Thanks, Bob. The formula is simple, really. Take the Longfellow poem...change ten words...voila! Instant classic!

Hi Sarah - greetings from San Francisco: As much as we wish we could be the 'conduct police' there's no way to accomplish it fully (unless one spies on those entrusted with one's data 24 hours a day, which is completely unrealistic). It's important to remember that policies are in place to accomplish two goals: 1) The 'obvious' goal: Protection of the data, and, 2) The 'not-so-obvious' goal: A defensible legal strategy should a breach occur. You want to establish safe harbor and a foundation from which to argue on behalf of the client, so you make the best, good faith effort you can. On that note, I have no compunction making sure the data custodians understand that if they make a foolish 'mistake' (euphemistically), no matter where they are or what product they're using, it may result in a subpoena and/or being hauled into a deposition and/or court to testify - never mind being named as a party. Did I mention the other risks, such as public disclosure of private facts, lengthy litigation, losing said litigation... Hopefully, this will serve as a sufficient deterrent for most people. The rest? You'll have to deal with them on a case-by-case basis.

Hi Bob: Yeah...this is what I tweeted June 15th, 2010 - the last time this happened: "Imitation is the sincerest form of flattery http://catalystsecure.com/blog/2010/06/changes-for-this-blog-and-for-catalyst/" But, to (mis)quote Fiddler on the Roof, "Once in a while, can't they 'flatter' someone else?"

Sarah: If I spoke in standard deviation, I'd be applying the same robotic approach that I frown upon. There are always assumptions in any project, however, one of them should never be, "everything will go according to plan". There has to be a reasonable accounting for 'slippage', based on an assessment of your particular circumstances. As for begging the question, I'm not so obvious. If you go the next step, the assumed answer to my premise of a 3rd-party request is, "They will deliver the data because they will deliver the data." And if the vendor fails, you'll be doing a different kind of begging...

Too bad I can't steal your banner...it's better than mine...

From the article: "Hostess Brands Inc. doesn't make English muffins. But that doesn't matter to the lawyers seeking to protect the trademarked "nooks and crannies" in a U.S. baking industry where four major players duke it out on supermarket shelves. "Botticella could produce an English muffin that might look a bit different, but that would nevertheless possess the distinctive taste, texture and flavor character that distinguish the Thomas' English Muffin and that have been the foundation of the product's success," they argued in a brief submitted to the 3rd U.S. Circuit Court of Appeals."

Note to my readers: I knew I was playing with fire posting this item, but I'm focusing on bad lawyering. Personal feelings about the subject matter aside, when you go into court, you'd better have FACTS. I've received some highly-political comments but, forgive me, I'm not going to post them because this isn't a political blog and I don't want to turn it into one. Perry

I think it's way too premature to consider dropping the "e". Why? Because when I use the term "e-discovery", virtually nobody outside my immediate sphere has any idea what that means! For me, the decision shouldn't revolve around what the "insiders" know. When the general public understands what it means and it becomes part of the vernacular, maybe THEN it's time to think about losing the "e". Just my 2 cents...

Sally: I only have one question. If I agree with your post agreeing with my post, do we create some sort of causality loop a la Star Trek?

Hi Paul: I didn't see a link back to your post in your comments, so I hope you don't mind - I added one for you. I regret these days I have less time to flesh out some of my posts as much as I'd like, but you did a good job for me. One thing I always consider; if you happen to be a company that really tries to do the right thing, then you want some of those documents around to prove it. Also, most cases have a statute of limitations of, say, two to three years. It's going to be an interesting problem defending a case from three years ago if all you have available is 90-days worth of data. Again, my usual caveat stands - these assessments should be made on a case-by-case basis.