Electronic Data Records Law | How to Win E-Discovery

Botched Cyber Investigations | Evidence Preservation

I am looking for cases and stories about digital evidence that had been collected but could not be used or authenticated (or at least became open to question) on account of problems like these:

1.  Investigator could not vouch for the evidence due to the investigator's death, retirement, refusal to cooperate or termination of employment.

2.  Investigator committed some kind of error related to his/her securing of the evidence with a digital hash, key or signature.  Example: investigator used a private crypto key to "sign" a digital evidence file, but the private key was compromised either before or after its use and therefore the trustworthiness of the evidence diminished.

Have you seen any cases like this?  Are any such cases documented?

The reason I am interested is that I've been experimenting with webcam "signed affidavits" by investigators.  http://legal-beagle.typepad.com/wrights_legal_beagle/2011/04/credible.html

Many thanks

--Ben

Benjamin Wright
Attorney
SANS Institute Instructor: Law of Data Security & Investigations
https://profiles.google.com/benwright214/about

Simulated Lawsuits

Computer Game as Legal Educator and Lawsuit Outcome Predictor

E-discovery and e-investigations involve ever-growing quantities of legal records . . . oceans of records.  To sift and understand these oceans, we need new tools.

Two such tools are crowdsourcing and sentiment analysis.

Crowdsourcing can employ an  army of virtual workers to analyze massive numbers of records like emails.  CrowdFlower will demonstrate this application of crowdsourcing at the SANS Institute’s E-Records Summit in September.

Sentiment analysis uses linguistic software to glean the intent or attitude of people expressed in large numbers of records, such as text messages or Twitter tweets.

Tools like crowdsourcing and sentiment analysis are little known in legal circles.  How can courts, lawyers and investigators gain experience?  How can they evaluate these new tools and learn their uses?

I suggest those tools (and others) be incorporated into computer games.  In the Information Age, games and simulations are assuming a larger role in education, training and dispute resolution.  For example, managers at healthcare providers learn how to cope with adversity, such as employee termination, through computer-aided simulation.

And diplomats use simulated negotiations to envision how  to resolve international disputes.   See Simulated talks show possible solution for Arctic dispute

Lawyers, law students and even courtroom judges can play computer games for the serious purpose of evaluating evidence, testing arguments and ascertaining what the outcome of litigation should be.  Computer games can be quicker, more insightful and less expensive than the traditional form of litigation simulation, i.e., mock trial.

I can imagine lawyer computer games including tools like crowdsourcing and sentiment analysis.

Imagine that a law firm is defending an age discrimination lawsuit involving 3 million electronic mail records at a corporation.  To assess those records and develop strategy, the law firm could play games with them.  It could feed the records into a computer game that uses crowdsourcing, sentiment analysis and the like to test and search the records under different standards and scenarios.  The firm might, for example, learn that sentiment analysis reveals an overall executive desire to comply with employment laws, even though a few “stray remarks” use impolitic language to discuss older workers.  Alternatively, the firm might discover that a thorough review of the emails, by hundreds of reviewers, reveals a management culture at the corporation that is insensitive to rights of older employees.  (See Efrati and Koppel, “Google is set back in age-bias case in ruling with broad implications,” Wall Street Journal, August 6, 2010.)

Either way, the law firm is better able to advise and represent its corporate client.

The law industry is slow to recognize new methods.  As inventors like CrowdFlower develop innovations for the industry, computer games can publicize those innovations and teach lawyers and investigators to think differently.

–Benjamin Wright

Mr. Wright teaches IT law at the SANS Institute.

Computer Raid | Search Warrant

Police Seize Records | Civil Inspector

Law enforcement searches for and raids to seize computer records come in many shapes and sizes.  A student in one of my SANS classes – who had experience helping the FBI confiscate electronic evidence under formal search warrants – taught us that an FBI raid is swift, forceful, well-equipped and well-organized.  
 According to him, the bystanders, such as IT staff at the target enterprise, have little opportunity to say or do anything other than try to get out of the way.

But a highly-professional FBI raid is just one kind of police/prosecutor investigation that can demand computer records.  Other raids or investigations can involve law enforcement personnel who are less specialized and less well-trained.  The raid could be executed by the local county sheriff's department, which may not possess the resources and expertise of the Federal Bureau of Investigation.

The Maricopa County sheriff raided a tow truck company in Mesa, Arizona, seizing computer and other records, in connection with a fraud investigation.  Five years later (that's a long time to wait on an investigation!) prosecutors had still not decided whether charges would be brought against the truck company.  The company claims the whole event was political.

Also in Maricopa County, the sheriff's department raided one of its sister county departments in a dispute over control of county computers.  Sheriff's deputies threatened to arrest fellow county employees who stood in the way.  The computer system in question was the topic of a civil lawsuit between the county sheriff's office and the county board of supervisors.

The personnel executing a raid or inspection need not necessarily be peace officers who carry guns. They could be simply regulatory investigators.  For example, in Australia, a Fair Work Inspector can enter a business and (“without force”) demand access to computer records related to labor practices.

Any time government appears at the door looking for computers or electronic evidence, here are general guidelines for IT staff:

1.  Do not obstruct an officer acting under color of law.  An example of “color of law” is that the person carries a police badge and a gun.

2.  Do not authorize or express “consent” for the search.

3.  Designate a single, calm spokesperson to talk to the government personnel.

4.  Politely request to see and get copies of documentation of the government's authority (but don't stand in the way if your request is not immediately answered).

5.  Politely request opportunity to have counsel come and be present. 

6.  Politely explain (if given the opportunity and if truthful) that (a) the enterprise computer systems are complex and damage to them might damage the enterprise and throw employees out of work, and (b) a cooperative acquisition of records through counsel might be more prudent. 

7. Politely request to make as many records as possible of the government's activity while its on the premises.  Although FBI agents may be unlikely to allow you to follow them around, take notes and/or video them as they work, a Fair Labor Inspector might.

–Benjamin Wright, Senior SANS Institute Instructor