eDiscovery & SharePoint 2013 eDiscovery: Anforderungen und Umsetzung mit SharePoint 2013 Alexander Fromm DTI - Senior Consultant Thierry Gasser Microsoft TSP Microsoft Technet Event, Wallisellen, 25.09.2013

eDiscovery - Intro

eDiscovery - Agenda Was ist eDiscovery ? Was bedeutet eDiscovery im Kontext des angelsächsischen aber durchaus auch im schweizerischen Rechts? Wer hat sich damit weshalb auseinanderzusetzen? Was sind dazu die Anforderungen an eine IT-Lösung ? Was nutzt dazu SharePoint 2013?

eDiscovery: Weg zum Regulation (ISO/IEC 27050)! Tech Ready 15 3/28/2017 eDiscovery: Weg zum Regulation (ISO/IEC 27050)! http://www.iso.org/iso/iso_technical_committee?commid=45306 Enterprise Information Management High-Performance Analytics Discovery, Visualization, & Collaboration Is my Enterprise data consistent and trusted? How can I get it quickly and accurately? Can we make it easier for users to understand? Governance, Risk, and Compliance = GRC GRC - Processes, Workflow, & Controls What is compliant and what is at risk? Ediscovery is a Audit legal system for IT. © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

eDiscovery - Definition eDiscovery: Electronic Discovery oder eDiscovery (engl. eDisclosure) ist der Vorgang des Ermittelns und Bereitstellens von elektronischen Daten, die als Nachweis dienen können.

eDiscovery – Rechtlicher Rahmen «Civil Action»

eDiscovery – Beispiel Legal Hold Notification

eDiscovery – Rechtlicher Rahmen Was bedeutet eDiscovery im Kontext des angelsächsischen aber durchaus auch im schweizerischen Rechts USA Offenlegung aller prozessrelevanter Daten und Aushändigung an die Gegenpartei (Federal Rules of Civil Procedure, FRCP – Electronically Stored Information - ESI). Auslöser einer eDiscovery können amerikanische Rechtsanwälte, Insolvenzverwalter, Revisoren, Steuerfahnder oder auch Behörden sein. Regulatorische Anforderungen: Foreign Corrupt Practices Act [FCPA 1998], Sarbanes-Oxley Act (SOX) (2002). Sanktionen: Finanziell oder Beweislast-Umkehr. Angeforderte Informationen zu löschen, zurückzuhalten, nicht zu finden oder zu verändern wird vor Gericht hart bestraft.

eDiscovery – Wer hat sich damit auseinanderzusetzen? Unternehmen mit Geschäftstätigkeit in den USA Geschäftsleitung, IT, Rechtsabteilung, Rechtsanwälte

eDiscovery – Welche Daten sind relevant?

eDiscovery

eDiscovery – …im schweizerischen Rechts I Was bedeutet eDiscovery im Kontext ……… aber durchaus auch im schweizerischen Rechts Schweizer StGB (http://www.gesetze.ch/) Haager Übereinkommen Schweizer Bankgeheimnis (http://schweizer-bankgeheimnis.ch/) Datenschutz

eDiscovery - … im schweizerischen Recht II Pre-Trial Discovery nach Schweizer Strafgesetzbuch nicht strafbar. Kreuzverhöre lt. Rechtshilfeabkommen möglich. Datenschutzgesetz bei internationaler Rechtshilfe (Art. 2 Abs. 2 Bst. DSG) findet keine Anwendung.

eDiscovery – Beispiel Legal Hold Notification

eDiscovery – sonstige Anwendungsbeispiele Hilfreich nicht nur bei Rechtsstreitigkeiten mit den USA Verwendung der Daten bei rechtlichen Auseinandersetzungen z.Bsp.: Patentstreitigkeiten Preisabsprachen Wirtschaftskriminelle Ermittlungen sowohl gegen das Unternehmen als auch gegenüber Einzelpersonen Interne Ermittlungen gegen Einzelpersonen Anklagen durch Geschäftspartner oder Mitarbeiter

eDiscovery - Anforderungen Was sind dazu die Anforderungen an eine IT-Lösung - Enterprise Search – Leistungsstarke Suche - Compliance Archivierung der Suchergebnisse/Daten - Authentifizierung/Authorisierung - Datenexport

eDiscovery - Nutzen Was nutzt dazu SharePoint 2013 SharePoint 2013 hat den Fokus auf die ersten 3 Bereiche des eDiscovery Prozesses. Discovery – Suchen und finden der Fall relevanten Daten Preservation – Fallspezifisches sicheres Aufbewahren von Daten – Archivierung Collection – Einsammeln der Daten und Überwachung Was nutzt dazu EX 2013 und Lync 2013 - Exchange und Lync haben dieselben Focus für eDiscovery

Lifecycle of mailbox items (1) Message delivered User A Mailbox Recoverable Items Deletions Inbox Purges Versions Audits Deleted Items … DiscoveryHold Calendar Logging (5) Message Edited (2) Message moved to Deleted Items (3) Message deleted (6a) Messages purged by DIRW Policy (or maintained for Litigation Hold) (4b) Message “purged” by user (In-Place Hold) (4a) Message “purged” by user (Litigation Hold / Single Item Recovery) (6b) Mailboxes with SIR and In-Place Hold enabled have expired messages moved The Deletions folder replaces the ptagDeletedOnFlag view that was displayed when a user accessed the Recover Deleted Items tool.  When a user soft deletes or performs an Outlook hard delete against an item, the item is moved to the Recoverable Items\Deletions folder.  When the user accesses Outlook/OWA Recover Deleted Items, the RPC Client Access service translates the request and returns the Recoverable Items\Deletions folder view. At this point you may be thinking, how is this any different than in previous versions of Exchange?  With short-term preservation deleted items will still be moved into the Recoverable Items folder structure.   However, the data cannot be purged until deletion timestamp is past the deleted item retention window.  Even if the end user attempts to purge the data, the data is retained.  Consider this example by a malicious user: User sends or receives a message that is legally incriminating. User deletes the message.  The message is moved to the Deleted Items folder. The user empties the deleted items folder. The user accesses the Recover Deleted Items functionality in Outlook or OWA. The user then selects the item and deletes the item.  At this point the user believes he has removed the incriminating evidence.  And this is a key strength in this work flow as the end user's actions are not interrupted or prevented; in other words, the end user's work flow is not impaired with single item recovery enabled. However, the message was not purged from the mailbox store.  Instead the message was moved from the Recoverable Items\Deletions folder to the Recoverable Items\Purges folder.  All store hard-deleted items end up in this folder when single item recovery is enabled.  The Recoverable Items\Purges folder is not visible to the end user, meaning that they do not see data retained in this folder in the Recover Deleted Items tool. When the message deletion timestamp has exceeded the deleted item retention window, Records Management will purge the item. Not only does short term preservation prevent purging of data before the deleted item retention window has expired, but it also enables versioning functionality.  Essentially when an item is changed, a copy-on-write is performed to preserve the original version of the item.  The original item is placed in the Recoverable Items\Versions folder.  This folder is not exposed to the end user.   What triggers a copy-on-write? For messages and posts (IPM.Note* and IPM.Post*), copy-on-write will capture changes in the subject, body, attachments, senders/recipients, and sent/received dates. For other types of items, copy-on-write will occur for any change to the item except for moves between folders and read/unread status changes.\ Drafts will be exempt from copy-on-write to prevent excessive copies when drafts are auto-saved.  The data stored in the Recoverable Items\Versions folder is indexed and discoverable by compliance officers. (6c) MFA evaluates item against hold queries set on mailbox

eDiscovery - Überblick eDiscovery in SharePoint 2013 eDiscovery SP2013 besteht aus folgenden Komponenten und Funktionen: eDiscovery site template In-place holds (or In-place Preservation) – Compliance Archiv eDiscovery Datenexport eDiscovery APIs

eDiscovery – Site Template Erstellt und managed eDiscovery Sätze. eDiscovery Satz ist ein SharePoint site template und erstellt sub webs in der eDiscovery site collection. Identifizieren und Halten des Inhalts Compliance Archiv Suchen und filtern im Inhalt Export der Daten Das eDiscovery site template enthält auch Funktionen für die Zusammenarbeit an Fällen (Collaboration), die zentrale Speicherung der Daten und das Datentracking.

eDiscovery In-place Holds – Compliance Archiv Definieren eines Haltebereich Inhalt wird erst in das Archiv übertragen, wenn der Inhalt geändert wird (Design Spezifikation). SharePoint 2013 Dokumente, Listeneinträge, Webseiten, Exchange Postfächer, Lync Chat Aufzeichnungen Setzen von “legal hold” - (Schützen/Aufzeichnen der Daten auf Veränderung) ohne die Benutzer über die Archivierung der Daten zu informieren

eDiscovery Export Daten Export zur weiteren Überprüfung SharePoint Inhalt incl. Versionierung (Dokumente, Listeneinträge, Webseiten und Exchange Inhalt) Berichterstellung – Log Dateien XML mit Metadaten ERDM Format - Electronic Discovery Reference Model

eDiscovery APIs Microsoft .NET programming model Microsoft.Office.Server.Discovery namespace Weiterführende Informationen unter: http://msdn.microsoft.com/en- us/library/jj163267.aspx#SP15_eDiscoveryInSP_eDiscoveryProgrammingModel

eDiscovery – Limite - Fragen Kann auch SharePoint 2010 Inhalte verwendet werden? Ja, aber keine In-place holds möglich. Suchen, Filter, Berichte und Export möglich. Kann auch in «alten» Versionen eines Dokumentes oder SharePoint Inhaltes gesucht werden? Nein, OOB nicht möglich. Können Benutzer SharePoint Daten ändern, nachdem ein «Hold» auf einer Site gesetzt wurde? Ja, wenn ein «Hold» auf eine Site gesetzt wurde, können Benutzer weiterhin Daten ändern. Werden die Modifikationen / edits innerhalb eines Dokuments auch in die Preservation Hold Library / Compliance Archiv übernommen ? Nein, die Modifikationen werden nicht übernommen. Limite können über die API gelöst werden, bzw. Partner arbeiten an einer Lösung. Hinweis: eDiscovery Download Manager benötigt .NET 4.5 auf dem client system

Beispiele SharePoint 2013 eDiscovery Beispiel / Walk-thru / Demo

Live Demo

Create Case Preserve Search Export Tech Ready 15 3/28/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Query of what to preserve Tech Ready 15 3/28/2017 Query of what to preserve Turn on Hold Create Case Preserve Search Export © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Create Case Preserve Search Export Tech Ready 15 3/28/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Create Case Preserve Search Export Tech Ready 15 3/28/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Create Case Preserve Search Export Tech Ready 15 3/28/2017 © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Fragen?

DANKE! Weiterhin stehen wir Ihnen für Fragen gerne unter folgenden Kontaktdaten zur Verfügung: Alexander Fromm fromm@dti.ch Peter Angehrn angehrn@dti.ch