Electronic Lost And Found.

Lawyers combing computer systems find a gold mine of electronic evidence. Insurers and consultants are helping policyholders manage the risk.

E-mail is rapidly becoming an electronic banana peel in terms of risk for U.S. businesses. With an estimated 6.9 trillion pieces of e-mail being generated annually in the United States, managing the growing hulk of electronic information is becoming a major risk-management issue.

Lawyers for plaintiffs and defendants increasingly request e-mail and other electronic evidence such as memos, calendars, databases, voice mail and--in the most recent twist--video mail, the latest communication technology. About 15 years ago, the U.S. court system expanded the obligation by defendants to conduct a "reasonable search" to include electronically stored data. "Only about 5% of litigation expressly includes this demand, but it's growing. There is statutory or case law in virtually every jurisdiction interpreting the definition of document to include electronically stored information," said Thomas Tobin of the New York law firm Wilson, Elser, Moskowitz, Edelman & Dicker LLP.

According to Computer Security magazine, the corporate computer system is the single largest unfunded liability for business today.

As the demand for electronic evidence grows, so, too, do businesses such as Electronic Evidence Discovery Inc., a Seattle-based firm started 12 years ago by John Jessen, president and chief executive officer. Jessen's company, one of many in this business nationwide, ferrets out electronic evidence during litigation and helps companies reduce their electronic-data risks.

Insurers didn't anticipate electronic discovery costs until recently, and they are starting to build them into their policies. "Insurance companies are facing picking up the bill for electronic evidence discovery," Jessen said. "About 40% of payments to my company come from insurers."

Increasingly, government regulators and agencies, such as the U.S. Department of Justice, the Environmental Protection Agency and the Securities and Exchange Commission, are going after electronic data in court cases, Jessen said.

Some insurers and consultants are developing risk-assessment programs for clients that focus on electronic evidence. "Most employers have rules about keeping banana peels off the floor and hard hats on, but they must also include the use of e-mail and the Internet in risk-management programs," said William L. Granahan, a manager in Milliman & Robertson's Risk Management Consulting Practice.

Coverage Issue

Electronic evidence is a growing concern in directors-and-officers coverage, employment-practices-liability insurance and errors-and-omissions policies.

Insurers realize that by helping policyholders properly manage electronic data, they can reduce risk and litigation.

Customers of Travelers Property Casualty are asking for help in addressing the risks of e-mail and Internet usage as it applies to EPLI coverage. Policyholders are concerned about sexual harassment "not being limited to the pin-up calendar but moving to the computer," said Rob Schueler, an EPLI product manager for Travelers. "It's one more thing to worry about besides managers propositioning employees."

In the near future, Travelers will integrate Internet and e-mail loss-prevention information into the model computer-usage policy it plans to give clients who purchase EPLI coverage. "Customers are worried they don't have control over e-mail," Schueler said.

Travelers' EPLI loss prevention program advises policyholders to organize a computer-usage policy while reinforcing its sexual-harassment policy. "If steps are taken to avoid a problem, courts are more considerate of employers who have a policy and act on it," he said.

Reliance National Insurance Co. also tells clients about the importance of establishing a corporate policy for e-mail usage and a system to manage electronic data, including a routine data-destruction program. The New York-based property/casualty insurer offers excess-and-surplus lines coverage, D&O liability and-professional liability policies that cover financial institutions, architects, engineers and lawyers. "Companies think of purging the system only when it slows down," said David DeBerry, a vice president and underwriting counsel for Reliance.

Spotlight on E-mail

The U.S. government's antitrust case against Microsoft drew attention to the vulnerabilities that e-mail creates for companies. In one instance, the prosecution revealed an e-mail from Microsoft Chairman Bill Gates indicating that the company wanted to persuade rival Netscape Communications to stop marketing its Web browser software for Microsoft's Windows operating system.

In the recent case concerning the combination diet drug known as fen-phen, evidence presented in court showed how a passing thought recorded in e-mail could have potentially devastating consequences for a company. According to various press reports, e-mail produced by the prosecution included one memo in which an employee of drug maker American Home Products said she hoped she wouldn't have to spend her career paying off "fat people who are a little afraid of some silly lung problem."

The casual and instantaneous nature of e-mail is its allure and its downside. "People open up in e-mail, they feel invulnerable, they say more in e-mail than in a letter," said James Pabarue of Christie, Pabarue, Mortensen & Young, a Philadelphia law firm.

Reliance's DeBerry agreed that people tend to use e-mail in an informal manner and type in comments as if thinking out loud. "But they are captured as memorialized data and can be used as a admissable evidence in court cases," he said.

Other characteristics of e-mail also make it a powerful source of proof, according to Ontrack Data International Inc., Eden Prairie, Minn. E-mail contains inherent trails of information that can identify the creator, sender and attachments. Communications that include business strategy and commitments that were once private can be made public when they become court testimony, Ontrack warns.

Corporate Junk Drawer

The amount of e-mail and other electronic data saved and backed up by U.S. businesses could be a litigation time bomb. Jessen recalls how the head of a company with 120,000 employees was flabbergasted when he discovered that his company generated 22 million new single-message e-mails weekly. Much of it probably wasn't related to the business. About 40% of corporate e-mails have no business value, and 85% of work-related e-mails lose their business value within 30 days, Jessen said.

The volume of information that most companies generate--and could be asked to produce--is staggering. The digital linear tapes routinely used in system backups hold a vast amount of data. A tape that Jessen's firm recently obtained could hold 20 gigabytes of information, but only 75% of the tape was used to back up the desktop, network data and e-mail accounts for 12 people. Jessen's client instructed him to pull data pertaining to 12 search words. Ultimately paring the search to multiple hits, Jessen's company pulled 200,000 printed pages of material from the tape, and that represented only 20% of the original data.

Companies such as Jessen's Electronic Evidence Discovery also are hired to search defendants' files when courts deem their replies to interrogatories insufficient. "Companies go berserk when courts approve such onsite, invasive discovery," Tobin said. "Corporations need to anticipate such orders in their original efforts to be responsive to discovery. If they routinely search and provide all appropriate information from electronic sources in their early responses to discovery, their adversaries will be less successful in convincing courts to allow them physically inside an opponent's computer systems."

What Was Lost Now Is Found

Established 15 years ago, Ontrack, provides data availability software and services that helps customers protect, back up, recover and discover their data. "Business is growing by leaps and bounds and has doubled in the last five years," said Jennifer Zeller, product line manager, electronic information management.

Ontrack's electronic information management division uses its in-house software to re-create original text and retrieve data that was considered deleted.

During the discovery phase of a wrongful-termination suit against a Fortune 50 company, Ontrack, working for the plaintiff, retrieved and restored archival data from the defendant's computer system, Zeller said. "We asked them, 'What do you want to see? We can filter information by time, names or keywords,'" she said.

Jessen developed the idea for Electronic Discovery in his previous job while setting up computers in law firms. He realized that the attorneys didn't understand the speed and data capabilities of computers. Today his company, which has doubled in size every year, has expanded to three divisions: litigation, corporate services and software solutions.

To recover data created by obsolete systems, Jessen's firm collects old software. "We have quite a library of old data systems, so when the occasion comes up we can read the data," Jessen said.

His firm also helps businesses address the risks hidden in their computer systems. "We go in and analyze the data and ask them if they really need to keep all of it," Jessen said. "Computers are the new filing cabinet."

The company also sells software it developed to manage e-mail and to delete unwanted data. With SafeMail, e-mails that a client wants to save are coded and filed in a central database. After 30 days, uncoded messages are deleted automatically.

The firm developed TruErase software when Jessen's employees could not find a product on the market that permanently deleted all kinds of data. "So two years and lots of money later, we developed our own tool that permanently deletes data," Jessen said.

Many people think that if they don't "save" something that they typed, those words cannot be retrieved. But most computer programs automatically save words typed on a computer screen, even if the typist doesn't. "The act of typing saves it," Jessen said. "What you type is discoverable." Ontrack also developed DataEraser software that overwrites data so users can feel confident that information is permanently erased.

Another risk is hidden data, words, edits and codes that aren't visible on the computer screen or hard copy. Electronic Evidence Discovery used electronic detective work to prove evidence provided by a defendant was not what it seemed. The defendant produced a letter that was written in the past to show that a contract was negated. Because every version of a software system saves data differently, Electronic Evidence Discovery was able to prove that the letter was written more recently, and the defendants lost the case.

"In the past, there were lots of sources of paper like mimeograph or Xerox machines. But today, there is one main source of all paper: the print key on the computer," Jessen said. "Everything comes from electronic data."

Business E-Mail Etiquette

What you type into a computer is discoverable in a court case. The act of typing in data means it can be used as evidence even if it's not saved.

"Central to mitigating e-mail risks is educating employees about what to do and not do," said John Jessen, president and chief executive officer of Electronic Evidence Discovery Inc.

* Instruct employees to write e-mail with the idea that it will be archived. Most employees don't understand that when they delete data, it's really not deleted. Explain what the company's archive and backup policies are and establish time limits for messages to remain on the desktop.

* Create a policy that differentiates business documents according to confidentiality requirements. Have the company's legal staff define the policy.

* Don't mix reports or any business information that is to be kept confidential with information that is not confidential.

* Train employees to write carefully. Especially avoid hyperbole or a flippant tone in e-mail.

* Place notices on the business e-mail system that reiterate the policy that e-mail is confidential and should be used for business purposes only. Personalized e-mail names and passwords give employees a sense of ownership of messages and documents.

* Update, audit and evaluate your business e-mail policy. If you discover gaps, correct them. Check your e-mail system on a regular basis to see if any problems have occurred and evaluate how the policy is working.

Source: Electronic Evidence Discovery Inc. and Christie, Pabarue, Mortensen & Young.

Locking the Electronic Door

Because so many U.S. businesses are driven by and dependent on computers, insurers such as the Chubb Group of Insurance Cos. are addressing technology issues, including e-mail security, software firewall protection and building security with their clients. At the center of the issue is protecting intellectual property and data.

"The value of a company's data and intellectual property can far exceed the value of a company's property When they realize this, it becomes a security issue," said Victor Sordillo, a Chubb vice president and zone manager in the loss control division. Businesses need more consultation on protecting their data. They cannot rely on only a lock and key for their front door and a fire protection system for the building they occupy, he said. Chubb is rolling out a new product and service called Network Security Risk Management Review to evaluate a company's computers and networks for overall susceptibility to losses--such as the theft of a client's proprietary data. The review encompasses the entire scope of a firm's operations, emphasizing potential liabilities from many parts of the organization.

While other insurers have partnerships with third-party technology firms--such as IBM and Kroll O'Gara--to provide clients this kind of risk assessment, Chubb believes it is the only insurer providing this service using its own staff.

Chubb has trained service representatives to conduct the review in tandem with the client's risk-management and computer-security team. The review consists of a scoring matrix that covers low, moderate and high risks in management and administration; risk assessment; and internal and external protection features. When the scores are tallied, Chubb recommends mitigation where scores are weak, suggesting changes like employing encryption techniques or upgrading their firewall software or positioning.

For example, in scoring internal systems Chubb looks at activities such as passwords, building security and intrusion detection. For building security, it rates controlled access to sensitive areas using card keys as a "strength" and guards or burglar alarms as a "norm."

Building security is an important but often weak area for companies, Sordillo said, considering that their computer systems on premises typically house hard drives filled with information such as lists of customers, Social Security numbers and accounts-receivable information.

Employers and their staff also must be aware of drafting, Sordillo said. That's when strangers walk into a building behind an employee, giving them unauthorized access to computer systems and allowing them to walk out with laptops.

Chubb also rates if intruders are trying to hack into a company's network. "We determine if they are monitoning pings on their firewalls. By studying patterns you might find that a teen-ager is trying to hack in every night after 11 o'clock," he said.

Background checks on information-technology employees also are rated. A company will score in the high range if it has a thorough process for screening employees, including the use of information from government agencies, and if it provides different levels of security clearance depending on employees' needs for access to data. "Even employees can corrupt information or destroy it. You have to know your employees," Sordillo said. "Remember the Melissa virus?" The computer programmer who pleaded guilty to creating the destructive computer virus was hired as a computer technician by a university while he was out on bail with the charges pending.

"Some companies aren't doing their homework," Sordillo said.