| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forensic Discoveries Newsletter
November 2009 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Welcome to Forensic Discoveries' eDiscovery and Digital Forensics Newsletter. Keeping you and your practice informed of the ever-changing realm and value of Electronic Discovery and Digital Forensics is the purpose of this newsletter. If you have a colleague that may be interested in subscribing, follow the instructions at the bottom of this newsletter to be added to the distribution. If you choose not to continue receiving this newsletter, follow the directions at the bottom of this newsletter and accept our apologies for intruding. |
|
We hope you enjoyed our last newsletter article, "Scrubbing Metadata". Due to a steady increase in new subscribers, Forensics Discoveries will continue to list previous newsletters. As others have done, please let us know of a specific topic you would like to see covered.
We have added a new newsletter archive section to our website. The improved archive interface provides the same interaction with the newsletter as the distributed newsletter. View the new newsletter archive here. Below is a review of our previous newsletters:
|
|
When ESI isn't "there"
Like most industries, information technology sometimes
suffers confusion between which is most valuable: products or marketing. The
newest struggle in this fight is "cloud computing". I find great enjoyment in
watching commercials that market "the cloud", and then do not attempt to
describe what it is or why companies are using it. The common definitions and
explanations of cloud computing are very complex in describing a relatively
simple concept, storing data and applications somewhere else. While eDiscovery
can be challenging enough, clients using "the cloud" will add another level of
complexity to the process, but it is manageable. From an eDiscovery
perspective, this means that the ESI isn't "there".
"Cloud Computing" is defined by Wikipedia.org as Internet ("cloud") based
development and use of computer technology ("computing"). In concept,
it is a paradigm shift whereby details are abstracted from the users who no longer need
knowledge of, expertise in, or control over the technology infrastructure
"in the cloud" that supports them. I hope that clears things up
for you. Now you understand why the commercials are so abstract. I define
"cloud computing" as "a very large and
successful marketing initiative to sell the idea of storing applications and
data somewhere else." From the viewpoint of a company, it is appealing from
a financial perspective to add computing power, application upgrades, and data
storage without the need for large capital investments. In addition, cloud
computing can prevent additional operational costs required to employ
additional IT professionals to support the growth of the technical
infrastructure.
With all of the confusion surrounding cloud computing, the
fact is many of you have or are currently using it. The truth is, the basic
concept and operational features of cloud computing have been in place for
years. Google's Gmail and GoogleApps, Microsoft's Hotmail, Salesforce.com, and
YahooMail! are simple examples of cloud computing. Another great use of cloud
computing are Internet backup services such as carbonite.com. If your
eDiscovery vendor has given you the ability to remotely search and review ESI
that could be relevant to your case, that too is cloud computing. While your
clients may be using cloud computing in different forms and none should be
ignored, there are two specific uses that legal professionals need to pay very
close attention to in eDiscovery: email and backups.
So how do you
deal with ESI that is "in the cloud"? The simplest analogy for attorneys is to
treat it like paper. For some of your clients, all of their paper documents of
relevancy may not be stored in their facilities. They may rely on vendors like
Iron Mountain to handle or assist with their records management and storage of
paper documents. While the methodologies and tools will differ, the strategies
for obtaining paper documents from a vendor such as Iron Mountain are the same
as retrieving email from Google. The information isn't "there" and additional
efforts will be endured to obtain it. The success in obtaining ESI from the
cloud will depend on the technical expertise that you have assisting you. The
truth of the matter is, even if ESI is stored somewhere else, it belongs to
your client and information of relevancy may need to be reviewed and produced
in litigation.
As explanations vary from source to source, cloud computing
is one of the most confusing marketing initiatives in the information
technology field. Remote applications and storage have been used for years and
the substantial product offerings will continue to evolve. Whether email or
data backups, it is likely that you will encounter a situation in which your
client has, or you are requesting, ESI that is stored in a cloud-computing platform.
Rest assured that the "cloud" is not falling; it will just require some
additional expertise to identify, preserve, process, and review the information
that has potential relevance to your matter.
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Google Provides FREE Case Law Research
A little over a week ago, Google announced their newest offering, free case law research. With this offering, I can think of a couple of companies that just removed Google.com from their Christmas card list. I would be very interested in feedback on how well this free service compares with the commercial offerings. The website can be accessed here. |
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Changing State E-Discovery Laws and Rules
The Federal Rules guiding eDiscovery laws went into effect on December 1, 2006. Since that time, many states are beginning to adopt similar rules and keeping up with the specific laws for each state can be "challenging" the say the least. Finally, Applied Discovery has created a website that lists the rules for each state. The website can be found here. This is a great resource that I have bookmarked and encourage you to do the same. Kroll also has a great resource for State level rules. It can be accessed by clicking here.
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FBI Says Hackers Targeting Law Firms, PR Companies
Many law firms have given little to no thought to the fact that they could be targets for cyberattacks. However, law firms contain on of the most valuable assets in today's society, sensitive information.
"Hackers are increasingly targeting law firms and public relations
companies with a sophisticated e-mail scheme that breaks into their
computer networks to steal sensitive data, often linked to large
corporate clients doing business overseas.The FBI has issued an
advisory that warns companies of "noticeable increases" in efforts to
hack into the law firms' computer systems _ a trend that cyber experts
say began as far back as two years ago but has grown dramatically." Read the entire article here |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Divorce
lawyers find evidence on Facebook
Facebook now has a population that equals that of the United States, more than 300 million. Although we are a society that demands privacy, Facebook users disclose a wealth of information both intentionally and unintentionally. As an example, Facebook activity provided issues in the jury selection for the Christian-Newsom torture slaying trial in October of this year. As this article describes, Facebook activity is beginning to a role in divorce matters. One challenge that attorneys face when trying to gather information from Facebook, or other social media sites, is when someone's profile is "protected" and cannot be viewed unless permission is given. Although the online profile itself may be protected, the computers used to access the Facebook profile contain much of the Facebook activity that can often be recovered and produced.
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Four in 10 workers have stolen corporate data, says survey
Another study was recently performed to determine to what extent employees were stealing sensitive information from their employers. The study revealed that 40% of the respondents admitted to stealing their employers data. Speaking from the case load currently in our forensic labs, the statistics are true. In 2009, approximately 35% of our investigations have involved intellectual property and trade secret theft. For more information on trade secret and intellectual property theft, see our July 2009 newsletter. |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Businesses are ill-prepared for e-discovery, warn lawyers
"In-house lawyers are concerned that their businesses are
unable to respond to legal demands to retrieve electronic
documents, a survey of lawyers at 200 global companies
reveals."
Read the entire article by clicking here |
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Upcoming Speaking Engagements and Publications
Chattanooga BAR e-Discovery Workshop
February 4th, 2010 Chattanooga Offices of Miller & Martin PLLC details for registration will be published soon
United
States Magistrate Judge Clifford Shirley, Chuck Young from Kramer
Rayson, and I have decided to take a fresh approach to the eDiscovery
seminar. Rather than lecturing on the familiar talking points, we will
take an interactive walk through the application of eDiscovery laws and
technologies to situations you should expect to encounter. We will
examine six different scenarios, and in each we will provide applicable
law, technology insights, and the perspective of a judge who hears and
decides eDiscovery disputes. You'll learn more than what the law is:
you'll learn how it works in bits and bytes, and what courts expect
from you and your clients.
Knoxville BAR Association - Federal Court Bench and BAR Conference
May 14th, 2010
United
States Magistrate Judge Clifford Shirley, Chuck Young from Kramer
Rayson, and I will again provide an eDiscovery presentation.
Digital Forensics Magazine Bill Dean published an article titled, "Companies Operating in the USA Need to Prepare Right Now" which covers the updated U.S. Federal Rules of Civil Procedure and their impact on companies and the discipline of computer forensics. The online version of the magazine can be found here |
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
EDiscovery Case Law
Court Holds Parties
Accountable for Failure to Timely Produce Documents Stored on a
"Shared" Directory
Wixon v.
Wyndham Resort Dev. Corp., 2009 WL 3075649 (N.D. Cal. Sept. 21,2009)
In this litigation, the
parties filed several motions regarding the special master's report. The report
found the defendants' violation of a previous production agreement was harmless
but still held the defendants responsible for 75 percent of the fees related to
the special master proceeding. In particular, the plaintiffs objected to the
special master's finding that the defendants' noncompliant production was
harmless. Addressing the
timeliness of the production, the court upheld the report with respect to 47 of
the documents because they did not contain any keywords selected by the
plaintiffs. However, the court rejected the portion of the report that
pertained to the defendants' failure to produce documents stored on a
"shared" directory in a timely manner, noting the defendants should
have noticed a flaw in the custodian-based search when a group of potentially relevant
documents had no custodian. Based on this failure, the court issued sanctions,
which included
requiring the defendants to bear expenses
incurred by the plaintiffs in preparing the motion to strike and the full cost
of the special master's fees.
Court Grants Preclusion Sanctions for Pattern of Stubborn Defiance Regarding E-Discovery
Bray & Gillespie Mgmt. LLC v. Lexington Ins. Co., 2009 WL 2407754 (M.D. Fla. Aug. 3, 2009)In this ongoing insurance litigation, the defendants sought dismissal
sanctions or preclusion of evidence pertaining to a key business
interruption loss claim. The defendants argued the plaintiffs'
violation of three court orders to compel production,
misrepresentations that discovery was complete and production of 188
pages of key documents after the close of discovery warranted
sanctions. In opposition, the plaintiffs argued they had no reason to
know the production was incomplete. Finding that none of the court's
previous efforts were effective to defer the plaintiffs from
"continuing their pattern of stubborn defiance," the magistrate judge
determined severe sanctions were warranted. In cataloging the
plaintiffs' discovery failures, the magistrate judge noted that "no
reasonable person could conclude" the plaintiffs' failure to timely
produce documents was justified and that the plaintiffs' conduct was
intended to deceive and prevent discovery. The magistrate judge also
discussed the attorneys' role in the discovery misconduct, noting
lawyers owe a duty of candor to the court and a duty to deal honestly
and fairly with opposing counsel. Accordingly, the magistrate judge
granted the motion for preclusion sanctions and determined the
plaintiffs and counsel were jointly and severally responsible for the
defendants' expenses and costs. Court Orders Production of Litigation Hold Letters upon Preliminary Finding of Spoliation Major Tours, Inc. v. Colorel, 2009 WL 2413631 (D.N.J. Aug. 4, 2009)In this discrimination litigation, the plaintiffs sought production of
the defendants' two litigation hold letters. The plaintiffs argued the
letters were relevant to their examination of the defendants' document
production and whether spoliation occurred. In opposition, the
defendants claimed the plaintiffs failed to demonstrate evidence of
spoliation and thus the letters were protected from discovery. Noting
that litigation hold letters are in general privileged and not
discoverable unless spoliation occurs, the court found a preliminary
showing of spoliation existed in this case. The court inferred that
relevant evidence was lost given the failure to timely ask a number of
pertinent custodians to preserve evidence in addition to the
significant time lapse that occurred between the duty to preserve and
the issuance of the first litigation hold letter. Accordingly, the
court granted the plaintiffs' production request, limiting it to those
portions of the letters pertaining to preservation. Court Issues Sanctions for Preservation and Litigation Hold FailuresGreen v. McClendon, 2009 WL 2496275 (S.D.N.Y. Aug. 13, 2009)In this breach of contract dispute, the plaintiff sought sanctions
alleging the defendants failed to preserve and produce electronically
stored information (ESI). Finding the duty to preserve arose no later
than the lawsuit's filing, the court determined the defendants' counsel
failed to meet discovery obligations by neglecting to issue a
litigation hold and properly search for responsive documents. Despite
these failures, the court declined to issue an adverse inference
instruction since there was no proof that the defendants' actions
created an unfair evidentiary imbalance, noting the absence of evidence
that any relevant information was destroyed. However, the court held
other sanctions were appropriate, including further discovery of ESI
and an award of attorneys' fees and costs to be allocated among the
defendants and counsel once the "respective blame-worthiness" was
determined. Court Foresees Day When a Lack of Internal E-Discovery Software Will not be Well ReceivedCapitol Records, Inc. v. MP3tunes, LLC, 2009 WL 2568431 (S.D.N.Y. Aug. 13, 2009)In this copyright infringement litigation, the court addressed several
discovery disputes it claimed could have been avoided if the parties
had "focused their attention on discussing their differences, rather
than drafting dueling epistles." Addressing the defendant's issues, the
court did not agree with the defendant that producing and searching
files would be unduly burdensome. Thus the court ordered the defendant
to conduct thirty searches proposed by the plaintiffs, which included
additional custodians. The court then addressed the plaintiffs'
arguments that the discovery sought by the defendant was unduly
burdensome in part because they were unable to conduct centralized
e-mail searches without relying on an outside service provider. Noting
that the day will come when the burden argument based on a large
organization's lack of internal e-discovery software will not be well
received, the court found that e-discovery case law had not yet
developed to this point. Therefore, the court upheld the plaintiffs'
argument and concluded that the e-mail files the defendant sought to
search were not reasonably accessible. Finally, the court considered
the specific document requests from the defendant to the plaintiffs
that were at issue, and restricted the search terms and production
scope as appropriate for each request.
Court Imposes Sanctions for Destruction of Information Contained on BlackBerry SmartphonesSe. Mech. Servs., Inc., v. Brody, 2009 WL 2883057 (M.D. Fla. Aug. 31, 2009)In this ongoing computer fraud and abuse litigation, the plaintiff
requested sanctions alleging the laptops and BlackBerry smartphones
belonging to the defendants were wiped of data. The defendants argued
that all evidence was preserved on the servers and that e-mails were
produced in hard copy from the servers. Relying on explanations
provided by computer forensics experts that the "wiped" state of the
BlackBerry smartphones was attributed to intentional and deliberate
actions, the court disagreed with the defendants' arguments and held
that sanctions were appropriate. Given the nature of the destroyed
evidence, including personal e-mails, telephone records, text messages
and calendar entries, the court determined the evidence was likely
unfavorable to the defendants and therefore issued an adverse inference
instruction.
| |