussion heading, Section 1 ("Duties"), which is what I'm doing for the purposes of this post.

Section 1 examines confidentiality issues of employing a cloud-based system with a 3rd-party vendor and provides a five-point list of due diligence factors that includes, but isn't necessarily limited to:

  1. The Credentials of the Vendor
  2. Data Security (Well, that's not very helpful, but it goes on to refer the reader to California, New York and ABA opinions for guidance)
  3. Vendor's Transmission of Client Info in the Cloud Across Jurisdictional Boundaries or Other 3rd-Party Servers (You've heard – or read, I suppose – me pontificate on that one; the "digital roach motel" and "know where your data is")
  4. Attorney's Ability to Supervise the Vendor (As I've reminded you often, you may hire competence, but not delegate this duty)
  5. Terms of Service of Contract with the Vendor (This is huge where the cloud is concerned.  For example, many provider contracts contain language to the effect that, "Once you transfer it to us, it becomes our property.", a major no-no for attorneys)

It also points out the security environment must be periodically reassessed, which is terrific advice.  I usually refer to it as "fire drills".  Finally, it points out that none of this may take place without proper disclosure to the client, who may, by the way, have no idea how any of this works.

Section 2 examines competence issues as follows:

  1. Proper management of attorney's intake system to determine one of the basics; "Who is the client?"
  2. Determining whether attorney may perform the requested services
  3. Determining that the client comprehends the services being performed (This document also refers to comprehension issues due to a language barrier)
  4. Keeping the client reasonably informed
  5. Determining that the client understands technology (When I read #3 above, it immediately triggered the thought that technology is another language both attorney and client must understand…)
  6. Determining when to decline to represent a client via a VLO, and whether representation may continue through traditional means

This section also re-raises the supervisory issue, but this time it's in terms of the attorney supervising other attorneys and/or non-attorneys.

Ok, so you know what I like, now let's get into what I don't like.  The hypothetical describes the VLO as a password-protected and encrypted portal that sits on a 3rd-party cloud.  So far, so good.  But then, it goes on to say that the attorney plans not to communicate with clients by phone, email or in person, but will limit communication solely to the portal.

Yeah, that covers a lot of us, doesn't it? 

I understand that it's possible for attorneys to communicate this way, but is it probable?  Does this opinion realistically apply to most attorneys; now and even into the future?  I'm not trying to be snarky here, but you can't blame me for being a tech guy.  Immediately, my mind wanders to what would likely happen in this scenario.  A technology or communication issue arises and the frustrated attorney – or client – resorts to email or a phone call.

And what about secrecy?  No, I'm not alluding to some nefarious purpose.  There are legitimate reasons why attorney and/or client might not want to document ideas or discussions – electronically or otherwise – in the short-term (what comes to mind is a nervous potential client who has invented a new product, but doesn't want to provide a lot of written detail to attorneys, while soliciting the representation of several of them, for fear that the inventor's intellectual property will be revealed).

The second thing that bothers me is the "Issue" statement that opens the opinion.  It states, verbatim:

"May an attorney maintain a virtual law office practice ("VLO") and still comply with her ethical obligations, if the communication with the client, and storage of and access to all information about the client's matter, are all conducted solely through the internet using the secure computer servers of a third-party vendor (i.e., "cloud computing")."  [Italics/bold added.  It's posed as a question, but in the text, the paragraph ends with a period – not sure if it's a typo that will be corrected in a later version].

What's the danger here?  Hello?  Facebook is the cloud!  Google is the cloud!  Email is the cloud!  A lot of communication is taking place – right now – through means not anticipated in this opinion.  What I'm saying is, if one removes the term, "VLO", from this document, it could just as easily apply to methods attorneys use to communicate with their clients on a daily basis, while at the same time, being completely unaware that many of these products are in the cloud.

It also fails to anticipate one other factor; what will happen the day these measures apply to all cloud-based technology (that day is coming, and in some cases, is already here).  As it stands today, if most attorneys attempted to comply with these security measures, law practice as we know it would grind to a halt.

Better start preparing now…

e-Discovery California: Wow – I Coulda had a VLO!!!

MP900315631Happy Holidays, everyone.  I'm about 2/3 of the way through my book-writing and with any luck, I hope to submit most of my remaining contribution before New Years (that is, if I don't succumb to the most wonderful time of the year – Bowl Season!).  Hopefully, then, I can get back to posting here more often.

In the meantime, I have some homework for you.  The California State Bar Standing Committee on Professional Responsibility and Conduct (COPRAC) has posted, "Proposed Formal Opinion Interim No. 10-0003 (Virtual Law Office)" for public comment [Warning; link opens a 7-page PDF].

I'm currently working on an in-depth analysis of the proposal and hope to post it next week, but when I first scanned the opinion, my mind wandered to the law of unintended consequences.  I'll reserve commenting further until I've completed my analysis, however, I encourage you to familiarize yourselves with the opinion – whether you personally make use of a VLO or not.  After all, (and it pains me to say this), it isn't all about you; the attorneys at the other end of your communications may make use of a VLO.

The public comment period remains open until March 23rd, 2012.  Hope to see you before the ball drops, but if not, please be safe and have a great holiday!

Century City Executive Counsel Exchange – Summary

MP900382650Alec Baldwin’s Twitter rant?  So last year…(that’s why I created a ‘Twit List’).

BP accused of spoliation?  I’ve never heard that, before…

This week, I actually saw an article warning people to be careful what they post on social media, ‘because it might come back to haunt you, someday.’…

Folks, it’s almost 2012!  If any of the above headlines surprise you, you’re either new to this game or you’ve been hiding in a cave (or you haven’t been reading e-Discovery Insights the past three years…).  So, let me tell you about something more substantive – the annual Executive Counsel Exchange that was held this past Monday and Tuesday at the Hyatt in Century City, California.

I’m not aware of any other conference that operates the way this one does it.  It’s a roundtable, free-form discussion over a period of a day-and-a-half.  Two old pros were moderating this year, Robert Brownstone of Fenwick & West LLP and Browning Marean of DLA Piper (if you don’t recognize either of these names, we may have to have the ‘cave’ discussion again).  The moderators cover a series of relevant topics and the attendees are encouraged to participate.  Everything is memorialized and the attendees receive a copy.

Another thing I really appreciate is that, although it’s a sponsored conference, the vendors are highly respectful about not bombarding us with sales pitches during their contributions to the program.

If you want to know what’s happening right now, this is the place to be, because you’re hearing it exactly as it is, from people covering all parts of the spectrum who do this every day (vendors, technology, inside and outside counsel, executive, etc).  Over the next several months, The Exchange (as its called) will be in four more cities across the country.  Unfortunately, I was only able to attend Monday’s session this time, but I encourage you to check it out if you have the opportunity.