FORDHAM FORENSICS When It Really Matters770-777-2090
Inquiries
To learn more about our e-discovery,
computer forensic, forensic accounting or computer security services or
discuss a specific matter
770-777-2090
E-Mail
Computer Forensic & E-Discovery Articles
10 Steps to Protect Your Company from Employee Based Computer Compromise |
|
There is a lot about computer security that employees need to be taught and reminded. Furthermore, it is not just something that they can leave at work. The practices can follow them home as well. In fact, a successful organization should impress upon their employees that they (the employee) will be a target as a result of their employment. Consequently, they must always be on guard for evil doers and practice good computer security. |
|
During discovery, whether the producing party’s data is accessible or inaccessible is an important determination. The producing party will have to provide its accessible data while it may not have to provide its inaccessible data. |
|
Another Domino Falls: Kentucky PI Statutes Have No Evidentiary Effect |
|
On January 13, 2012 the Kentucky Court of Appeals reversed and remanded a lower court decision where the defendant's forensic expert was excluded because the expert was not a licensed Private Investigator (PI). (see, Susan Lukjan, Appellant, v. Commonwealth of Kentucky, Appellee. No. 2010-CA-001509-MR. Court of Appeals of Kentucky, 2012 WL 95556, January 13, 2012.) In its decision, the Appeals court reasoned that, "Reading the plain language of the statutes, we believe the General Assembly meant only to prohibit an unlicensed individual from offering private investigation services to the public; hence, the prohibition against 'hold[ing oneself] out to the public as a private investigator[.]' KRS 329A.015. Providing testimony in a court proceeding is not the equivalent of selling the public one's services as a private detective. . . .Kentucky's statutes governing the practice of private investigating are simply not meant to have any evidentiary effect, and to prohibit the testimony of Lukjan's expert on that basis was erroneous " |
|
The expertise of the dark side is not limited to perpetrating wrong but also in hiding it. When paper was king so were shredders, light tables, white-out and various copier manipulations. In the digital age it can be far more sophisticated. |
|
Clearly with the volume of digital evidence in many modern litigations, it simply is not practical to take a “boots on the ground” approach to document review and analysis. Certainly the volumes of data make it commercially impractical to use anything other than computerized techniques. Moreover, many other fields of human activity have demonstrated that the weak link in the chain is often the human element. As a result, automation and statistical sampling techniques are often used in other fields not only for economic reasons but for increased accuracy reasons as well. |
|
In a letter dated April 2, 2007, that has been widely circulated by computer forensic practitioners as well as some e-discovery shops, the Secretary of State advises that the Georgia Board of Private Detective and Security Agencies (the Board) requires computer forensic firms and their technicians to be licensed when providing services to the public, since they meet the definition in OCGA §43-38-3(3) as a private detective business. Some have theorized that what is actually happening here is that anyone with a credit card and access to the internet can obtain a background check. So, the PI profession may be going the way of the elevator operator. Consequently, is the profession simply leveraging the amorphous definition of a private detective business to find new blood? If so, they have picked the wrong host. |
|
The question of whether computer forensic experts require a PI license is currently a hot topic in American jurisprudence. Numerous groups and individuals have invested considerable time in answering the question for those who are interested. Unfortunately, the work by most of these researchers is usually limited to the various state PI licensing statutes and opinions by the PI boards. Thus, they never consider applicability of the evidence statutes, controlling precedent, or any analysis of legislative intent. The reality is that a PI license is not required in federal courts. The answer is more complicated for state courts and requires some amount of statutory construction analysis on a state-by-state basis. Generally, however, a state’s evidence statutes tend to trump that state’s occupational statutes when forensic experts are the subject of the analysis. |
|
Search technology is essential to both finding the smoking gun and controlling discovery costs in the digital age. The old fashioned manual approach is simply not practical for a variety of reasons. |
|
Does the Answer to Rising Discovery Costs Exists in the Mirror? |
|
| The cause for escalating discovery costs is attributable to those not following the rules as they have existed for years. The FRCP imposes an affirmative duty to engage in pretrial discovery in a responsible manner. Apparently, the belief that the American adversarial system does not lend itself to the cooperation required by the rule has undermined this requirement. Advocacy is a form of public service. But it ceases to be that when it hinders the process and misleads, distorts and obfuscates and makes the decision process more difficult |
|
When confronted with an e-discovery project or any litigation involving digital evidence many wonder where to begin and how to proceed. Rule 26 of the Federal Civil Rules is a good place to start. The product of the Rule 26(f) Discovery Conference should be a discovery plan. When the plan goes into even more detail and describes the specific procedures that will be followed in executing the discovery plan it becomes a protocol. All kinds of industries, where complex projects are performed, have found that advanced planning not only improves the final product but can reduce overall project cost. In fact, analyses of various projects with and without advance planning have developed a rule of thumb that 15 to 20 percent of the overall budget should be allocated to advanced planning. This 15 to 20 percent is not an additional cost, however. Rather, by spending that much on advanced planning the overall costs of the project are often cut by 50 percent or more when compared to similar projects without the planning effort. |
|
When the case is on-going the storage problem may not be obvious, since it is needed for day-to-day activities. The dilemma becomes more obvious, however, when the case goes into sleep mode while waiting for some kind of disposition like a decision on summary judgment motions or even for a final decision. |
|
Once the need for a computer forensic expert is recognized, the next likely hurdle will be how to find and select one. To the uninitiated, this may seem no more complicated than an inquiry with a colleague. However, there are more things to consider, particularly now as the number of those claiming to have this expertise grows to meet demand. The following sections provide guidance to the litigator on finding and selecting a computer forensic expert. |
|
One would have thought that after the recent changes to the FRCP, substantive in 2006 and minor in 2007, that the form of production for Electronically Stored Information (ESI) would be well settled. Not so. |
|
Four Reasons Why You Need Fordham Forensics to Investigate Your Intrusion and Data Breach |
|
When one considers the two choices of using in-house resources or using an outside consultant to investigate an intrusion and data breach one factor looms large. By their own admission in the recent Ponemon Institute survey, over half of the in-house security professionals are not adequately equipped to handle the unique challenges of a network intrusion and data compromise. |
|
Despite the breadth of data captured by forensic imaging, courts have allowed production and discovery of entire computer hard drives under protocols like those described in Cenveo Corp. v Slater, Slip Copy, 2007 WL 527720 (E.D.Pa.) and its predecessors. Even so, production and discovery of imaged hard drives is not an inherent right of the requesting party even if the data is easily accessible. |
|
In the final analysis, there is an economic answer for the litigator who thinks that the smoking gun resides in the opposing side’s computerized data but who has been reluctant to try e-discovery because of cost concerns. The solution: go native. |
|
If Six Monkeys Can Write Shakespeare Can They Make E-Discovery Affordable? |
|
The reality is that litigation is not the same as repetitive manufacturing. Also, human imperfection is a long recognized problem to be solved. If e-discovery is to be more affordable, it likely means scrapping ill conceived review efforts and not just charging less for them. |
|
A network intrusion. The theft of confidential or trade secret data. A fraud. An employee complaint or employee misconduct. A malicious attack or destruction of computer data. Each is an example of a computer incident that will require a management response to determine the scope and veracity of the event. And in each case special care is warranted. |
|
In the early days, electronic discovery followed the more traditional paper based discovery model despite the considerable inadequacies of such an approach. Decisions like Williams v Sprint/United Management Co., 230 F.R.D. 640 D.Kansas (2005), however, made that fallacy more obvious because of the forgotten metadata. The result was an increasing interest and transition toward native format documents. |
|
When fishing the ocean of digital evidence multi-stage discovery is a technique that can be used to reduce risk and increase efficiency. Under this technique there are two basic approaches. |
|
Organizing Requested Document Productions: When Everything Is Never Quite Enough |
|
Interestingly, satisfying the burden of producing data as they are kept in the ordinary course of business requires more than a mere representation of fact. Some minimum informational data is still required. |
|
There is a paradigm shift occurring in American jurisprudence. The shift is caused by the computer and the digital evidence that it spawns. For some, a case involving digital evidence is death by a thousand nicks. While it is only pennies a page, there are millions and million of pages. Others see things differently. For them an examination of digital evidence is mutually assured destruction. In either case, it is like repelling a human wave attack with muzzle loading rifles. No matter how inexpensive the ball and powder might be the end result is costly. Clearly, a new tactic is needed—a paradigm shift. |
|
|
Preservation is the most important step in litigation. If not performed, relevant evidence can be lost. If not performed properly, relevant evidence could be inadmissible. In either case, sanctions are both possible and likely. |
Properly Logging E-mail Chains Key to Maintaining Privilege and Avoiding Sanctions |
|
|
While the Rhoads Court followed Muro and did not require the listing of each link in a chain of an e-mail communication for which privilege was claimed, it recognized that each version was a separate communication requiring disclosure in the log if it was to be withheld. |
Protecting Privilege from Inadvertent Disclosure in E-Discovery |
|
| There is no need to manually review every document for privilege. Furthermore, a complete manual review is not assured of having better accuracy. So, perhaps the best and most economic approach is one that implements electronic searches, statistics and limited manual review. |
|
The recent decision in the patent infringement dispute, Qualcomm. v Broadcom, 2008 WL 66932 (S.D.Cal), provides many lessons for litigators involved with digital evidence. The most obvious lesson is that this case is just another in an ever increasing line of decisions awarding impressive monetary sanctions for discovery misconduct where digital evidence was involved. The second obvious lesson is that sanctions are not just for the named parties. In its decision the Court explained that, “If an attorney makes an incorrect certification without substantial justification, the Court must sanction the attorney, party or both . . .” |
|
After proving gross negligence, as was the case here, no other proof of relevance is necessary. Only when the defendant’s actions are negligent that the claimant must demonstrate that the destroyed evidence would have been relevant and favorable to the claimant’s case. |
|
Scheindlin on Litigation Holds Solves Sanctions but not Economical Discovery |
|
Six years after Zubulake, Judge Scheindlin pens another lengthy opinion in The Pension Committee of the University of Montreal Pension Plan v Banc of America Securities, LLC, et al, 2010 WL 184312 (Jan 2010). In this case, she examines the entire litigation hold and evidence spoliation problem from duty inception to remedy assessment and jury instruction. |
|
Although improved, the Sedona Principles are still weak, especially on preservation. Thus, much is still needed for both the existing subject areas as well as practices and procedures not yet addressed. Fortunately, the Principles’ Preface states, “[T]he accompanying Commentary reflects numerous circumstances and illustrations where the presumptive rule must be adapted to the particular facts.” |
|
Sedona Releases Commentary on ESI Admissibility: Does It Help, Hurt or Spot Best Practices Flaws? |
|
While the headlines about recent decisions involving ESI have focused on the 2006 changes to the federal rules and involved issues like undue burden and expense, accessibility, preservation and sanctions; a newer yet familiar storm is visible on the horizon. The impending tempest is one of ESI admissibility. |
|
As e-discovery continues to become more widespread and more technical, practitioners will likely face the need for vendor assistance. When the time comes, how should practitioners chose a vendor? Is it just a matter of lowest cost? |
|
Sinbad the Sailor Versus Emily Post: Will Cooperation Make E-discovery Affordable? |
|
| Clearly cooperation can make e-discovery more economical. However, it will take innovation, competence and attention to the entire lifecycle to deliver swift and economic justice. |
|
Understanding ESI Admissibility: When You Absolutely, Positively, Must Win |
|
Despite the 2007 changes, the current Sedona best practices still contain preservation weaknesses. For example, principle 8(c) discourages the practice of forensic data collection except in certain cases. Yet without such collection techniques is the authenticity of the evidence not compromised particularly in light of the decision in Lorraine? |
|
System metadata, on the other hand, is created by the computer system on which documents are managed. System meta data provides context to the documents found on particular media. They may explain when and how often a document was used. In addition, their existence can help to authenticate a document and its usage or highlight data hiding and spoliation schemes. |
|
The use of keyword search terms in litigation has received careful |
|
| There are risks and limitations to keyword searches. Understanding those risks and limitations is important for their users because of how they can adversely effect the outcome of a case as a result of excessive false positives or false negatives. |
|
Generally, when a production involves inaccessible ESI, the cost of production can be shifted to the requester or even avoided entirely. In this case, however, the costs of the examination were deemed the producer’s responsibility. |
|