Human 1.0

Future of Work Interview: Robert Brownstone, Technology, eDiscovery and Computer Forensics, Fenwick and West LLP

This interview was written up while drinking a Soy Latte at the Swank Bar in San Francisco’s Pacific Heights neighborhood.

A “Make Your Own Major” Type of Job

For the last 18 months, I have become interested in the emerging fields of Digital Risk, Crisis Management and Cyber Security. So, I decided to reach out to Robert Brownstone (@ediscoveryguru) from Fenwick and West, LLP. I know Robert from when I sought his advice on the Internet and the Law. Normally, we share stories and exchange ideas while eating Chinese food on Castro Street in downtown, Mountain View.  Our meetings remind me of George Costanza and Jerry Seinfeld, engaged in this intense conversations at Monk’s Cafe. Today, however, I telephoned him from the Human 1.0 office in Cambridge, MA, where there is only one restaurant (Italian, not Chinese) within walking distance.

Brownstone started his career on Wall Street as a white-collar crime litigator in fraud cases. He then became law school professor and program director while working as a part-time lawyer. For the last thirteen years, Brownstone has been working out of Fenwick’s Silicon Valley office where he has his hand on the pulse of legal and technical issues impacting, some which impact of the most innovative companies in America.

Bill Fenwick, the firm’s founder, originally hired Brownstone as his “experiment” and gave him the title Knowledge Manager.  He wanted to take a law teacher and litigator, and as Brownstone describes it, “pump my head with as much computer knowledge as possible in hopes that I would continue to spark some new developments and opportunities for the firm.” Fenwick asked Brownstone to focus on electronic discovery, IT, Data Security, and Legal issues with the intention of sharing these learnings in two ways: “in house” with Fenwick attorneys and “out-house” (really called “outsiders”) with Fenwick clients.

Brownstone characterizes his role at Fenwick as a “make your own major type of job,” where he has often finds himself immersed in issues such as intellectual property, the protection of trade secrets, data security strategies, and employer-employee disputes over data. To make all this new information useful, he says, “the secret sauce is understanding  (our) clients’ business and how their internal information systems work.”

Digital Law: Riding the River

In representing many high-tech and life science companies, Brownstone has found that his main challenge is in the area of Digital Law, which is in flux right now with the Courts wrestling with some major issues, such as:

  • How to protect data secrets and information and what to do when their use is in dispute
  • How to handle electronic information over a lifetime –from creation to usage to destruction
  • How to handle electronic information issues when a company gets sued or when there’s an electronic discovery (e-discovery) request 

Clog That Drain: Prevent Data Leakage and Cut Your Losses 

According to Brownstone, there are essentially three ways information can leak from a company:

  1. An employee or some other insider is intentionally trying to harm the company and puts information in front of the public (sometimes via the Internet). The most highly publicized examples would be from the Wikileaks site. Basically, someone is trying to harm an organization through disclosure or an accusation.
  2. An intentional disclosure becomes unintentionally harmful.  An employee, executive, or other insider posts something (i.e. a photo or a tweet) but he or she does not know the FTC prohibits specific kinds of disclosures under certain circumstances. [Having managed online communities and social networks since my AOL days in the mid-1990s, I would say this happens at lease once or twice a year for many companies.]
  3. An unintentional disclosure. Confidential Information gets out via a smart phone, laptop, device, or paper when the item is stolen, hacked or lost. There is no malice or intent on the part of the employee or client, but the information still gets leaked.

Even if the law does not require it, companies can reduce their risk and exposure when it comes to data leakage. Two ways to reduce a company’s risk exposure are:

  1. Role-Based Access Control or what IT folks call RBAC, which essentially means that not everything within the virtual or physical world is open to everyone in the company. For example, different permissions granted to folks who need to access databases, etc. Brownstone calls this approach “narrowing the risk of leakage.”
  2. Encryption, particularly for company-issued devices (laptops, phones, etc.) to the extent the data can be encrypted. Two purposes are served. One: companies can prevent someone who steals or finds a lost laptop “from sucking out, bit by bit, the data on that drive and booting it up in another machine.”  This measure is important.  First, companies want to protect their employees and their data. Second, companies will not have to take a hit financially or in the court of public opinion by having to announcing a data breach. (Note: some States handle this differently and for customer-relations reasons, many companies choose to voluntarily disclose breaches to their users).

The Mobile Horse Has Already Left the Barn

The ubiquitous usage of mobile devices makes controlling a company’s data even more complicated and gives Information Technology (IT) leaders multiple headaches. Brownstone advises companies to consider issuing a second phone and to officially notify, educate, and remind employees that “Anything which involves your company device” is the company’s property.

Brownstone states “this is the cleanest way under the law to handle data on a mobile device – it is a clean way to deal with a complex issue.” He points out, however, “It gets tricky because most organizations, especially hi-tech companies, are in the mode of not wanting to stifle employees from being able to hook as much as possible into the network at any time wirelessly or otherwise” and from their devices of choice.” 

Leaving employees to (literally) their own (mobile) devices exposes the company to multiple security issues. If a company decides to follow this route, it can be difficult to change how employees operate. Brownstone points out though “If the horse is already out of the barn in a data security situation, then it is a lot trickier in advance to establish good practices.” In most cases, employees are already using their own phones for work so it’s a challenge for a company to regain control. 

Warning: You Have The Whole World In Your Hands

Other significant mobile-related considerations involve location services:

  1. Due to GPS technology, employers can potentially track where their staff is and has been and has been at all times.
  2. The frictionless sharing of Facebook, for example, means that employees download an app and opt in to sharing, or when they log-in to a site that uses Facebook credentials, their personal information gets shared.
  3. The Fourth Amendment has not prevented courts from allowing law enforcement to seize an individual’s mobile device.  In some instances, officers practice computer forensics and carry a tool that can do bit-by-bit capture of certain types of data off of a mobile device, e.g. employee data, and by logical extension, employer data. This significant information becomes not just mobile, but able to be seized by law enforcement.
  4. Remember: Not everything stored on a mobile device is encrypted!

Potential Disasters and Detours

I ask Brownstone about some of the more organizational challenges his clients face. He mentions:

  1. Sales people negotiate and close business deals by sending instant messages. If there were ever a dispute about a contract, one General Counsel feared she might not have an actual copy of the final terms of the contract. She asked Brownstone to write her a new policy, forbidding negotiations over IM.
  2. General Counsel and the CIOs/CTOs are not alwasy on the same page (or even in the same meeting). Brownstone illustrates this concern with a story about how he witnessed an IT leader telling his executive team that he had thought he was following Legal Department orders when he had captured, stored, and logged all employees’ instant messages for the prior three years. This turned General Counsel red in the face and feared all of the information would be available if the company were ever subpoenaed and had to collect, process and review all the information. The discovery process alone could cost more than any lawsuit.
  3. Brownstone cites an article that says “Lawyers are from Mars and ITs are from Venus, so you need a translator.” Both groups are infamous for their acronyms and jargon. Getting them to work together during discovery can mean interplanetary mayhem. (You can find the article here as well as some material Brownstone-co-authored on that theme).
  4. Anticipate all the potential data leaks and make a prioritized list. Brownstone recommends working through them over time. Don’t try and conquer the law in one day.

Your Employees’ Own Personal Pages 

Since I am conducting a social media-training program for a Fortune 500 company, I ask about employee-owned Facebook and LinkedIn pages. Brownstone states that it’s more challenging to establish rules for company-sponsored pages than address what employees might be doing with their own pages on their own time:

“The law is really unsettled…and there are some issues that cut across both arenas of company-sponsored and individual pages. For a company of a substantial size, if someone anonymously posts praise or an endorsement of (that) product, the FTC calls it a testimonial, and if they don’t disclose that they work at the company or are a spouse of someone that works at the company that actually runs afoul of the long-standing FTC guidelines for online product endorsements“. [Disclosure: I worked with the FTC on this in an advisory capacity while serving on the board of the Word of Mouth Marketing Association in 2008.]

Brownstone points out that even in the age of disclosure and transparency, publicly traded companies need to be alert: “It is very dangerous for someone to post anonymously even if they are praising the company. In some instances this is called ‘sock puppeting.’ (Read the Wall Street Journal’s article about a famous example of this involving the CEO of Wholefoods)

Brownstone recommends that companies focus on “narrowing the risk” by:

  1. Providing training for employees
  2. Implementing a Rules Based Access Control approach
  3. Using encryption as much as possible (and don’t just depend on the Cloud)
  4. Communicating with your legal advisors as soon as possible so they can advise and reroute rather than react or put out a fire
  5. Cleaning all devices before and after international travel
  6. Having a clearly identified owner for company branded social media pages. 

Note: the law is more stringent overseas, e.g. a company cannot just say they can confiscate an employees device because it is presumed that personal information exists on it.

For More Information

Brownstone speaks at conferences often, offers webinars, and publishes quite a bit. He is also an avid online reader of law and technology items, especially of what lawyers used to call “Advance Sheets.” His favorites include Law Technology News, the New York Times (especially the Business and Technology sections), Compliance Week and beSpacific. He also relies on his mentors including:

  • Bill Fenwick, whom we discussed above
  • Matt Kesner, Fenwick’s CTO
  • Browning Marean of DLA Piper, a large business international firm
  • Kevin Moore, Fenwick’s IT Director
  • Patrick Premo, a Fenwick litigation partner championing efficiency and alternative fees
  • Delos Putz, Professor Emeritus of USF School of Law

(Brownstone provided a bibliography below about eDiscovery, Computer Forensics and Technology).

Brownstone loves eDiscovery and all things “e”.  As he explains, “My wife and friends of mine say it puts them to sleep when I start talking about eDiscovery. But, I have to say as a technologist, I have seen his passion first hand. Our one-hour scheduled Chinese food lunch hours often turn into a two and half hour discussion. Fortunately, he doesn’t bill me by the hour for these talks but freely exchanges ideas as he does in his many presentations around the hemisphere.

Thank you for visiting.

Advertisements

Future of Work: Cindy Jutras, Founder and CEO of MintJutras.com

I reached out to Cindy Jutras (www.mintjutras.com), a self described “data junkie,” because she focuses on how enterprise companies consume technology. This is important because Information Technology folks wrestle all the time with “To what degree do they move their infrastructure to the cloud?”

[powerpress]

Similar to some of the other women I recently spoke to, Cindy has a degree in Math and Physics with a concentration in Computer Science. She also spent many years at Aberdeen Research, which at the time was one of the premier research companies.

Cindy’s focus is really on how people use technology; “Consume” and “Consumers” were two terms Cindy used often during our discussion indicating that she tries to see things from the point of the view of the person using a given technology. She also makes the distinction between interacting with a device vs. just consuming information from a device. This made me think of the iPad as something you interact and create or be productive with vs. the Kindle which is mainly an information consumption device.

In some ways, though, I would describe her as a loyal skeptic, meaning she is extremely loyal to her work and her clients, but always ready to challenge why someone might need to play with the latest gadget or participate on the latest social network.

She was one of the few technologists to tell me “the iPad doesn’t do it” for her. “From a consumer standpoint, I’m not a big consumer of technology.  I don’t own an iPod.  I don’t own an MP3 player.  I don’t look at technology from a consumer standpoint as much as I do from a business standpoint.  So, it really depends on which perspective you’re looking at technology.  And when I look at technology, I don’t – as I said, don’t look for technology as the next gee-whiz thing  I would only buy an iPad if I thought it was really going to contribute to my ability to do my job and build my business.

While I might be reading into her personality a little bit too much, I see this as an important trait and one that probably contributes to her success, especially because more and more people will be skeptical of social networks, like Facebook, who often changes their privacy policy.

One online community Jutras frequents focuses on Six Sigma, which is something that I had been heavily involved with at Intuit. She said that she likes conversations that focus on certain performance improvement techniques. When it comes to company community websites, Jutras rightly pointed out that they often talk about technology and present their technology as the be-all and end-all, but they don’t focus on the actual business benefits.

Our research at Human 1.0 has also shown that men tend to focus more on functional related information vs. what’s the customer really going to get out of their products. This is similar to the “tell not sell” chant we often hear in management circles.

Jutras prides herself on her ability to “educate” her customers and help them clearly define their own needs. I can easily see how easy it would be for her customers to talk through their business issues with her and work towards defining their own requirement.

In terms of future trends, she sees a big opportunity for companies to leverage enterprise data using their mobile technology. “What’s not pervasive now is being able to directly interact with enterprise data from that mobile device and actually take action.  Most people want to be able get their alerts and notifications on their mobile device; but nine times out of the ten, once they have that alert, they turn that Smartphone into a dumb phone.  They pick up the phone and call someone, and they have someone else actually take the action or investigate the issue.

During our conversation, I noticed that Jutras did a great job on shying away from buzz terms such as Social Business. Her approach is “to look at business issues and needs from what these social streams can bring, and that’s connectivity, and collaboration, and openness.” This is especially true if you start dealing with individuals in more traditional industries such as manufacturing because “they tend to view social as something people do on their personal time.” They do want to collaborate.  They do want to monitor activity.  But to them, that’s not social. Which is, again, highlighting the importance of knowing your audience and customer.

Cindy mentioned a blog that I never knew about — Laurie McCabe’s, which focuses on small and medium size business processes and technology.  When we spoke about LinkedIn and Twitter, she indicated that her view of them have changed over time. LinkedIn Groups first seemed more useful, but now there seems to be a lot of self-promotion and advertising, and Twitter seems to attract a group of people just focused on building up their Klout scores. I tend to agree with this.

And of course the Big Data term was brought up in our discussion. Cindy stated “if companies start to recognize that they need a better job of managing that data, reaching the data, and handling the data, then they’re going to find that the only way they can do that is through some of these technologies, whether it’s accessing it over the cloud, whether it’s through a mobile device, whether it’s monitoring activity streams, or commentary, etc.  By looking at what – understanding what problem they need to solve, and then searching for the technology that can help them solve the problem, then they’ll arrive at that destination, technology-enabled, and also solving a problem.”

Cindy focused at the end of our discussion on the changing role of the IT leader, who has to identify and focus on specific business problems and has to work better across the organization with such groups as marketing. They also need to really live the life of a customer and understand the tasks or needs of that individual. By focusing on these, companies can help people become more efficient in their work.

Cindy is very customer focused and appears to be very efficient in how she manages her business. As I could see from our discussion, her years as an analyst have paid off and really helped build a successful consulting business.

Trends discussed:

  1. “Walking with your customer”
  2. Importance of identifying and focusing on business benefits and issues vs. talking about technology. Most successful IT people will also understand business issues
  3. Downsizing of CIO and CTOs
  4. Users of social networks like LinkedIn are becoming too promotional and marketing oriented
  5. Enterprises need to leverage mobility for an ongoing relationship