Electronic Data Records Law | How to Win E-Discovery

Real-Time Evidence for Cloud Investigations

Narrated Screencast Assures Investigator’s Personal Accountability 

The collection of cloud evidence vexes investigators, whether they be police, auditors or consumer watchdogs.  As more and more social and commercial interactions occur in the Internet cloud, new methods are needed for proving what happened. 

Traditional Forensics Methods Usually Don't Apply in the Cloud

Traditional digital forensics emphasizes an investigator gaining access to data stored on a computer, such as in a hard drive, where records show what happened through the computer (web surfing, email writing).  Yet our digital lives are becoming centered less in our computers and more in the cloud, where we mingle by way of numerous, increasingly mobile, disposable, interchangeable devices.  An investigator may never get access to the relevant user or service provider device(s), even though he can witness a live online event by connecting to it through his own computer.

Online content is ephemeral.  A Facebook Wall can show one thing now and something different a minute later.  A chat session or an online game can transpire in a flash.  How should a professional investigator record the activity on a FB Wall or in a chat session?

Screenshots Miss a Lot of Detail

 Granted, the investigator can take a screenshot or make a log file of activity, but such a record can be sketchy. 

Screencast Video Captures Detail and Interaction

A better record would capture a stream of all the text, images, motion and sounds in a online activity – what’s known as a screencast.

Still, a record is like a rumor.  It’s worthless unless a credible witness can explain and vouch for it. 

So I propose a recording that unites a screencast with compelling, eyewitness testimony.  It’s a split-screen video record simultaneously showing what an investigator sees and his real-time narration of events.  Let me demonstrate:

 

The video depicts an investigator memorializing what he sees in a live interaction with another party, in this case a thief hawking stolen product plans. It shows him explaining through his webcam as he chats, clicks and observes.  He reads directly into his video report his identity, his purpose, and his authorization.  At the end he takes responsibility by formally signing and vouching for his record, in a way that would appeal to a skeptical audience, such as a jury, a judge, a journalist or a panel of lawmakers.

The rich detail captured in the video facilitates later review of the investigator’s work by a third party.


Compare Log File

In the video, the exchange with the thief occurs through Windows Live Messenger, which does allow for creation of this activity log.

But notice the log misses much of the action.  It shows no images or mouse movements.  It completely ignores Scooter Montgomery’s dramatic visual display of the stolen document.


Problem Investigations

Is a better way to record online investigations really needed?  Have online investigations ever been discredited due to poor records?  Yes.  

In one series of cases, the Recording Industry Association of America hired MediaSentry to find copyright infringers sharing music on peer-to-peer networks. MediaSentry said it identified some infringers and produced logs and screenshots as evidence.  But an expert criticized the credibility of MediaSentry’s evidence in court, and a leading critic sounded authoritative when the Wall Street Journal quoted him calling MediaSentry’s evidence collection “sloppy.”  RIAA terminated its relationship with MediaSentry.

In another case, the district attorney for Collin County, Texas, dropped charges against alleged pedophiles on account of weak evidence of online activity.  Investigators for a public-interest group named Perverted Justice claimed to have engaged the suspects in incriminating chat sessions, but police lacked confidence in the trustworthiness of the logs Perverted Justice produced to show what happened in the sessions. 

The split-screen video demonstrated above compiles a more complete and credible record.

Update:  Here's another application of the split-screen record.  The operator of a surveillance camera could narrate and authenticate, in real-time, what she sees by way of the camera.  The camera might be mounted on a building.  Or it might be on a police or military drone.

I'd be honored to hear your comments.

–Benjamin Wright

Mr. Wright teaches the Law of Data Security and Investigations at the SANS Institute. 

The software used to record the split-screen video is BBFlashback.  See Mr. Wright's other use of split-screen video for recording an online investigation or an online agreement.  See his video on undercover officers securing evidence from a social network.

Related: How to memorialize function of online Bitcoin wallet.

Virtual Counterfeit Investigations

Consent, Contracts, Privacy Rights in the Information Economy

Professional investigators should read cyber terms of service.

Technology contracts like terms of service (ToS) and end user license agreements (EULAs) are having a growing impact on the execution and outcome of investigations . . . internal investigations,
private investigations, forensics examinations, law enforcement investigations, intellectual property investigations, cyber-theft investigations and many more.

Increasingly, social, business, academic and entertainment interaction occurs inside virtual environments.  These environments saturate modern life:  web pages, video games, online schools, social networks, digital media (books, music, movies) smartphone apps and corporate computer networks.

As users enter these environments, they are commonly required to agree to legal terms of use and access.  These agreements can govern official investigations that may come later.  These agreements can (and increasingly do) contain statements that users consent to official audits and probes and consent to limits on their privacy.

 

University Network Terms Applicable to Student

For example, when a freshman student at the University of Wisconsin attached his PC to the university's network, he agreed to terms of service, which included an acknowledgment that the university could execute IT security measures.  Later, when a university system administrator suspected that the student's PC was involved in an ongoing, dangerous hacking incident on the network, the administrator hacked remotely into the student's PC.  

While searching inside the PC, the administrator found evidence that incriminated the student in illegal hacking outside the university's network.  The university gave this evidence to government prosecutors, who attempted to use the evidence in a criminal trial against the student.  The student objected, on the grounds that the university had violated his privacy.  The court disagreed with the student.  The court said the student's privacy had not been violated because he consented – by virtue of the security clause in the network terms of service – to the search by the system administrator. US v. Heckenkamp

 

Social Network's Terms Authorizing Investigation

Here are example terms of service authorizing investigations, published by Zenbe, a social networking service for sharing information among friends:

Zenbe reserves the right to access, read, archive, monitor, and disclose any information it reasonably believes is necessary to:  1. enforce this Agreement, including investigation of potential violations hereof.  2. protect the rights, property or safety of Zenbe, its users and the public.  3. satisfy any applicable law, regulation, legal process or governmental request.  4. detect, prevent, or address fraud, security or technical issues, including the filtering of spam.

Terms like these can be relevant to monitoring users in online communities and business  transactions.

 

Terms for Investigationg Abuse of Online Games and Credits

Entrepreneurs are inventing new ways to transact business online.  They are devising myriad electronic credits, coupons, vouchers, discount codes, trading cards, play money, online property, virtual game pieces and more.  As they distribute these virtual goods and assets to users, their power to investigate their users is critical to nixing abuse, foiling hacks, thwarting counterfeits and maintaining the quality of their product or service.  Investigations are a growing component of the information economy.

A substantial method for entrepreneurs to police their products and services is to require users to click on terms of use that include power on the part of the entrepreneurs to investigate their users.

 

Terms for Internal Investigations

Some investigations are internal to an enterprise, as is the case with a human resources (HR) investigation.  The scope of an internal investigation can depend on contract terms or written employment policies.  For example, in Ontario v Quon, a police officer said his boss violated his privacy when the boss reviewed text messages the officer sent from his employer-issued pager.  In other words, he argued that his government employer violated his Fourth Amendment right to be free from unreasonable search.  However, the US Supreme Court held the employer did not violate privacy, in part because the officer had previously known by virtue of department policy that management could review (investigate) the content of messages exchanged through the department's equipment.

An employer or other organization that creates an electronic space is remiss if it lacks terms of use that include rights for official investigation.  Although those rights may exist without explicit statement in an agreement, the user's assent to them erodes her ability to object to an investigation when it happens.

 

Terms of Service Applicable to Professional Investigators

To be sure, terms in an agreement cannot legitimize an irresponsible investigation.  But terms can help clarify that the user was warned he could be scrutinized, records could be captured and evidence could be used against him.   They can clarify that as a condition to his treatment as an authorized user, he consents to monitoring and evaluation.

A professional investigator should take note when the subject of investigation has agreed to no relevant terms or agreement.  The lack of agreed terms can constrain the investigation.

Conversely the investigator should note whether multiple, overlapping terms of investigation apply simultaneously to a person under investigation.  For instance, suppose an investigator is engaged by the operator of a game app that works inside Facebook, and the investigator is examining whether Jane is abusing the game.  The game terms that Jane agreed to when she started the game may support the investigation.  The investigator may gather relevant evidence from game app’s network.

 

In addition, the terms of Facebook may support the investigation.  The investigator may be able to get help from Facebook.  Facebook, based on its terms of service, may be willing to cooperate with the investigation and turn over its own records about Jane.

–Benjamin Wright

Mr. Wright teaches e-Investigations Law at the SANS Institute.

Related: EDiscovery and Investigations on Facebook.

 

 

 

B2B Cyber Security Lawsuit | Guerrilla Publicity Dogs Bank Online

Populist Politics

Forensics Disagreement | Web PR Levels Court-of-Law Playing Field

The web changes how public disputes are contested.  Inexpensive web 2.0 publicity disrupts the balance of power.

Internet Bank Robbery - The Facts

After computer thieves stole [Krebs] $200,000 from the bank account of Hillary Machinery Inc., the company demanded reimbursement from its bank, PlainsCapital Bank. 
  The bank refused.  Thus began one of the most gripping cases in the history of computer security law . . . and a lesson in how to use the Internet as a populist podium . . . 

Apparently the investigation of the heist has not determined conclusively how the hackers succeeded in tricking the bank to transmit money out of the account.  Each party believes the forensic investigation proves it is blameless.

The Law On Internet Bank Robberies

The legal relationship between Hillary and the bank is largely governed by Uniform Commercial Code Article 4A and the banking agreements signed between the parties. In a case like this, an essential issue is whether the bank employed commercially reasonable security procedures when it acted upon what purported to be electronic payment instructions from Hillary. The bank maintains that its security was reasonable, and therefore it need not reimburse the money.

As this dispute escalated, Hillary might have sued, possibly in Texas state court or possibly in federal court.

But the bank seized the legal initiative.  It sued Hillary in federal court!  The bank may have calculated that a federal court would review this complex, technical case more thoughtfully than a state court.  So it preempted from Hillary the option to sue in state court.  

From the federal court, the bank seeks an affirmation that its security was reasonable.  In essence, the bank said Hillary had called into question the integrity of the bank's operations, and the bank is entitled to clear its name by way of litigation.

The bank is forcing Hillary to spend money on lawyers, quite possibly hoping Hillary will decide this quarrel is too expensive, too much trouble and will settle and shut up.  From the perspective of traditional litigation strategy, the bank is probably in a stronger position because it can afford to spend much more on lawyers and technical experts to fight the case.

 

Internet as Populist Bullhorn

This is an unusual lawsuit.  But it has taken an even more remarkable twist.  Instead of cowering, Hillary has gone on the publicity warpath.  On its primitive web page, Hillary complains noisily about the bank and its security.  

It started working with other interested and knowledgeable parties, and is shouting from the virtual rooftops, “Can you believe this?  Hackers stole $200,000 from my bank account, and then my bank sued ME!”  That's one newsy sound bite.

Hillary has attracted quite a few news stories (including in the Dallas Morning News and the Denver Post), much of it favorable to Hillary.  The most sensational is a TV report on Fox Business, which is posted on the web.  Hillary of course points to many of these reports from its web site. 

What's more, Hillary affiliates appear to be posting pointed comments on web discussion threads.  When a popular Dallas news blog wrote an unrelated story about PlainsCapital, someone apparently associated with Hillary posted a comment saying (paraphrase) “Thieves stole money from our PlainsCapital account, and then PlainsCapital hauled us into court!” linking to the Fox Business video.  [Another example:  see the second comment, from Amanda, below this post.] 

Someone who appears to be the spouse of a Hillary co-owner vocally discusses the case in an online forum, complaining about the bank and pointing to the media reports.  

This controversy between Hillary and the bank now dominates the Wikipedia page about the bank.  Can this be good for the bank?

In the public comments to a key blog article on the lawsuit, one observer sympathetic to Hillary finds that the bank has published a job posting for a wire transfer risk specialist.  The observer suggests, yeah, they need someone with those skills!  The actions of this "observer" (Is he or she affiliated with Hillary?  A volunteer?  Who knows.) give the impression that the public is rallying to Hillary's aid.*

The bank hasn't said much to defend itself in public.  The bank's tight-lipped approach (“our lawsuit speaks for itself”) hasn't played well.  There is no way all this chatter on the web has been good for the bank's reputation.  The damage to the bank's image could far exceed $200,000.

Hillary is a reasonable-size mom and pop business ($35 million in 2008 annual sales).  PlainsCapital ($4.4 billion in assets) is much larger.  The bank's old-style approach – let our lawyers do our talking – seems to have enabled populist underdog Hillary to land some blows on its opponent.

Although many details about this case are known to the public, many are not.  We don't know, for instance, everything about the security or insecurity of Hillary's computers or whether the bank had offered Hillary some additional security procedures that Hillary declined to use.  (An example of additional security might be sms text messages to cell phones of Hillary officials as each and every event transpires within the bank account.)  The bank may have a stronger story here than it has revealed so far.

 

Cyber Publicity is Faster Than a Lawsuit

But as things are going now, the bank may not have a good chance to tell its side of this cybertheft story.  Internet-driven public opinion may solidify long before the bank can explain.

Talking on the web (Hillary's approach) is fast and cheap. Talking through lawyers in the courtroom (the bank's approach) is slow and expensive. 

Publicity is different today than it was a few years ago.  In the past, an unflattering report might appear on TV or in a newspaper, and then it was gone and few would remember.  But media reports today live persistently on the web.  Months-or-years-old reports can show up when prospective customers google “PlainsCapital Bank.” 

This squabble is not over.  But as of February 16, 2010, little Hillary seems to have exploited the web as an asymmetrical weapon against a larger adversary.

Update: Resolution May 2010

Hillary and Plainscapital settled their their lawsuit, and agreed to keep the terms confidential.  The settlement came two days after the court rejected motions by Plainscapital that the case go to arbitration; Plainscapital apparently wanted arbitration because it felt a public trial was less likely to deliver it a net benefit.  It is hard for me to conclude that this lawsuit was good for Plainscapital.  The bank started the lawsuit.  The bank's apparent goal was to clear its name and reputation.  The bank did not achieve its goal.

–Benjamin Wright

Mr. Wright teaches IT security law at the SANS Institute, where he stresses how critical public communications (policies, notices, banners, warnings, contracts, subpoenas, interviews, social media, press releases, declarations in court and much more) are to effective cyber defense, negotiations and investigations.

* Gadzooks.  Notice how easily a grumpy member of the public was able to dig up a choice detail about PlainsCapital (its job posting for a risk specialist) and link to it from a well-trafficked location with an unfavorable comment.  The world did not operate this way a few years ago.  Organizations like PlainsCapital live in more of a fishbowl today than they once did.  Organizations must re-calibrate how they make and maintain their public images.

[Note:  Since I originally posted this article, Hillary Machinery and its affiliates have contacted me and asked that I correct a couple of factual errors.  Based on what they said and what I read elsewhere on the web, I have revised my article here.  If anyone believes that I have made a mistake here or any other place, I ask that person to telephone me promptly at 1.214.403.6642.]

Porn | Employee Computers

Hostile Workplace Lawsuits in the Age of Networked Computers

In the workplace, electronic pornography is legal poison.  A singular lawsuit against the Chicago Police Department demonstrates the value of technical measures to filter, screen or block porn (including lewd spam).

In a hostile workplace lawsuit against an employer (whether private sector or government), the existence of porn on work computers or in work e-mail systems can be highly prejudicial.  Even though the employer objected to porn and enforced an explicit policy against it, its presence can reflect horribly on the employer as a case goes to a public courtroom.

In Williams v. City of Chicago (US Dist Ct, N.D. Illinois, E Div 03C2994, Jul 13, 2004), e-pornography backed the police department into an indefensible position.  Officer Williams had complained more than once about a sexually offensive work environment, including both foul comments by co-workers and nasty images on computers (e-mail and otherwise).

The department had a formal policy against such behavior, and Ms. Williams' supervisors endeavored to uphold that policy.

In pursuit of the policy, supervisors had promptly investigated and responded to her complaints, including removal of pornography.  The city argued that on account of its good policy it should be entitled to "summary judgment" in the case. Under summary judgment, the city would win the case before it went to the jury.

However, the court ruled there was insufficient evidence to award summary judgment to the city. In other words, the court said the case should go to a jury for decision.   According to the court: "If the jury determines that pornography was so prevalent that the City should have known about it, the jury could conclude that the City was negligent in discovering the harassment.  Similarly, if the jury determines that the City knew about the pornography because others had complained about it, the jury could conclude that the City was negligent in remedying the harassment."

Wow.  How can the police department (or a sherrif's office) withstand a jury trial focused on the amount of pornography on the department's computers?  Such a public trial would be highly embarrassing, even if the department eventually won the case!  The local media would have a field day.  At this point, the city has strong incentive to settle – at considerable expense – with Ms. Williams.  (I can't tell from the court's opinion whether the city did settle with Mr. Williams, but I'll bet it did.)

Behold the city's unenviable position.  Even after it settles, its problem remains.  The continued presence of Internet pornography can prejudice the city in future cases brought by future employee-plaintiffs, just as it did in Ms. Williams' case.  A case could rise directly from sexual harassment allegations, or from allegations of retaliation following a complaint about porn.

I therefore argue an employer like this police department has good reason to seek technical measures to mitigate its problem.  Although technical filters and blocks are imperfect, they can materially reduce the quantity of pornography in workplace e-mail and systems.

–-Benjamin Wright

 Mr. Wright teaches Internet Records and Security Law for the SANS Institute, where he covers topics like investigations into cybertheft and HR allegations.