In This Issue:

	FROM THE BENCH: COMPUTER FORENSIC EXPERTS PLAY CENTRAL ROLES IN TWO RECENT LITIGATIONS
	THE BRILL FILES: PROCESS-DRIVEN SPOLIATION - PART II
	TECHNOLOGY YOU SHOULD KNOW: COMPUTER FORENSIC TESTIMONY REQUIRES A QUALIFIED EXPERT
	NEWS & EVENTS

FROM THE BENCH: COMPUTER FORENSIC EXPERTS PLAY CENTRAL ROLES IN TWO RECENT LITIGATIONS

Court Orders Specific Computer Imaging and Examination Procedures
Cenveo Corp. v. Slater, 2007 WL 442387 (E.D. Pa. Jan. 31, 2007).  In a trade secrets misappropriation case, the parties presented two differing approaches for how electronic data contained on hard drives in the defendant’s possession would be produced to the plaintiff. The plaintiff requested the hard drives be completely imaged and given to a third-party expert to search for relevant information. Under the plaintiff’s approach, the expert would sign a confidentiality agreement to protect privileged information. The defendant argued that the parties must agree on search terms and the defendant will provide the search results from the hard drive images. The court agreed with the plaintiff and ordered a third-party computer forensic expert to image and examine the hard drives. The plaintiff will chose the expert and the actual imaging will take place on the defendant’s premises under the supervision of an expert chosen by the defendant. The court also ordered the expert to provide the defendant with a report of the recovered documents. The defendant must review the documents for privileged material and then produce relevant documents to the plaintiff.

Court Orders Deposition of Computer Forensic Expert
Roberts v. Canadian Pacific R.R. Ltd., 2007 WL 118901 (D. Minn. Jan. 11, 2007). In a claim relating to a train derailment accident, the plaintiff filed a motion to compel the production of an expert report from the defendant. During the state court proceeding, one of the defendant’s witnesses admitted to deleting a damaging e-mail. Subsequent to that admission, the defendant hired a computer forensic expert to determine if any e-mail had been destroyed and lost as evidence. The plaintiff filed for production of the expert’s report in this federal action. The defendant argued that federal law will preempt the plaintiff’s claim and, therefore, any spoliated evidence is irrelevant to the plaintiff’s case. However, the court disagreed with the defendant’s argument that there was “no harm, no foul” due to destroyed e-mail.  The court held that it “must insure that any ‘tradition’ of destroying derailment-related documents be discovered and brought to an end.” The court’s order stated that the plaintiff would be able to conduct limited discovery of the expert’s report by deposing the expert.

THE BRILL FILES: PROCESS-DRIVEN SPOLIATION - PART II

This article is the second part in a two-part series addressing process driven spoliation. Visit http://www.krollontrack.com/newsletters/cybercrime/feb07.pdf to review part one of this column.

Last month, I discussed Process-Driven Spoliation (PDS) and described how businesses utilize automated processes to destroy electronic documents. Although the automated PDS processes are an integral part of appropriate business procedures, failure to identify your clients’ PDS processes in a timely manner may result in sanctions if not halted when litigation is reasonably anticipated.    

But what is the best approach for counsel to consider, both in regard to their own clients and to opposing parties? The following steps will be helpful in planning your strategy.

• Issue Immediate Litigation Holds
  At the first sign of potential litigation, attorneys should contact their client and institute an immediate litigation hold. It should be broad enough to cover any potential areas of the suit, but narrow enough to not impose a large burden on your client’s business.

• List All PDS
  After a litigation hold is issued, the client’s I.T. department should list all automated processes that result in the destruction of data. This should specifically identify all portions of a company that are relevant to the actual or expected litigation.

• Maintain Contact
  Most importantly, attorneys should keep constant contact with their clients to ensure that the hold is actually taking place. Attorneys and clients may be sanctioned even if the instruction to hold documents is given but not properly followed by the party. An attorney should know: when the hold was issued, the time period of documents affected, names of the people responsible for the hold and detailed steps taken in response to your litigation hold requests.

• Keep Experts in Mind
  Lastly, if the technical issues are complex, you may want to engage an independent expert in the field.  Experts who work in the field can review the information provided by the I.T. department and provide attorneys with guidance in complex areas.

Approaching the Opposing Counsel with PDS Issues
When it comes to opposing counsel, you want to limit their ability to claim ignorance of processes that result in spoliation.  There are several steps to accomplish this:

• Issue a Preservation Letter
  Spoliation should be an agenda item in the early meet and confer session. Ask about potential sources of PDS with opposing counsel’s client and how PDS is being managed by the party. Of course, expect the same questions in return, and be prepared with answers.

• Identify Knowledgeable Persons
  If opposing counsel cannot sufficiently provide proper answers about PDS during the meet and confer, attorneys should ask opposing counsel who has knowledge about PDS and then depose them under FRCP Rule 30(b)(6) on an expedited basis. The person should be questioned on how PDS is being handled and if any potential evidence has been destroyed.

Conclusion
As an attorney you cannot simply inform your clients about PDS and issue a litigation hold.  Proper compliance with the new FRCP requires attorneys to maintain contact with their clients to ensure document destruction does not occur on their watch. The attorney properly prepared for PDS will not be the party sanctioned at the end of the day.

If you would like to explore the opportunity of Alan Brill speaking at a conference you are supporting or organizing, please contact Amanda Karls at 952 516 3637 or at akarls@krollontrack.com.

TECHNOLOGY YOU SHOULD KNOW: COMPUTER FORENSIC TESTIMONY REQUIRES A QUALIFIED EXPERT

With the recent amendments to the Federal Rules of Civil Procedure, cases are flooded with aspects of computer technology and the courts are faced with the daunting task of applying legal standards to new technologies. When it comes to courtroom testimony, courts are requiring expert standards for those testifying about results from forensic software used to investigate electronic media.

For instance, the U.S. Court of Appeals for the Sixth Circuit recently ruled in United States v. Ganier, 468 F.3d 920 (6th Cir. 2006) that a government witness’ proposed testimony about forensic software he used in case is expert testimony, and it must abide by Federal Rule of Evidence 702 concerning expert testimony. The court held that although the software used by the witness might be readily available to the public, the testimony constituted “scientific, technical, or other specialized knowledge” within the scope of the Federal Rules of Evidence. The court noted that a lay person using the software would not be able to formulate the kinds of conclusions formed by the witness and that some type of technical knowledge was needed by the witness.

The Ganier case involved criminal charges against the defendant for obstructing a federal investigation by deleting several electronic documents. In order to prove the charges against the defendant, the government hired a computer forensic expert to review the defendant’s computer. The government sought to introduce his reports as evidence one day prior to trial. However, the defendant challenged the forensic expert’s reports because he did not receive a written summary of the forensic expert’s report prior to trial as required under Fed. R. Crim. P. 16(a)(1)(G) for all expert reports.

The government argued that the forensic specialist was simply a lay witness and not an “expert” because he used software available to the general public and that he was simply reporting what he found using this software.

The court disagreed, stating that the “forensic tests [the witness] ran are more akin to specialized medical tests run by physicians.” However, the court did not preclude the proposed testimony. It noted that there are other remedies to protect against untimely disclosures of expert testimony and that the district courts should balance the government’s reasons for not disclosing the expert summary and the prejudice to the defendant.

The Ganier decision is likely the first of many cases applying an expert standard to the processes used by computer forensic experts.

NEWS & EVENTS

Meet our representatives at the following events:

Visit www.krollontrack.com/upcomingevents for more information on these events and others.

Back To Top

WE REQUEST YOUR INPUT

Our legal consultants, project managers, and technology experts strive to stay on top of e-discovery law. If you are aware of any additional local court rules or new cases in this area of the law, please contact us by writing to mlange@krollontrack.com. 

This newsletter is written by Michele C.S. Lange, an Ontrack Forensics staff attorney with Kroll. Ms. Lange has published numerous articles and speaks regularly on the topics of e-discovery, computer forensics, and technology’s role in the law. She can be contacted by writing to mlange@krollontrack.com.

For more information about e-discovery and computer forensics services, please call 800 347 6105 or visit www.krollontrack.com. To view a complete archive of Cyber Crime & Computer Forensics e-newsletters, please visit www.krollontrack.com/newsletters/cybercrime.aspx