18 Surviving legal processes

This chapter is unlike any other in this book because it isn’t about dispassionate technology or the virtual arm wrestling of setting internal policies. This chapter is about an event that most technologists won’t encounter in their careers—legal processes that make them the expert on the spot—so they’re horribly unprepared when it happens to them. I want to prepare you for this event so if the unlikely happens, you will respond from a place of competence rather than shocked and reactive surprise.

The sorts of legal trouble that organizations can get into is infinite, but only a subset of that infinite could potentially put your telemetry systems in the crosshairs of the other side’s lawyers. This brings me to the first of many definitions: eDiscovery.

18.1 Defining the eDiscovery process

18.2 Dealing with records-retention requests

18.2.1 Examining an ELK-based centralized logging system

18.2.2 Examining a Sumo Logic-based centralized logging system

18.3 Dealing with document-production requests

18.3.1 Telemetry in the collection phase

18.3.2 Telemetry in the review phase

18.3.3 Telemetry in the production phase

18.4 Working with lawyers

Summary