E-discovery SaaS: Using the cloud to deliver e-discovery application software. These SaaS packages typically cover one of several e-discovery processes, such as collection, preservation or review.
Cloud-based e-discovery: Using a hosting provider to run e-discovery processes on data archived to the cloud. This comes in two forms. First, a customer can archive data at a hosting provider with the specific understanding that the service provider can and will do e-discovery on that data if the need arises. Second, a customer keeps its archives in-house, but in the case of legal trouble it collects the relevant data and sends it to a cloud provider specifically for the purpose of e-discovery services.
E-discovery on any data stored in the cloud: Using a cloud provider to store data in the cloud, with no special provisions or considerations about e-discovery. This is by the far the riskiest option of the three, says Taylor. "Even where the cloud provider is trusted, such as Google or Amazon, service level guarantees for the enterprise are notoriously poor," she wrote in a recent report. "And these services also have few mechanisms in place to report on physical data locations to their customers, which can be a serious defensibility issue."
Know the potential problems
And yet most companies are blissfully unaware of the potential problems with e-discovery, says Murphy. In a recent survey of legal and IT professionals using cloud services, Murphy found that less than 16% of 172 respondents had put an e-discovery plan in place before moving data to the cloud. Even more alarming, he says, nearly 60% of respondents didn't know whether they had an e-discovery plan in place or not.
In another survey, conducted last year by Clearwell Systems Inc. (an e-discovery vendor acquired last year by Symantec) and consulting firm Enterprise Strategy Group (ESG) Inc., nearly 60% of more than 100 Fortune 2000 enterprises and government agencies said they expected to have to consider their cloud-based applications "in scope" for e-discovery.
In the same survey, however, only 26% considered themselves somewhat or very prepared for such e-discovery requests. In other words, notes Katey Wood, an ESG analyst, "they said yes, they think they'll have litigation, but no, they are not prepared for it."
Murphy thinks lawyers may even start to target cloud-based sources of information hoping to catch opponents unprepared. A wily opposing attorney could, for example, request discovery of data in Salesforce.com, knowing that most companies are inexperienced with doing collections from that particular data source.
"Until we have a successful anecdote in which someone gets sued and they run their search successfully on data in the cloud, until they've actually done it at speed and to scale, we won't really know" how prepared companies are for e-discovery in the cloud, he says.
Sign up for CIO Asia eNewsletters.