Logo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forensic Discoveries Newsletter

November 2009
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Welcome to Forensic Discoveries' eDiscovery and Digital Forensics Newsletter. Keeping you and your practice informed of the ever-changing realm and value of Electronic Discovery and Digital Forensics is the purpose of this newsletter. If you have a colleague that may be interested in subscribing, follow the instructions at the bottom of this newsletter to be added to the distribution. If you choose not to continue receiving this newsletter, follow the directions at the bottom of this newsletter and accept our apologies for intruding.
in this issue
When ESI isn't "there"
Google Provides FREE Case Law Research
Changing State E-Discovery Laws and Rules
FBI Says Hackers Targeting Law Firms
Divorce lawyers find evidence on Facebook
Four in 10 workers have stolen corporate data
Businesses are ill-prepared for e-discovery
Upcoming Speaking Engagements and Publications
EDiscovery Case Law
Previous Newsletters
 
We hope you enjoyed our last newsletter article, "Scrubbing Metadata". Due to a steady increase in new subscribers, Forensics Discoveries will continue to list previous newsletters. As others have done, please let us know of a specific topic you would like to see covered.

We have added a new newsletter archive section to our website. The improved archive interface provides the same interaction with the newsletter as the distributed newsletter. View the new newsletter archive here.
 Below is a review of our previous newsletters:
 

August 2007 - "What is Computer Forensics?"

September 2007 - "Preparing Your Clients for EDiscovery - Part 1"
October 2007 - "Preparing Your Clients for EDiscovery - Part 2"
November 2007 - "Preparing for Your Clients' EDiscovery"
December 2007 - "Why Does My Case Need Electronic Discovery?"
February 2008 - "Computer Forensics Proves Intelletual Property Theft"
March 2008 - "In Search of the Holy Grail"
May 2008 - "When to Preserve"
June 2008 - "Electronic Discovery in Workplace Litigation"
July 2008 -
"Proving Spoliation with Computer Forensics"
August 2008 - "Proposed Updated TN Rules of Civil Procedure"
When ESI isn't "there"
 
Like most industries, information technology sometimes suffers confusion between which is most valuable: products or marketing. The newest struggle in this fight is "cloud computing". I find great enjoyment in watching commercials that market "the cloud", and then do not attempt to describe what it is or why companies are using it. The common definitions and explanations of cloud computing are very complex in describing a relatively simple concept, storing data and applications somewhere else. While eDiscovery can be challenging enough, clients using "the cloud" will add another level of complexity to the process, but it is manageable. From an eDiscovery perspective, this means that the ESI isn't "there".

"Cloud Computing" is defined by Wikipedia.org as Internet ("cloud") based development and use of computer technology ("computing"). In concept, it is a paradigm shift whereby details are abstracted from the users who no longer need knowledge of, expertise in, or control over the technology infrastructure "in the cloud" that supports them. I hope that clears things up for you. Now you understand why the commercials are so abstract. I define "cloud computing" as "a very large and successful marketing initiative to sell the idea of storing applications and data somewhere else." From the viewpoint of a company, it is appealing from a financial perspective to add computing power, application upgrades, and data storage without the need for large capital investments. In addition, cloud computing can prevent additional operational costs required to employ additional IT professionals to support the growth of the technical infrastructure.

With all of the confusion surrounding cloud computing, the fact is many of you have or are currently using it. The truth is, the basic concept and operational features of cloud computing have been in place for years. Google's Gmail and GoogleApps, Microsoft's Hotmail, Salesforce.com, and YahooMail! are simple examples of cloud computing. Another great use of cloud computing are Internet backup services such as carbonite.com. If your eDiscovery vendor has given you the ability to remotely search and review ESI that could be relevant to your case, that too is cloud computing. While your clients may be using cloud computing in different forms and none should be ignored, there are two specific uses that legal professionals need to pay very close attention to in eDiscovery: email and backups.

 So how do you deal with ESI that is "in the cloud"? The simplest analogy for attorneys is to treat it like paper. For some of your clients, all of their paper documents of relevancy may not be stored in their facilities. They may rely on vendors like Iron Mountain to handle or assist with their records management and storage of paper documents. While the methodologies and tools will differ, the strategies for obtaining paper documents from a vendor such as Iron Mountain are the same as retrieving email from Google. The information isn't "there" and additional efforts will be endured to obtain it. The success in obtaining ESI from the cloud will depend on the technical expertise that you have assisting you. The truth of the matter is, even if ESI is stored somewhere else, it belongs to your client and information of relevancy may need to be reviewed and produced in litigation.

As explanations vary from source to source, cloud computing is one of the most confusing marketing initiatives in the information technology field. Remote applications and storage have been used for years and the substantial product offerings will continue to evolve. Whether email or data backups, it is likely that you will encounter a situation in which your client has, or you are requesting, ESI that is stored in a cloud-computing platform. Rest assured that the "cloud" is not falling; it will just require some additional expertise to identify, preserve, process, and review the information that has potential relevance to your matter.
 
 
 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Google Provides FREE Case Law Research

A little over a week ago, Google announced their newest offering, free case law research.  With this offering, I can think of a couple of companies that just removed Google.com from their Christmas card list. I would be very interested in feedback on how well this free service compares with the commercial offerings. The website can be accessed here.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Changing State E-Discovery Laws and Rules

The Federal Rules guiding eDiscovery laws went into effect on December 1, 2006. Since that time, many states are beginning to adopt similar rules and keeping up with the specific laws for each state can be "challenging" the say the least. Finally, Applied Discovery has created a website that lists the rules for each state. The website can be found here. This is a great resource that I have bookmarked and encourage you to do the same. 

Kroll also has a great resource for State level rules. It can be accessed by clicking here.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FBI Says Hackers Targeting Law Firms, PR Companies

Many law firms have given little to no thought to the fact that they could be targets for cyberattacks. However, law firms contain on of the most valuable assets in today's society, sensitive information.

"Hackers are increasingly targeting law firms and public relations companies with a sophisticated e-mail scheme that breaks into their computer networks to steal sensitive data, often linked to large corporate clients doing business overseas.The FBI has issued an advisory that warns companies of "noticeable increases" in efforts to hack into the law firms' computer systems _ a trend that cyber experts say began as far back as two years ago but has grown dramatically."

Read the entire article here
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Divorce lawyers find evidence on Facebook

Facebook now has a population that equals that of the United States, more than 300 million.  Although we are a society that demands privacy, Facebook users disclose a wealth of information both intentionally and unintentionally. As an example, Facebook activity provided issues in the jury selection for the Christian-Newsom torture slaying trial in October of this year. As this article describes, Facebook activity is beginning to a role in divorce matters.

One challenge that attorneys face when trying to gather information from Facebook, or other social media sites, is when someone's profile is "protected" and cannot be viewed unless permission is given. Although the online profile itself may be protected, the computers used to access the Facebook profile contain much of the Facebook activity that can often be recovered and produced.
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Four in 10 workers have stolen corporate data, says survey

Another study was recently performed to determine to what extent employees were stealing sensitive information from their employers. The study revealed that 40% of the respondents admitted to stealing their employers data. Speaking from the case load currently in our forensic labs, the statistics are true. In 2009, approximately 35% of our investigations have involved intellectual property and trade secret theft. For more information on trade secret and intellectual property theft, see our July 2009 newsletter.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Businesses are ill-prepared for e-discovery, warn lawyers

"In-house lawyers are concerned that their businesses are unable to respond to legal demands to retrieve electronic documents, a survey of lawyers at 200 global companies reveals."

 
Read the entire article by clicking here
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
 
Upcoming Speaking Engagements and Publications

  Chattanooga BAR e-Discovery Workshop

February 4th, 2010
Chattanooga Offices of Miller & Martin PLLC
details for registration will be published soon

United States Magistrate Judge Clifford Shirley, Chuck Young from Kramer Rayson, and I have decided to take a fresh approach to the eDiscovery seminar.  Rather than lecturing on the familiar talking points, we will take an interactive walk through the application of eDiscovery laws and technologies to situations you should expect to encounter.  We will examine six different scenarios, and in each we will provide applicable law, technology insights, and the perspective of a judge who hears and decides eDiscovery disputes. You'll learn more than what the law is: you'll learn how it works in bits and bytes, and what courts expect from you and your clients.


Knoxville BAR Association - Federal Court Bench and BAR Conference

May 14th, 2010

United States Magistrate Judge Clifford Shirley, Chuck Young from Kramer Rayson, and I will again provide an eDiscovery presentation.


Digital Forensics Magazine

Bill Dean published an article titled, "Companies Operating in the USA Need to Prepare Right Now" which covers the updated U.S. Federal Rules of Civil Procedure and their impact on companies and the discipline of computer forensics. The online version of the magazine can be found here

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
EDiscovery Case Law



Court Holds Parties Accountable for Failure to Timely Produce Documents Stored on a "Shared" Directory
 
  Wixon v. Wyndham Resort Dev. Corp., 2009 WL 3075649 (N.D. Cal. Sept. 21,2009)

In this litigation, the parties filed several motions regarding the special master's report. The report found the defendants' violation of a previous production agreement was harmless but still held the defendants responsible for 75 percent of the fees related to the special master proceeding. In particular, the plaintiffs objected to the special master's finding that the defendants' noncompliant production was
harmless. Addressing the timeliness of the production, the court upheld the report with respect to 47 of the documents because they did not contain any keywords selected by the plaintiffs. However, the court rejected the portion of the report that pertained to the defendants' failure to produce documents stored on a "shared" directory in a timely manner, noting the defendants should have noticed a flaw in the custodian-based search when a group of potentially relevant documents had no custodian. Based on this failure, the court issued sanctions, which included
requiring the defendants to bear expenses incurred by the plaintiffs in preparing the motion to strike and the full cost of the special master's fees. 


Court Grants Preclusion Sanctions for Pattern of Stubborn Defiance Regarding E-Discovery

Bray & Gillespie Mgmt. LLC v. Lexington Ins. Co., 2009 WL 2407754 (M.D. Fla. Aug. 3, 2009)

In this ongoing insurance litigation, the defendants sought dismissal sanctions or preclusion of evidence pertaining to a key business interruption loss claim. The defendants argued the plaintiffs' violation of three court orders to compel production, misrepresentations that discovery was complete and production of 188 pages of key documents after the close of discovery warranted sanctions. In opposition, the plaintiffs argued they had no reason to know the production was incomplete. Finding that none of the court's previous efforts were effective to defer the plaintiffs from "continuing their pattern of stubborn defiance," the magistrate judge determined severe sanctions were warranted. In cataloging the plaintiffs' discovery failures, the magistrate judge noted that "no reasonable person could conclude" the plaintiffs' failure to timely produce documents was justified and that the plaintiffs' conduct was intended to deceive and prevent discovery. The magistrate judge also discussed the attorneys' role in the discovery misconduct, noting lawyers owe a duty of candor to the court and a duty to deal honestly and fairly with opposing counsel. Accordingly, the magistrate judge granted the motion for preclusion sanctions and determined the plaintiffs and counsel were jointly and severally responsible for the defendants' expenses and costs.

Court Orders Production of Litigation Hold Letters upon Preliminary Finding of Spoliation

Major Tours, Inc. v. Colorel, 2009 WL 2413631 (D.N.J. Aug. 4, 2009)

In this discrimination litigation, the plaintiffs sought production of the defendants' two litigation hold letters. The plaintiffs argued the letters were relevant to their examination of the defendants' document production and whether spoliation occurred. In opposition, the defendants claimed the plaintiffs failed to demonstrate evidence of spoliation and thus the letters were protected from discovery. Noting that litigation hold letters are in general privileged and not discoverable unless spoliation occurs, the court found a preliminary showing of spoliation existed in this case. The court inferred that relevant evidence was lost given the failure to timely ask a number of pertinent custodians to preserve evidence in addition to the significant time lapse that occurred between the duty to preserve and the issuance of the first litigation hold letter. Accordingly, the court granted the plaintiffs' production request, limiting it to those portions of the letters pertaining to preservation.

Court Issues Sanctions for Preservation and Litigation Hold Failures

Green v. McClendon, 2009 WL 2496275 (S.D.N.Y. Aug. 13, 2009)

In this breach of contract dispute, the plaintiff sought sanctions alleging the defendants failed to preserve and produce electronically stored information (ESI). Finding the duty to preserve arose no later than the lawsuit's filing, the court determined the defendants' counsel failed to meet discovery obligations by neglecting to issue a litigation hold and properly search for responsive documents. Despite these failures, the court declined to issue an adverse inference instruction since there was no proof that the defendants' actions created an unfair evidentiary imbalance, noting the absence of evidence that any relevant information was destroyed. However, the court held other sanctions were appropriate, including further discovery of ESI and an award of attorneys' fees and costs to be allocated among the defendants and counsel once the "respective blame-worthiness" was determined.

Court Foresees Day When a Lack of Internal E-Discovery Software Will not be Well Received

Capitol Records, Inc. v. MP3tunes, LLC, 2009 WL 2568431
(S.D.N.Y. Aug. 13, 2009)


In this copyright infringement litigation, the court addressed several discovery disputes it claimed could have been avoided if the parties had "focused their attention on discussing their differences, rather than drafting dueling epistles." Addressing the defendant's issues, the court did not agree with the defendant that producing and searching files would be unduly burdensome. Thus the court ordered the defendant to conduct thirty searches proposed by the plaintiffs, which included additional custodians. The court then addressed the plaintiffs' arguments that the discovery sought by the defendant was unduly burdensome in part because they were unable to conduct centralized e-mail searches without relying on an outside service provider. Noting that the day will come when the burden argument based on a large organization's lack of internal e-discovery software will not be well received, the court found that e-discovery case law had not yet developed to this point. Therefore, the court upheld the plaintiffs' argument and concluded that the e-mail files the defendant sought to search were not reasonably accessible. Finally, the court considered the specific document requests from the defendant to the plaintiffs that were at issue, and restricted the search terms and production scope as appropriate for each request.

Court Imposes Sanctions for Destruction of Information Contained on BlackBerry Smartphones

Se. Mech. Servs., Inc., v. Brody, 2009 WL 2883057 (M.D. Fla. Aug. 31, 2009)

In this ongoing computer fraud and abuse litigation, the plaintiff requested sanctions alleging the laptops and BlackBerry smartphones belonging to the defendants were wiped of data. The defendants argued that all evidence was preserved on the servers and that e-mails were produced in hard copy from the servers. Relying on explanations provided by computer forensics experts that the "wiped" state of the BlackBerry smartphones was attributed to intentional and deliberate actions, the court disagreed with the defendants' arguments and held that sanctions were appropriate. Given the nature of the destroyed evidence, including personal e-mails, telephone records, text messages and calendar entries, the court determined the evidence was likely unfavorable to the defendants and therefore issued an adverse inference instruction.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Forensic Discoveries is available to provide onsite presentations or Q&A sessions on topics such as Electronic Discovery, Technical Implications of the updated Federal Rules of Civil Procedure, or Computer Forensics. Forensic Discoveries is also available to you, obligation free, to answer any specific questions pertaining to these topics. Simply give us a call and we will be glad to answer any questions pertaining to Electronic Discovery and Digital Forensics.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

a division of Sword & Shield

   Knoxville Office

   Phone:    (865)-244-3500

   Address:  1431 Centerpoint Blvd, Suite 150

                  Knoxville, TN 37932


   Washington D.C. Office

   Phone:    (410)-414-5580

   Address:  1425 K Street NW, Suite 350

                 Washington, DC 20005-3514


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

If you have a topic that you would like addressed in the newsletter, please let us know. Either visit http://www.forensicdiscoveries.com/newsletter.html and submit your suggestion there or reply to this e-mail with your suggestion. 

For previous versions of Forensic Discoveries EDiscovery newsletters, click here 

This document does not provide legal or other professional advice and should not be relied upon as anything other than a starting point for research and information on the subject of electronic evidence and digital forensics.