| In This Issue:
FROM
THE BENCH: JUDGE REFUSES TO ORDER FORENSIC EXAMINATION WITHOUT ADDITIONAL DETAILS
Loving v. N’Namdi, 2006 WL 3456311 (S.D.N.Y. Nov. 29, 2006). In a probate matter, the plaintiff moved the court to compel a computer forensic examination of the defendant’s computers. The plaintiff argued the defendant manufactured electronic invoices after the litigation started in an attempt to reduce liability and a forensic examination would uncover when certain documents were created. The court noted the defendant’s record-keeping for this case was inaccurate, and documents may have been “manufactured” for the purposes of the litigation. However, the court was apprehensive to allow a forensic examination of the defendant’s computers. First, the court stated it was unsure of the procedures or the scope involved regarding a computer examination and it would not “approve testing without a specification of purpose, methodology and time-frame.” Second, the court declined to order the examination given the tight discovery deadlines in the case, which were already extended for both sides. The court ruled it would only allow a computer forensic examination if the plaintiff provided an affidavit of a computer forensic specialist stating the procedures and timelines for such an examination.
THE BRILL FILES:
TOP COMPUTER FORENSIC CASES OF 2006
*** Written by Alan Brill, Senior Managing Director for Kroll Ontrack, The Brill Files reflects his work in the field with clients who have encountered some not-so-pleasant events and what was done to remedy the situation. With more than 25 years of consulting experience, Mr. Brill has assisted organizations with a wide range of technology security issues and is an internationally recognized speaker and instructor. ***
Kroll Ontrack is the world leader in helping corporations, attorneys, and government agencies obtain electronic data from individual hard drives and systems for use in court or in an investigation. From restoring destroyed hard drives to detecting cyber scams, Kroll Ontrack computer forensic engineers have worked on some of the nation’s most high-profile computer investigations this past year.
The following case examples maintain the confidentiality of Kroll Ontrack’s computer forensic clients, while offering some insight into how our computer forensic experts uncovered the “who, what, when, where, and why” of some of the most puzzling technology mysteries of 2006.
- High-Stakes Data Heist - A respected financial services company suffered a break-in and theft of a laptop computer. The company’s main concern was the loss of the information contained on the stolen hard drive. The company believed the machine contained unencrypted financial records of over 250,000 customers. Since the machine in question was missing and could not be forensically examined, Kroll Ontrack and the client conducted a “digital inquest” of whether the information in question ever made it to the stolen laptop. The analysis showed the file of 250,000 records had not been sent to the stolen laptop and the laptop owner never had access to the file. The company avoided sending notification to its customers about the stolen data, which would have cost at least $1million and damaged the company’s reputation.
- Former Employee Data Theft - In a misappropriation of trade secrets case, an employer claimed an employee downloaded trade secrets onto her work-issued laptop computer which she subsequently transferred to her home computer. The employer’s computer forensics expert conducted an investigation and concluded the data confirmed the company’s suspicions. The employee called Kroll Ontrack to conduct an investigation on her behalf. In analyzing the evidence more closely, our forensics investigators determined the employee never downloaded the trade secret information and, in fact, deleted the files months before leaving her former employer.
- High-Tech Drug Dealing - In a criminal matter, Kroll Ontrack investigated a hard drive belonging to a pharmacist. The federal agency involved in the case believed the pharmacist was ordering inexpensive prescription drugs from other countries and selling them at his pharmacy for a large profit. Our investigation team made a mirror image of his hard drive and found several communications relating to the prescription drugs. They discovered the pharmacist knew the mail-order drugs were not the same as the brand name drugs he was supposed to sell at his pharmacy. They also found proof the pharmacist modified other legitimate shipping records to compensate for the amount of inexpensive drugs received from other countries. The pharmacist’s conduct led to jail time, large fines, and the loss of his pharmacy license.
*** If you would like to explore the opportunity
of Alan Brill speaking at a conference you are supporting
or organizing, please contact Amanda Karls at (952)
516-3637or at akarls@krollontrack.com.
***
TECHNOLOGY YOU SHOULD KNOW: ROLE OF THIRD PARTY NEUTRALS IN E-DISCOVERY AND FORENSIC INVESTIGATIONS
Any law firm or client involved in an e-discovery production or computer forensics investigation understands the complexity, time, and costs involved in these projects. In some cases, a high degree of technical aptitude is needed to navigate the issues and communicate with the opposing party and judge. In situations such as these, some parties have found success using a neutral third party expert to provide independent, non-biased processing or evaluation of the data involved in the case. In some highly contentious cases, the judge will order appointment of a third party neutral on his or her own accord.
In both situations, these experts typically work as officers of the court, ensuring data is properly preserved, technological best practices are employed, confidentiality and privacy are protected, and issues between the parties are resolved. An e-discovery expert acting as a third party neutral would collect, filter, process and host review and production databases for both parties, using separate technical resources and project management teams. A third party neutral engaged on a computer forensic case would image the computer media, assess the data involved, and only present relevant information to the parties and court, thus protecting any sensitive material.
The use of third party neutrals has become more common in e-discovery and forensic investigations because of the benefits for the overall litigation. Advantages of employing a third party neutral may include:
- Enhanced objectivity and balanced fairness across parties to protect privacy interests, attorney-client privilege, and irrelevant and non-discoverable information.
- Fewer discovery disputes and a level playing field regarding the technology methods used to collect, filter, or investigate the data.
- Greater predictability of completion timeframes given one individual or service provider is the main conduit for work.
- Decreased expense given the possibility for cost sharing between the parties.
The advantages associated with a third party neutral, however, come with some drawbacks. First, unless the court appoints the neutral expert, the parties must agree on who should be hired. Once a neutral expert is engaged, in very adversarial litigations, it can be difficult to convince both parties their confidences and communications with the expert will be fully protected. Many times, it is necessary to draft an agreement that delineates how confidences will be protected and communications will flow during litigation. Lastly, in computer forensic investigations, it may be necessary for a party to bring in a separate expert to provide expert opinion testimony, as the neutral expert could only provide objective testimony. In a recent case, Sony v. Arellanes, Case No. 4:05-CV-328 (E.D. Tex. Oct. 27, 2006), the judge ruled the defendant's hard drive could only be examined by a neutral third party computer forensics expert, not the Plaintiffs’ expert. The plaintiffs alleged that the defendant, using her personal computer, downloaded and distributed copyrighted sound recordings. The plaintiffs sought permission for their computer forensics expert to make a mirror image of the defendant's hard drive and to analyze it for evidence of illegal downloading and distribution. The defendant, citing invasion of privacy concerns, opposed the inspection of her computer hard drive by anyone other than a neutral third party expert. To balance the legitimate interests of both sides, the court found the defendant's suggestion had merit, with the cost of the neutral computer forensics expert born by the plaintiffs. The court provided the plaintiffs should have the right to suggest hard drive search methodologies to the neutral expert, and the expert should make every effort to use those methodologies. The neutral computer forensics expert was tasked with producing a report of his or her findings and the methodologies used.
With the new Federal Rules of Civil Procedure in place, courts will be calling for parties to work together and avoid drawn out electronic data disputes. Savvy legal teams will consider finding common ground with their opponents and engaging a neutral third party expert to assist in e-discovery productions and forensic investigations. Further, like in the Sony case, if privacy concerns are involved in the case, parties may want to consider requesting the appointment of a third party neutral. In both situations, an even-handed, technical intermediary may make great strides in bringing closure to the case.
KROLL ONTRACK NEWS & EVENTS
Meet Kroll Ontrack Representatives at the Following
Events:
Visit http://www.krollontrack.com/upcomingevents/
for more information on these events and others.
KROLL ONTRACK REQUESTS YOUR INPUT
Our legal consultants, project managers, and technology
experts strive to stay on top of electronic discovery
law. If you are aware of any additional local court
rulings or new cases in this area of the law, please
contact us by writing to mlange@krollontrack.com.
This newsletter is written by Michele C.S. Lange, staff
attorney with Kroll Ontrack. Ms. Lange has published
numerous articles and speaks regularly on the topics
of electronic discovery, computer forensics, and technology's
role in the law. She can be contacted by writing to
mlange@krollontrack.com.
For more information about electronic discovery and
computer forensics services, contact Kroll Ontrack at
1-800-347-6105 or http://www.krollontrack.com.
|
