Electronic Data Records Law | How to Win E-Discovery

Real-Time Evidence for Cloud Investigations

Narrated Screencast Assures Investigator’s Personal Accountability 

The collection of cloud evidence vexes investigators, whether they be police, auditors or consumer watchdogs.  As more and more social and commercial interactions occur in the Internet cloud, new methods are needed for proving what happened. 

Traditional Forensics Methods Usually Don't Apply in the Cloud

Traditional digital forensics emphasizes an investigator gaining access to data stored on a computer, such as in a hard drive, where records show what happened through the computer (web surfing, email writing).  Yet our digital lives are becoming centered less in our computers and more in the cloud, where we mingle by way of numerous, increasingly mobile, disposable, interchangeable devices.  An investigator may never get access to the relevant user or service provider device(s), even though he can witness a live online event by connecting to it through his own computer.

Online content is ephemeral.  A Facebook Wall can show one thing now and something different a minute later.  A chat session or an online game can transpire in a flash.  How should a professional investigator record the activity on a FB Wall or in a chat session?

Screenshots Miss a Lot of Detail

 Granted, the investigator can take a screenshot or make a log file of activity, but such a record can be sketchy. 

Screencast Video Captures Detail and Interaction

A better record would capture a stream of all the text, images, motion and sounds in a online activity – what’s known as a screencast.

Still, a record is like a rumor.  It’s worthless unless a credible witness can explain and vouch for it. 

So I propose a recording that unites a screencast with compelling, eyewitness testimony.  It’s a split-screen video record simultaneously showing what an investigator sees and his real-time narration of events.  Let me demonstrate:

 

The video depicts an investigator memorializing what he sees in a live interaction with another party, in this case a thief hawking stolen product plans. It shows him explaining through his webcam as he chats, clicks and observes.  He reads directly into his video report his identity, his purpose, and his authorization.  At the end he takes responsibility by formally signing and vouching for his record, in a way that would appeal to a skeptical audience, such as a jury, a judge, a journalist or a panel of lawmakers.

The rich detail captured in the video facilitates later review of the investigator’s work by a third party.


Compare Log File

In the video, the exchange with the thief occurs through Windows Live Messenger, which does allow for creation of this activity log.

But notice the log misses much of the action.  It shows no images or mouse movements.  It completely ignores Scooter Montgomery’s dramatic visual display of the stolen document.


Problem Investigations

Is a better way to record online investigations really needed?  Have online investigations ever been discredited due to poor records?  Yes.  

In one series of cases, the Recording Industry Association of America hired MediaSentry to find copyright infringers sharing music on peer-to-peer networks. MediaSentry said it identified some infringers and produced logs and screenshots as evidence.  But an expert criticized the credibility of MediaSentry’s evidence in court, and a leading critic sounded authoritative when the Wall Street Journal quoted him calling MediaSentry’s evidence collection “sloppy.”  RIAA terminated its relationship with MediaSentry.

In another case, the district attorney for Collin County, Texas, dropped charges against alleged pedophiles on account of weak evidence of online activity.  Investigators for a public-interest group named Perverted Justice claimed to have engaged the suspects in incriminating chat sessions, but police lacked confidence in the trustworthiness of the logs Perverted Justice produced to show what happened in the sessions. 

The split-screen video demonstrated above compiles a more complete and credible record.

Update:  Here's another application of the split-screen record.  The operator of a surveillance camera could narrate and authenticate, in real-time, what she sees by way of the camera.  The camera might be mounted on a building.  Or it might be on a police or military drone.

I'd be honored to hear your comments.

–Benjamin Wright

Mr. Wright teaches the Law of Data Security and Investigations at the SANS Institute. 

The software used to record the split-screen video is BBFlashback.  See Mr. Wright's other use of split-screen video for recording an online investigation or an online agreement.  See his video on undercover officers securing evidence from a social network.

Related: How to memorialize function of online Bitcoin wallet.

Tax Enforcement Intelligence | World Wide Web No Trespassing Sign

State Revenue Department Snooping and Audit

The controller of an SME in North Carolina recently got a call from the tax authority in California (Board of Equalization), saying the authority had web evidence the SME was doing business in California and needed to file a use tax
return.  State revenue departments are becoming more assertive in enforcing use tax, which applies when a taxpayer uses a taxable product or service in a state but did not pay sales tax on it.

The SME was indeed starting a sales office in California, and the controller was impressed at how quickly the California authority discovered that information on the web.

Tax Intelligence Collection

Make no mistake about it; tax authorities are exploiting the web for intelligence. Laura Saunders, "Is 'Friending' in Your Future? Better Pay Your Taxes First," Wall Street Journal, Aug 27, 2009.

But many taxpayers would prefer that tax collectors not come into their web pages to gather information, just as they prefer the collectors stay away from the taxpayers’ land, homes, offices and factories. In the physical world a taxpayer can post a no trespassing sign to keep out tax agents (unless they have a search warrant) and other personae non-gratae. Why can’t a taxpayer post a no trespassing sign on its web page as well?*

No Trespassing Notice

US case law hints that a web site owner can enforce a no trespassing sign.  For example:

eBay Inc. v. Bidder's Edge, Inc., 100 F. Supp. 2d 1058 (ND Cal., May 24, 2000): Competitor trespassed as to eBay’s servers when it systematically scrapped data from eBay’s web site in violation of eBay’s published terms.

Creative Computing v. Get Loaded: Web site owner wins judgment (under federal Computer Fraud and Abuse Act) against competitor who used stolen password to access owner’s site without authority. 

Here is an example of no trespassing language for a web site:

“Warning.  No trespassing. This web site is exclusively for the benefit of ABC Corp., its customers, prospective customers, vendors, prospective vendors, employees and prospective employees.  It is not for tax agents, tax collectors, tax authorities or programs or contractors operating on behalf of the same (collectively, “Tax Authorities”).  Tax Authorities are forbidden from using, entering or copying information this web site.  All Tax Authorities accessing this warning agree to its terms.  Violation of this warning constitutes, among other offenses, trespass, breach of contract, and entry of a computer without authority causing damage.”

What do you think, gentle reader?

Update April 2011:  Students in my SANS course commented that the no trespassing sign as written above will make a company a target for a tax audit.  Therefore, they suggested making the words of the no trespassing sign more generic in its description of who is allowed in and who is not.  In reaction to their comments, I have rewritten the no trespassing sign I present in the course.

Update August 2011:  HM Revenue & Customs says it will be using web robots to find tax cheats. 

–Benjamin Wright

Mr. Wright teaches Internet law and investigations at the SANS Institute.

The foregoing is public discussion, not legal advice for any particular situation.  If you need legal advice, you should consult a lawyer.

* A no trespassing sign might deter the gathering of OSINT (open source intelligence) by many kinds of adversaries (bill collectors, divorce lawyers), not just tax authorities.

Related Article: Tax auditors demand more data

Custom Professional Training

Tutorials | Questions Answered

Price | Professional Credit | E-Policy Workshop

Many professionals who visit this blog are looking for education on electronic records or technology law. Mr. Wright can deliver custom tutorials on the topics important to you right now.  A tutorial can be one hour, two hours, a half-day, or more.

Benjamin Wright has much experience training professionals on such topics as e-discovery, e-record privacy, data security law, cyber defense investigations, record retention policies, BYOD, e-commerce records and contracts, and more.

Now he delivers this continuing professional education on a tailored, as-needed basis.  Tell him what interests you, and he will work with you to develop a curriculum and a delivery plan.  The number of students could be one, two, 100, or more.

The method of delivery could be Webex, on-site, telephone conference, or something else, depending your needs and resources. A tutorial could combine lecture and interactive Q & A.

To discuss, please call Mr. Wright at 1.214.403.6642.


Price

Price would depend on many factors, such as the length of seminar time, the medium of delivery, out-of-pocket expenses, and the amount of advanced preparation involved.  A one-hour briefing by Mr. Wright to a small audience (delivered by telephone call you initiate) on a topic for which he already has material, could cost as little as $375.


Continuing Professional Education Credit

Many professionals – auditors, lawyers, investigators, accountants, records managers, security professionals -- need continuing professional education (CPE and CLE) hours.  Mr. Wright's tutorials are of a quality to support the granting of credit.  Mr. Wright will be happy to sign a letter confirming that any particular professional participated in a seminar.  However, the application for and obtaining of credit will be the responsibility of the individual professional.

Rules for continuing legal education credit vary by jurisdiction.  Often an attorney can obtain credit by applying for it after attending a seminar.


Policy Workshop

Mr. Wright and Messaging Architects deliver an in-house workshop for developing enterprise policy on BYOD and the retention, destruction and management of electronic records, especially e-mail.

=
Statement from Andrew Scygiel, Merck & Co., Inc. to Mr. Wright:  "Thanks again for a great class and very insightful information.  You have really changed my view of records and I have 'aspired' to be much more aware of our policy and how today's climate can affect us."

As senior legal instructor at the SANS Institute, Mr. Wright emphasizes that -- in response to an IT security incident -- an effective public message is just as critical as the technical and legal responses.

Metadata | Email Discovery Control

Logs and Audit Trails for Data Privacy and Internal Control

Filtering Attorney Work Product

Electronic records such as email serve as memorials of business actions and as evidence of legal responsibility.  But they are also vulnerable to abuse by privacy infringers or trade secret thieves.

One key to protecting e-records is metadata.  Meta-data comprises all the ancillary notes and audit trail surrounding a given record (a given e-mail) . . . the system logs showing when a record was created, who accessed it and when, how and when it was changed, to whom it was forwarded and possibly much more.  Metadata can illuminate an auditor or detective about the status, the history or the security of the record in question.

For records containing personally identifiable information (PII), good meta-data can be invaluable as an instrument of privacy.  Metadata can deter a snoop.  A busybody in a hospital  who wants to peek at a celebrity’s patient record will think twice before doing so if he knows the system will create an audit trail showing what he saw and when he saw it.  Further, in the investigation of a hacker incident, system logs can inform whether (for instance) the crook accessed credit card record X or social security number Y.  Armed with this information, an investigator can evaluate whether the hacker did or did not actually breach the security of record X or record Y.

Example: In the wake of a security breach at one of its hotels, Best Western International was able to evaluate the breach and narrow the universe of affected credit card numbers by inspecting specific logs on the computer in question. 

Accordingly, a well-crafted e-mail archival system will maintain extensive meta-data about each electronic mail record.  The M+Archive product for instance keeps tabs on who viewed a record, when it was printed and so on. 

Be all that as it may, sometimes system logs are undesirable.  For example, when an attorney turns over records in an eDiscovery request, she normally should not turn over metadata that constitutes her own work product.  As she reviews individual emails in an archival system, the system may be keeping meta-records showing which records she accessed, when she accessed them and how often.  Those records are probably her attorney work product, which normally is excluded from disclosure in the discovery phase of litigation.  She should normally screen out any such work product when she turns over required emails to another party.

I spoke to Ranjit Sarai, e-discovery expert at Messaging Architects. “The management of meta-data in an enterprise archival system can be tricky,” he said. “Normally you want the system to be making meta records for security and accountability purposes.  But sometimes ediscovery lawyers want to turn this logging feature off, or they want to filter out their work product metadata before delivering records to an adversary.  We have experience helping an attorney understand the options and craft a solution for her particular case.”

–Ben Wright

Mr. Wright often serves as a public speaker on the law of electronic records and investigations.

EuroSox: Audit, Disclosure for Corporations

E-mail Archives For Control and Contract Enforcement in Europe

European enterprises feel impelled to improve internal controls, and retention of e-mail records must play a role.  

For years government authorities have sought greater accountability and transparency among European companies, and greater uniformity in financial reporting.  This campaign has led the European Union to adopt amendments to the following: 4th directive 78/660/EEC (annual accounts of specific type of companies), 7th directive 83/349/EEC (consolidated accounts) 8th directive 84/253/EEC (auditor and audit committee requirements).  

In accordance with these amendments, individual EU member countries are now implementing new national law.  Informally known as “EuroSox” (a nod toward the US Sarbanes-Oxley Act - SOX), these laws reflect modern expectations that institutions open themselves to much greater outside scrutiny, through disclosure and third-party review.  

Although the details can vary from country to country, the broad message is clear:  publicly-held companies and larger public enterprises are expected to pay greater heed to responsible governance and internal control.

A critical part of modern internal control is electronic mail.  E-mail records (and other electronic messages records such as instant message) show who was delegated responsibility for what and when. They show what the terms of business deals were.  They deter the creation of false accounting books.

See for example the UK case Hall v Cognos Limited (Hull Industrial Tribunal 1803325/97).  Cognos’ company policy was not to reimburse employee expenses more than six months after they were incurred. That policy was part of the larger, written employment contract between the company and salesman Hall. The employment contract stated it could be modified only by a signed writing.  Then a superior agreed by e-mail to depart from the policy and reimburse Hall for certain old expenses. When the company failed to honor this commitment, Hall sued.  The court held the e-mail (when printed out) was in fact a signed writing that amended the employment contract.  Therefore, the court enforced the agreement to reimburse the expenses.

E-mails need to be kept (in a way that facilitates searching) so that third parties –- that is, auditors -- can review transactions and relationships after the fact.  They enable investigations into issues like fraud, bribes, kickbacks, corruption, tax evasion, false pretenses, misrepresented facts, government waste, misappropriation of funds-assets, executive abuse of assets.  As internal control grows in importance in Europe, the old practice of deleting business e-mail and text messages quickly looks more and more archaic.

–Benjamin Wright

Mr. Wright is an advisor to Messaging Architects, global provider of electronic archival solutions.