Are You Kidding Me?

We the People Expect a Record

2015-10-27T11:07:00.003-07:00

I am exhausted by all the petty infighting. I am tired of the partisan politics. Just knock it off already. It’s nothing but wrangling between the political parties. Everyone gets it. It’s so painfully clear. Poor Hillary in another overly politicized inquisition to just tear away at her flesh and storied career.

Our republic is great. For me it is the greatest country that has ever existed. There are some other really good ones, but America is the “cat’s meow.” Loathe to be insensitive with my last idiomatic expression, I don’t want to offend cat owners or dog lovers or people who like leashes--well you get the idea.

America is great in part because it has advanced a unique form of government with built-in checks and balances, among many other institutional protections. What that means is that one branch of government can’t push around another branch. After all, we evolved out of a polity where the king or queen held sway and the Constitutional Framers decided the monarchy wouldn’t work here. That means that Congress can’t make war by itself and when the President can’t get his ideas passed through Congress, he can’t circumvent the process with some king-like Executive Order to frustrate the process, for example (the Iran Nuclear deal advanced through Executive Order notwithstanding).

Another unique feature of our democracy is governmental transparency. We get to see what our elected officials do or not do. They are supposed to memorialize their actions in the government record for posterity and transparency sake. Thereafter our laws, like Freedom of Information, ensure that we have an optic into governmental activities, assuming it isn’t classified. Because we don’t want just anyone seeing our classified information.

Another really great thing about America is our advancement of individual freedoms embodied in the Bill of Rights, among other places. But it seems like sometimes when our great American values collide, we have to have a predictable way to advance the most important values of our great land. The right to do whatever you want, whenever you want is not likely going to win especially when it’s the government at issue.

So if you are a government worker and you don’t like having a government email, too bad so sad. All employees can’t do what they want at work, including the US Government employees. Or if you don’t like the government provided IT staff, technology choices or functionality provided to get your job done, you can’t just find a cheapo cloud provider and use their free IT email and storage services for your government work because, come on, that would undermine the whole accountability/transparency thing that made our great nation great. But Hillary Clinton is different. She is the boss. So when she tells the entire State Department to refrain from using personal email for government work, she was talking to everyone but herself. And when she complains about managing the complexity of multiple communications devices, then she should be able to get rid of her government email all together, right? Come on, she’s the boss and should be able to use a private server located in her basement to manage US foreign affairs for all other nations because it’s just way easier for her. And if she wants to manage state secrets through an IT provider in Colorado located in a strip mall, then she should be allowed to, because, come on, she’s the Queen Bee. Come on, this is America, “Land of the Home and Free of the Brave.” Freedom rules. But we do not have kings and queens and that’s the really great part of our great land.

I sure wish they would stop busting Clinton’s chops over the information she sent or received via email. Even if it was classified it wasn’t marked classified so not one of the bad guys would have bothered to hack her account and read such boring stuff. (Yes, I heard the “rumor” that several foreign governments tried to hack her server, but who knows if it’s really true.)

And then there is the personal vs. government issue—you don’t think her aids know the difference between a wedding invitation discussion and an explanation of security threat in Libya and the likelihood of a major terror attack on our diplomatic presence there? Why not let Clinton decide when she will turn over records in accordance with the Federal Records Act, because after all, transparency can happen sometime in the future—maybe after she is elected queen. And don’t you think the Secretary of State is the best person at the State Department to know what is classified or top- secret and how to protect it. For that matter, I bet she knows best how to secure data, and between her Colorado IT shop in the mall and the NSA or Department of State security personnel, I am sure she had it all locked down and buttoned up. “Hey, can I get some help over here working my fax machine.” And why bother with the National Archives and Records Administration to decide what is a government record worth keeping when Hillary will give us what she hasn’t destroyed when she decides it’s time.

It’s an election year and that is all this is—partisan politics. I hate the sabre rattling about the silly email security stuff.

On the other hand, if she wasn’t running for President of the United States and her former boss wasn’t the king, I wonder if Hillary would be prosecuted for her mishandling of sensitive government information the way others have been. Thank goodness for transparency and accountability. I see myself as an Independent. I am not anti-Hillary. But this is not about Clinton or the Republican’s trying to make hay from the Benghazi tragedy. For me, it’s about making a record. I am for ensuring America’s greatness by keeping a complete record and making it open to the citizens. I am also for protecting government secrets. I am also for applying a little reasonableness to the discussion. If what Hillary did doesn’t bother you a little, perhaps you are too colored by Fall foliage or the election season. Just saying.

Another Sad Hacking Story: What Can We Learn From Sony

2014-12-10T09:14:00.000-08:00

Sony hacked. Data stolen. Personal lives exposed. Interested in Judd Apatow’s social security number? Blah, Blah, Blah.

“The hack and subsequent posting…illustrate the risks large companies like Sony take by amassing years of digital records on employees and customers on machines connected to the Internet. Much of the data analyzed…was stored in Microsoft Excel files without password protection.” Wall Street Journal December 5, 2014

After the hundredth major information hack, you start to become immune or may be underwhelmed by the magnitude. “So what if another 47,000 personal identities got swiped.” “So they know the personal info of Sylvester Stallone, no big deal.”

What can we learn from our world where there is more information than ever before, that is more connected than ever before and as a result more vulnerable to information theft than ever before?

So here are a few truisms about the hacking reality in these times:

1. Security breaches will happen no matter how much effort is made to ensure they don’t.

2. Information matters. That is why criminal groups, across the globe seek to steal as much information as possible. Its business.

3. More businesses are being more proactive as reputations hinge upon it. Information security has become central to fiscal health. Just ask Target how impactful a serious hack can be.

4. We will become more immune to “hacking” stories, which is, in some ways good and in some ways bad.

a. Good, because we are not worried that the sky is failing and organizations can focus on the real business of knowing where its data resides and can lock it down better.

b. Bad, because ignoring the huge impact that some of these hacks create maybe portend lethargy or helplessness.

5. Security is a process not a project. It is a marathon, not a sprint. It is an organizational activity that requires vigilance and persistence over time. Getting lazy means more bad results. From a corporate governance perspective, it is like any activity that is important enough to bake into the business processes.

6. Smart organizations continually augment the ways they manage privacy, information security, corporate trade secrets and IP. That is because technology changes. Actions taken by criminals change. And the problem evolves, so your response needs to continually evolve to meet the new challenge.

7. Smart organizations take action for two reasons—one, to mitigate the risk and address the harm, and two, to insulate the company from the harm caused by the attacks that get through. In other words, the good things your organization does to prevent a hack, may be used to support your company and mitigate the downside if and when your information crowned jewels are hacked.

And that brings me to Information Nation- Seven Keys to Information Management Complianceand the importance of a process to better management which serves both purposes described in paragraph 7. Compliance methodology can save your company and act as insurance or insulation. This is why, “A corporation can act through natural persons, and it is therefore held responsible for the acts of such persons…on the other hand in certain circumstances, it may not be appropriate to impose liability upon a corporation, particularly one with a compliance program…

U.S. Dept. of Justice”

Here are a few simple rules to help guide you:

a. Vigilance comes from having a process, so build it or augment the existing process.

b. Information Management Compliance is our compliance methodology that we built on the Federal Sentencing Guidelines which is the basis for most US compliance programs. Compliance methodology demonstrates what good corporate citizens do and can act to mitigate harm or insulate all together.

c. Good corporations need to protect their reputation now more than ever by having working security programs.

d. Combining a compliance methodology with security initiatives is something to seriously consider. That way your security program can better confront the hacking your organization most assuredly will be confronted with, as well as mitigate the damage if and when something slips through the cracks

e. Finally, getting your company better buttoned up and protected begins with knowing where your information lives, knowing who has access to it and coding and securing it according to its value.

The Sony hack is another wake up call. Even though, I am not sure if Sony could have stopped the intrusion no matter what security it had in place given the complexity of the hacking. But I am sure we will have many governmental organizations seeking to answer that question. One thing I am sure of already, is that when personal information or company secrets are amassed and not locked down, they will get exposed. It’s just a matter of how often and how much impact it will have. When PII of Hollywood figures is replicated numerous times in the data pool, perhaps without business justification, someone should be asking why so many instances of the same information and why are they not locked down? Did Sony do anything to mitigate information security risks by keeping as little as possible for as short as possible and properly locking it up? These questions too will be addressed in due time, which most assuredly will have further impact on Sony. But for today, purposeful vigilance with a plan is the rallying cry. Know your information, know where it resides and lock it down. Your existence may depend on it.

Making Peace with Too Much Information, the Holiday Season and Big Ten Football

2014-12-04T08:25:00.000-08:00

I got a late start this year. So yesterday I sent a box request to Steel Hill, our off-site storage vendor, to get my box of holiday paraphernalia. I celebrate Christmas, I mean Hanukah, I mean Kwanza, I mean Unique Snowflake Fest. Anyway, I wanted to get my box so I can adorn my office. And that got me thinking that if everyone in my company did what I do, we would be spending loads of unnecessary dough on storing crud. And that got me thinking about how much money we could save getting rid of crud. And that got me thinking about what crud really is? And well, that got me thinking that I forgot to wish you a happy holidays. But let me come back to that in a minute.

Shockingly, this past year we were engaged many times to deal with cleaning up the boxes of crud at off-site storage vendors for big company clients. That is significant for a few reasons. One, because companies now understand keeping unneeded information carries with it real costs. Two, even boxes of paper have become the target to save money (given that most info costs are related to electronic stuff). Three, we have been in a nearly all-electronic business world for years now, so dealing with paper now seems odd. Four, companies seemingly forgot about the boxes, but hopefully now are getting reacquainted as they get their annual bill and are asking why store crud? Five, getting rid of boxes of paper carries with it a cost which may be higher than the annual cost to keep the boxes and that reality may impact clean-up efforts.

Oh, Happy Holidays-whatever it is that you celebrate. Be safe, healthy and live joyously.

And all that holiday sweet talk got me thinking about New Years. And that got me thinking about chicken wings. Don’t ask. And that got me thinking about New Year’s resolutions, which by the way I’m generally not a fan of. But as the old adage goes, “do as I say, not as I do”. So please take to heart my sincere request to: Save a Tree; Go Green; Live Simply; and Create a smaller carbon footprint. Help your company clean up its crud this year. Take on the personal drives, email system, or even the boxes of curd ready for disposition. Tis the season to “Rightsize Your Information Footprint”. And that means get rid of your crud. And that got me thinking about chicken wings. And that got me thinking about what cute sweater I was going to wear to the Unique Snowflake Fest party this weekend. And because my sweater is red, that got me thinking about the Wisconsin Badgers beating Ohio State this weekend. Jump Around!

Building an Information Factory

2014-11-21T07:44:00.000-08:00

Years ago, email burst onto the business scene to become the premier business productivity tool used at work. Not surprising, the post office immediately started to witness the precipitous decline in the number of first class business letters being sent. Revenue from first-class mail in 2000 was $91 Billion, and according to the US GAO it’s projected to be $39 Billion in 2020. Email was a game changer for which the post office didn’t have an immediate answer. The United States Post Office (USPO) tried staying open later and also tried selling non-mail related products. The USPO even allowed customized stamps to be printed at home. But in the end, the only way the USPO was going to replace the revenue lost due in large part to email use, which replaced the first class letter was with truly transformative change. In fact, maybe there wasn’t really a viable answer. But whatever was tried was incremental in nature and insufficient to stem the bleeding that was catastrophic to the letter mailing business.

Steal this Song

Some kid had the bright idea that he could build an online network for people to share music for free, over the internet (otherwise known as Napster). Wonderful idea, unless of course you are the artists who created the music or the music companies that sell it. In either case, both the artist and music company will be directly and substantially impacted. The music industry was ill prepared for this transformational change and started to flail immediately trying to seize control of the problem. Whether you embrace change or fight it when confronted with transformational changes will in part dictate your future. But we will come back to that in a minute.

First the Recording Industry Association (RIA) sued the creators of the various music sharing environments. Then the RIA sued select “borrowers” of the online “free” music to send a message to the rest of the snot nosed kids. This approach didn’t address the heart of the issue and instead made the industry look like bullies. While they were trying to stop transformational change with ineffective incremental baby steps, the winners, the ones building transformational solutions, were creating new ways to build value and business around a new reality-- that music could flow fast and freely across the web.

For Apple, which figured out how to deliver and sell the music, they have been handsomely rewarded. Many artists now sell their music one song at a time through the Apple music ecosystem or elsewhere or even sell it directly to listeners from their own websites. For companies like Sony and their famed (tape-based) Walkman, the story of their decline is well documented and painful to revisit.

The Changing Information Landscape

But this is not an article about business transformation generally. Rather, it’s an article about how global business is going to deal with an information landscape that is rapidly evolving and morphing in unpredictable ways. It’s about companies being overwhelmed by a tsunami of data routinely negatively impacting IT frameworks, storage networks, servers and employees. It’s also about more opposing laws and rules that can’t be applied or followed at the document or file level. It’s about big data demanding more information to crawl through while the corporate privacy officer is pushing for the company to keep less information to reduce overall risk.

If, in another world, information grew at 2 or 3% per year, then maybe employees could manage privacy, protect company trade secrets and handle the task of records management. But most organizations’ information footprints are growing at 25-50% per year, and that is not the only challenge they face. More company information exists outside the company firewall (or in unmanaged repositories) than ever before, making control and access a new costly complexity. There has been a proliferation of new laws and regulations dictating how organizations deal with litigation response, manage company IP, lock down personally identifiable information (PII) or personal health information (PHI), or classify records.

Dealing with the Perfect Information Storm

How does a company deal with this “Perfect Information Storm” where massive volume meets massive management complexities, which collides with burgeoning laws, all of which can result in existential consequences from mismanagement?

Every day Bob goes to work and like the day before, does exactly what he has done every other day. The products that are created look and function exactly like the ones produced yesterday, most likely boring for Bob, but predictable for the company and the factory in which Bob works. That is because the process by which the products were created was a process meant to predictably create the widget the same way, day in and day out (think Henry Ford). Behind the factory processes is the concept that building a good and repeatable manufacturing process in turn ensures that the widget or whatever is built predictably good enough, every time. The whole idea is that once the factory itself is built well there is no need to rethink the manufacturing process every time another widget is made. If I focus on making each widget by hand when I need to make scads of them, then I am committing to a process that is wrong for the task. On the other hand, if I wanted to craft a fine painting, the factory-based manufacturing process is not right for the task.

One Man’s Record is another Man’s Junk

Contrary to popular belief, information is not so unique that it requires the master artisan’s touch to manage it properly. Even if that were true, and it’s not, that is simply no longer doable as we have too much information volume and it continues to grow. Even more importantly, if you asked 10 employees their opinion on the business value of a document, they would likely have several different CORRECT ways to manage or classify it. It’s something like - one man’s record is another man’s junk. Or better stated, everyone, no matter how much training they have, evaluates information differently. Not all the time, but a lot. That is because where you sit in an organization, your individual educational background, risk tolerance, understanding of the content, etc. all impact how you evaluate whether or not it’s a record, if its private, if it’s a trade secret, etc.

Compliance with laws won’t get any easier, the places data is parked won’t get fewer, and volume of information won’t get less voluminous. Each one of those statements is game changing yet folks still wear their incremental (paper-based) information management hat limping along trying to solve a transformative problem with the wrong set of tools - Much like trying to eat an ocean sized pot of soup with a spoon. Transformational change needs transformation solutions, not incremental ones.

So what to do?

Build an Information Management Factory. You need to solve the problem from the top down. Looking at the individual file when there are hundreds of millions or billions of them can’t possibly work, in other words think reproducible. Think massive. Think through-put. Think practical. Think transformational.

Can or should a company even contemplate managing hundreds of millions of files with rules built for a time when there were no computers and a few dozen paper record types? The information management space is trying to solve a transformational change issue with wimpy incremental ideas whose days were numbered decades ago. Get a clue and get on the transformation bus. Employees couldn’t manage company records 10 years ago when the company information footprint was 1/100th its current size (or less). The key take-away - Rethink and rework everything.

10 Things You Must do Now to get Information Management Right?

1. Throw out old thinking, old policies, old ideas and tired information workers.

2. Hire a new IM factory “Owner.”

3. Build a multi-disciplinary IM Factory team.

4. Develop the factory build out strategy and agenda for the next 3 years.

5. Build an IM Factory.

6. Simplify rules so that all rules can be applied without much or any employee intervention.

7. Use automation and applications to do the “heavy lifting.”

8. Make certain environments “non-records” locations so that all content goes away after a couple of years no matter what.

9. Develop rules for every new information source upfront so end of life is predictable and contemplated.

10. Apply simpler rules to all environments with a specific focus on storage hogs.

Don’t forget to buy some robots. Robots are good for everything.

Whether you embrace change or fight it, when confronted with today’s information realities, what is clear is that the problem isn’t getting any easier to solve. What is equally as clear is that you and your colleagues have not been very successful at solving it either. The reason is clear, minor incremental changes won’t solve the information management problem any more than a spoon can be used to serve up the ocean.

When faced with an exponential information growth problem, responding with incremental fixes won’t address the real issue. In other words, managing information in the current environment is unlike anything ever before as there is so much more content in so many more places which the company doesn’t have control over. It’s time for a whole new way to manage information. It is time for information management professionals to take the lead in guiding the factory in managing information. Employees can’t and shouldn’t be expected to manage stuff anymore, they are bad at it, they don’t have time for it, and there is too much of it to meaningfully attack the issue. Instead, build an information factory, automate as much as possible, and manage whole environments as one. Time changes and you need to revisit and rework your thinking about what works on a regular basis.

I heard a funny joke:

“How many Canadian post office employees does it take to deliver a letter?” Answer—“None as they are phasing out of home delivery because they are bleeding money”. Ka-Boom.

Epilogue

Kahn Consulting has spent the last few years building IM factories. It’s both doable and needed. If we can do it, so can you. Get busy.

Big Data v. Godzilla

2014-10-30T11:04:00.000-07:00

Who Wins the Battle For The Right to Use or Kill Information

Com·pe·ti·tion: the act or process of trying to get or win something (such as a prize or a higher level of success) that someone else is also trying to get or win: the act or process of competing (Merriam Webster)

Steven Wright mused that “you can't have everything, where would you put it?” But there are many in the IT world that think otherwise. Larger companies this year will grow their Information Footprint by 25-50% on average, which is about how much their data store grew last year and the year before that. Smart business people believe this path of keeping all their information is a good thing. Some even go farther, believing that all their information is essential to effectively use analytics technology (referred to as Big Data) to connect the dots to solve business problems. That is because not only does Big Data crave, well, big data, but also because answers to important business questions may dwell within the deep recesses of unstructured data piles that may seem unimportant to the casual or even the sophisticated observer. In other words, within all sorts of Information Parking Lots dwell all sorts of valuable information nuggets that only technology can harness. Getting rid of any information is tantamount to ridding the company of a competitive advantage that comes from harvesting the business answers.

The Information Competition Becomes a Conflict

But there is a whole different group of smart business folks that look at Big Data as a big risk and liability. Sure there may be value in finding the needle in the massive information haystack, but at what costs? These people seemingly take the exact opposite position, that more is not merrier and that at some point information which is “valueless” must be disposed. Defensible Disposition or “Rightsizing Your Information Footprint” is needed for risk reduction and reducing costs. The more information the company retains, the greater the likelihood that personal customer data may be compromised or someone will successfully hack our corporate information Crowned Jewels. Or the more information the larger the e-discovery headache. Or keeping everything forever undermines the records management program. Indeed, Privacy Officers generally think the right answer is for companies to keep less information for shorter periods of time. While Big Daters think about keeping more information longer periods of time. Core to Records Management is that records go away at the end of its period of retention no matter what, unless it’s needed as evidence in a lawsuit of investigation. More ill managed IP means more risk of losing company trade secrets.

And the “information use” battle waging is not limited to companies trying to predict the colors customers will want next season based on past buying habits. In an October 16, 2014 Wall Street Journal Story, entitled “FBI Chief Warns Against Phone Encryption,” it makes clear that the conflict over who gets to decide how information is managed is a real life and death situation pitting privacy advocates against the government. While government uses Big Data tools to crawl and unearth terrorists, privacy advocates and some phone companies want phone data encrypted. Similarly in an article entitled, “Privacy in the Internet of Things era: Will the NSA know what’s in your fridge,” Wojtek Borowicz, points out that “we’ve already entered the Internet of Things: a world where everything is connected, with billions of devices storing and exchanging data about each other and about their users – i.e. us. As it matures, it’s going to be hugely convenient, not only to the average Joe, whose smart home will always remember to lock the door and switch the lights off, but also to huge organizations. However, one of the main concerns associated with it is the security of IoT platforms and devices. But it’s not only preventing hackers from accessing these systems we should be discussing: What about privacy, government surveillance and the creepy vision of Big Brother hiding in my smart fridge?” http://thenextweb.com/dd/2014/10/18/privacy-internet-things-era-will-nsa-know-whats-fridge/

So Who Wins and Who Loses in This Conflict?

We find ourselves in an information Olympics where the best of the best of every information use and misuse is congregating to duke it out, though they may not even know it. The Big Data team is trying to tie together disparate chunks of information to answer business questions, while the storage guy screams, “No Mas”. I think the business people win. I think Big Data wins where it adds value. But that said, I believe that maybe making the seemingly divergent interests of information use can be accommodated. Either way, we will see soon enough. But for now, conflict or competition, information is being used for different purposes by different sides of the company and this new reality needs management attention ASAP.

Kahn's 8 Steps to Defensible Disposition Nirvana

2014-10-07T13:29:00.002-07:00

1. Define a reasonable diligence process to assess the business needs and legal requirements for continued information retention and/or preservation, based on the information at issue.

2. Select a practical information assessment and/or classification approach, given information volumes, available resources, and risk profile.

3. Develop and document the essential aspects of the disposition program to ensure quality, efficacy, repeatability, auditability, and integrity.

4. Develop a mechanism to modify, alter, or terminate components of the disposition process when required for business or legal reasons.

5. Assess content for eligibility for disposition, based on business need, record retention requirements, and/or legal preservation obligations.

6. Test, validate, and refine as necessary the efficacy of content assessment and disposition capability methods with actual data until desired results have been attained.

7. Apply disposition methodology to content as necessary, understanding that some content can be disposed with sufficient diligence without classification.

8. On an ongoing basis, verify and document the efficacy and results of the disposition program and modify and/or augment the process as necessary.

The path to hell is paved with good intentions.

2014-06-12T10:05:00.001-07:00

I am not sure I have any good way to say what I am about to say. And in fact, I am so trepidatious that I have to couch my commentary in verbiage subterfuge. I am not spineless, but just don’t want to create a bunch of enemies with my cohort. So here goes. I am certain you will get my point even if I hide the true identities of the offending parties to protect the innocent and/or guilty.

Assume for a moment that an international information association, decided that the industry and more specifically companies needed a way to assess if they had a mature information management program. So the organization got a bunch of their folks together to develop criteria by which they should evaluate if their program was good enough to pass muster. And let’s say after much talking and thinking they settled on an information management Maturity Model and related criteria.

Recently, a client of ours had us look at their self-assessment of their information management program using one such Maturity Model Best Practice self-assessment tool. (The client is now considering having us perform a new Gap Assessment). It is one of my favorite clients and it’s a great company that does so much right. So when I reviewed their self-assessment, I was stupefied. They used the information management’s organizations Maturity Model criteria and concluded they were seriously substandard. I totally disagreed with most of the conclusions of the assessment. I am not going to lay out why I think the various criteria are flawed in total, but let me give you an example to make my point. One of the criteria by which this company evaluated itself according to the self-assessment was information “integrity”. Based upon how the assessment MADE the client answer the questions, they got a flunking grade. I told my client given what I knew about their business processes and IT framework, that on the information integrity scale I would give them a Rhodes Scholar type grade—at least an “A”. SO why such a disconnect?

I get the whole thing about “one man’s hot is another man’s cold” but this is not about perception. It is about the criteria and maturing the process and still utterly failing even if what you have done is at least good enough. From my humble perspective, the evaluative criteria are aspirational, not functionally helpful, impracticable and may sell your company unfairly down the river. BOOM! I believe it sets up companies to fail that use the self-assessment, on criteria that are not really central to success. Every organization would be flagging miserably if put under the assessment’s microscope. And that’s just not the way it should be.

Which bring me to the PG&E San Bruno disaster and how industry “best practices” evaluations can be helpful at fixing failings and can also provide the basis for regulators to whack companies for failing to properly manage records, among other things. The tragedy was horrible. The loss of life and property is unthinkable. And the company may have had records management failings. But look close enough at any company and most organizations fail miserably. See the report at the following link. http://www.cpuc.ca.gov/NR/rdonlyres/23513DF5-28CB-425B-BAE4-0151981F0779/0/CPSD_Recordkeeping_OII_Report_Final.PDF

There are lots of information management industry standards, best practices, evaluations from all sorts of organizations. There is some terrific guidance and there are some downright damaging unattainable “best practices”. I’m sure all comes into being with great intentions. But massaged, manipulated and maneuvered by lawyers and a good company begins to smell dirty.

We developed a methodology called “Information Management Compliance” for evaluating the “goodness” of your Information Governance Program which has been used by so many companies. I borrowed the criteria from the Federal Sentencing Guidelines, which help judges evaluate what is good corporate behavior. I figured if the court will evaluate your company by the criteria, that you should build your program according to the criteria. (This is also the topic of “Information Nation-Seven Keys to Information Management Compliance”, See also http://www.arma.org/bookstore/files/Kahn.pdf.

Look close enough at any company’s information management practices and you will find flaws. Lawyers are in the business of exploiting flaws. I don’t need to give them material to work with that isn’t even real. So companies, evaluate carefully, document thoughtfully and pick criteria by which you evaluate circumspectly. Just saying.

Randolph Kahn, ESQ.

10 Leaps of Change

2014-02-05T09:20:00.000-08:00

10 Leaps of Change

There is an expression (probably in every language) that says something to the affect that if you try something and it hasn’t worked in the past and you continue to do it, that you are a knucklehead. Ok, I may be paraphrasing a little. But in any event, this adage seems to apply to business as it does in life generally. When you take a path in business that hasn’t worked in the past and nothing has changed to increase the likelihood of success this time around, then choosing that same path is bad business.

Employees are bad at records management. Never will the run of the mill employee wake up saying, “Yikes, I really miss classifying information for retention purposes.” And if they do, you don’t want them working at your company anyway. Having employees do the heavy lifting when it comes to managing information is a bad use of their time; they are really bad at it and they fail way too often.

Recently, I was talking to a big financial services client who was having us react to a new policy initiative. At its center of the policy was the employee who would either make it a success or utter failure. I voted for failure the second I saw it. After all, the same kind of policy failed last year in a similar task. Employees scoffed at the last policy directive and didn’t care, why would this time be different?

But actually, it’s way worse than you think. That is because businesses continue to ask of its employees the same tasks that haven’t worked well in the past. But now two things are different that make making employee center stage in the Information Management Compliance business that much stupider.

Each year the Information Footprint is increasing at between 25-50%. So if records management was hard last year this year it’s AT LEAST 25-50% harder. If your employees couldn’t get through classifying the pile last year, this year they have last year’s left over info to deal with and this year’s pile which is 25-50% larger.

I say AT LEAST because there is another important reality—employees are increasingly asked to do more with less. How often do you hear a worker say that this year they had less work responsibilities? If they did, perhaps they were unemployed. Everyone working the last few years especially in the downturned economy had more work responsibilities, not less.

My point is simple, using the some old solution that didn’t work in the past has no chance now where employees have more stuff to deal with and less time.

So what to do?

10 Leaps of Change (LOC)--It’s like a Leap of Faith, but with less fairies involved and more action.

1. Stop thinking your employees can make information management happen, those days past decades ago. Take them out of any heavy lifting.

2. Applying multiple business rules to each chunk of content is not going to happen. Too much stuff in too many places.

3. Change the paradigm from records live everywhere to records live only in sanctioned and designated repositories.

4. Thereafter, develop plans to apply straight retention to the vast storage locations that house non-records.

5. Start applying retention rules to structured records as they are a storage hog and can save the company a boat-load of money by being properly disposed.

6. Revisit email policy rules and develop a plan to reduce the time email is being kept.

7. Try to come up with ways that email can be managed without evaluating the content of each message—not practical and not happening.

8. Take on old repositories and old back up media to get rid of the stuff you no longer need. After all, you want to thin out your Information Footprint.

9. Every time a new location to park info is created, develop rules for the info disposition event and make it happen automatically downstream.

10. Stop tilting at windmills, stop believing in fairies (except perhaps the Tooth Fairy as she is as real as Chicago is cold), and stop believing that things that have failed in the past so many times may work this time.

You can Fly if you Believe Wendy.

Get on the Clue Bus and Revisit Your Email Retention Policy Randolph Kahn, ESQ.

2013-07-23T12:09:00.001-07:00

Times change and sometimes your direction must change with the changing times. Evolve or wither is how some like to describe it. I prefer “get on the clue bus”.

The first book I wrote, “Email Rules” is over a decade old. Shockingly, it is still published and sold today. “Email Rules” sought to give business folks a simple way to think about managing the complexity of email.

One of the simple rules of the book was that email should be managed by its content. Content is king, blah, blah, blah. Nice perhaps, but I don’t believe that is practical guidance anymore. Yes in a perfect world where each employee has one email a day and one easy-to-understand records retention rule to apply and a technology to manage it thereafter, managing by content would be terrific. But the reality is far from the perfect world of theoretical records retention. There was more than 2800 exabytes of new data last year alone created in the world. That is the data equivalent of about 140,000,000 years of continuous DVD movies. There are around 150 BILLION emails every day.

Believing that your employees can or should manage by content is not going to happen. Most employees today have many hundreds of messages bombarding them all week long, from various communication tools, not just email. Records Retention, if managed at the message or document level, if it was ever possible, would take a good part of the employees’ day every day and would be a very bad business decision. After all, businesses are in business of selling things, providing service, making money and not having employees use precious time and resources to manage records.

My view is that the retention rules that once made theoretical sense are today wholly impractical and undoable. Plus we have a decade of experience to know what works and what doesn't. Having employees classify and apply retention rules to an email message to manage it over its life cycle didn't work, doesn't work, won’t work, can’t work and you should be rethinking your policies. Remember—my admonition—“Evolve or wither”. There are lots of ways to evolve your email management thinking depending upon your industry, users’ needs, litigation docket, IT realities, etc. Here is one example.

In the last few months, several financial service companies have retained our services to revisit their email management strategy. What is required NOW? What should our policy be NOW? How can we stop keeping everything forever NOW? For large businesses keeping all email messages forever is an expensive proposition—costs millions or tens of millions of dollars and isn't required.

In fact, no law requires that a financial service company keep all email, forever. Yet some broker-dealers do just that-- retain all email indefinitely. It is fear? Perhaps. Is it not knowing the law? Maybe. Could it be the lawyers have forced the IT department into preserving everything forever because its perceived an insurance policy against discovery failures? Probably each of these motivates the brokers. But it's ill-guided because when do you stop keeping everything forever and how can you clean up the past. (We can help you clean up the past, just ask me I will tell you all about it, but that’s not today’s blog)

As the law for the broker-dealers are well settled and cases reviewed on this very topic elucidate, maybe its time to evolve your thinking on email retention. If you are a broker subject to the Broker-Dealer regulations, then FINRA Regulatory Notice 11-39 provides insights to your email management obligation. It states in pertinent part, “Rule 17a-4(b) under the Securities Exchange Act of 1934 (SEA) requires broker-dealers to preserve certain records for a period of not less than three years, the first two in an easily accessible place.
1 Among these records, pursuant to SEA Rule 17a-4(b)(4), are “[o]riginals of all communications received and copies of all communications sent (and any approvals thereof) by the member, broker or dealer (including inter-office memoranda and communications) relating to its business as such, including all communications which are subject to rules of a self-regulatory organization of which the member, broker or dealer is a member regarding communications with the public.”

When the SEC “interprets” their own rule, they conclude that a broker can satisfy the Broker-dealer regulations by retaining all email for 3 years even if the rules says a minimum of three years. See the regulator’s position below on this issue making clear that keeping all email for 3 years will satisfy the rule.

Further, when these matters get to Administrative Hearings, the way its addressed is similarly clear that 3 years and out is defensible. Neither the SEC nor FINRA demand brokers require that employees apply different retention rules based on the underlying business value of the message. And they aren't demanding that all message be retained forever either.

It gets way more complicated for the financial services companies that are subject to additional or different regulatory frameworks, as well. So, if you are subject to the Investment Advisers Act or Dodd Frank Swap retention rules, for example, they are going to require different retention rules. While I don’t want to get too deep into the legal issue (email me at rkahn@kahnconsultinginc.com if you want to talk about it), the real point is that it may be a good time to revisit and evolve how you retain email and see if there is a better way.

What if its way simpler and legally defensible to keep email for 3 years and then purge it unless its needed for audit, litigation or some other formal matter. Why can’t you carve out the exceptions for the folks that are subject to Dodd Frank or the Investment Advisor’s Act or some more restrictive rules and mange those employees outside the general rule. There are so many things you could consider, but last on my list is keeping everything forever. Not smart. Not needed. Not inexpensive. Not Productive. Not economical, not required. Not easily unwindable.

For companies subject to different regulations there is similarly different, easier and productive ways to attack email retention. No laws or regulations for any industry require that all email be retained forever. Perhaps more importantly, when relooking at the retention question it is worth considering that employees rarely access messages a short while after they are sent or received. So why are you keeping all that stuff anyway?

I have written numerous e-communications policies and have changed my thinking many times since I wrote “Email Rules”. I have hitched a ride on the clue bus many times and have taken clients for the ride over this very issue many times in recent years. Keeping a petabyte of email costs millions just for storage, saying nothing of wasted resources, employee efficiency, privacy risk, litigation expense, etc. Keeping everything forever isn't tenable when information is growing at 30-50% per year. I don’t believe your company is really benefited by keeping all email forever anyway. I know there is a lawyer somewhere that sleeps well tonight, but there are a bunch of IT and business professionals that suffer many sleepless nights thereafter trying to manage the pile of digital debris and pay for it out of a limited budget. The only way through this Information “Perfect Storm” is rethinking, evolving, reeducating, redrafting and getting practical albeit imperfectly.

Hanging with my Legal Peeps and Giving out Some Well Deserved Tough Love

2013-05-09T09:08:00.000-07:00

“A big shout out to all the lawyers in the hizouse.” “Give it up for all the attorneys”. “‘Hey lawyers, when I say ‘Ob’ you say ‘structionist’, ‘OB’.” “I can’t hear you.” Ok, when I say “your IT department thinks you’re THE problem,” you say “really?”. “Your IT department thinks you’re the problem”. And a painful and profound silence befalls the harried hallowed hallways of your corporate law department. What if your thinking is wrong. What if you believe your course of action is prudent but in fact it’s dead wrong. It’s not as though you set out to tell your whole company that from today forward that no information will ever be destroyed. But for many companies that is the precise situation in which they find themselves. Maybe it has nothing to do with you and your legal eagle pals, but if experience is any guide that is probably not the truth. If you are an in-house litigator maybe your thinking is misguided because you think tactically at the lawsuit level not strategically for the enterprise. Or perhaps, it’s because you are only concerned about the lawsuit you face today not what happens when you say to the IT department stop destroying anything even if policy otherwise allows its destruction. Maybe it’s because from your vantage point you are always looking backward at evidence created in the past not forward at business efficacy through information accessibility. But I think you are likely, at least, part of the problem.

So I have devised “Randy’s Twelve Step Program To Help Lawyers Own and Combat Information Hoarding” (herein after referred to as “RTSPTHLOACIH”). Maybe it will help you and your law department start to rethink your approach to litigation response and maybe help build a better relationship with your IT folks—who are desperate for some of your lawyer’ brilliance and legal love, not to mention, a simple answer to the 15 plus questions they have asked over the last few months, for which they are still patiently waiting a real response. BTW-“it depends” is not a useful answer for your IT folks. To them it means “the lazy lawyers are a pain in my server”.

RTSPTHLOACIH (also referred to as “Randy’s Twelve Step Program To Help Lawyers Own and Combat Information Hoarding”)

1. Storage is not cheap—unit cost may be going down by a few percent per terabyte but because your organization’s information footprint is likely growing at 20—50% per year, you are spending way more to store information.

2. “Information” is broader than “records” and “evidence” may include records and non-records provided it’s potentially relevant. So by retaining all information, your organization is tacitly agreeing to manage all information as though it’s a bona fide company record, which carries with it huge responsibility. Getting rid of non-records allows your company to save big bucks and be way more efficient.

3. Records Retention rules allow and REQUIRE that records are properly disposed at the end of their useful life. But you stopped that process from happening when you countenanced the “keep everything” approach to litigation response or failed to promote the disposition of electronic content pursuant to your Records Retention rules.

4. Put another way, if you allowed your company to keep everything and no longer purge records when their period of retention is up, then you are responsible for violating your own Record Retention rules by failing to follow them (absent a court order to keep everything which is rare).

5. Litigation costs are soaring in part because “keep everything” makes finding the relevant needle in the irrelevant haystack that much more complex, burdensome and expensive. Knock it off.

6. Many large companies are now spending tens into the hundreds of millions of dollars per year just to store information and thinking search is omnipotent and storage is free provides a fallacious basis for failing to clean up the digital data debris.

7. Your organization can’t keep all information forever—your business people spend too much time trying to find needed content and more often now they can’t find it at all or its taking way too long. You think the CEO would opt for business inefficiency so that you can sleep well tonight after you represent to a court “nothing could have been destroyed, because we keep everything”. (BTW-last year the MER Conference I heard an enlightened Federal Court judge admonish those who were over-retaining and over-preserving as he extolled the virtues of shorter and more uniformly applied retention rules.)

8. Litigation response requires taking action up front and segregating responsive information from the rest of the company information, otherwise you can’t apply retention rules and dispose of outdated information downstream as everything is commingled. A more proactive approach to litigation response may cost short term money but there will be long terms gains. (don’t believe me, email me (rkahn@kahnconsultinginc.com and I will show you the business case). If everything is commingled and not flagged for preservation, getting rid of outdated content is all but impossible without huge expense.

9. Your IT department needs very specific help to clean up the past information piles otherwise their systems will break and budgets will be decimated retaining loads of outdated information unnecessarily. You can help save your company millions and help develop a new Information Governance construct. You want some real IT (maybe even CEO and CFO) love, help Defensibly Dispose info crud.

10. Employees can’t do the heavy lifting of records retention and litigation preservation any more as there is too much stuff to go through. Harnessing technology to better deal with discovery will be essential. Maybe you can use some of your budget to fund an IT technology purchase that both the law department and IT can benefit from and you can garner even more Nerd Love.

11. Technology is way better at managing information than people. Evolve your old school paradigm. Employees don’t have time to search and classify and if they did, they would do incredibly poorly at the task. Evolve or wither.

12. Courts have recognized that technology should be used to help manage information. Become a Change Agent and get on the Clue Bus.

When I say “I” you say “T”. When I say “Legal dogs” you say “are in the IT Hizouse”. And as the sun rises over another “faster, better and cheaper” company, you can hear a youthful exuberance of a member of the IT department say “put your pocket protectors down fellas, so I can introduce you IT nerdlets to our legal homie”. 15 minutes later…the CFO gives you the business process improvement award for fixing litigation response, cutting e-discovery costs, helping the CIO save millions on the burgeoning storage budget, cutting customer response time, and bringing about world peace. And with plenty of time to redline a contract and eat a pound of flesh before you go to lunch, you realize you are truly valuable. BOOM.

Stop Whining Already

2013-03-18T09:48:00.000-07:00

As I was extracting the plastic butter knife from Bob’s frail and thin-skinned chestal cavity (as you recall, Bob is our archetypical records manager that I love to pick on), in a rare moment of decency, I couldn’t help but realize that maybe I was too harsh and should reflect upon my pointed last blog post that made Bob feel so bad about himself. If you need to refresh your recollection, here it is (http://areyoukiddingme.kahnconsultinginc.com/2013/03/dont-shoot-messenger-records-management.html)

People tell me they are tired of “issues spotters”. That is the cynical and negative types like me that hone in on corporate America’s information management failings while eating popcorn just to point out the obvious. “I get that discovery is painful and expensive—help fix it”. “I get that records management is utterly broken—help make it better”. “I get that I am a powerless “Army of One” with a records management agenda that would keep 12 people busy and report to a knucklehead that doesn’t care, but get me funding to do something productive”. Ok I get it, you want solutions not the “in your face” slap of reality that reminds you that you have already been replaced by the IT folks and your days are numbered.

Here are 7 things that you can do to transform your career

1. SIMPLIFY-Rework all records policies and retention rules so that they can be applied by technology. If you have event based retention, get rid of it unless ABSOLUTELY required by law. Lots of folks point to imaginary laws that they claim requirement event triggers. Do the research and you will realize you are wrong lots of the time. In any event, work with your lawyers to get agreement to simplify, simplify, simplify. Make it practical and seek reasonableness.

2. RELOCATE-Politic to have records management be part of the IT department. They have money, control all info and need your help. I have heard the debate for years now. In fact, I hear it every year for 2 decades—where is the best corporate location for information management? Stop the debate find a better home, where you are loved.

3. MARKET-Change your program to an Information Governance program, and market what you do, build support, and go and win budget for valuable initiatives. You are a business not an indigent on the dole. Make yourself valuable and sell your wares just like everybody else does.

4. BUSINESS FOCUSED-Stop trying to get approval for saving 12 dollars by destroying 6 boxes of paper. Think big and think value to the business and what executives care about. If your information governance program saved millions of dollars and made the business appreciably more productive, the executive would take note. Defensible Disposition is a winner project for IT, Legal, Users, Customers and Executives. Go build a team, get buy in and elevate retention to a place of import.

5. EDUCATE- Our world doesn’t need old tools, it needs really smart folks with knowledge of technology that makes things hum. Get busy and get smart ASAP.

6. BUSINESS CASE- The way you will get budget is to have a plan to attack a business problem. The plan will demonstrate how much it will cost, how long it will take, how many internal and external resources it will take, and WHAT THE ECONOMIC BENEFITS WILL BE TO THE ORGANIZATIOIN. If a project costs a lot and doesn’t provide calculable economic benefit it won’t get funded. If it is little in value to the organization nobody will care. Think big and think smart. Cleaning house of 30%of the information crud clogging the pipes will be valuable because it can save major money.

7. STOP WHINING-Bob, no one likes to hang with victims. Start to see yourself as a valuable asset to the company. Think money, not boxes. Think service provider, not box pusher. Think budget, not justifying your salary. Think relationships, not about being browbeat by the head of Real Estate to whom you report, but who cares naught for you. Become, faster, smarter and business value focused.

Maybe if you can successfully take that on in the next 12 months, you won’t be so interested in collecting chapter pins at the next ARMA International Conference anymore.

Don’t shoot the messenger-Records management, as we know it, is dead.

2013-03-07T10:20:00.000-08:00

The death of records management came silently, almost without any warning or notice. As Bob dragged his last banker’s box from one side of the dank basement to the unlit portion of the massive underbelly of the company, he let out his last gasp. The executives were not present and indeed took no notice. No gold watches. No kind words. To add insult to injury, the e-discovery hot shot lawyer was immediately circling around Bob’s decaying middle age mass to glom onto anything of value. There was lots of value but it wasn’t packaged up pretty for the corporate world to see, so the pickins were easy and plentiful.

Riddle me this?

Is it practical to expect your employees to classify company information given today’s information volumes?

Would your executives really want all employees to spend 10-20% of their day doing records management?

Do record management procedures help the business be more agile and competitive?

Should employees be expected to go through hundreds of millions of files from the past to determine if they still harness any on-going business value?

Does your records program really apply those retention rules to all electronic records across the company—or to any of it for that matter?

Does keeping everything just in case you get sued make sense given that your company already struggles to find needed business information?

Can your records program claim millions in savings from its activities?

Truth is, most would answer each of the questions with a resounding NO.

Records management once stood for the proposition that employees could and would code each record so that it went away at the end of its useful life. Those days are over.

Records management once stood for the belief that if everyone did their part, managing all content would be easy enough. That’s never going to happen again-- if it ever happened before.

Records management once stood for the idea that people (not technology) had to make business decisions about business content. That became wholly untenable as we created nearly 2800 new exabytes of data last year alone (IDC). One Exabyte is the data equivalent of 50,000 years of DVD movies - just to contextualize the enormity of the problem.

I have spent the last several years trying to figure out how to rework records management to deal with today’s volume and complexity of managing e-information. Part of that answer is Defensible Disposition (check out www.Delve.us) —how can we take simplified retention rules and apply them to electronic content without relying on the employees to do the heavy lifting? How can we attack different chunks of data to clean house of unneeded business content in a legally defensible way? In some cases, Defensible Disposition turns into an auto-classification exercise using technology to analyze and classify data. In other situations, it is a rather different exercise, looking at junk file types and making reasonable decisions about what content can be disposed. Big picture is this—making sure that retention requirements and preservation needs are satisfied before content is laid to rest and doing so with as little employee involvement as possible. Sometimes that means taking on big chunks and sometimes that means training retention rules to a computer crawler to classify content. But what it no longer means is that Bob’s replacement is going to be hauling boxes or the electronic equivalent.

Let me tell you about Bob’s replacement. She is super smart. She is a business person first and an IT person second. She only inherited records management because of Bob’s untimely demise. She will have no problem learning records management. She will bring fresh eyes and not be clouded by the “old school” ideas of records management past. She looks at Defensible Disposition as a way to clean up a big pile of digital crud and save the company millions, while making litigation response less onerous and increase profitability by making business “faster, better, cheaper.” She won’t let perfect get in the way of practical. To borrow a line from a song, “her future is so bright she needs to wear shades.”

I sat grave side at Bob’s funeral today. There were so many nice people saying so many kind words. One colleague stood and said that without Bob the boxes in the basement won’t move so often and so quickly anymore.

One man’s demise is another’s opportunity.

Randolph Kahn

Get Your Information Retention Under Control

2013-02-21T11:22:00.000-08:00

Most sizable companies spend millions or tens of millions of dollars every year storing unneeded business content. So please don’t get me started about the fallacious “storage is cheap” hokum.

The CIO is tired of having his dog wagged by the legal tail whose mantra is getting old. It sounds like this-- “But wait, WHAT IF we need that one document for a lawsuit and it’s gone”. So don’t get me started about how we should keep everything just in case there is a lawsuit down the road for which we need a specific document. That approach is contrary to your records policies and makes little or no sense.

Ok this is the reality, you can’t keep everything forever, buy you are afraid. If only I could hear it from a judge that would make me comforted.

Your wish is my command. I’m a Defensible Disposition fairy.

A lawyer seeks to justify why her company needs to keep all information.

“…part of the reason eDiscovery is so expensive is because companies have so much data, that serves no business need, but it’s so easy just to keep it there…. I think despite the economy, companies are going to realize that it’s important to get their information retention, their information governance under control, get rid of the data that has no business need and mine the data that has business needs – you know the so called Big Data – things like that in ways that will improve the company's bottom line on the business side and reduce costs on the eDiscovery side as a benefit as well.”

United States Federal Magistrate Judge Andrew J. Peck, “JD Supra Law News,” February 4, 2013.

Information Classification

2012-09-21T09:58:00.000-07:00

Information classification is the process of arranging information with shared characteristics. It is a lot harder than what meets the eye. And if it’s the employees classifying data (increasingly a non-issue as there is way too much information), it’s more like an art than a science and more like contextual guesstimating than measuring. Even harder when a user must make the determination on what is a formal record(required for legal or regulatory reasons) – vs. what is not. And there is a really good explanation as to why that’s the reality.

Today around the globe, employees do business, real business in Facebook, Twitter, blogs, SharePoint, text messages and email. As email has been the business tool of choice for many years and as there are billions of them used in business every day, it’s a good place to start to explore just why having 100% exactitude in classifying is not a reality.

Let’s delve into an example to start to understand just how complicated the mere act of classifying information can be.

Lily, the manager of the sales support unit gets the following email from Teddy, the head of the leasing business unit. You make the call—is it a record and if so, how should it be classified?

“Thanks for overseeing the Ace Leasing deal. I thought your assistant manager, Dylan did a good job and I think he is ready for bigger challenges and a boost in pay. It would have been useful if he brought contracting in sooner. We should really think about how to make the documentation process touch fewer hands and simpler over all. Also, we need to get implementation services involved ASAP. Please have Riley from contracting confirm the pricing, as it wasn’t on the attached proposal.

Best, Teddy.

BTW-say hi to your daughter Cooper.”

This email or millions like it happen every day, all day long. If you were asked to classify it, would you say it’s a record requiring long term retention? If you did, what kind of record is it?

If you had any employee determine what the business value of the email was, they could classify it many different, albeit CORRECT ways. Most employees predictably classify information with a parochial perspective about what it is based on their work experience. If Lily, the recipient classified it, she would be colored by the utility of the email for her job or department. In that case maybe it’s a sales record which should be put in the Ace Leasing file. On the other hand, as a manager she may see it as an HR related record, which recommends advancing Dylan and getting him a pay raise. Maybe it should even go into Lily’s personnel folder as being complimentary of her good management of her unit. Maybe the email is a record for the contracting department or instructions for the implementation of the project. Maybe it’s also a record for the Business Process Improvement team to fix the business process as management thinks it’s broken. Fact is it could properly be classified as all those types of records. All different records have different retention periods associated with them. And further depending upon who classifies and what business unit they are from, the result may be substantially different.

Not surprisingly, employees are not particularly good at classifying information, even the smart ones, and if they don’t need to do it, they won’t, and don’t even care. Now imagine each employee touches 100 information nuggets daily that need classification. This partly explains why classification is so difficult. It also makes the point that there are many subjective right answers. I believe many records could be properly classified in different correct ways. We sometime think there is only one right way.

For almost a decade I have been thinking about the use of auto-classification technology to classify and manage information. I used to think it wasn’t ready for prime time. Today it is really powerful when used properly. I then got hung up on lawyers attacking it giving a known failure rate. I got over that as they attack everything any way and reasonableness and information volumes dictate relying on technology to do the heavy classification lifting. Given information volumes and expecting employees to do the classifying is like asking your auditors to count the grains of sand on the beach, and classify them according to size and shape. And now I am down to how effective the technology has to be to allow your classification to be done by a computer. There are no hard and fast rules about confidence ratings or efficacy scores (sometimes referred to as F-Score,) even though most people would be substantially comforted if there were simple rules for what was good or good enough.

I know employees are not good at classification. I know that employees don’t have time to do it and even if they did, they usually won’t get it right. I know people classify information in different ways and rarely are consistent from employee to employee. I know information volumes for most big businesses are growing at 20-50% per year. I know computers can do classification. I know it is not simple or cheap to do auto-classification. I know it takes upfront effort to get auto-classification right. I know that a company can’t dispose of business information without some diligence process to ensure that records are retained and evidence is preserved. I know that I have concluded that every big business needs to consider defensible disposition of information using technology to make it happen. In the end, I know people will attack the process and they will attack the auto-classification soft underbelly—the failure rate, the confidence score, the F-Score. I used to think it had to be above 90% to be good enough. Then I thought well maybe 80% is good enough.

Well, I have changed my thinking because the paradigm bounding my thoughts on this topic is flawed. As the classification tool crawls, it uses linguistic and numerical analysis to determine what something is and how to properly classify it. In the end if the software tells me it believes it’s correct with a confidence score of 51% or higher—what that means is the software probably got it right but maybe there is another category that is also a good option. In the end people do exactly what the technology does, but we hold technology to a different and higher standard. I am not sure what the right confidence score is, but I think we need to give technology a chance and not look for reasons to dismiss its utility. Nothing’s perfect, including your employees.

Kahn’s 4 Keys to Defensible Disposition

2012-06-06T12:40:00.002-07:00

With virtually no companies methodically applying retention rules to their ever-growing information heaps, and no practical way for employees to discern what is needed and what is digital data debris, you need to be thinking about how you will defensibly dispose of info crud. After all, “innocent” technology folks have been forced to defend claims of destruction of evidence for merely recycling systems to make room for more stuff. So here are Kahn’s 4 Keys to Defensible Disposition.

Kahn’s 4 Keys to Defensible Disposition

1. There is sufficient diligence (including review, audit, analysis by human and/or technology) to determine that the information subject to disposition is no longer needed for records retention or legal purposes.

2. The analysis and diligence process is managed by individuals without any personal interest or incentive in the disposition of the specific content subject to disposition and any disposition is undertaken with agreement and oversight by law department and relevant business unit heads.

3. The disposition process followed is documented, routinized and repeatable and all disposition actions taken are authorized, final, complete and irreversible.

4. Prior to any disposition, there will be sufficient notification of the proposed disposition actions to be taken, to the affected business unit heads and the legal representative to be able to immediately stop the disposition process if questions arise as to the appropriateness or legality of the disposition.

Keep Clouds Floating

2012-02-10T14:09:00.000-08:00

Who do you do business with? When you need to park your information does it matter what parking lot you select? Do you select based on cost? Do you select based on functionality? Perhaps based on both? What matters most?

I do believe in the cloud. I don’t believe in parking information assets with the cheapest cloud or the one that has a questionable future life. If information is worth storing then it must be worth protecting and having access to in the future. If you have any question about whether or not the Cloud will be floating next week, and you don’t know if you will have access to your data, then you should care.

Imagine a company builds a “cyberlocker” business in the Cloud. Basically it’s a cloud storage provider with a cool moniker. Let’s call the business Megaupload for fun. And let’s say Megaupload decides to use other cloud storage providers to park your data—sort of like outsourcing the “storage in the cloud” to another “storage in the cloud provider.” But let’s say Megaupload is alleged to have done some IP thievery for which they are being pursued by the government for their alleged criminal wrong doing and as a result, the US government closes Megaupload’s cloud doors for business.

And because the doors were closed without warning, you don’t have access to your information. What if you never get it back?

Imagine no more because if you read the February 1, 2012 USA Today article entitled “Legit Megaupload users cut off from their files USA Today” you will realize the story is real and the Cloud risks you fear can come true. Kick the Cloud tires hard. Check the Cloud doors for tightness? Make sure the Cloud is mature and well financed and isn’t going away any time soon.