This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

The volume of electronic information that has been creating risks in e-discovery for more than a decade is ripe for renewed attention in the era of artificial intelligence (AI) and advanced analytics. Just as advanced tools now play a role in mining data for use in business pursuits, they can also be used to mitigate what in the past has plagued those charged with meeting litigation and investigation e-discovery needs.

Artificial and augmented intelligence — embodied in tools that ostensibly make judgements previously made by humans — offer analytical capabilities that can help differentiate data and speed identification of responsive and key information — at least in theory. In this roundtable discussion these experts share their experience and insight on the evolving acceptance and use of AI and advanced analytics tools for e-discovery — and beyond:

• Brandon Graves, Counsel, Davis Wright Tremaine (BG). Brandon Graves focuses his practice on cybersecurity, internal investigations, and litigation related to complex administrative, civil, and criminal matters. He advises on internal investigations, crisis management, and government investigations, as well as litigation-related matters before courts and administrative bodies. His clients include defense contractors, multinational energy companies, and leading providers in the banking and payments industry.
• Kara Ricupero, Global Information Governance, eBay (KR). In her current role, Kara is responsible for development and management of eBay's Information Governance program and accompanying policies. Kara and her team also establish and manage eBay's e-discovery strategy in litigation and government investigations. Kara regularly counsels the business on legal requirements and best practices for new technology implementations, as well as cybersecurity risks.
• Kimberly Quan, Lead, e-discovery & Information Governance, Juniper Networks (KQ). Kimberly Quan has over 20 years' of experience in the legal-technology realm and leads e-discovery and Information Governance (IG), concentrating on operational efficiency and maturity. She is a key member of the Juniper IT Security Team that focuses on Forensics, e-discovery, Data Loss Prevention, and IG. 
• Sheila Mackay, Managing Director, e-discovery Services – H5 (SM). Sheila Mackay has more than 25 years of experience in the legal services industry including product development, professional services, operations, analytics, consulting, management and business development. As Managing Director of e-discovery for H5, Sheila leverages these skills working with H5's client services, infrastructure and technical services teams.

The Discussion

Q1. Given the rapid pace of technological change, there is a growing sense that professionals in the legal realm — wed to precedent and often change-resistant — should jump on the technology bandwagon in order to better serve their clients. What changes, if any, are you seeing in your daily practice?

KR: I believe it is essential that legal professionals jump on the “technology bandwagon,” not only to better serve their clients, but to ensure compliance with emerging requirements of the rules of professional conduct in many jurisdictions. In 2015, the ABA added this as an express requirement for attorneys within its Model Rules of Professional Conduct and increasingly, individual jurisdictions are mandating that lawyers be competent in technology (or associate with someone who is) as part of their ethical obligations.

SM: In many circumstances, the legal community has been historically slow to adopt new technologies and can be reticent to change existing technology and previously created workflows. That said, this is changing as tech-savvy professionals are either influencing or making decisions regarding how best to use technology. AI is a little different, and there seems to be more interest in leveraging AI for tasks such as technology-assisted review to identify privileged or other sensitive classes of data such as PII and PHI, which are gaining in importance due to changing regulations in the United States and internationally.

KQ: In my current in-house role, as well as in my previous roles providing advisory services to Fortune 500 companies, I have embraced technological advances but consider it imperative that they are stringently vetted and that their deployment is defensible. When I was consulting, my clients were very open-minded about considering new technologies and methodologies, especially if there were potential mitigations in risk and/or efficiencies to be gained in time or cost. In the corporate environment, many do not realize that companies have already been successfully utilizing AI for such tasks as automating review and classification of contracts, identifying privileged or classified documents or PII/PCI/PHI, and recognizing patterns of potentially fraudulent or risky behavior.

BG: There are a number of stakeholders beyond lawyer and client that are involved in the introduction of new technology. For adversarial matters, these stakeholders include the tribunal and the opposing party. For compliance matters, the regulatory authority is a stakeholder. To properly use new technology, we as lawyers need to understand the technology well enough to make the case to the other stakeholders. We need to be upfront and honest about the benefits and the costs. I have seen poor protocols and communication on predictive coding increase the time and money spent for document review. All of the involved stakeholders left with a negative view of the new technology.

Clients are asking more questions about whether we use new technologies, referencing both buzz words and specific products. It is important to be sufficiently informed to have an intelligent discussion on the topic. Jumping on the technology bandwagon without that understanding will do more harm than good. But lawyers failing to develop an understanding will be left behind.

Q2. AI is a topic receiving a lot of attention for a number of reasons. Do you think legal professionals are reluctant to adopt AI technologies? If so, why?

KQ: I've seen many different responses to AI, and some of it is just fogginess about the concept of what AI actually is and its potential applications. Most of the concern industry colleagues have communicated to me is in regard to its effectiveness and defensibility, and less, at least at this point, about AI replacing humans. One area where I do see unease is the clash between privacy and AI; both privacy regulation and AI's utilization of personal information are augmenting at a rapid pace.

BG: In general, the legal profession is reluctant to adopt AI technologies, although it is getting better. There is a feeling that with AI, the tool is making judgment calls traditionally left to a lawyer, and the lawyer is relying on those judgment calls to provide legal advice. As more clients demand the efficiencies that AI can bring, lawyers will be forced to adapt. They will need to educate themselves and their clients on which decisions can be made by a supervised machine and which decisions must be made by lawyers. And they will need to know enough about how any AI is trained to defend the ultimate legal advice that the lawyer renders.

SM: AI is gaining attention in the legal marketplace. One challenge to adoption, as Kimberly mentioned, is a clear definition of AI — in fact, some people consider AI to be an acronym for augmented rather than artificial intelligence. Another challenge is deciding how to effectively employ it. In my experience, many corporations are looking for optimal ways to use AI, and they are open to collaborating not only on use cases, but also on how to measure the results and effectiveness of these tools.

Our experience has shown that the combination of technology and human expertise results in the most effective and defensible solutions, so we use linguists, lawyers, data scientists, and statisticians in conjunction with AI when addressing our clients' pain points. When lawyers team up with these experts, there is a rich collaboration on the most effective strategies to meet various goals. Each expert brings something to the table, resulting in a more reasoned and informed solution for the client.

KR: AI is definitely a hot topic, and my company generally is excited about finding innovative ways to leverage it. Typically, legal professionals are referring to the use of machine learning to review data and glean insights about a particular litigation. But recently, I have noticed that individual legal teams are much more open to exploring the use of technology in a variety of circumstances. It used to be that everyone wanted to reserve AI for very large, complex cases, but now there is a trend to explore its use for an expanded range of legal use cases, such as compliance with the General Data Protection Regulation (GDPR), M&A projects and contract management.

I think reluctance to adopt AI is most often driven by a lack of understanding. When a lawyer doesn't truly understand how the technology works, there is naturally a discomfort in defending or being a proponent of the process with opposing counsel or the court. Thankfully, there is a growing trend among legal professionals to educate themselves on machine learning technologies and analytics generally. This is an exciting development, because it will likely help overcome resistance among lawyers (litigators in particular), who tend to be skeptical and feel the need to be hands-on or supervisory in all aspects of a case. We've seen that when judges are exposed to technology-assisted review (TAR) or other AI in cases pending before them the better they understand it, and the more they will not only sanction its use, but begin to encourage it in other cases.

Some lawyers may also fear adoption of AI will reduce their head count and available billable work. I do not believe that is the case, as the most successful uses of AI are those that leverage technology to augment — not replace — legal professionals. AI can free up the legal professional to perform higher level tasks exploiting the insights the technology has provided to the legal team.

Q3. E-discovery for litigation and investigations is thought to benefit from the use of advanced tools, such as machine learning and other forms of technology-assisted review and analytics. Do you see the use of such tools increasing for e-discovery or other pursuits? What do you see as the benefits/drawbacks?

BG: Document counts are increasing, and as we deploy more data collectors (e.g., Internet of Things devices), that will only increase. We really shouldn't refer to these tools as advanced anymore, as they are becoming necessary. Lawyers will get comfortable with these tools for prioritization, then they will get comfortable with them for culling document populations, if they are not already.

For internal investigations, where speed can be at a premium, they are already essential. Companies are also beginning to deploy these tools outside of these e-discovery and internal investigations. For instance, not all companies have been diligent in keeping their contracts in a dedicated repository, and these tools can assist in finding contracts within a general document repository. Companies are also learning about the need to map their data to comply with new privacy regimes. The same techniques used in e-discovery can be leveraged within corporate infrastructure to determine what data is flowing where.

SM: Yes, the use of technology-assisted review and analytics is growing in the context of litigation and investigations and other use cases, ranging from M&A to compliance-related tasks.

Some benefits are the ability of the technology to scale and aggregate larger data sets to identify patterns in data to leverage going forward. For example, AI facilitates the automated detection of PII, such as social security numbers, street addresses, phone numbers, and email addresses, or PCI, such as credit card and account numbers. Potential drawbacks are that AI does not have a common definition, is not universally accepted and therefore lacks standardization around metrics and measurement of effectiveness.

KQ: The understanding and appetite for utilization of TAR and analytics has definitely increased in the last few years. Many jurisdictions and judges seem to have gotten their heads around it. Interestingly, many in the e-discovery community don't realize they have been using one application of AI — natural language processing (NLP) — for years when utilizing concept clustering or near-duplication identification functionality. A few well-known potential benefits of using these technologies is increase in accuracy and efficiency and reduction in time and cost. Users must exercise caution, however, as there are myriad tools out there that haven't been properly vetted and not many established standards at this point.

KR: I absolutely see the use of such tools increasing. It's now well established that the use of technology can make the e-discovery process more efficient, increasingly accurate, and less costly. Despite this, I continue to encounter legal professionals who are hesitant to trust the technology. On the other side, however, there is absolutely a new openness among some legal professionals to consider adoption of technology in their daily practice and an increased interest in exploring ways we can leverage technology. In practice, we try to show our internal legal teams how these technologies work and to demonstrate how successful they can be on less significant projects in order to drive adoption of these tools when we encounter the more critical projects.

On balance, our internal legal teams seem much more enthusiastic about embracing the use of advanced tools than outside counsel may be. This appears to relate to the fact that legal professionals are more hesitant to use technology when they know they are going to have to explain or defend its use to another party.

Q4. Do you think that cybersecurity and privacy concerns are affecting data retention and/or changing e-discovery?

BG: Privacy laws are driving companies to better understand how they are using and retaining data, and this is an area of focus for more sophisticated clients. But an increase in data mining and the need for large data pools to train AI balances those concerns. Ultimately, most companies are still retaining large amounts of data, either out of inertia or because the economics currently weigh towards data retention.

SM: Yes, in my experience cybersecurity and privacy concerns are — and should be — on the minds of general counsel and their internal and external advisors. Since a breach can bring both financial and reputational damage, they are now Board level concerns as well. Numerous, well-publicized cyber breaches (not to mention the untold number that are not broadly reported) put cyber issues front and center.

GDPR accelerated the focus on data privacy, and the California Consumer Privacy Act (CCPA) is further fueling concern — with more states sure to follow. Because of this, corporations need to know where PII is located in order to be able to respond to requests regarding individual access and deletion requests. In response, we are seeing great interest in technology that can identify PII quickly and reliably. The added benefit of technology that identifies PII or other sensitive data is that once corporations locate the data, they can also leverage their document retention policies to clean up risky data lakes. Corporations are shifting away from the conservative “save all” mentality to one focused on retaining only data that it needs for: 1) legal obligations; 2) regulatory requirements; or 3) critical business reasons.

KQ: Definitely. GDPR, CCPA, etc. and the punitive effects of non-compliance have certainly created a flurry of activity around education, if not action, with regard to data classification and information governance. Many available tools employ AI that can be extremely effective at auto-categorization of corporate documents, which can help support an organization's data classification policies. Proactive planning is required to determine whether AI will be utilized in lieu of or in conjunction with more manual categorization workflows, as well as whether a more automated workflow will tend towards more conservative or more liberal labeling of information.

KR: Absolutely! With the explosion of data creation and the simultaneous increased focus on user privacy around the globe, companies must get a solid information governance program in place to reduce their data footprint and reduce risk, both in the event of a cyber attack and in inadvertently violating any current or future privacy protections.

We are attempting to utilize AI and analytics to understand what data we have, where it is stored, and if we really need it, to ensure the company only retains what it has a legal obligation or critical business need to retain. It is just too risky to live in a “let's keep it just in case” environment. This cleanup isn't easy for most companies, but it is a critical process in an environment where cyber attacks are occurring on a regular basis and where there is an increased need to shield sensitive company information and customer and employee PII from exposure.

Q5. To the extent that legal professionals do utilize AI and advanced analytics in their practices, do you see an evolution in the skill sets required and/or being employed to maximize the value of these tools?

SM: Yes, it is a common view now that the people best equipped to locate key data are not limited to lawyers and the technology professionals that assist them, but instead search and information retrieval experts who know how to pair technology and human linguistic expertise to obtain the most accurate, cost-effective results. We are at the point where we can leverage technology to complete tasks where humans are less efficient. As a result, the importance of the collaboration between in-house and outside counsel and their e-discovery service providers has grown stronger. It is our experience that counsel are increasingly seeking to partner for external technological expertise. More and more, we find clients looking for defensible solutions that combine technology with human expertise, and provide measurable and cost efficiency.

KR: There is definitely a need for some more technical skillsets and analytical skills to get the most out of these tools. Training in things like SAS, SQL — or some other database experience — Tableau, advanced Excel, and other business intelligence software is all highly desirable for this purpose.

How these skillsets are best engaged really depends on the size of the company and its litigation profile, among other things. It's easy for a firm or company to access needed skills by partnering with an experienced vendor. However, companies like mine are also bringing some of these skills in house, creating dedicated legal analytics and similar teams to help leverage these technologies. While I do believe there is absolutely a subset of attorneys who are working to gain better and more robust technology training, I don't see a world in which lawyers also become the actual technical analysts that are “pushing the buttons,” so to speak.

KQ: Having people who understand and know how to use advanced technologies explain them is key; practitioners need to be able to elucidate the methodologies and potential outcomes to their clients, as well as be ready to speak to their defensibility. I see more law firms relying on technology and service providers to serve as their subject matter experts as opposed to bringing these people in. On the other hand, many corporations that are extremely protective of their data are bringing these resources in-house.

BG: Lawyers need to understand the costs and benefits of the tools that they use. They need to be able to explain those costs and benefits to other stakeholders. Many lawyers already have these advocacy skills. More and more clients are emphasizing legal project management, which can assist lawyers in maximizing the value of AI and advanced analytics even if the lawyer is not technologically proficient. Lawyers have to be willing to change their own processes to integrate the new technology and management techniques necessary to fully leverage that technology.

Q6. What do you think the future holds?

KQ: Faces, objects and places can be determined in video; voices in sound files; sentiment analysis and translation are available across media. In the future, we'll be more comfortable with harnessing all the data points that we have, which will give us incredible intelligence around incident prevention and response. (Even now, with regards to data loss prevention (DLP), some of my industry colleagues are using AI to detect potentially risky behavior that can be supported by employee monitoring software that allows them to record and demonstrate an employee's activity; this allows them to create airtight cases.) Big Brother won't just be watching, he'll be listening, interpreting and strategizing.

BG: Lawyers will need to focus on where they add the most value. Clients will demand that lawyers delegate tasks to tools and vendors to increase efficiency. The law is becoming more complex as well, requiring lawyers to become more specialized and to outsource more and more traditional tasks. To keep up, lawyers will need to show an intellectual flexibility that has not always been the hallmark of our profession.

KR: In the future, I believe we will see more formalized training for lawyers related to technology. Some law schools are already beginning to offer courses in e-discovery and analytics. I think this will ultimately become a requirement for legal professions in the future. I think it is also foreseeable that more and more law firms will start to employ internal analytics teams, as many of them already have e-discovery experts within their firms.

SM: Technology will continue to evolve. The scalability of data aggregation and the ability to analyze the data will continue to increase. It will be important that our industry continue to focus on harnessing the technology while also concentrating on metrics and measurement to ensure the solutions are defensible, effective and cost efficient.

Potential changes to regulations will play a role. Lawyers will need to stay abreast of the increasingly powerful technologies and ensure their advisors have the requisite expertise including skillsets including cybersecurity, statistics, information retrieval, data science and the often-overlooked need for solid project management. [And, as Kara noted], I think law school curriculum will continue to develop to ensure lawyers are equipped to understand these technologies, deploy them competently, and measure the results. The ABA will also continue to evolve to ensure the Rules of Professional Responsibility keep pace with the technological changes. One way to ensure obligations are met is to have the necessary combination of skills to understand the capabilities, efficacy, and impacts of AI.

[Editor's Note: Thanks to Nick Gaffney and Lauren Miller at Zumado PR for coordinating the roundtable and following up with the participants.]