Category Archives: Cost

I’m Good Enough, I’m Smart Enough & Doggonit, People Like Me…

Cute Sheep…and eventually, I’ll write an in-depth analysis of California AB 5 and contrast it with the Federal Rules.  But, take a look at this fine analysis from Law.com regarding how California will deal with Zubulake ‘accessible vs. inaccessible’ ESI and how it contrasts with the Federal rules.

Finished reading?  Great.  Now let me tell you why nothing in the analysis rattles me.  You should have been treating your ESI as accessible all along.  Here’s why:

The law is all about exceptions.  Everyone knows the general rule, but ultimately the facts dictate whether an exception is in order.  At Sony Pictures in 1997, we successfully fought off a request for ESI in a California court because we made the case that it was accessible, but at punitive cost because we’d long since retired that particular backup system and complying would have required a $250,000 outlay (there was no product like Index Engines around in 1997).

I had a very smart professor in law school.  His advice was to always assume the worst-case scenario, then work backwards.  It’s actually a very logical approach.  Yes, the flood may be that bad, yes, the stock market may fall that much and yes, your adversary may make a persuasive argument to the judge.

Be an actuary.  They look at everything as ‘cost vs. risk’.  Which will likely cost more, paying to protect or paying after the fact?  A young PC user asked me the other day, “Why do I need a firewall?  What are the chances that I will be the one that will be hacked?”  My answer was, “If you want to gamble, that’s your call, but here’s a short list of things that could happen if you’re the unlucky one.”

Gamble if you like; but be prepared to face the consequences.

Jurors take the Law, PDAs – and e-Discovery – into their Own Hands

j0314263 Coming soon to a courtroom near you; sequestering with no access to electronic devices, and all movement and correspondence monitored – for the entirety of every trial.  Got any better ideas?

On the heels of my post late last week about “Juror Jonathan“, comes the following story from the New York Times about jurors ignoring their judges’ admonishments and conducting their own online research during trials.

Courts have always operated on the honor system when it comes to non-sequestered juries.  We hold out hope that when a judge issues jury instructions, they will be taken seriously and followed to the letter of the law.  Unfortunately, we also know that individuals violate these rules all of the time.  Sometimes they’re caught – sometimes not.

Now, virtually every PDA comes equipped with the ability to access the internet, so jurors can conveniently misbehave on their breaks!  If our system of jurisprudence can’t get a handle on how to control juror misconduct, here’s the next place they’ll be getting a ‘handle’ on them:

ca. 2002 --- Motel Room Toilet --- Image by © Royalty-Free/Corbis

 

Dancing ‘Geek to Geek’ – Judges’ Panel Weighs in on California AB 5, ‘Train Wrecks’ and the ‘Mayflower’

If this keeps up, I’m going to rename this site the ‘Hot Potato‘ blog…

j0404952
 I’ve posted ad nauseam about how parties want to rid themselves of the e-discovery hot potato, but throwing it to the Judge?  Not so fast, says the Hon. Andrew J. Wistrich.  You can try, but he won’t play the game!  That was one of the morsels from the Judges’ Panel, which also included the Hon. Maureen Duffy-Lewis and the Hon. Carl J. West.

I like Judges.  They’re always more candid than I expect, and as some of you have probably figured out from my prior writing, I like candor.  Don’t beat around the bush, don’t use fancy language, just tell me what you mean!  I certainly got a lot of that from this panel.  It was the best 75 minutes a person interested/involved in e-discovery could spend, because it tells us where things are headed in the minds of the Judges – and ultimately, they’re the ones we are speaking to, not only our adversaries.

What was the most important concern to the panel?  Cost!

Judge West lead off the discussion and to my delight, he immediately weighed in on California AB 5, noting the pending March 3rd hearing and saying he expects the Bill to be adopted either by late this quarter or the next.  My take?  California finally reached a budget deal, so we’ll see if that development facilitates the passage of AB 5.

Judge West was concerned about two seemingly-contradictory provisions in the Bill; one, which discusses imposition of sanctions, and the other, which defines Safe Harbor.  He noted there were several exceptions to Safe Harbor that might incur sanctions.  That reminded me of law school.  As my professor used to constantly warn, “Everyone knows the rule, but they’ll test you on your knowledge of the exceptions to the rule”.

He also mentioned that more and more, he’s seeing each party provide a technology expert at hearings, and that many times it becomes an ‘expert versus expert’ issue.  That’s when he coined the phrase, credited to another Judge, that the parties should have their respective experts ‘dance geek to geek’.  I just want the Judge to know I haven’t worn horn-rim glasses since grade school…

Judge Duffy-Lewis spoke next…

She’s involved with what we refer to in California as ‘Fast Track’, but she came right out and said it; e-discovery hearings in her courtroom sometimes resemble “train wrecks”.  She said this occurs because she doesn’t see cases until they’re 90 days out and many of the lawyers wait to file motions until their case is about to be heard.

She would like to see attorneys dive right in as soon as possible and not wait.  They should begin submitting motions early related to issues of privilege, preservation and notice.

A major issue is how to handle privileged documents.  For example, I don’t want to turn over to the other side a document that contains information I’m going to use to impeach my adversary.  That’s easier when you’re talking about a paper document, but not so easy when the particular statement you need is buried in a 20-page email thread between multiple custodians that contains other relevant statements.

Judge Duffy-Lewis’ solution was to create something called an Impeachment Log.  The attorneys submit the documents to her, then she makes the determination, preserving the privilege.  Brilliant!

What does she see in the future?  Recommending a status conference will become virtually mandatory for e-discovery issues, and she predicts the appointment of special masters will become more prevalent.

Judge Wistrich completed the trifecta.  Talk about candor!  He’s a Magistrate Judge of the U.S. District Court for the Central District of California (I’m a member also) so his was the Federal view.

Judge Wistrich didn’t mince words.  He said the “rules have helped, but haven’t solved the problem.”

What problem?  The adversarial system and the natural tension created by asking parties – that by virtue are required to keep things close to the vest – to break that habit to cooperate on e-discovery issues.  He said the parties are going to have to get around that problem because in many cases, the experts are going to ask for – and be granted – access to their adversaries’ data.

He also said he’s “uncomfortable” because, “I’m not sure I know enough”, and is “concerned” that e-discovery is going to end up adding another layer – experts – to the front-end of the process, further bogging it down.

Still, like Duffy-Lewis, he says attorneys had better be prepared to take the pro-active approach.  He clearly understands his role and will not let the parties try to shift decisions to the bench that don’t belong there.

He also discussed Mancia v. Mayflower Textile Servs. Co.,
2008 WL 4595175 (D.Md. Oct. 15, 2008) and its effect on Rule 26(g).  I wasn’t surprised that Chief
Magistrate Judge Paul W. Grimm would be cited at the conference, since he’s one of the pioneers in this area.  Wistrich said that, when faced with issues of good faith, he orders the parties to videotape all further meet & confer discussions.  Strangely, he noted, their behavior improves immediately.

Bravo!

The ‘Missile Command Act’? No, the ‘Internet Safety Act’!

A5200_Missile_CommandI think my career is about to resemble Missile Command.  It was all the rage in the 1980s.  Atari still exists and I was surprised to see that they’re still selling it.

The name of the game is to intercept falling missiles (which have an annoying tendency to split off in multiple directions) with silos on the ground (hint; we’re the silos).

John Cornyn (R) has introduced the “Internet Stopping Adults Facilitating the Exploitation of Today’s Youth Act”, or ‘Internet Safety Act’ (for those of us who can’t fit all that in a catchy blog title).  This bill is actually a regurgitation of a bill introduced in 2006.  I think you get the gist from the bill’s title, but here’s the fine print:

“A provider of an electronic communication service or remote computing service shall retain for a period of at least two years all records or other information pertaining to the identity of a user of a temporarily assigned network address the service assigns to that user.”

Anybody besides me thinking about the storage/costs required to retain and/or restore these logs?5_Day

That’s Part I of the headache.  Part II is who would be covered under this bill; essentially anyone who serves wireless using DHCP.  That’s right – it includes that little Wi-Fi router you have at home.  Note to those who brought their wireless router home from the store and
just plugged it in; you might want to configure the security feature, lest someone nearby connect through it and start looking at child
pornography.  Starting to sweat, yet?  Maybe you will after I mention Part III; you might go to jail for up to 10 years.

Here’s the really bad news – there’s a Part IV…

Once again, all I think about is Zubulake.  The moment you’re required to retain a record for two years, it may be adjudged ‘accessible’ for Zubulake purposes – and not just the ones covered under this Act, which, as I previously mentioned, specifically targets child pornography.  Any purpose of litigation may be fair game to subpoena these logs!

You think maybe Senator Cornyn knows how to push a bill through Congress by piggybacking it on the hot-button terms that frighten all parents to death?

This Act really could be the legal equivalent to ‘Missile Command’ (or starfish, or octopus…).  The tentacles could reach virtually anywhere.  I’ll be monitoring this closely, as should you.  If it becomes law, it could be…Missile Command - The End

Tips & Tricks: e-Discovery Calculator

Adding machineThis is cool!  That’s about all I can say about the JurInnov Electronic Discovery Calculator.  Obviously, little explanation is necessary as to what it does.

To me, whether or not you may rely on this tool to accurately estimate costs isn’t really the point.  Anything that gets the ‘conversation’ started – or fills in elements you may not have considered – is a good thing.

I expect that some of you who try this calculator, after
you see some of the fields, will say, “I didn’t know that was part of
e-Discovery!”.  If it accomplishes that goal alone, it’s worth a look.

I Have some Good News & some Bad News…

*** My n/w and phones are out, so I’m coming to you live from the Redondo Beach Public Library, courtesy of their free wireless service…THANK YOU!!! ***

j0178660

Why did the goose cross the road?  Let’s take a gander…

I.T. to the Attorneys and Management:  “Great news!  We can leverage our existing ESI backup and/or disaster recovery systems to solve many of our e-discovery challenges and simultaneously cut costs!”

The Attorneys to I.T. and Management:  “Terrible news!  You can leverage your existing ESI backup and/or disaster recovery
systems to solve many of your e-discovery challenges and simultaneously cut costs!”

Why both?  Sauce for the goose is good for the gander – anything that makes it easier for you to access ESI, also makes it easier for your adversary.  But is it that simple?

Key phrases to keep in mind; ‘accessible’, ‘not reasonably accessible’, ‘inaccessible’ and ‘cost-shifting’.  The Federal rule states:

A party need not provide
discovery of electronically stored
information from sources that the party
identifies as not reasonably accessible
because of undue burden or cost. On motion
to compel discovery or for a protective order,
the party from whom discovery is sought
must show that the information is not
reasonably accessible because of undue
burden or cost. If that showing is made, the
court may nonetheless order discovery from
such sources if the requesting party shows
good cause
, considering the limitations of
Rule 26(b)(2)(C).
Fed.R.Civ.P. 26(b)(2)(B), italics added.

j0178039The courts sought to define the parameters in a series of rulings, commonly referred to as ‘Zubulake I, II, III, IV & V‘!  These are not new rulings by any means (2003-2004), and I dealt with a case on this very issue in 1997, but because so many IT groups are ramping up their e-discovery bona fides at this time, this would be a good opportunity to revisit Zubulake and make sure you understand the implications.

In the normal course of business, one might implement a solution, then policy follows.  This is definitely one of those times where you should be thinking about policy – and consulting your legal resources – before you implement the solution or modify your current one.  After all, a lot of IT professionals don’t read cases nor know of their implications.

I can’t count how many times I’ve been asked, “How long do we have to keep this stuff?”  Is it possible 37 days is enough?  Gippetti v. UPS, Inc., 2008 WL 3264483 (N.D. Cal. Aug. 6, 2008)

Think about it; what does “keep” mean, exactly?  What does “stuff” mean, exactly?  Can a single data retention policy apply to “everything” or only certain types of ESI; and should you apply a different retention standard to various forms of ESI, based on their use?

Let’s say you have a policy that you delete ESI after X months.  Do you retain or destroy the backup media?  Do employees thwart you by archiving data to their office PCs – or worse – store it on the internet, a personal PC or a thumb drive?

This should be part of your thinking as you craft policy.  It matters whether you can answer those questions.  If not, be prepared for an unpleasant surprise when your adversary comes looking for this information.

Ready, Set, Litigate!

Businessman on Start Line of Running Tract --- Image by © Royalty-Free/CorbisLitigation readiness.  What does that mean?  Sure, I can state clearly that it means you’re ready to respond to a litigation hold; maybe “prepared” would be a better word.  What about everything that follows?  How ready are you?

I break it up into five possible scenarios:

  1. No lawsuit in sight, but you want to be ready for the future
  2. Plaintiff – you sue someone
  3. Defendant – someone sues you
  4. Internal – Plaintiff and Defendant are within the same organization (e.g. employee suing employer or vice versa)
  5. Third Party – you’re drawn into a complaint between other parties (e.g. impleader)

How do you get the conversation started when there are so many reasons to put it off?

  • “I don’t know what the big deal about ESI is.”
  • “We don’t have it in the budget.”
  • “We don’t have time to deal with it right now – try again next cycle.”
  • “We’ll deal with it if and when a problem arises.”

Fortunately, most of us recognize that if one waits until an issue arises, it’s already too late.  Receiving a subpoena is not an ideal time to find out that you can’t comply.  It’s also a short-sighted view.  You may need your own ESI to bolster your case, no matter what side of the action you’re sitting on.  Perhaps that’s the argument to make when attempting to motivate management to act.

If that doesn’t work, there’s always the fact that trying to do anything in a piecemeal fashion results in much higher cost.  And if that doesn’t work, management needs to understand that they have duties to uphold – and it’s very easy to violate them when you’re not aware of the rules (oh, and the court won’t necessarily absolve you for being ignorant of the rules – there is a presumed level of competence).

Litigation isn’t just segregated to a small portion of a company.  It requires activating resources from all over the enterprise; HR, IT, Legal (internal and external), Management, etc.  Ever tried getting all of these parties in a room for a meeting?  I have.  Depending on what everyone has on their plate at that particular moment in time, it can take weeks!

Do you really want to be dealing with this at the last minute?  What about e-discovery software?  What
about storage?  Who will review the ESI?  What about your adversary?  Do you have the expertise to know that they’re complying with your ESI requests in good faith?  Who will oversee all of this?

3D Rendering. Very high resolution available! Use it for Your own composings!

The problem with this discipline is that it’s hard to know what questions to ask unless everyone who has a hand in the process is in the same room.  It’s like smashing the atom.  One question generates a whole host of other questions and before you know it, you’ve opened Pandora’s Box.

Start with question #1 – who belongs in the room?

If you have policies in place, everyone knows their responsibilities.  When a litigation hold is issued, duties are already pre-defined.  This is critical, because when they say “hold”, they mean “hold“.

Will your response be more like The A-Team, or the Keystone Cops?

Businessman Crossing the Finish Line --- Image by © Royalty-Free/Corbis

e-Evidence: Legoland or Humpty Dumpty?

Part II of a two-part series.  Part I appeared 12/03/08.

Forgive me – I’m in a mischievous mood today…

PART II – LEGAL RELEVANCE

j0403058“All the king’s horses and all the king’s men couldn’t put Humpty together again!”

This is a humorous nursery rhyme from my childhood.  Others, like Ring around the Rosey or London Bridge might have illustrated my point well, but those are missing the most important part; with e-discovery, once the opportunity is lost, it’s likely a permanent result.

Let’s say you’ve made it all the way through to this stage,  If that is so, then not only have you located evidence, you’ve established that it’s logically relevant (which in law-speak generally means that the evidence is material to prove or disprove a disputed fact that is of consequence to the action, and has probative value).  That takes care of that, right?

Not so fast.  Now, you have to persuade the court that it’s legally relevant to your case; and that means laying a foundation of admissibility.  Your adversary is going to use every tool at his or her disposal to knock out items that exculpate your client.  Did you take care to make sure that all technical aspects have been satisfied?  A paper trail is one thing, but an electronic trail?  Maybe a game of Twister would be easier.

In law school, we had a ‘mini-checklist’ that would help us remember all the things we had to think about when addressing this type of evidence:

  1. Is it Relevant?j0385258
  2. Is it Authentic?
  3. Does it violate the Best Evidence Rule?
  4. Is it Hearsay?
  5. Is it Privileged?
  6. Is it Parol Evidence?

Techies, take a deep breath.

For our purposes today, I’m not concerned with three through six.  Lawyers will determine the disposition of the evidence once it’s produced.  But what about one and two?  There are a lot of steps leading up to production.  The data may pass through several hands before it makes its way to the legal department.  Let’s take a look.

RELEVANCE (LEGAL)

We discussed logical relevance above.  We have, theoretically, material evidence.  Now, we must lay the foundation (also mentioned above).

AUTHENTICATION

We have to establish that the evidence is what it purports to be.  That’s not simple, even when it’s paper.  We need an electronic trail to follow – and that’s the east part.

First, we have to establish chain of custody.  That means we need to link together the source and all phases it passed through – kind of like a Barrel of Monkeys. If a cutting-edge method was used to procure the data, there could be a scientific challenge to the process. We’ll need expert testimony to walk the court through how the evidence was obtained.

The lawyers aren’t likely to be doing it.  They don’t have the technical know-how, plus, there are ethics issues with lawyers testifying in trials they’re working on.

Techies, let out that deep breath.  If they won’t be doing it, you will!  It means you’d better document everything, then be prepared to testify about it in court.

EPILOGUE

If this exercise proves one thing, it’s that attorneys and technology professionals have separate and distinct – and extremely important – jobs to do.  But in certain areas, they depend on each other.  If IT can’t get access to data, the attorneys may have to file a motion.  If IT establishes that there will be a punitive cost to comply, the attorneys may have to push back – or seek cost-shifting.  As an attorney, if I don’t explain to IT that every step of their process must be documented, am I hurting them?  No – ultimately I’m hurting myself, because I’m the one who will have to establish authenticity in court.

As you can see, the process of bringing ESI to it’s proper form is a series of building blocks, not unlike stacking Lego bricks.  In fact, in evidence law we have a saying; “A brick is not a wall“.

Take care.  Failure to stack the bricks carefully and your wall will likely end up like Jenga or Kerplunk.

Darn…I should have been able to work in Operation

What is Electronic Evidence? Answer: A lot more than you might Think!

Part I of a two-part series.  Part II will appear 12/04/08.

PART I – LOGICAL RELEVANCE

A cardinal rule, known to law students everywhere, was broken.  “When on a break from the bar exam, don’t discuss a specific part of it with anyone – and if you absolutely must, ask permission first!”  The reasoning behind this rule; to prevent students from freaking out because inevitably the other student will point out something they themselves missed, thus setting off a chain reaction of worry, panic and distraction.

There I was, on a break from the California Bar Exam, and another student really wanted to discuss the evidence question with me.  We had a pleasant conversation – as pleasant as it could be between two stressed-out bar candidates in the middle of a three-day exam.  We discussed the facts as they pertained to the question and the issue of whether each piece of evidence put before us was authentic.

Signature:2a0f6d0366f291694bd9cc422bff24b12e1d3afd88bc0ed09c9a8814df3c0837

All was going well until I pointed out the ones that were legit, but weren’t admissible in court.  The pallor of my counterpart changed noticeably.  That’s when he realized that he’d done a great job analyzing whether each piece of evidence was authentic, but forgot the next step – determining whether each was admissible.

Finding evidence is just the beginning.  If all of your dominoes don’t line up properly, it will never be admitted.  The technology gurus have a huge role to play and may not even be aware of it.

A few years ago, if you explained to the average person what electronic evidence – or e-evidence was, then asked them to give you an example, 99% of them would have given you the same answer – e-mail.  We’ve all read news stories about this individual or that one who was caught red-handed through his or her e-mail messages.

Later, another example started showing up more often – text messages.  Just ask the former Mayor of Detroit how that turned out for him…

ESTATUAS DE JARDIM

In law school and on the bar exam, the testers took pride in finding ways to slip a piece of written evidence right by a student by putting it into a form that he or she wouldn’t normally think of as “written”; engraving on a tombstone, label on a medicine bottle, a license plate.  We’re conditioned to think of written evidence as something more mainstream, like a letter, a book or a bill of receipt.

A lot of e-evidence is still written – but now it’s written to computer hard drives, DVDs and cellular phones.  Just like law school students, we have to broaden our thinking and remember that virtually any device that can save, store – or even process electronic information (e.g. RAM in printers/fax machines) may qualify. Then, we have to remember the really tough part – many of these devices are mobile.  They could be virtually anywhere in the world.

Let’s take a hypothetical look at Jane Doe.  She works for a multi-national corporation, “Multi-Corp”.  She has an office in Los Angeles and one in Tokyo, and an apartment in each city as well.  She has a desktop computer in each office, plus a laptop to use when she’s out in the field, at home or traveling.  She stores some of her work on the company file servers.  She’s taken to transferring work from her laptop to her home computers in both Tokyo and L.A. – because she likes them better (the boss doesn’t know).  It’s annoying for her to connect the machines directly, so she either hooks up wirelessly through her router or uses her thumb drive.  She has two cellular phones (one is personal) and a PDA.

Multi-Corp is sued by Uni-Corp, and the Plaintiffs subpoena Jane’s correspondences.  Am I the only one with a headache?  Probably not.

If I’m in the IT department at Multi-Corp, I have to think of every possible device – and the location of each – where relevant data may be stored (let’s hope Jane remembers to tell me about the thumb drive).  Then, once I do, I have to locate the data on the device itself.  What if I need to retrieve it from back-up media?  What happens if a device – and the data it contains – is owned/managed/outsourced to a third party (e.g. the file servers or the cellular phones)?  How do I get them to grant me access when they don’t want to be dragged into a lawsuit?  Do they have to do so?  I might have to ask the legal department.

If I’m in the Legal department at Multi-Corp – or in their outside counsel’s office – I’m depending on the expertise of my IT resources, but I’m also worried about issues that IT doesn’t normally think about; chain-of-custody being a prime example.  I’m looking for data that will exonerate the defendant and relevance is only one issue.  I’m also responsible for making sure it’s admissible and I don’t want it thrown out on a technicality.  How can I impress this and other concepts upon people who don’t work directly for me?

Meanwhile, both departments – and management – are thinking about the costs and whether the Plaintiff’s subpoena is too broad in its scope.

A lot of questions.  A lot of concerns.  I will endeavor to address all of them in tomorrow’s post.

Money Pot or Money Pit? The ‘Proactive vs. Reactive’ Debate

j0382668Want to re-create the experience of salmon swimming upstream?  Try convincing the higher-ups that making an initial capital outlay to implement highly-efficient technology will benefit them in the long run.

Want to re-create the experience of salmon swimming upstream in a tsunami?  Try doing it in our current economic environment, while IT budgets are being slashed; and the highly-efficient technology you want to implement is a new discipline that almost nobody understands.

I’ve been making the”proactive” argument my entire career.  Certainly, I always had logic on my side, and lined up all of the metaphors to support my position.  Who would possibly argue against fixing potential leaks before the dam bursts?  “Don’t be penny wise and pound foolish!”.  “You can pay now or pay a lot more later!” (my brilliantly-usurped line from the Fram oil filter guy).

The problem is, you may win the argument, but still lose the debate.  CIO magazine illustrates this point beautifully.  There are a mass of sinister forces working against you; not the least of which is, to a lot of executives, the IT department is like that not-too-popular uncle they keep in the attic.  A necessary evil.  Their mantra is, “IT should be seen, but not heard”.  You end up running into four common issues and one exception:

  1. Management looks at IT as a non-revenue-generating cost center, and as such doesn’t want to fund it.
  2. Management has no idea what you’re talking about.  They won’t fund it.
  3. Management actually listens to you and even likes what they hear.  Then comes the dreaded result, “That’s a great plan, but we simply don’t have room for it in the budget.  We can’t fund it.”.
  4. Management likes it and wants you to implement it, but thinks it can be done on a shoe-string.  They fund it, but just enough to set you up for failure.
  5. Management funds it!Pennybags

First of all, views one through four are highly short-sighted.  I phrase it this way.  In IT, we produce nothing!  Our job is to make sure that everyone else can do THEIR jobs.  Management sometimes doesn’t see the bigger picture.  They don’t realize that a catastrophic failure means that the revenue-generating parts of the company will not be able to generate revenue.  In short; time is money.

Times are changing, though.  Some companies have broadened their definition of the IT department and have brought them in to support projects that actually generate revenue.

Also, one can’t blame management all the time.  If it’s not in the budget, it’s not in the budget.  That changes your mandate.  How do you move yourself up in the pecking order?  If management can’t see the big picture, it’s your job to MAKE them see it!

This is where IT and Legal can really cooperate to achieve a beneficial
result for both departments – and by default, the organization as a
whole.  How?  By using the one thing that is the singular goal of most attorneys:

PERSUASION!

Legal eagles face dire consequences for failure.  Their licenses are on the line.  IT knows what it feels like when they can’t deliver what’s requested of them – it’s already happened many times.  And the organization?  Somebody will end up paying the penalty.  Everybody has skin in this game.

This is a true opportunity for IT and Legal to come together to play to each other’s strengths.  Get into a room together.  Formulate a plan.  Then persuade management as a team.  This has to happen!