Microsoft 365 is Forcing Lawyers to Face Cloud Discovery

This article was originally published by ACEDS.

You’ve probably heard that the business world is moving all of their electronic records to the cloud. You’ve probably heard that shift is going to fundamentally change litigation and discovery forever.

Despite dire warnings, the move to the cloud has not had a notable effect in eDiscovery. That is beginning to change.

According to litigation support professionals, one cloud solution is driving a mass migration of electronic data to the cloud. According to analysts, Microsoft’s cloud-based Office 365 is the company’s fastest growing commercial product ever. In addition, the Cowen & Company IT spending survey finds that among companies representing more than $51M in IT spending and a number of verticals, 77 percent report meaningful adoption of the cloud already and believe more processes could be moved to that platform.

For eDiscovery professionals, the adoption of Microsoft 365 means that the most common and important type of electronic evidence in most matters- email- is moving to a new platform. While that software is still based on the popular Microsoft Exchange platform, there are important differences that will complicate collection and review of that ESI. “I see it every week,” says Scott Polus, the Director of Forensic Services at Xact Data Discovery. “Microsoft 365 simplifies the and reduces IT costs and complexity, but organizations don’t always take litigation or eDiscovery into account when they make the transition.”

According to Polus, Microsoft 365 is a popular solution among Fortune 500 companies because it is easier to manage than hosting multiple Microsoft Exchange servers. He says that in a large, corporate environment, an organization may need to have 20 or 30 separate Exchange servers. That can be reduced to one portal in Microsoft 365.

While Microsoft’s built-in, In-Place eDiscovery service lets administrators search mailboxes and SharePoint sites for eDiscovery, the eDiscovery functionality is not part of the basic Microsoft 365 package, and advanced eDiscovery functions are only available if organizations pay a premium to have them installed. “You have to remember that IT people have a lot on their plate, so eDiscovery is not always a high priority,” says Irene Fiorentinos of Counsel with Jones Day in Chicago. “As an attorney you have to work with the people involved to understand how any cloud technology works, where it is stored, and who has access to it.”

Cause for Concern

If there is one ruling around cloud discovery that made eDiscovery pros nervous, it was Brown v. Tellermate Holdings (S. D. Ohio, July 1, 2014). In this employment discrimination suit, a sanction was imposed on the defendant after its counsel repeatedly objected to producing data stored at salesforce.com, from which counsel claimed information could not be retrieved. The court, finding that no contractual issue prevented Tellermate from obtaining the cloud-based Salesforce data, sanctioned both client and counsel, stating that Tellermate attorneys should have been more diligent about the accuracy of their discovery representations. A full overview of the case is available here.

Because cloud data is clearly discoverable in litigation, it is important that look at any contract signed with a cloud vendor to determine the ability to access and download information for litigation. However, Polus warns that cloud services often maintain data in unusual formats or container files that make discovery problematic.

In addition to email, sales data, and other business applications, organizations are increasingly moving backup, archiving, and journaling services to the cloud. That means terabytes of corporate data is now stored in services available only via the Internet. The great complication is that these services often ass an extra outer shell or overlay of metadata to the data when it is moved to the cloud. That means that when the data is downloaded for eDiscovery review, the data is not immediately accessible or vital metadata has been lost or replaced.

For example, Fiorentinos says that cloud data that has been collected often has new metadata or code added when it is stored in the cloud. Unless reviewers recognize the situation, they may be able to search and find evidence they are looking for. “Recently, we were given emails to review that seemed like they were all from the same source. But what happened was that all of the emails were given the same header when they were downloaded,” she says. “Fortunately, we recognized what was going on and were able to extract the original emails so they could be reviewed.”

Don’t Assume You Know What’s in the Cloud

When litigation arises, legal counsel and forensics examiners cannot assume that their clients know where and how data is stored. Fiorentinos says that legal professionals need to ask important questions of their clients including, what is stored in the cloud? Is the data backed up elsewhere? How do you access it? She says that in many cases, hiring a forensics expert or litigation support professional is ideal in order to ensure that cloud data is properly extracted.

Unfortunately, simple tasks that eDiscovery professionals think they have mastered a long time ago are now complicated in the cloud. For example, Polus says that unless an organization has a license agreement with for Microsoft 365 that includes In-Place Discovery, a simple task like recovering files from the Trash becomes a labor intensive, manual process.

The greatest risk involved in recovering files from Microsoft 365 is usually a loss of metadata. However, the technical challenges are not confined to Microsoft. For example, the popular backup and storage serve, Symantec Enterprise Vault, automatically shrinks the file size of any documents it stores, changing the document’s properties. In addition, it will often erase custodial information to help identify who owns an email, document, or other record.

As Microsoft Office365 and other cloud solutions increasingly replace in-house software solutions, it will be vital for legal departments to get involved in licensing decisions. They will need to know not only how data is stored, but if the cloud solution makes it easy to recover data for litigation. “When a litigation hold is triggered, it’s too late to start thinking about where your data might be,” says Polus. “And if you start reviewing documents and realize the metadata is gone or you didn’t collect everything you needed, it might be too late to go back and start over.”


Whether you prefer email, text or carrier pigeons, we’re always available.

Discovery starts with listening.

(877) 545-XACT / or / Email Us