skwilder

Future of Work Interview: Robert Brownstone, Technology, eDiscovery and Computer Forensics, Fenwick and West LLP

This interview was written up while drinking a Soy Latte at the Swank Bar in San Francisco’s Pacific Heights neighborhood.

A “Make Your Own Major” Type of Job

For the last 18 months, I have become interested in the emerging fields of Digital Risk, Crisis Management and Cyber Security. So, I decided to reach out to Robert Brownstone (@ediscoveryguru) from Fenwick and West, LLP. I know Robert from when I sought his advice on the Internet and the Law. Normally, we share stories and exchange ideas while eating Chinese food on Castro Street in downtown, Mountain View.  Our meetings remind me of George Costanza and Jerry Seinfeld, engaged in this intense conversations at Monk’s Cafe. Today, however, I telephoned him from the Human 1.0 office in Cambridge, MA, where there is only one restaurant (Italian, not Chinese) within walking distance.

Brownstone started his career on Wall Street as a white-collar crime litigator in fraud cases. He then became law school professor and program director while working as a part-time lawyer. For the last thirteen years, Brownstone has been working out of Fenwick’s Silicon Valley office where he has his hand on the pulse of legal and technical issues impacting, some which impact of the most innovative companies in America.

Bill Fenwick, the firm’s founder, originally hired Brownstone as his “experiment” and gave him the title Knowledge Manager.  He wanted to take a law teacher and litigator, and as Brownstone describes it, “pump my head with as much computer knowledge as possible in hopes that I would continue to spark some new developments and opportunities for the firm.” Fenwick asked Brownstone to focus on electronic discovery, IT, Data Security, and Legal issues with the intention of sharing these learnings in two ways: “in house” with Fenwick attorneys and “out-house” (really called “outsiders”) with Fenwick clients.

Brownstone characterizes his role at Fenwick as a “make your own major type of job,” where he has often finds himself immersed in issues such as intellectual property, the protection of trade secrets, data security strategies, and employer-employee disputes over data. To make all this new information useful, he says, “the secret sauce is understanding  (our) clients’ business and how their internal information systems work.”

Digital Law: Riding the River

In representing many high-tech and life science companies, Brownstone has found that his main challenge is in the area of Digital Law, which is in flux right now with the Courts wrestling with some major issues, such as:

  • How to protect data secrets and information and what to do when their use is in dispute
  • How to handle electronic information over a lifetime –from creation to usage to destruction
  • How to handle electronic information issues when a company gets sued or when there’s an electronic discovery (e-discovery) request 

Clog That Drain: Prevent Data Leakage and Cut Your Losses 

According to Brownstone, there are essentially three ways information can leak from a company:

  1. An employee or some other insider is intentionally trying to harm the company and puts information in front of the public (sometimes via the Internet). The most highly publicized examples would be from the Wikileaks site. Basically, someone is trying to harm an organization through disclosure or an accusation.
  2. An intentional disclosure becomes unintentionally harmful.  An employee, executive, or other insider posts something (i.e. a photo or a tweet) but he or she does not know the FTC prohibits specific kinds of disclosures under certain circumstances. [Having managed online communities and social networks since my AOL days in the mid-1990s, I would say this happens at lease once or twice a year for many companies.]
  3. An unintentional disclosure. Confidential Information gets out via a smart phone, laptop, device, or paper when the item is stolen, hacked or lost. There is no malice or intent on the part of the employee or client, but the information still gets leaked.

Even if the law does not require it, companies can reduce their risk and exposure when it comes to data leakage. Two ways to reduce a company’s risk exposure are:

  1. Role-Based Access Control or what IT folks call RBAC, which essentially means that not everything within the virtual or physical world is open to everyone in the company. For example, different permissions granted to folks who need to access databases, etc. Brownstone calls this approach “narrowing the risk of leakage.”
  2. Encryption, particularly for company-issued devices (laptops, phones, etc.) to the extent the data can be encrypted. Two purposes are served. One: companies can prevent someone who steals or finds a lost laptop “from sucking out, bit by bit, the data on that drive and booting it up in another machine.”  This measure is important.  First, companies want to protect their employees and their data. Second, companies will not have to take a hit financially or in the court of public opinion by having to announcing a data breach. (Note: some States handle this differently and for customer-relations reasons, many companies choose to voluntarily disclose breaches to their users).

The Mobile Horse Has Already Left the Barn

The ubiquitous usage of mobile devices makes controlling a company’s data even more complicated and gives Information Technology (IT) leaders multiple headaches. Brownstone advises companies to consider issuing a second phone and to officially notify, educate, and remind employees that “Anything which involves your company device” is the company’s property.

Brownstone states “this is the cleanest way under the law to handle data on a mobile device – it is a clean way to deal with a complex issue.” He points out, however, “It gets tricky because most organizations, especially hi-tech companies, are in the mode of not wanting to stifle employees from being able to hook as much as possible into the network at any time wirelessly or otherwise” and from their devices of choice.” 

Leaving employees to (literally) their own (mobile) devices exposes the company to multiple security issues. If a company decides to follow this route, it can be difficult to change how employees operate. Brownstone points out though “If the horse is already out of the barn in a data security situation, then it is a lot trickier in advance to establish good practices.” In most cases, employees are already using their own phones for work so it’s a challenge for a company to regain control. 

Warning: You Have The Whole World In Your Hands

Other significant mobile-related considerations involve location services:

  1. Due to GPS technology, employers can potentially track where their staff is and has been and has been at all times.
  2. The frictionless sharing of Facebook, for example, means that employees download an app and opt in to sharing, or when they log-in to a site that uses Facebook credentials, their personal information gets shared.
  3. The Fourth Amendment has not prevented courts from allowing law enforcement to seize an individual’s mobile device.  In some instances, officers practice computer forensics and carry a tool that can do bit-by-bit capture of certain types of data off of a mobile device, e.g. employee data, and by logical extension, employer data. This significant information becomes not just mobile, but able to be seized by law enforcement.
  4. Remember: Not everything stored on a mobile device is encrypted!

Potential Disasters and Detours

I ask Brownstone about some of the more organizational challenges his clients face. He mentions:

  1. Sales people negotiate and close business deals by sending instant messages. If there were ever a dispute about a contract, one General Counsel feared she might not have an actual copy of the final terms of the contract. She asked Brownstone to write her a new policy, forbidding negotiations over IM.
  2. General Counsel and the CIOs/CTOs are not alwasy on the same page (or even in the same meeting). Brownstone illustrates this concern with a story about how he witnessed an IT leader telling his executive team that he had thought he was following Legal Department orders when he had captured, stored, and logged all employees’ instant messages for the prior three years. This turned General Counsel red in the face and feared all of the information would be available if the company were ever subpoenaed and had to collect, process and review all the information. The discovery process alone could cost more than any lawsuit.
  3. Brownstone cites an article that says “Lawyers are from Mars and ITs are from Venus, so you need a translator.” Both groups are infamous for their acronyms and jargon. Getting them to work together during discovery can mean interplanetary mayhem. (You can find the article here as well as some material Brownstone-co-authored on that theme).
  4. Anticipate all the potential data leaks and make a prioritized list. Brownstone recommends working through them over time. Don’t try and conquer the law in one day.

Your Employees’ Own Personal Pages 

Since I am conducting a social media-training program for a Fortune 500 company, I ask about employee-owned Facebook and LinkedIn pages. Brownstone states that it’s more challenging to establish rules for company-sponsored pages than address what employees might be doing with their own pages on their own time:

“The law is really unsettled…and there are some issues that cut across both arenas of company-sponsored and individual pages. For a company of a substantial size, if someone anonymously posts praise or an endorsement of (that) product, the FTC calls it a testimonial, and if they don’t disclose that they work at the company or are a spouse of someone that works at the company that actually runs afoul of the long-standing FTC guidelines for online product endorsements“. [Disclosure: I worked with the FTC on this in an advisory capacity while serving on the board of the Word of Mouth Marketing Association in 2008.]

Brownstone points out that even in the age of disclosure and transparency, publicly traded companies need to be alert: “It is very dangerous for someone to post anonymously even if they are praising the company. In some instances this is called ‘sock puppeting.’ (Read the Wall Street Journal’s article about a famous example of this involving the CEO of Wholefoods)

Brownstone recommends that companies focus on “narrowing the risk” by:

  1. Providing training for employees
  2. Implementing a Rules Based Access Control approach
  3. Using encryption as much as possible (and don’t just depend on the Cloud)
  4. Communicating with your legal advisors as soon as possible so they can advise and reroute rather than react or put out a fire
  5. Cleaning all devices before and after international travel
  6. Having a clearly identified owner for company branded social media pages. 

Note: the law is more stringent overseas, e.g. a company cannot just say they can confiscate an employees device because it is presumed that personal information exists on it.

For More Information

Brownstone speaks at conferences often, offers webinars, and publishes quite a bit. He is also an avid online reader of law and technology items, especially of what lawyers used to call “Advance Sheets.” His favorites include Law Technology News, the New York Times (especially the Business and Technology sections), Compliance Week and beSpacific. He also relies on his mentors including:

  • Bill Fenwick, whom we discussed above
  • Matt Kesner, Fenwick’s CTO
  • Browning Marean of DLA Piper, a large business international firm
  • Kevin Moore, Fenwick’s IT Director
  • Patrick Premo, a Fenwick litigation partner championing efficiency and alternative fees
  • Delos Putz, Professor Emeritus of USF School of Law

(Brownstone provided a bibliography below about eDiscovery, Computer Forensics and Technology).

Brownstone loves eDiscovery and all things “e”.  As he explains, “My wife and friends of mine say it puts them to sleep when I start talking about eDiscovery. But, I have to say as a technologist, I have seen his passion first hand. Our one-hour scheduled Chinese food lunch hours often turn into a two and half hour discussion. Fortunately, he doesn’t bill me by the hour for these talks but freely exchanges ideas as he does in his many presentations around the hemisphere.

Thank you for visiting.

Advertisements

Mr. Zuckerburg, tear down this Wall

Recently, I have seen some cracks in the Facebook wall. And I am not talking about the company’s weak stock price.

In the past six months, I have talked to over 200 college students around the country and almost all of them expressed their frustration with the online service.

Their concerns center on the following areas:

  • Too much clutter on the service and it’s increasingly difficult to easily accomplish simple tasks
  • Too many parents on the service
  • They can’t start a new life (so to speak) when they get to college because they already have an extensive and well-documented history on Facebook (how many of us learned more about ourselves at school and evolved into a slightly different being)
  • The inability to be annonymous and thus I have to be extra careful about my postings otherwise, I might jeopardize my career; something that seems innocent to me, such as a picture of student drinking beers with his friends, might be misinterpreted by a perpective employer
  • The terrible mobile experience — where Facebook is getting over 50% of its users
  • The constant change in the company’s algorithums, such as when determining the content that appears in a person’s New Feeds
  • The adjustment in what’s called the EdgeRank algorithm has reduced the organic (unpaid) exposure received by Facebook posts from companies. At the same time, Facebook is campaigning aggressively to get companies to pay for promoted posts to increase the reach of their content.(see good write up)
  • The lack of customer service as Seth Godin points out.
Need I say more.
It is important to note that Facebook is also becoming what Sherry Turkle describes as being like ‘job interview.’ Employers use Facebook to screen applicantes even though they could be sued for discrimination if they don’t hire the prospect.

Facebook’s Walled (in) Garden approach (trying to capture every user possible and keeping them on your website), which has been tried before by AOL, Prodigy, PathFinder (Time Warner’s old Web Portal) and MySpace, just don’t have a great track record.

Most of them have tried to keep users from treating the Web as their Oyster, building barriers to our free-style searching across the web. [I imagine, though, that Facebook will at some point change their search strategy and open things up a bit so that we can easily access other info across the web, especially those sites that use their log-in process.]

Older generations have also expressed concerns about how much people personal information share on a public wall. One has to ask the question graffiti will come back and haunt a user.

I might be alone in this thinking and I hope I am. I made a personal bet early on with Facebook, signing onto the site when it was still limited to students. (I used my alum.vassar.edu email address)

And then there is the issue of Facebook’s Business Model. Can it really turn them into a profitable mega-company. Something company’s in the Social Business space (whether they are Facebook or an advertiser on social network) need to think about.

The reality is that many regimes and company’s have fallen due to the fact that they don’t listen to their customers. Especially the core base that got them started, such as college students.

Facebook needs to tear down the wall and open up its service more to the rest of the web and more important, listen to it’s people, so it avoids a collapse of an empire (Yes, I know it will not happen overnight)

Your users’ Technology Adoption Curve

When building a new community or functionality on a social network, one of the first questions I ask is ‘tell me about the people who will use it.‘ I want to learn more than just their demographics, their psychographics or even what we called at Intuit, their firmographics (how many employees are at the company, how much revenue have the generated, or their occupation such as purchasing agent or IT professional).

And I also want to know where on the technology adoption curve the target audience(s) reside. And I want to know about the words and phrases they use in their ever day business.

A few years ago, when we introduced Podcasts on the Intuit Community website, nobody clicked on the word ‘podcast.’ So we did some tests in usability and learned that our users — who tend to be older and not residing on the cosmopolitan coasts of the USA — didn’t know what that term meant. Instead, we learned that they related better to more common phrases, such as Radio-on-Demand, so we used that term. We also learned (a few years ago) that they had no idea what a blog was and they had no interest in blogging.

So, it’s important to understand where your users (the people) are on the adoption curve.

As the above chart shows, Geeks started using Blogs a lot sooner than Small Businesses. Sound obvious, right?

It was until we started talking to people that manage online communities and social media activities. At that time, everyone wanted to build a blog, write a blog, and ‘do the blog.’ But we resisted at Intuit because our typical Small Business owners were not ready at the time. Today, they might just be ready. However, Business.com recently did a survey listing out the top social media tools for different vertical/industry segments. And at the top of some of the lists were Webinars. Who knew that something so old web school could still be popular?

I am working on compiling a list of examples like the ones above. So, feel free to send them my way.

The Big 3: Marketing on Facebook, LinkedIn and Twitter

Recently did a webinar for Bizmore.com — an exciting new website for Small Businesses – that outlined some basics for marketing on Facebook, LinkedIn and Twitter. Enjoy!