Check it out at:

New on @InfosecurityMag talked to @datachainrisk about her PhD research into data privacy and the effect of breaches on people, as well as how #GDPR came along at the right time. @CityUniLondon https://t.co/lq29fQ6ans

— DanRaywood (@DanRaywood) May 24, 2018

My interests are varied as listed in my main jollyvip website.

Since October this year, 2013 I’m a PhD research student with the Centre for Cyber Security Sciences (CCySS) with the City University London.

My domains of research are varied too. I use the word ‘domain’ as I have not figured out where all my interests lie or map into the academia world of research with it’s own definition of disciplines and schools and departments. I do know that my main interest is in computer science (or software engineering). Over the years, having worked primarily on complex software projects/programmes, I am particularly drawn to the dynamics of interaction between people (hence my foray into Law and Dispute Resolution) and within organisations. To me, computer (and technology) is a tool, albeit a tool unlike others whereby it can transform life positively or negatively depending on it’s use or abuse. Well it’s like a hammer except it’s ‘soft’ i.e. malleable. Others have argued and also written on many aspects of software. I like to view software as malleable i.e. this Merriam definition;
a : capable of being altered or controlled by outside forces or influences
b : having a capacity for adaptive change

With this view, my research will explore these domains:-

Software Practice and Engineering
Organisation Operational Practice (cyber insurance)
IT Governance, Risk and Compliance
Data and Privacy Laws
Data and Information Visualisation
Supply Chain and Cyber Space (Internet)

So edisclosure/ediscovery is not on my agenda for my PhD research. However I do hope that the outcome of my research will provide useful tool(s) for edisclosure/ediscovery related issues.

As this site will be my only (public) blogging space, I will keep this blogging site as it is i.e. without any changes to the site name and description. From time to time, I will post news & tweets (via my twitters, @edisclosure and @insuredatarisk ) covering edisclosure/ediscovery and beyond into the above domains.

Thanks for reading this.
Cher

In the litigation arena, I have found that there are many more blogs on various aspects of ediscovery coming from the US and still hardly any blogs from elsewhere. Worldwide searching/linking is still lopsided when it comes to online knowledge and information distribution. Perhaps the very concept of knowledge or data or information divides the technology ‘haves and haves not’. For a survey of the ‘haves’ check out what others have compiled at Guide to E-Discovery Resources on the Web.

In my conclusion I stated ‘Whether the benchmarks set by the Sedona Principles will further be incorporated into IBA Rules or modified by the various international organisations such as the ICC, LCIA, IBA, UNCITRAL and the American Arbitration Association, to meet the expectations of the international businesses will be an event worth earmarking.‘.

With the lopsided information world and even with search engines allowing me to specify whatever I want to seach, I have to say there is so far no such event worth earmarking. Instead, these organisations have gone their own separate ways and with others (e.g. CIArb) joining in the bandwagon to come up with protocols/standards/models etc. So…expect more to come.

It’s nearly a year since I wrote my conclusion and this year I have attended most of the momentous ediscovery/edisclosure events hosted in the UK. One notable observation in all the events I’ve attended is that the international arbitration arena is also lopsided in that the participants are invited by the organisers’ arrangement/selection of the topics/themes. Hence the participants are driven by the (commercially driven) organisers’ goals instead of a truly opening forum for a wider participation by the end users or people/businesses who are the primary ‘stick’ when it comes to ediscovery/edisclosure related matters. Personally, I find the ‘carrot & stick’ (this idiom or expression conveys the way I feel about these seminars/events) approach rather limiting especially in areas whereby technology, law and other social sciences are involved i.e. like in ediscovery/edisclosure. Heh! I’m not blaming the organisers, in fact without them the ‘ediscovery’ industry will be less exciting (as I will have less to compare and contrast!).

I’m sure in due course there will be open forum(s) on ediscovery/edisclosure whereby there will be protocols/guidelines/procedures/standards etc designed/developed with participation from the wider businesses/communities rather than a select few or lone individual. I guess with the nature of the international arbitration arena whereby not a lot of cases are widely publicised, the ‘one size fits all’ stuff for edisclosure will remain elusive and challenging.

My article “Electronic Discovery/Disclosure: From Litigation to International Commercial Arbitration” appeared in The International Journal of Arbitration, Mediation and Dispute Management, V 74, N 4, Nov 2008 (The Arbitration Journal by the Chartered Institute of Arbitrators).

Just want to pass on my acknowledgement here (which appeared in the footnote in my article):

The author (me) would like to thank Martin Goodman and Roger Clough for their individual reviews. This essay is based on the author’s dissertation for a post-graduate diploma in International Commercial Arbitration. The author also wishes to thank Angie Raymond and Stavros Brekoulakis, Queen Mary College, London for their support. Also, many thanks to those who kindly provided access to their articles on their websites/blogs, e.g. Ken Withers.

However, the source of the inspiration for doing my dissertation on ediscovery/edisclosure started when I was involved in a document management programme with a major subprime mortgage company, a subsidiary of Lehman Brothers (yeah!). Companies and all the system documentation (many versions/iterations – which I considered unnecessary but then…that’s another story) disintegrated and perished.

Well, nothing beats experience and I’ve certainly been fortunate to have the opportunity to be involved in exciting software/technological projects. Experience itself though is rather like a piece of paper stored in a cupboard (or rather in the mind). By writing my dissertation and having my article published (reviewed and critic) serves to remind myself the power of sharing/collaborating one’s experience with others. A piece of paper written (like the many documentation I’ve produced) and never opened and shared with others is akin to creating and building junk instead of building one’s knowledge with self and others.

I hope I will continue to learn more by sharing with others. I also hope that others will open up and share their experience.  Many thanks to others who have shared their experience with me in many unconscious and conscious ways.

I do not know why the ICC specifically use the term ‘Production’. Why not just a Task Force for electronic disclosure or electronic documents?

I fear that by having a Task Force for ‘Production of electronic documents’ and with a mandate specifying two streams (i.e. disclosure and production) signal the potential to focus on disclosure and production with the outcome to report on ‘production of electronic documents’.

The ICC has great world class reports and publications and also a great institution in many ways.

I do hope this new Task Force will break convention and not just focus on the production aspects of e-disclosure.

When I started on my research back in October 2007, ediscovery/edisclosure was not a term recognised in the IT corporate environment in London. I know this for a fact as my colleague and friends said ‘what is that?’ when I told them my subject matter for my dissertation.

I came across ediscovery only because I was looking for a topic for my dissertation. As I was involved in a Document Management implementation project (with many challenges!) last year, I decided to explore various IT and legal issues related to document management. So, I too have no clue what is ediscovery until I started my research. The research subsequently led me to start this blog and also opened up a vast area of ‘unknown or ‘mysteries’ to explore further. So far, I have met several interesting folks from various fields.

Right now, I am looking for ways to pursue a PhD and will welcome any suggestions as to where to get funding and/or sponsors. I am told three years full time will costs a ‘lot’ of £££££. It will be worth more than £££££ as I know what I want to research will be stuff worth writing about.

For my IT friends and those in the IT corporate world and also the IT community in general, ediscovery/edisclosure may still be a mystery or simply another ‘e-something-fad’ and if you think you can avoid or rebel, think again and share your views here. Even the storage people (or IT storage stewards) have shared their views, read what was reported in Users rebel against e-Discovery liabilities by Beth Pariseau, June 19th, 2008

Furthermore, there are technology vendors/suppliers providing various forensics and investigations related tools and software for ediscovery/disclosure. Also, this year there are several organisations providing trainings/seminars on ediscovery/disclosure. Not surprisingly, lots of trainings/seminars have been conducted focusing on the ‘what’ and ‘why’ of ediscovery/disclosure. When the ‘how to do…’ is encapsulated or prescribed in process models or in cookbook approaches like ‘tips and traps’, the application or rather the act of performing the ediscovery/disclosure activities will still need to be carry out by people and team of people. Process models and ‘tips and trap’ will add to the heap of processes and procedures for organisations. Also, people generally trump or ignore procedures especially if there are too many to chew.

From my own real-world lessons, having worked with several major organisations in large projects/programmes involving software development/implementation, ediscovery/disclosure activities will require not only tools, process models and procedures. Like software development projects, ediscovery activities involve many stakeholders with competing needs and interests, many dependencies all requiring resources to be used effectively. Why not utilise a project management approach to manage the resources?

As far as I am aware, most or practically all commercial strength project management approaches and methodologies do not provide any framework for dealing with the people aspects in managing projects.

For example, PRINCE2 has detailed description of managing product deliverables and also steps for managing risks. I recalled in a PRINCE2 Practitioner training course, the instructor said something along the lines: ‘For effective project management, the people skills are crucial and are not covered under PRINCE2 trainings or in the manuals’.

Moreover, even if ‘best practice’ guidelines such as the IT Infractructure Library (ITIL) is adopted by organisation, the challenges of co-ordinating and working with diverse teams of people as when in an ediscovery scenario will be even more pressing. People cannot be certified against guidelines or even standards e.g. BS 15000, the IT Service Management Standard.

Individuals and team dynamics are what make an organisation ‘tick’. It is also common to hear other phrases such as ‘people matters’ or ‘we value people’. However, when it comes to tapping into (or the buzzword –empowering) individual to deliver the required value, the ‘tick’ becomes more like a loud bang. Loud bangs are generally not welcomed (unlike in Chinese celebration where the loud bang from fire crackers are said to drive away demons/back luck etc) as noises are deemed as unpleasant causing discomfort and unanticipated consequences. Is this why people avoid or simply fail to cope with the dynamics of people interaction?

Perhaps I have lost touch with my own abilities to do what comes naturally. How to get back in touch with my own abilities? How to get in touch and stay in touch with my own abilities especially when I am faced with chaos or in chaos situation whereby I have to interact with others.

Looking back to the heydays of the 80s, where there were less processes or tools and less rules and regulations, I was better equipped (by being less equipped with choices) to get any job (mainly building great systems and running a family) done with lots of ticks and banging. Nowadays there are way too many processes/tools and every actions I take there are rules/regulations to catch me out or trap me. So much so, I dread the thought of walking into an office, especially in an organisation where people, process and technology (what else is there in a 21^st office?) actually restrict and hinder my abilities to feel, think and act. So far, I have been mostly fortunate to work for/with companies whereby the people makes it worthwhile going into office to work.

Do I have an alternative to escape the 21^st organisational trap? Well, I have been busy re-training and re-visiting my long held interests and most importantly reflecting on my life and how I want to live my life. I am taking small steps each day and learning to cope with needing less and reaching out into my inner strengths.

One realisation is that when I am in chaos, I will find a frame of reference to make me feel good again. This frame of reference can be anything or nothing. When I find my frame of reference I get the ‘tick’ and this makes me feel good. Feeling good enable me to make sense of what I need to do. Doing then becomes second nature, effortless work or task.

When in Chao, find a frame of reference!

In collaboration with others why not find a frame of reference too?!

I attended the 1^st Forum last year and the focus then was mostly related to forensic stuff and presentations from top notch e-discovery vendors offering solutions/services based on the edrm.

Judging by the agenda, a mixed bag of themes and topics are planned for Oct 2008.

Heh! Incidents, investigations, readiness all sounds like fun to me. However I doubt if any of the technical and legal presentations will be fun.

Maybe the organiser will prove me wrong and comes up with 2 days packed with fun learning.

Anyhow, the listed agenda:

• Provide a wealth of practical information and examples of best practice on building proactive capabilities for disclosure and discovery requests
• Explain how best to contain costs while ensuring a high degree of forensic and litigation readiness
• Investigate how to strike the perfect balance when deploying in-house capabilities and using the services of external service suppliers 
• Detail what the perfect e-discovery crisis response team should look like, which departments should be involved internally, and explain how to ensure your organisation can react quickly and cost-efficiently 
• Highlight pitfalls to watch out for, and give pointers on how to overcome unexpected problems and hurdles that organisations can encounter during events and incidents
• Offer an opportunity to ensure that your policies are up-to-date with those of your competitors and peers
• Ensure you are aware of the issues you may encounter if you face a forensic or litigation engagement and are not prepared

Key themes and scenarios for 2008 include:

• Internally generated events
  > Fraud and theft
  > Investigations into employee activity
  > Employee disputes
  > Whistle blowing
• Compliance issues
  > Investigation by the government or regulatory body
  > Data privacy when discovering data in different jurisdictions
• Information leakage
  > Insiders divulging information (e.g. about mergers and acquisitions)
  > Espionage

According to the draft, the model is based on ‘the Plan-Do-Check-Act model (PDCA) used in the majority of management system standards’.

In the ediscovery arena, there is the Electronic Discovery Reference Model (EDRM) which was setup due to the lack of standards and guidelines in the electronic discovery market. The EDRM is a generic practical process model.

Also, there is another ‘closed’ (non lawyers are not welcome) working group looking at protocols to supplement the CPRs.

What an interesting mix of views/perspectives?!

What are the challenges of electronic disclosure?

According to the speakers/presenters from the legal world, the challenges are explored by themes which are;

Implications of the latest electronic disclosure developments
Minimising costs associated with eDisclosure
Best practices for managing and preserving electronic information
Developing litigation response strategies
Tips and traps for records management
Litigation strategy
Plus much more…

Not unusual that the legal world have tips and traps for records management.

On the subject of record management, I went to a talk & workshop on records management only last week, conducted by IT/Software professionals. The presenter actually raised some very interesting questions (no tips and traps) for the workshop discussions. One discussion topic was on ‘how to manage across boundaries (inside and outside the organisation)?’

Records management is not a challenge in edisclosure. Records management is already defined by the rules of the games i.e. the CPRs and the various procedures/processes for edisclosure. Ah! Maybe the rules of the games need to be reviewed or re-learnt/re-visited (by lawyers?) or maybe the lawyer’s interpretation of records management is different from what the IT/Software people viewed as records management. For the record, even within the IT/Software community records management have generated heated discussions especially when viewed in terms of knowledge management. Edisclosure is getting ‘relevant/needed/asked for/disputed/evidential’ (or any other keywords searched for) information from knowledge workers to other knowledge workers (or information seekers). Information is knowledge/power.

To me, this is the real challenge. It will involve not only strategy but the art of getting these knowledge workers to really want to collaborate. Who will be responsible for getting the information? Who will be fined? Knowledge workers or their managers?

Maybe the next Lawyer Conference will start to address the real challenges of edisclosure.