Information Governance and ediscovery in Office 365

Information Governance and ediscovery in Office 365 John Collins, JD Director of Information Governance Options Clearing Corporation April 17, 2018

Agenda Adoption of Office 365 is a monumental event and trend for IG and ediscovery professionals What is Office 365? Key elements of O365 for the IG and ediscovery practitioner Out-of-the-box ediscovery tools Out-of-the-box information governance tools Licensing 2

O365: monumental impact on IG and ediscovery The widespread adoption of O365 is one of the most disruptive and significant trends to hit the ediscovery and Information Governance professions in the past 20 years 3

Why?

Reason #1: Office 365 is an evidence factory and warehouse Factory for creating ESI: Email Files: Word, Excel, PowerPoint, OneNote Web pages Chats: Instant Messages Warehouse for storing ESI: Mailboxes SharePoint document libraries OneDrive for Business Teams Yammer Groups 5

Reason #2: Office 365 is becoming the leading enterprise and business email system worldwide Email is involved in MOST cases and frequently is KEY evidence Whatever system houses email naturally is a focal point for discovery The email system impacts in part or in whole: Where email is stored How email is stored How long email is retained Whether email is purged on a regular basis How easy or difficult it is to identify, preserve, and collect 6 6

Reason #3: Office 365 is a powerful reflection and amplification of general IT trends Cloud computing: Office 365 is THE quintessential cloud computing platform Massively scalable utility computing IT infrastructure owned and managed by provider (DR, backup, etc. under exclusive control of Microsoft) Apps with rapid development and deployment Social media infused user experience Facebook, Snapchat, Instagram Communicating using acronyms, emoticons, graphics, pictures, video, giphy 7 7

Reason #4: built-in ediscovery and Information Governance tools ediscovery tools: Identification Preservation Collection Processing Analysis Information Governance tools: Retention and disposition Compliance Information Security 8

What is Office 365?

What is Office 365? Suite of Services/Products E-mail, Instant Messaging, Collaboration, File Sharing Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business Cloud Quintessential example of cloud computing Hardware, storage, backup and disaster recovery are handled by Microsoft Software as a Service (SaaS) Individuals, companies, organizations subscribe to the service for a fixed monthly or annual fee 10

Key elements of Office 365 Exchange Online -Email -Calendar -Contacts -Tasks -Notes -Journal -Exchange Public Folders SharePoint Online -Collaboration: Team Sites -Intranet/portals -Blogs/wikis -Application development -Enterprise Content Management -Document libraries -Enterprise file sharing: OneDrive for Business & document libraries Yammer -Enterprise social media: Facebook for the corporation -Groups and communities -Posts: free-text entries, comments, conversations -Upload files (Word, Excel, etc.) -Polls, praise -Like, share, unlike Built-In Information Governance Tools -Retention and disposition -Compliance -Information Security Skype for Business -Instant Messaging (IM chats) -Voice (call logs) -Online meetings -Presence Mashups Applications and tools that are cross-platform and/or built from the ground up in Office 365 --Groups -Planner -Teams Install on up to 15 devices! Office ProPlus -Word -Excel -PowerPoint -Outlook -OneNote -Access -Publisher Built-In ediscovery Tools -Identification -Preservation -Collection -Analytics -Processing 11

Key Elements of O365: OneDrive for Business What is it? Individual file storage tool that competes with DropBox, Box, GoogleDrive Potentially replace My Documents and home-share on file server Technically it s a SharePoint site Access via the web or local copy on user s device ediscovery and IG implications FYI ESI stored in OneDrive for Business is subject to ediscovery tools ESI stored in OneDrive for Business is subject to Information Governance tools Centralized repository reduces need to collect from desktop, laptop, tablet There is OneDrive for Business AND OneDrive consumer OneDrive consumer Consumer oriented service Work with files on local device Provided with certain Office and Office 365 subscriptions but your files are ALSO stored in the cloud 12

Key Elements of O365: Teams Chat oriented collaboration tool with heavy social media influence Each Team has Chat Files (SharePoint document library) Calendar Wiki Team Channels General team Sub-channels to address specific topics Desktop, web, mobile apps Business, Enterprise, Education, NOT Government Is subject to ediscovery tools Retention tools are now available but have limitations 13

Key Elements of O365: Groups What is it? Collaboration tool Each has a: Mailbox Stores messages and conversations SharePoint document library Calendar OneNote ediscovery and IG implications ESI stored in a Group is subject to ediscovery tools ESI stored in a Group is subject to Information Governance tools Centralized repository reduces need to collect from file shares (group, dept., project, etc.) Why are they of interest? Individuals can enable and invite others Upload and create Office files Participate in conversations Emails Calendar (SEPARATE FROM EXCHANGE!) 14

Key Elements of O365: Planner What is it? Collaboration tool Each has a: Mailbox Stores messages and conversations SharePoint document library Calendar OneNote Also includes Planner or Plan, a Microsoft Project lite (very) ediscovery and IG implications ESI stored in a Group is subject to ediscovery tools ESI stored in a Group is subject to Information Governance tools Centralized repository reduces need to collect from file shares (group, dept., project, etc.) Why are they of interest? Individuals can enable and invite others Upload and create Office files Participate in conversations Emails Calendar (SEPARATE FROM EXCHANGE!) 15

Key Elements of O365: Yammer Private social network or Facebook for the company Internal External access is optional Employs concept of Groups Public or private (only group members see posts) Department, project, community of interest Features include: 16 Inbox for messages Post public or private messages File post (upload) Like posts Announcements, Praise Notes (free text) Notifications Follow people User profile Mobile app

Dynamics introduced by moving to Office 365 New content types 17 Conversations and Chat-based communications with emoji, emoticons, Memes, Giphy, etc. Planner Sway New storage locations OneDrive for Business Teams Office 365 Groups Yammer Change Persistent, continuous, and at high velocity Lower bar to deployment Heavy IT integration and configuration is handled by Microsoft Easier to deploy and consume features such as Instant Messaging, collaboration, Information Rights Management, etc.

How does Office 365 work?

How does Office 365 Work? Backend infrastructure resides in Microsoft s data centers Backup and disaster recovery controlled by Microsoft Highly specialized hardware configured specifically for Office 365 19

How does Office 365 Work? Unlike many SaaS applications, Office 365 has a robust locally installed client software component: Office 20

SINGLE OFFICE 365 TENANT SPANNING MULTIPLE GEOS Available geos & services in Multi-Geo GLOBAL GEOS Contoso.onmicrosoft.com 25K Office 365 Users Home: NAM Satellite: EUR & AUS Asia-Pacific Australia Canada European Union (EMEA) India 1 Japan United Kingdom United States (North America) South Korea 1 TO BE LAUNCHED France NAM 15K EUR 5K AVAILABLE SERVICES Exchange Online IN PREVIEW OneDrive for Business IN PREVIEW SharePoint Online IN DEVELOPMENT AUS 5K 1 India and South Korea Geos are currently only available for customers with licenses and billing addresses in those geos

Out-of-the Box ediscovery in Office 365

In a nutshell: ediscovery Features in Office 365 Standard ediscovery (E3) 1. Search across one or more mailboxes, OneDrive for Business, SharePoint sites, O365 Groups, Teams Keywords, proximity, date range, metadata 2. Preserve In-Place (hold) No disruption to custodians they don t know they are on hold No collect or copy to preserve No journaling 3. Preview preserved content Not a review tool! 4. Collect and export Mailbox ESI PST or MSG ODB and SharePoint ESI Native 23

ESI in O365 Exchange Online SharePoint Online Teams Sway -Email -Calendar -Contacts -Tasks -Notes -Files of virtually any type (maximum of 10 GB) -Web pages, such as blogs/wikis -Lists -App data -Chats (group and private) -Calendar -Files (SharePoint Document Library) -OneNote -SharePoint Team Site -Content creation tool -Content itself -Journal *Exchange Public Folders OneDrive for Business -Files created using web apps (Word, PowerPoint, Excel) -Files uploaded (maximum of 10 GB) -Files uploaded can be virtually any type Skype for Business -Instant Messaging (IM chats) -Voice call logs Groups and Planner -Conversations (emails) -Calendar -Files (SharePoint Document Library) -OneNote -SharePoint Team Site -Planner Yammer -Messages -Announcements -Notes -Files -Notifications ****Yammer can now have a Group Subject to builtin tools Not Subject to built-in tools 24

Standard ediscovery workflow Options Boolean, Proximity, Wildcard, date range, metadata Exchange = PST, MSG Mailboxes SharePoint Sites Skype for Business Exchange Public Folders SharePoint = Natives,.csv Groups OneDrive for Business Teams 25

In a nutshell: ediscovery Features in Office 365 Advanced ediscovery (Equivio Zoom) (E5) Advanced Analytics Near-duplicate detection Thread analysis Predictive coding ( relevance ) Themes * Advanced ediscovery E5 Processing: export review-ready load file Includes native files Metadata HTML Advanced analytic values Advanced ediscovery E5 26

Advanced ediscovery Workflow Options Options 1. Create case 2. Assign permissions 3. In-place hold on entire source or scoped 4. Create content search 5. Preview search results 6. Advanced ediscovery Express Analysis 7. Advanced ediscovery Relevance 8. Export loadready data 9. Eyeballs on data Boolean, Proximity, Wildcard, date range, metadata Themes Themes Mailboxes Skype for Business Near duplicate detention Near duplicate detention SharePoint Sites Exchange Public Folders Email threading Email threading Groups OneDrive for Business Predictive Coding Teams E3 E5 Provider Identification, Preservation, Collection Processing, Analysis Review, Production 27

What DOESN T Office 365 ediscovery do out-of-thebox? Legal hold notification and workflow Telling custodians they are on hold and tracking acknowledgements Sending out questionnaires Providing audit trail of when and who is on legal hold Does not identify, preserve, or collect ESI located outside of Office 365-for example: Desktop, laptop, tablet computers File (network) shares Smartphones Full ediscovery processing Review Production 28

ediscovery dynamics introduced by moving to O365 Perform investigation and early case assessment without collection, processing, hosting/review Move away from custodian selfpreservation Stop journaling email Significant process change Where do existing tool investments fit? 29

Out-of-the Box Information Governance in Office 365

Information Governance features: retention and disposition Retain data Delete data Across multiple O365 locations Single or multiple policies Manual or automatic classification Office 365 Tools Data Governance Retention Policies Labels Advanced Data Governance Auto-classification Auto-labeling 31

Data Governance: Retention Policies (E3): retain OR delete based on: Created Last modified (E5): retain or delete based on Keywords Sensitive information types Apply to: Exchange OneDrive for Business SharePoint sites O365 groups Exchange public folders Multiple policies allow for tailoring to department s requirements 32

Data Governance: Labels (E3) Retain-delete based on Created Last modified Date of labeling (E5): Auto-apply labels based on: Keywords Exchange, SharePoint, OneDrive for Business, Groups Sensitive information types SharePoint, OneDrive for Business 33

Data Governance: Auto-Classification Can be used in: Retention policies Labels Auto-classify based on presence of: Key words and phrases Sensitive information types 34

Data Governance: Disposition Review Disposition review options: Apply different label Extend retention period Permanently delete item Based on labels Includes ESI in SharePoint OneDrive for Business O365 Group sites Does NOT include Exchange, Skype, Exchange Public Folders, Group Mailboxes 35

Retention and disposition alternatives Out-of-the-Box SharePoint Records Management In-Place vs. Records Center site Managed Metadata Service, Content Types, Content Organizer, Policies, Document Sets Lacks key features such as event based retention, physical records mgt., Out-of-the Box PLUS 3 rd Party Tool File plan management, auto-classification, event based retention, bulk disposition Enterprise Content Management (ECM) or Enterprise Records Management (ERM) Centralized, integration with multiple repositories, physical records management 36

Data Loss Prevention (DLP) Detects sensitive data and information At-rest and in-motion Based on policy Educates users about sensitive data Reports for compliance, legal, and information governance Conditions If contains PII Actions Restrict access User Notifications Contains PII Currently addresses: Exchange (more robust capabilities for email) SharePoint OneDrive for Business User Overrides Ok to send Reports 37

Supervision Monitor and review messages sent or received by identified users Report on reviewed messages Create lexicon and choose sampling % Built-in review 38

Azure Information Protection Cloud based information protection Classification Manual or automatic Label and marking Information Rights Management (IRM) Two major components: 39 Administrator configuration Client

IG Dynamics introduced by moving to Office 365: what ESI to move? Forklift move? Everything Information Governance cleanup prior to move? Identify Redundant Obsolete and Trivial ( ROT ) data Not subject to legal hold Not subject to legal, regulatory, or business retention Develop criteria (age, author, duplicate, etc.) Identify data subject to legal hold Identify data subject to legal, regulatory, or business retention requirements (records, work in progress, etc.) Document actions taken Approval for disposition What was disposed, when, by whom Information Governance cleanup after move? Move ESI into O365 then turn on policies 40

IG Dynamics introduced by moving to Office 365: adoption Email is typically pushed out to all users, but what gets migrated? Server PSTs Archived email (Enterprise Vault, SourceOne, etc.) OneDrive for Business adoption: Will we adopt? Will it become our corporate standard for user file storage and sharing? Will we migrate home share, My Documents? File shares to SharePoint Online document libraries adoption Will we adopt? Will SPO replace file shares? Will me migrate file shares to SPO? Server PST Archive PC Documents Home Share File Sharing Service Department Shares Public Shares Project Shares OneDrive 41

Licensing

Business and Enterprise Plans Many organizations have a mix of plans Plans and features: https://technet.microsoft.com/enus/library/office-365-platform-service-description.aspx Office 365 for IT Professionals (Fourth Edition) Published by Tony Redmond, Paul Cunningham, and Michael Van Horenbeeck 43

Enterprise Plans 44 Office 365 for IT Professionals (Fourth Edition) Published by Tony Redmond, Paul Cunningham, and Michael Van Horenbeeck

Office 365 Resources

support.office.com 46 https://support.office.com/en-us/article/security-and-compliance-in-office-365-for-business-admin-help-7fe448f7-49bd-4d3e-919d-0a6d1cf675bb?ui=en-us&rs=en- US&ad=US

docs.microsoft.com 47 https://docs.microsoft.com/en-us/microsoftteams/teams-overview

TechNet https://technet.microsoft.com/en-us/library/dn532171.aspx 48

Trust Center https://products.office.com/en-us/business/office-365-trust-center-cloud-computing-security 49

Excellent Reference http://store.exchangeserverpro.com 50

Video blog 51 https://www.youtube.com/playlist?list=plxpr7gfummkwn422hmcx7b7d5qh9t6frb

Roadmap https://products.office.com/en-us/business/office-365-roadmap 52

Microsoft Ignite To access free recorded sessions go to: https://www.microsoft.com/en-us/ignite/default.aspx Annual conference 20k+ attendees Major product announcements Roadmaps ediscovery sessions with Microsoft experts, including E.J. Bastien and Rachi Messing Reduce legal fees and gain insight into your data leveraging Office 365 Advanced ediscovery How Microsoft Legal drives down ediscovery costs with machine learning in Office 365 Quickly find what s relevant and reduce risk with intelligent ediscovery in Office 365 53