InfoGovANZ

Legalweek NYC 2020 – the Down Under Perspective

February 18, 2020 by InfoGovANZ

New York City

Legalweek 2020 brought together thousands of legal professionals to discuss business, regulatory, technology and talent drivers impacting the industry. The week featured workshop boot camps, conferences, networking events and hundreds of technology exhibitors on the tradeshow floor. There are three main conferences: Legaltech (the world’s longest running legal technology trade show), LegalCIO, and Legal Business Strategy. Around the main conferences there are many other events, a few of these are highlighted below. The following week The Sedona Conference’s International Working Group 6 annual program focusing on cross-border discovery and data privacy held at the New York Law School.

AI and Privacy

This year’s Legalweek in New York City was dominated by the themes of AI, new and developing technologies and privacy. The impact of privacy regulations, particularly the GDPR and the California Consumer Privacy Act (CCPA) is driving up compliance costs and also the cost of discovery in legal proceedings. It is also leading to the development of eDiscovery technologies designed to identify protected information in order to redact or de-identify it in legal proceedings.

The AI bootcamp workshop included discussion about finding uniformity and standardisation of AI. While many countries and professional associations are issuing AI and ethics guidelines, the challenge of standardisation and implementation need to be addressed. From the legal perspective the challenges within AI, such as unconscious bias, are significant. These require both guard rails and a diverse range of appropriately skilled personnel to be involved in data projects involving AI. In several sessions, the importance of Ethics Councils for AI and Information Governance Councils to govern data and information were a feature of discussions.

LegalWeek AI & Privacy Presentation

Blockchain

One of the keynote presentations was by Bettina Warbug who is a blockchain researcher, entrepreneur, and co-author of the book, ‘Basics of Blockchain’. A political scientist by training, she has a deep passion for the intersection of politics and technology (you can view her TedX talk here -https://www.ted.com/speakers/bettina_warburg). Bettina highlighted that in the future everything that can be done digitally will be reimagined on blockchain. This will extend reimagining of physical assets as digital twins on virtual machines. Bettina explained that blockchain in transforming the economy will require machines moderated by both context and rules. According to Bettina Warburg, the ways in which blockchain will impact the law include:

Code as law or machine arbitration. This includes smart contract languages, blockchain virtual machines, machine learning systems, and algorithms for machine based arbitration in autonomous software stack.
Compliance innovation where there will be real time compliance audits for any given stat to ensure regulatory requirements are observed, and smart assets that can automatically comply based on the stateful context and rules relevant to them.
eDiscovery and mutable records. Blockchain will provide new ways to comply with privacy regulatory developments, while also maintaining the benefits of a stateful and persistent network.

Impact of privacy laws on eDiscovery

The Judges Panel at Legalweek together with other sessions dealing with cross-border discovery highlighted the challenges of new privacy regulations for document production in litigation and regulatory investigations. The takeaways from the Judge’s Panel and the 5th Annual Exterro + EDRM survey of some 260 U.S. Federal Judges are:

Judges want to see greater e-discovery participation from in-house legal teams.
New data privacy laws will make e-discovery more expensive.
Bad faith and poor communication are the leading causes of sanctions. Parties are getting sanctioned for (mostly) intentional e-discovery misconduct.

There was an excellent panel discussion on strategies to overcome the conflict of laws in eDiscovery led by Daniel Meyers - Transperfect Legal Solutions, James Sherer – Baker Hostelier, Emily Fedeles - Colgate Palmolive and Katie Perekslis - Transperfect. This panel discussed the challenges of irreconcilable priorities when managing data flows in legislation and investigations. Discovery obligations often conflict with privacy regulations, blocking statues, bank secrecy laws and state secrecy laws. The discussion included strategies to overcome the conflict of laws including implementing data minimisation as required by the GDPR, CCPA and Australia’s APPs, which is part of good information governance, as well as on site processing and reviewing of data. Explanations were provided of the different technology tools that can be used to identify and redact personal data.

Key tips from this presentation included:

Think strategically from the outset. Early identification of discovery obstacles and issues allows a party to manage the discovery process more effectively.
If discoverable data is subject to foreign data protection laws, understand what exceptions may be available to enable transfer, and consider involving local counsel.
Assess what can be done abroad to minimise conflicts – this may include setting up a temporary cloud in the foreign jurisdiction, local data processing and/or review, and using technology to redact non-essential protected information to achieve compliance with foreign regulations and meet eDiscovery obligations

Another excellent session was on the impact of collaboration and the use of mobile devices with Robert Cruz, Jonathan Rudolph, Gregory Breeze all of Smarsh and Anthony Diana of Reed Smith.

The increasing use of platforms such as Slack, Microsoft Teams and Zoom presents challenges for both record retention and discovery. The key for organisations is to understand the risks that these platforms present when confronted with a regulatory investigation or the need to preserve and produce data for discovery for legal proceedings. Organisations can then evaluate these risks in order to weigh work and project collaboration convenience against regulatory compliance obligations, eDiscovery burdens, and archiving and perseveration challenges.

Emojis – communication

The increasing and accepted used of emojis in business contexts is giving rise to a new critical risk element in corporate communications. In particular, it provides new challenges in the discovery process, to ensure that all relevant documents including emojis are identified and produced. The session also discussed emerging technology that helps to target risky communications containing charged words and emojis.

A very interesting overview was provided of the leading cases where emojis had been considered in judgments. The graph below shows the significant increase of emojis in court opinions in the US in the last few years.

Information Governance

While a number of sessions were dedicated to the role of Information Governance, it was interesting to see how the continuing development of emerging technologies highlights the need for robust information governance. As noted above, a significant driver is data minimisation as a result of recent and anticipated privacy regulations, including the GDPR and CCPA. In the collaboration and mobile device session referred to above, the point was made that -

It all starts with Good Governance

The importance and role of an Information Governance Council or Committee was raised in a number of sessions dealing with technology challenges as well as in sessions where IG was front and centre. The existence of a cross-functional committee which meets regularly and discusses use cases is key. The Smarsh panel discussion emphasized that the focus needs to be on the entire organisation when evaluating use cases and not limited to isolated areas. The increased awareness around data risk in relation to privacy laws, regulatory compliance and reputational considerations highlighted the need for enterprise-wide Information Governance. This should include accountability measures and sanctions for those employees (including senior executives) who don’t follow policies and procedures.

Nick Inglis and Ann Snyder from ARMA gave a terrific presentation on ARMA’s IG model and the underlying work they are undertaking to build out the model to provide a comprehensive guide to members on Information Governance for 2020.

Ari Kaplan’s Legalweek 2020 podcast

You can also listen to leading legal industry analyst, Ari Kaplan’s podcast mixtape from a variety of over 25 legal industry leaders perspectives recorded during Legalweek 2020 at https://lnkd.in/dkANsJs. From down under it includes Rod Vawdrey of Nuix, Tineke Mann of TIMG and Susan Bennett of InfoGovANZ.

Other events and networking

Legaltech is a great week as everyone is in the one place, all the leading experts, together with technology providers. Many are from all over the world, who all have perspectives of how legal technology is impacting the delivery of legal services. It is great to share experiences and discuss issues, while catching up with the latest technologies and trends. There are many events both in and around Legalweek where you can catch up with colleagues and network with industry peers. A few of these are highlighted below.

Commonwealth Brunch and Super Bowl

Our week kicked off with the traditional Sunday Commonwealth Brunch in the famous Tavern in the Park. Special thanks to James MacGregor of Consilio LLC, Matthew Geaghan of Nuix, and Amit Pandit of Apt Search & Selection for organising and continuing this great tradition started by our late dear friend Nigel Murray to start LegalWeek. Chris Dale was also missed - we wish him a speedy recovery and look forward to his return next year’s event. This is our photo from last year – a photo from this year is attributed to my jet lag oversight!

The NFL Super Bowl took place on the Sunday night and many thanks to Jo Sherman – EDT and Oscar Bleetstein who hosted us a gathering at home complete with celebratory cake. The Kansas City Chiefs won the Super Bowl defeating the San Francisco 49ers 31-20.

EDRM receptions

One of the highlights from Legalweek is the announcement of our affiliation with EDRM as an Industry Alliance Partner. Since 2005, EDRM has delivered leadership, standards, best practices, tools, guides and test datasets to improve best practices throughout the world, including its Electronic Discovery Reference Model (EDRM). The photo below shows Judge Peck (ret) and Wendy Axelrod at the second EDRM cocktail reception – each of these events had over 300 people in attendance.

Consilio Reception - Rainbow Room

A highlight was attending iconic Rainbow Room for Consilio’s Legalweek event. Thanks to Mark Garnett of Consilio LLC (pictured below) and to James MacGregor and Matthew Geaghan for taking the photo below as well as their selfie.

The Sedona Conference WG6 at New York Law School

Legalweek was then followed by Sedona’s international WG6 annual program held at New York Law School. But first, and in between conferences, there was Saturday night in Brooklyn with dinner at DUMBO with its stunning view of New York city skyline.

The Annual Sedona WG 6 meeting was held at New York Law School in Tribeca where Dean Anthony W. Crowell welcomed us. A number of Sedona draft publications were considered at the meeting, including the APAC eDiscovery Overview paper, which has been in development over the past 18 months by the WG6 APAC committee.

The Judges panel below with their Hons. Michael M. Baylson, James C. Francis IV (ret.) and Kimberly C. Priest Johnson, moderated by Ken Withers, provided an update on cross-border discovery and disclosure case law. I participated on the cross-border discovery and investigations and data protection laws updates panel, addressing recent significant developments in the APAC region with new privacy laws and regulations in a number of countries. On this truly global panel, I was joined by Karyn Harty - McCann Fitzgerald (Dublin)who spoke on the hot topic of Brexit and the ensuing uncertainty of the UK’s position in relation to data transfers. Dino Wilkinson - Clyde & Co (Abu Dhabi) outlined emerging data protection laws and considerations throughout the Middle East region, Jerami Kemnitz - Littler Mendelson (Minneapolis) - Littler Mendelson (Minneapolis) providing an in-house perspective. The panel was moderated by Denise Backhouse, Littler Mendelson (New York). Dialogue also centred on the differing impact of the GDPR in the various regions and the issue of harmonisation of global data protection laws.

In conclusion

The key takeaways for Legalweek 2020 included:

New ways of communicating and working (e.g. using Teams, Slack and emojis) present significant risks and challenges for organisations for record keeping obligations and eDiscovery.
Emerging and developing collaboration and communication technologies present challenges in discovery and document production processes and are driving up costs. However, new eDiscovery tools are being developed to address these issues.
Over-retention of data increases overall risks and costs, including privacy breaches and eDiscovery burdens.
Organisations need to be more proactive in implementing information governance to anticipate eDiscovery obligations and build in privacy by design and default. Technologies are developing to help meet compliance needs, including automated contract review applications.
Organisations need to have in place justifiable data retention and disposal policies, which are implemented and updated on a continuing basis.
It all starts with good governance - now more than ever, organisations need to implement robust enterprise-wide information governance to optimise the value of data as well as minimise the risks and costs.

Rapid developments in technology will continue to change the way in which legal services are provided and more significantly impact the way in which society functions. The role of law and the responsibilities of professionals providing legal and technology services are more important than ever. The opportunities to view the latest developments in technology and to hear and discuss trends as well as network makes for a great trip to New York City.

Special thanks to Denise Backhouse – Littler, Jo Sherman – EDT, Oscar Bleetstein, Taylor Hoffman – Swiss Re, Andrea D’Ambra and David Kessler from Norton Rose, Peter Baumann – Active Navigation, Wendy Axelrod, David Rohde – Epiq, Anthony W. Crowell – New York Law School, Ari Kaplan, Paul Muller, Matthew Geaghan, Enzo Liscotti, Simon Barnier and the team from Nuix, and Mark Garnett, James MacGregor and the team from Consilio LLC.

Author: Susan Bennett, Principal Sibenco Legal & Advisory, Co-founder InfoGovANZ

Information and Data Governance Driving Interoperability

February 17, 2020 by InfoGovANZ

Achieving interconnected services, sharing and re-using information and data assets requires strategic planning and investment. The Data Interoperability Maturity Model (DIMM) is the latest advice from the National Archives of Australia for building interoperability under the Digital Continuity 2020 Policy. It highlights the importance of information and data governance to drive interoperability initiatives.

The Director-General of the National Archives of Australia, David Fricker stated, ‘it is often said the data is the ‘oil’ of the 21st century, because in the future data will be the principal resource that drives our economy and our way of life. Just like oil, data has to be properly managed. It must discoverable, and of sufficient quality – pure, authentic and reliable – to drive the processes that rely on it. Unified information and data governance empowers an organisation to align its interoperability objectives while balancing associated risks.’

The DIMM’s downloadable assessment tool helps your organisation assess its current state of interoperability and plan to build the level of maturity they need.

DIMM follows an Interoperability Learning Resource that was released in early 2019, where you can learn about interoperability development phases and some typical scenarios to resolve common interoperability hurdles.

If you would like to discuss this work further please email the National Archives’ Agency Service Centre.

Automated Speech Recognition

February 17, 2020 by InfoGovANZ

While Automated Speech Recognition (ASR) technology has been present in various forms for decades, advances in statistical modelling, artificial intelligence (AI) and automation connectively have resulted in a new frontier for speech-based interaction between humans and computer systems. In this article Dr Peter Chapman, Director in the KPMG Forensic Technology team and InfoGovANZ advisory board member, details some of the current applications of ASR technology and offers guidance on a number of emerging governance issues associated with these technologies.

As a concept, computerised Automated Speech Recognition (ASR) has been around almost as long as the computer itself. However, only in the last decade have the capabilities of ASR technology reached the point where wide-scale commercial adoption is viable¹. Natural human speech contains slang terms, dialect peculiarities, abbreviations and other “non-standardised” content. While humans are very adept at managing these issues, the enormous variability of human speech makes ASR a very complex and difficult task for a computer. Being able to accurately identify and interpret natural human speech requires a combination of complex statistical methodologies, such as hidden Markov models which divide detected speech content into small sections for analysis, and artificial intelligence/machine learning techniques, such as neural networks which are processing environments that simulate human learning by comparing newly observed data with known examples².

In particular, advancement in AI capabilities have allowed ASR technologies to rapidly improve the speed of speech analysis and also reduce the word error rate (WER) of transcription – being the ratio of word errors to total words processed. Despite these advances, many difficult to control external variables exist which generally reduce ASR quality in real world environments to lower levels of accuracy when compared with human transcription³. Factors such as speaker age, background noise, accent, volume, pitch and tempo as well as variance in language structures can cause higher than acceptable false positive and false negative errors, can all affect the viability of ASR applications.

It is also worth noting that the advent of ASR technologies means that we are now entering a new era of heightened surveillance, sometimes by our own choice. While there may a certain level of acceptance regarding certain kinds of surveillance in public spaces and the workplace, it is an entirely different thing for individuals to install Internet-connected “listening devices” in their homes. While some may have actively weighed up the convenience and functionality provided by the devices over their privacy or security concerns, many others may have little appreciation of the potential risks involved.

ASR technology is also likely to have a significant impact on privacy outside of the home. While the capacity to record conversations in workplaces, retail spaces and other public places has existed for many years now, we now have the means to quickly and accurately transcribe the content of recorded conversations, and then apply advanced analytics and identification technologies to that transcribed content. To safeguard privacy and minimise ethical abuses of these technologies, it will be vital for governments to implement carefully considered legislation and appropriate industry bodies to provide sound ethical guidance.

Leveraging AI and Automation

While many of the earliest implementations of ASR technology were simple transcription applications, modern ASR applications often focus on using voice as the method for direct interface with an application or system. Such functionality still effectively requires the same processing and conversion of speech to text; however, it is the automation aspects and capacity for two-way voice interaction with technology that has enabled modern applications of ASR technology to leap forward.

Probably the most widely known example of device-voice interaction is Siri, the virtual assistant application associated with Apple devices. Initially developed as a third party application in 2010, Siri was purchased and integrated as a core iOS feature to assist users activate and interface with various phone functions and search the Internet⁴. An early leader in the “virtual assistant” field, Siri was joined over time by a range of competing consumer applications such as Amazon’s Alexa, Google Assistant, Microsoft Cortana, Samsung Bixby as well as a raft of lesser well known virtual assistants.

While the core interface functionality offered by virtual assistants is undoubtedly useful, a further fascinating aspect of these assistants is the voice feedback provided to the user following the initial, establishing an interactive conversation between human and machine. The capacity to interact with a machine through such a natural communication method (as opposed to pressing keys) creates a scenario with potentially significant psychological, cultural and ethical impacts. These issues have attracted interest in both academic⁵ and social culture – one of the more notable fictional explorations being the interactions between Dr David Bowman and the AI HAL-9000 in the science fiction movie “2001:A Space Odyssey”.

Commercial Applications

In addition to virtual assistants, smart home devices and automation hubs link ASR technology with various electronically controlled home and workplace systems. Some of the more common systems linked to home and workplace automation hubs include lighting, audio-visual equipment, heating, air conditioning, cameras and security systems. As mentioned above, society is still in the process of weighing the efficiency benefits and privacy impacts of this technology, however there are a number of other novel applications of ASR technology that demonstrate both the benefits and risks of voice interaction with systems and devices.

Conversational AI for Customer Service

For some time now, organisations have applied ASR technology to assist with service call direction and providing basic information to customers over the phone. Organisations have also been able to deploy AI agents to provide interactive service conversations when potential customers visit their webpage. The combination of these two technologies will allow customers to interact with “smart” AI agents who will be able to manage increasingly complex service and assistance conversations over the phone or an audio conference call.

AI agents are invariably cheaper, more consistent and constantly available, although there is still a certain stigma associated with relying on automated systems rather than human service agents. Conversational AI still has a long way to go if the Turing test (being able to hold a conversation that is indistinguishable from one with a human) is the standard that must be reached. However, as ASR and AI technology improves, customers may find interacting with an AI service agent quicker and easier than a human one regardless of whether the customer can determine whether they are dealing with an AI agent or a human one.

Conversation analytics and monitoring,

We have now reached the point where processing power and AI optimisation mean that recorded conversation content can be transcribed and analysed at almost real-time speeds. This provides the opportunity for service agents to have a live feedback loop on the conversation with the AI analysing conversation content to providing insights on how best to assist the customer as well as guidance on customer tone and mood⁶.

Real-time conversation analytics are also very useful in a monitoring and compliance capacity. “Red flag” and atypical words and phrases are analysed automatically by the AI, raising the alert with the organisation’s compliance function when necessary. The compliance capacity of ASR and AI technology is of particular interest in the regulatory technology (“RegTech”) space, with ASIC and other regulators strongly backing the increased use of real-time ASR and AI driven technologies for monitoring trading room conversations as well as other relevant financial advice/transaction conversations⁷.

A further innovative use of “real-time” ASR and AI technology is live translation between different languages. Similar to the “universal translator device” popular in science fiction series such as Star Trek, real time translation applications theoretically provide the capacity to speak in one language and, within seconds, have this speech converted and played back in one or more different languages⁸. While this technology still has a way to go before it becomes flexible and accurate enough to replace human translators, the potential social and commercial benefits of this application of ASR technology are boundless.

Medical and expert system applications

ASR technology used for speech to text translation is already in common use in the medical field due to the advantages of being able to convert voice to text on the fly while the practitioner’s hands are otherwise occupied. In recent years, more specific applications of ASR technology has in more advanced applications of ASR technology are being explored including in speech pathology treatments where patients are able to utilise a tablet computer as a supplementary treatment in speech rehabilitation programs. Early studies examining the use of this technology have found significant positive patient outcomes⁹.

While AI technology has not yet reached the point where it can reliably outperform human experts in most tasks, it has become powerful enough to assist human experts carry out certain tasks more efficiently. Much like home automation systems taking care of domestic tasks, a combination of ASR and AI technology can assist a pilot in charge of a complex aircraft by managing less critical functions through the use of voice commands and automation¹⁰.

Biometric identification & security applications

Voice print biometrics, also referred to as specific speaker recognition, is a related but distinct process to ASR. Rather than focusing on converting speech content to text form, voice print biometrics seek to identify and/or verify the identity of a particular speaker. This is achieved by braking the recording voice into segments, also referred to as formants, which undergo tonal analysis in order to generate a unique voice print¹¹.

Voice print biometrics lend themselves to security applications in a similar way to fingerprint or iris biometrics. Voice pattern recognition is becoming increasingly common for access control, both in commercial and residential applications, although the technology implementation has not been without difficulties.

ASR and voice print biometric technology can also assist in criminal investigations. Much like fingerprint patterns, voice print patterns can be used on a comparative basis to identify persons suspected to be involved in criminal activity. A notable example of this approach is the voice print identification database Interpol deployed for use in 2018 to assist with the tracking of criminals¹².

Risks when Adopting ASR Technology

While these applications provide the potential to improve process efficiencies, compliance, oversight, and functional performance in general, there are also increased risks and possible downsides associated with the implementation of these new technologies.

Even when operating normally, ASR home automation and virtual assistants collect enormous amount of personal data about their users¹³. This fact, considered alongside reports of somewhat “cavalier” attitudes towards the usage of collected data by “big tech”¹⁴ and the numerous reported incidents of personal privacy and data security breaches associated with the use of ASR virtual personal assistants¹⁵, the potential privacy and security consequences of having an Internet-connected listening device within the home cannot be understated.

As the uptake of ASR technologies in the workplace increases, questions of how to secure recorded voice data and the inherent privacy issues associated with the process are also of increasing relevance to organisations. Data collected by ASR technologies especially during customer interactions, has a high chance of containing personally identifiable information (PII) or other confidential information that requires protection. Data breaches caused by accidental user activation, automation following incorrect ASR translation, software glitches, the device being compromised by a malicious actor, or even a simple case of the product/application transmitting confidential data back to the manufacturer as part of an inbuilt “product enhancement” function may result in a notifiable breach of international or national regulations¹⁶.

While the stated purpose of workplace monitoring is generally to prevent unethical or illegal behaviour, the actual result of implementing a monitoring solution may have the opposite effect. Implementing ASR-based surveillance applications in the workplace, particularly if it is not expressly required by regulation, may indicate that the organisation distrusts their employees. This in turn may provoke negative reactions and result in reduced morale. Employees may become disengaged or find “work-arounds” to avoid the surveillance, introducing additional ethical and risk issues. Constant surveillance in the workplace may also lead to a compliance-focused culture, restricting innovation and flexibility in the workplace¹⁷.

Finally, when ASR results are just used for transcription purposes, the worst-case scenario is a set of unusable text. Conversely, when poor ASR results are used to automate systems the consequences can range from trivial (e.g. a misdirected phone call or inaccurate Internet search) to critical (e.g. an inaccurate voice pattern analysis on a biometric security control allowing access to a non-cleared person or poor quality ASR in law enforcement identifying an innocent conversation as containing red flags for terrorist activity). It follows that appropriate quality control and verification procedures are applied to any critical processes that rely upon ASR data.

Takeaways for Information Governance Professionals

Be alert to proposed or actual implementations of ASR technology in your organisation. Ensure that a comprehensive due diligence assessment of the technology, including capabilities, benefits and risks is undertaken prior to implementation. Where ASR technology may be used (either directly or indirectly) as part of workplace surveillance it is highly recommended that organisations obtain and act on employee feedback as part of this due diligence process.
Once implemented, ensure there is clear knowledge of what ASR data is being collected, stored, processed and disseminated by your organisation. As with other forms of data owned by the organisation, ASR data needs to be classified and secured with appropriate controls. There should also be a clear data lifecycle for this information that identifies when and how the ASR data is destroyed. This is particularly important if there is the possibility for personally identifiable information (PII) to be collected and transcribed during customer calls or other ASR capture activities.
Organisations should ensure that any surveillance and/or recording of employee activity complies with necessary state, federal and international regulations and requirements (e.g. the Workplace Surveillance Act in New South Wales). Additionally, organisations should ensure that both employees and customers are aware of any ASR recording that takes place and provided with avenues to seek further information and provide feedback.
In all cases, Australian organisations should be encouraged to assess their use of ASR technologies with reference to the Australian Privacy Principles to ensure that the organisation approaches the use of ASR data with a conscious focus on the security and ethical issues that may arise from the adoption of this technology.

Dr Peter Chapman is a Director in the KPMG Forensic Technology team and and advisory board member of Information Governance ANZ.

Footnotes

https://en.wikipedia.org/wiki/Speech_recognition – viewed 27 Jan 2020
https://www.rev.com/blog/artificial-intelligence-machine-learning-speech-recognition – viewed 27 Jan 2020
https://towardsdatascience.com/speech-recognition-is-hard-part-1-258e813b6eb7 – viewed 4 Feb 2020
https://en.wikipedia.org/wiki/Siri – viewed 4 Feb 2020
Computers that care: investigating the effects of orientation of emotion exhibited by an embodied computer agent, Brave et al 2005, International Journal of Human-Computer Studies.
https://www.nice.com/engage/real-time-technology/real-time-speech-analytics/ – viewed 3 Feb 2020
https://asic.gov.au/about-asic/news-centre/speeches/asic-regtech-voice-analytics-symposium/ – viewed 4 Feb 2020
https://medium.com/syncedreview/google-ai-translatotron-can-make-anyone-a-real-time-polyglot-e7b6d616f5d2 – viewed 5 Feb 2020
Feasibility of Automatic Speech Recognition for Providing Feedback During Tablet-Based Treatment for Apraxia of Speech Plus Aphasia, Ballard et al. 2019, American Journal of Speech Language Pathology
https://aerospaceamerica.aiaa.org/departments/fly-by-voice/ – viewed 5 February 2020
https://www.globalsecurity.org/security/systems/biometrics-voice.htm – viewed 27 January 2020
https://theintercept.com/2018/06/25/interpol-voice-identification-database/ -viewed 29 January 2020
https://www.theguardian.com/technology/2019/oct/09/alexa-are-you-invading-my-privacy-the-dark-side-of-our-voice-assistants – viewed 3 February 2020
https://www.washingtonpost.com/technology/2019/05/06/alexa-has-been-eavesdropping-you-this-whole-time/ – viewed 3 February 2020
https://www.bloomberg.com/news/articles/2019-04-10/is-anyone-listening-to-you-on-alexa-a-global-team-reviews-audio – viewed 3 February 2020
https://www.oaic.gov.au/privacy/notifiable-data-breaches/when-to-report-a-data-breach/ – viewed 4 February 2020
https://behavioralscientist.org/the-paradox-of-employee-surveillance/ – viewed 4 February 2020

Information Governance 2020

January 28, 2020 by InfoGovANZ

The Information Governance 2020 Roundtable took place on Monday, 18 November at the Governance Institute of Australia. The event covered highlights from the recent InfoGovANZ Survey Report, privacy developments and trends globally, the new ISO working group developing an Information Governance standard, and the new records management cloud-based system utilising machine learning at the Australian Human Rights Commission. There was a great turn out of members, sponsors and interested parties for a fantastic session covering a broad range of IG topics.

Executive Director, Susan Bennett started the ball rolling with a summary of valuable insights from the most recent InfoGovANZ IG Survey Report, noting the trend towards improved Information Governance awareness and leadership recognition since our 2017 survey. Just over half of the organisations surveyed have an formal IG framework with clearly articulated policies and procedures. 90% of respondents expressed agreement with the definition of ‘information governance’ – although some had commented on the definition and whether governance extended to activities traditionally associated with ‘management’ of data and information. The survey results also indicated a growing trend of privacy concerns and regulatory changes driving IG projects.

Susan explained the meaning of the InfoGovANZ logo, highlighting the complexity, breadth and interconnectivity between each of the Information Governance domains. She spoke about the essential role data and information plays in the overall health of the modern enterprise. Likening high quality, fit-for-purpose data and information to the ‘lifeblood’ of the organisation, she described each element of the Information Governance landscape and explained the logic and relationships between the IG domains illustrated and explained in the recent publication available here.

Building from the strong foundations of clear policies and procedures to the development of robust IG processes which enable value creation and risk minimisation to foster data-enabled innovation and the ability to respond to the constant changes in markets and environments. Susan also called out the essential role IG professionals play in creating the right strategic data and information direction for organisations. She emphasised how none of benefits of new technologies can be fully realised without the right people with the right capabilities being engaged in developing an organisation’s IG approach. From Susan’s presentation the audience, which was drawn from across the broad spectrum of IG practice domains, gained valuable insight into the essential function of each different IG domain area in the IGANZ logo to build on, or enable, the next group of activities to form the complete enterprise-focussed Information Governance strategy required by modern organisations.

Stephen Bollinger, Country Leader for IAPP, Chief Privacy Officer of Cochlear and soon to be General Manager, Privacy & Ethics at NAB, provided the audience with some key takeaways from the recent IAPP Summit including some of the trends in global regulatory approaches and collaboration. Stephen noted the important contribution made by New Zealand’s Privacy Commissioner, John Edwards in his keynote highlighting the growing concerns over the power asymmetry between big tech companies, their customers and the regulators tasked to oversee them.

Stephen also detailed his views on the direction privacy regulation is heading, providing great real-world examples of how different national and international regulations are providing guidance ranging from general privacy principles through to strict mandatory requirements. He noted the increasing collaboration between regulators across jurisdictions to design more consistent and interoperable privacy regimes. For example, the ISO Standard 27701 for privacy which was ratified in August, will include a mapping of various requirements such as the Australian Privacy Principles, GDPR and others. You can access the keynotes of the ANZ Privacy Commissioners from the recent IAPPANZ summit here.

Some wonderful insights into the development of ISO standards were provided by May Robertson from Sydney University. After explaining the true origin of the term ISO (hint – it isn’t an acronym), May explained to the audience how the working group for the new ISO Information Governance Standard TC46 WG13 is using global collaboration to inform the content of the emerging Standard as well as a brief summary of the intended content of the Standard. She noted it will not be a ‘management standard’, which will enable quicker delivery. The project started in July with an 18month timeline for completion. The new standard will be informed by the ISO 9000 series of standards on quality management, the ISO 27000 security series, ISO 15489 and ISO 30301 standards for records management. It will provide a formal definition for Information Governance, key terms and concepts. May couldn’t go into detail as it is still ‘early days’ yet but we will be watching this space with great interest as this significant Information Governance resource takes shape!

Ryan McConville, who recently lead the implementation of the Australian Human Rights Commission’s (AHRC) new O365 cloud-based information management platform ‘RADICAL’, finished up the session with a very engaging hands-on presentation about the implementation journey for RADICAL. Ryan provided some great context, contrasting the before and after pictures of AHRC information management, and describing some of the challenges his team faced to modernise AHRC’s information and records management approach.

Ryan followed up with a fascinating mini-tutorial on machine learning, auto classification and how it has been applied to great effect in RADICAL to minimise the business user intervention required for effective records management. RADICAL is using AI-enabled auto-classification of documents to augment information management activities, speed up business processes and automate retention and disposal classification to realise greater information value from the Commission’s documents and data. Ryan emphasised the level of effort and significant input required from an organisation’s records managers to develop and train these tools, in order to provide this light touch or ‘transparent’ records management, which is largely invisible to the business user.

This is session will be available as a webinar – if you were unable to attend and would like to be notified when it is available please email info@infogovanz.com and/or join to become a member (it is free) at https://www.infogovanz.com/join .

Article by Dr Peter Chapman, Carol Feuerriegel, Sonya Sherman

Social Media Perils in Litigation – InfoGovANZ

January 23, 2020 by InfoGovANZ

In this InfoGovANZ event, the implications and dangers of the widespread use of social media and apps were highlighted in their evidential value in investigations and litigation. The importance of technical and forensic expertise in the discovery process was demonstrated by reference to particular cases and technology tools by Brett Webber, Principal, ConsilAD and Matthew Golab, Director of Legal Informatics and R&D at Gilbert + Tobin. Susan Bennett, Executive Director InfoGovANZ and
Principal, Sibenco Legal & Advisory discussed the duties of technology competence and confidentiality, which extends to cybersecurity to protect client information and the implications of a recent High Court decision.

Social Media Perils

As Michael Tieu, posted on LinkedIn following the event, ‘[i]t was truly astounding to see how important it is to be wary of who, what, when and where you post on social media. Once the genie is out of the bottle, it’s nearly impossible to put it back inside. Information governance is as important as ever with the continuing incorporation of social media in our daily activities.’ Brett Webber who has worked on more than 2,000 matters involving social media discovery alone, took us through some of his cases to demonstrate how evidence can be gathered from social media including social media of other people. As Brett says, ‘how social media is found and technically managed can determine winners and losers in cases.’ This requires technical expertise to find probative material and being able to show the meaning within data collections.

Brett discussed his experiences with social media and litigation answering with the questions, ‘what’s out there?’. The volume of relevant data in freely available the public domain is often counter-intuitively high.

Finding relevant data for litigation / discovery

Social media discovery frequently draws upon tools and techniques honed by Open Source Intelligence (“OSINT”) practitioners. These techniques involve combining sources or data to form a coherent profile of a target or subject. In addition to finding sources of data authored by a party to litigation, it is normally productive to collect material posted “about” the subject (think of items posted by a third party which include a photo of a person, but without a tag or other element which can be controlled by the subject of the photograph). So even where people are cautious of their own online activity, relevant data are often posted by accounts outside of the subject’s possession, custody or control.

Searching for data using tags, hashtags or words is increasingly ineffective when social media includes pictures or videos without tags or text. Other search and analysis techniques such a location or social connection are required. These approaches require consideration of metadata.

Social media platforms are designed to share data not to keep it private. Social media account “privacy” controls or settings are unlikely to protect data in the long-term. The visibility of data in most social networks is dynamic, for example interactions with other users through an item being liked, commented upon, reposted serve to increase the public visibility of any posted item.

Breach data such as the Paradise Papers and Ashley Maddison are increasingly being indexed and made searchable. Even if the breach data contents are not suitable or useable as evidence, the very existence of such data which is connected to a targeted individual can be informative. For example, it can show interests and hobbies (e.g. online dating) interactions with businesses, real-world activities, ownership of an account or connection to third parties or a place.

Data linking or “pivoting” techniques increasingly benefit from access to commercial data sources such as government land and property or licensing information. Consideration of these sources with social media data can often provide deep insights.

Collecting OSINT as Evidence

Forensic tools offer particular advantages for litigation-related matters. Speed, rigour, completeness and the ability to demonstrate compliant collection methods are all important considerations. The importance of this is increasingly reflected in emerging bodies of legislation and rules such as the US’ Federal Rule of Evidence 902 (14).

When providing evidence, it is very important to be able to show understanding of the “back story” (context) in the matter and how the information will be used. If any of that would need to be defended in Court and it may be prudent to engage a forensic expert to assist with a defensible collection.

Social media publication methods continue to change very quickly, necessitating a broad portfolio of data search and collection approaches. Examples of changes and the needed adaptation of collection methods include Facebook’s anti-scraping controls, Instagram and LinkedIn’s Application Programming Interface (“API”) restrictions and an increasingly relevant set of social media data which is not accessible from either web-browsers or APIs but which can only be accessed using mobile devices. Some of these changes have been reactions to highly publicised matters such as the exposure of Cambridge Analytica’s methods.

Methods of data collection commonly used include:

1. APIs or data feeds from social or other databases.

2. Web-scraping.

3. Commercial data aggregators.

4. Mobile devices (physical or virtual).

Sound forensic methods should show how any data was accessed, how it appeared in its original context and that the resultant data collection hasn’t been tampered with or altered in any way. Attendant metadata should also be collected and able to be explained – showing the relationship of data, sequence of messages and originating author.

Compelled discovery

Most of the discussion above relates to investigation aka informal discovery. The identification of accounts and ability to demonstrate relevance and that more data can be collected at reasonable cost are often strong supports for discovery applications where the non-public elements of social media accounts are sought. For this and for law enforcement liaison requests, forensic methods which identify account details such as a number rather than a name enable efficient and precise collection.

The Sedona Primer on Social Media also addresses the limitations of self-produced data such as Facebook’s Your Data.

An eDiscovery Perspective – Social Media is different to email

Although metadata is quite important in typical eDiscovery which involves emails and documents, social media metadata from the social media platform can be as important as the actual content of a message. For example, in typical eDiscovery, when an email is sent, you have some rudimentary metadata including:

Date and time sent; sender; recipient; subject; content of message

Social media typically has much more extensive metadata. For example, you may take a photo with your phone camera which has the location (GPS coordinates) added to the photo. You then share the photo on social media – some of the social media systems may strip the metadata and/or dynamically reduce the size of the file, however they may also store your location when you uploaded the photo to the social media platform, while also tracking every interaction that is subsequently made with your photo – i.e. who looked at it and when, who commented or otherwise annotated (i.e. likes). In some social media forensics tools, it’s possible to access this deep metadata and so you can then build a graph or who, when and where. Whereas going back to an email, you will rarely know the where, and once you have sent the message you can’t really determine who read it or interacted with it.

Data preservation and spoliation

Spoliation in Australia is surprisingly common. ConsilAD’s experience in Australia is that where data has been produced in procedural fairness disclosures and no explicit communication of the data being relevant for prospective litigation or investigation is provided, it is all too common for data to be altered or deleted at source. By contrast our experience in US indicates an almost universal recognition of the obligation to preserve data. A key benefit from discovery using forensic tools is the ability to show the extent of spoliation e.g. to demonstrate the deletion of data by comparison or juxtaposition of available data with the original forensic collection.

Key takeaways:

1. More is out there than most people expect.

2. Just because you don’t operate a social media account, it doesn’t mean that social media will be bereft of content about you.

3. Leaked and breach data sources and the interaction of online friends transforms data from private to public in many cases. Finders keepers?

4. Privacy obligations for collecting social data might reasonably be considered as triggered when targeted collections are initiated. This means securing the data, logging it and being able to show provenance and lawful collection.

5. Forensic tools speed up data collection and allow data to be shown in its original context, which can be helpful where the meaning or value of data might be contested.

6. There is a requirement to preserve documents once litigation is reasonably anticipated. Ensuring clients are appropriately advised and organisations issue document/data preservation notices, referred to as ‘legal holds’ is critical to avoid spoliation.

Forensic data collection methods and technology offer effectiveness and efficiency benefits that amateur efforts do not. For lawyers they are required deliver legal services competently and diligently – this includes technology competence particularly for the discovery process in litigation and securing client’s information.

Duty of Technology Competence

The duty of technology competence for lawyers is set out in the American Bar Association Model rule 1.1 as follows:

To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.

The Model Rules have now been adopted in 36 US States. Susan discussed some of the recent US cases dealing with discovery issues and directions for adverse inferences relating to evidence unavailability, particularly in relation to social media, and/or failures in the document production process leading to sanctions. The ABA’s Model Rules are also referred to in the Australian Law Council’s Cyber Precedent, which says;

To be a competent lawyer, you need to understand the value of the information that you are dealing with.
Failing to properly protect your client’s information that has been entrusted to you could cast doubt on your ability to properly manage your practice.
As legal practices operate more in the digital realm the issues of cyber security will play a more prominent role. It is important to keep up-to-date with the current risks and the current security measures.

Susan also discussed the implications of the recent High Court decision in Glenore International AG & Ors v Commission of Taxation of the Commonwealth of Australia & Ors S256/2018. In this case, Glenmore’s documents were part of the ‘Paradise Papers’ that entered the public domain arising from the cyberattack on the Bermudan law firm Appelby and stolen from its electronic management system. The High Court in dismissing Glencore’s proceedings, held that legal professional privilege is not an actionable legal right capable of sounding in injunctive relief. The implication of this decision will be regulators seeking to rely on documents in the public domain as a result of a data breach, which otherwise may have been privileged and not required to be produced. The High Court observed that once privileged communications have been disclosed, resort must be had to the equitable doctrine of breach of confidence for protection respecting that use of material.

Susan pointed out that the Glencore decision was distinguished from the High Court’s decision in Expense Reduction Analysts Group Pty Ltd v Armstrong Strategic Management and Marketing Pty Limited where there had been inadvertent disclosure of 13 privileged documents by the appellants’ law firm to the respondents’ law firm. In that case, the High Court relied on the Court’s roles in the supervision of the process of discovery to permit a party to correct a mistake to deal with inadvertent disclosure of discovered documents. The High Court also noted the ethical duty under Rule 31 of the Australian Solicitors Conduct Rules, which deals with the duty of a lawyer to return material, which is known or reasonably suspected to be confidential, where a lawyer is aware that is disclosure was inadvertent.

The key takeaways are that the duties of technology competence and confidentiality include:

· properly securing and protecting client information, including ensuring appropriate contractual protections with technology and cloud suppliers;

· ensuring appropriate technology and expertise in investigations and litigation to ensure relevant data is retained, identified and collected efficiently.

The rapid changes in technology, widespread and growing use of social media and apps requires lawyers and eDiscovery professionals to continually keep up to date with changes in technology. It highlights the critical importance of sound information governance to secure and protect client data and information.

Brett Webber, Principal, ConsilAD

Susan Bennett, Executive Director InfoGovANZ and Principal, Sibenco Legal & Advisory

RIMPA Live Convention 2019

January 23, 2020 by InfoGovANZ

RIMPA Live 2019 was held at the Marvel Stadium in Melbourne, marking 50 years of RIMPA and its 35th Annual Conference. It was a conference filled with a keynotes, plenary sessions and roundtables over the three days of the conference. There were several keynotes including CTO and entrepreneur Gus Balbontin, Richard Foy, New Zealand’s Chief Archivist, information thought-leader Randy Kuhn Esq from the US and Kevin Sheedy AO, AFL Legend.

The first fifty years of RIMPA

The conference kicked off with David Moldrich Life FRIM outlining the history of the Australian recordkeeping profession and some of the key moments in the professions’ history such as the establishment of the Records Management Association of Australia (RMAA now RIMPA) and the development and implementation computer-aided records management systems and their successors the Electronic Document and Records Management System or EDRMS.

David highlighted the contribution of the Australian recordkeeping profession to the state of recordkeeping around the world mainly via the development of the first standard on records management AS4390, which later became the foundation for ISO15489, and through the development of the Records Continuum model. These standards and models influenced the role of best practice records management across the globe, including in countries like France where new vocabulary was added to the language as previously there was no word in French for ‘record’ only ‘archive’.

While the Australian recordkeeping profession were still world leaders in this field, David noted that countries like Canada, Germany, the Netherlands and France have now moved ahead of us and we have some catching up to do in the 21st century to continue maintain our world leadership in this field.

ADAPT

Former CTO of Lonely Planet and Entrepreneur in Residence and Executive Director of VU Innovations at Victoria University, Gus Balbontin, gave an entertaining and lively presentation with the key theme of adaptability at its core. He highlighted that it was people that needed to be adaptable, as the culture of businesses are the sum of the people in them. He highlighted that in the same way as businesses, if the recordkeeping profession are the sum of its practitioners, we need to be adaptable going forward to drive innovation and change for the profession and the businesses that communities and constituencies we serve.

One of the most interesting points that he made was that he always asked vendors for an ex-implementation plan as part of implementing a product. Technology is changing rapidly and it will inevitably be replaced at some point and in a fast paced business environment you need to do that quickly. He also cautioned about setting this in concrete and becoming slaves to the system once you have worked out the ideal process that is proven to work. These still need to be able to adapt and change but retain the good elements that they contained over new technologies or contexts.

He concluded with a number of key points – my favourite of which was, ‘the moral of the story of the story of the tortoise and the hare is not slow and steady wins the race – it is don’t get arrogant and slack off.’

Power of records and physical documents

The power and importance of records was and the recordkeeping professional’s role in being a curator of trusted digital content in this digital age were the two key themes that emerged from a panel discussion moderated by Chris Foley with NZ Chief Archivist Richard Foy and Justine Heazlewood, Director & Keeper of Public Records in Victoria.

In this world of algorithms and consumer expectations about having content surfaced to them, both Richard and Justine highlighted the role for records managers and archivists in being curators of trustworthy content in this post-truth era. While they noted that all truth is subjective, including the truth in the historical and current records we keep and preserve, Richard and Justine expressed a view that there was a role to play for the recordkeeping professions in promoting better informed/evidence based decision making and promoting a culture of questioning where there is no evidence for a particular view. In their view promoting that kind of culture leads to a better informed citizenry overall and that can only be a good thing.

Justine and Richard also emphasised that although the future is digital, the power of physical documents will remain. This is most evident with key foundation documents, such as, the NZ Declaration of Independence and the Treaty of Waitangi as well as more mundane documents written by your own ancestors. Justine recounted how she had literally seen researchers in the reading room moved to tears by simply holding something written by their ancestor. Richard noted that while these documents like the Treaty of Waitangi help us construct a view of the past, they also help bring the past and the present together and help build the future.

NZ Chief Archivist – recordkeepers are the Night’s Watch

Richard Foy provided a timely reflection of the role and importance of records, access to information and government accountability in the current context about information in the public arena and current discussion around misinformation, truth and trust in government and public institutions.

Richard provided an entertaining analysis of the importance of the accountability roles in government using Games of Thrones. The role of the Chief Archivist took on a whole new GoT dimension in his explanation of the role of Chief Archivist as ‘standing astride information’ and balancing the two key domains of the Government realm being government information and government accountability. He noted that key to this was enabling access to government information as seen below.

He also highlighted that role of the conscience of Government via the accountability officers which in New Zealand are – the Chief Archivist, Privacy Commissioner, Chief Ombudsman, Auditor-General and Chief Censor. He also likened the role of archivists, recordkeeping professionals and information management professionals to the Night’s Watch as shown in the photo below.

Kevin Sheedy AO – AFL Legend

Kevin Sheedy’s key note on leadership was of particular interest as his career development started as a football playing plumber, but after his stellar and record breaking career (winning 3 premierships) and coaching career (winning 4 premierships), he went on to write 10 books between the ages of 50-60. Although he didn’t see himself being a writer he cautioned that you should ‘never restrict yourself on what you can do – you only have one life’. Some of his tips included: make time to think and be creative – he recounted how he came up with the ideas of the ANZAC Day, County and Dreamtime in the G matches.

Kevin also spoke about the role of leading when persevering against those that are negative and ‘listening with your eyes’. He recounted examples of those that were unsupportive of his goal to increase indigenous players to take up AFL and increase the number of professional indigenous players. His commitment and energy to continual learning as an important part of ‘accumulating knowledge’ as a leader is evident in the life he has led, and also when he said in passing he always takes copious notes when he attends conferences!

InfoGovANZ participation

Leading Information Governance was presented by Susan Bennett and Christopher Colwell. The presentation explained the concept of Information Governance as a super discipline and unifying framework to maximise the value of data and information held throughout an organisation while minimising the risks and costs. The IG umbrella encompasses Cybersecurity & Infosecurity; Information Lifecycle Management; Data Analytics & Infonomics; Privacy; Risk & Compliance; Legal & eDiscovery; Data Governance; Content Services; Records and Information Management; and Archiving & Long Term Digital Preservation. The recent InfoGovANZ 2019 survey results were discussed – you can see our full report here.

Chris spoke about the National Archives requirements for an Information Governance framework as part of Digital 2020 and the role of the CIGO. Susan used the film Hidden Figures to highlight IG leadership lessons in times of organisational urgency, rapid technological changes and disruption as inspiration for those in areas of Information Governance including: upgrading both your skills and the skills of your team; working across organisational silos collaboratively; taking risks and stepping up to take on new roles and help solve organisational problems with new innovative solutions and best practice; and building the skills of your team to deliver value. The IG leadership capabilities include the ability to:

– Think strategically, plan, implement and successfully execute

– Align processes, systems and people with overall organisational strategic objectives

– Innovate, collaborate and embrace change

– Effectively manage stakeholders and engagement

– Promote project objectives, best practice solutions including process, technology and importantly people.

Gala Dinner and Tom Lovett

One of the highlights of RIMPA 2019 was the Gala Dinner attended by 368 people. Many worthy recipients were recognised for their outstanding contribution. The highlight of the evening was hearing from the inaugural Hall of Fame recipient, Mr Tom Lovett who 50 years ago, at the age of 30, founded the Records Management Association of Australia (RMAA) which is now RIMPA. As Tom recounted, he decided to establish RMAA because he saw a need to for a professional association to provide support and training for Records and Information Managers. However, when he started RMAA he never thought it would lead to the ‘sea of faces’ before him at the Gala Dinner. Tom recalled that as he went around to organisations and universities explaining there was a need for the tertiary courses that exist today there were many ‘scoffers’. The advice he imparted was, ‘to find a need and fill it – you will never be short of work’. He also said, ‘to bring your creative and innovative ideas’ to solve those needs. Similar to the great Kevin Sheedy, Tom said, ‘there will always be scoffers – they are a dime a dozen – but ignore them’. It was wonderful evening, celebrating the contributions of more senior professionals many of whom have over 30 years’ experience as well as some of the younger members for their outstanding contributions.

Congratulations to Anne Cornish, General Manager and her team for all the hard work and effort in making RIMPA Live 2019 such a success. Information Governance ANZ was delighted to participate and we look forward to the 51st RIMPA conference in 2020, which will take place in Canberra.

Susan Bennett, Executive Director, InfoGovANZ

Chris Colwell, RIMPA Fellow and Life Member and InfoGovANZ Advisory Board member