Computer Forensics In Business Litigation – Ask The Expert

Many business litigation cases require experts in various fields.  I am going to feature experts on this blog in an "ask the expert" series of interviews.  Disclaimer:  I am not endorsing any experts that I feature on this blog or the opinions expressed.  I am posting these interviews to offer my readers some insights from the various professionals that get involved with business litigation cases.

Monique Ferraro is an expert in computer forensics and the principal of Technology Forensics, LLC.  She is also an attorney. The following is my recent interview with Monique. 

Q: What issues do you see in business disputes involving computer forensics:

 

A: Mostly, we see parties seeking email and deleted email. Increasingly, lawyers are asking for email and all electronically stored information containing metadata in their discovery requests. When they don’t get what they asked for initially, or if the party is not able to produce the information on their own, they call us. We figure out the best way to obtain the information requested without disrupting the business process while maintaining the integrity of the potential evidence and providing a solid chain of custody.

As far as the types of cases, we see computer forensics being requested in every type of litigation, from contract disputes to debt collection, employment litigation and even motor vehicle accidents.

 

 

Q: Many people think that when they delete computers docs and emails, its deleted.  In laymans terms, what really happens to it?  Can it be recovered?

 

A: It’s important to remember that computers were designed by engineers, not lawyers. Lawyers are concerned with precision of language. If you say you deleted something, then you deleted something. It’s gone. Unrecoverable. Engineers think in terms of efficiency.

 

When computer systems were designed, the engineers who developed them figured it would be more efficient to simply mark the space where information is held as available for reuse rather than truly deleting the file. The process uses less energy and is more efficient than truly deleting the file.

So, when we hit the ‘delete’ key, information isn’t deleted.

 

What happens is that the computer software goes to the table that keeps track of all the files and where they’re located and makes a check mark indicating that the space where that file is kept can be used for something else. Next time the computer goes to save a file, it can save it to this newly open space. However, because the size of computer storage is so large now, the space left open by the ‘deleted’ file is rarely reused. The original file stays there, lying in storage but with the space marked as available until it is either overwritten or ‘wiped.’

 

‘Wiping’ refers to really deleting a computer file. To really delete a computer file by wiping, a process is used that both marks the space as available and overwrites the space. Usually, the space is overwritten several times in order to obliterate any data remaining.

 

Because deleted data isn’t really deleted in the true sense unless it is wiped, most of the time deleted files can be retrieved and fully restored. That is true for files that have been consciously saved as well as data that has not been saved is held in temporary storage, as with Internet data.

 

Q: What are you seeing in the courts in terms of road blocks to getting access to servers and hard drives?

 

A: Most of the time, courts have been quite willing to grant discovery of electronically stored information. It gets tricky when litigants ask for a specific file or folder on a network or a targeted hard drive. Parties resist requests that involve having the opposing party’s expert on site, which is what litigants often request when seeking a specific storage device, folder or file. Of course, few businesses welcome the opposing party coming in and accessing their systems and data.

 

The objections are usually based upon keeping their business and client data secure and confidential and preventing disruption of their business. If there haven’t been discovery abuses and the party is trustworthy, the court usually allows the business to hire its own expert. To validate the acquisition of potential evidence, there are several methods that can be used, from documenting the process in writing to videotaping it, that can minimize the intrusion into business information and keep business disruption to a minimum.

 

Q: How do attorneys get access to emails that are on ISP accounts like Comcast, or third party servers like Gmail?

 

Most ISPs require a subpoena or court order to release information. It depends on the service provider, the information you’re looking for and who you’re requesting the information about. It’s best practice to contact the legal department of the ISP and ask them what they need and how they want it in order to get the results you seek. It may be that you’re legally entitled to the information, but if you don’t request if in the form that the ISP wants you to ask it in and from the person they designate, you won’t get what you’re looking for. It’s important to bear in mind that quite a lot of Internet service provider information is held in storage for a limited amount of time and that by the time there’s a lawsuit pending, the information is long gone.

 

Q: What issues have you seen with forensics and social media sites like Facebook, MySpace and Twitter?

A: Usually, we’re asked to mine data from social media sites as part of the whole process of investigating a specific person or case. It’s often an adjunct to the larger inquiry that helps to establish that we have the right information or to identify someone a target is communicating with. Of course, in some cases, the use of the social media is an issue in a case, and gaining the posting history is the challenge for the forensic examiner.

 

Q: Is it a good idea to work with an attorney early in an investigation?

 

A: We prefer to contract with the attorney representing the business because that’s the best way to protect our work product from being discovered by the opposing party. Attorney-client privilege extends to us if the attorney contracts with us. That provides the business with the same sort of protection of confidential information that they enjoy in their relationship with their attorney.

Q: What can someone in a business dispute do to preserve critical ESI (electronically storied information) when they know they are going to be in a lawsuit

 

A: Every business will be involved in litigation at some point. As with all things, planning saves a lot of labor and expense. Every business today holds at least some electronically stored information- email, accounting information, transaction information. Businesses need to know what electronic data they have, who accesses it and where it’s stored. A big issue we see is that electronic data is being held on business-owned as well as personally owned resources such as smart phones and laptops. It’s essential for the business owners to know where their data are stored so that they can ensure its preservation and production in the event of litigation.

  

 

Q: What mistakes do people make before business disputes that end up hurting them after the case is in court?

 

A: By far the biggest mistake people make is deleting electronic records. The fundamentals of litigation have changed. Whereas it was once possible to shred documents (which was spoliation, but was harder to prove), electronic storage of data makes it very difficult to destroy information without leaving behind a trail of evidence documenting the destruction. 

 

Q: What if you do not control the servers, infrastructure, how can you save critical ESI for later use in a lawsuit:

 

A: If you don’t control the storage media, you need to have your attorney issue a letter that informs the other party of your intent to sue and tells them of their duty to preserve relevant data. It’s best if the party who doesn’t have access has a good understanding of where the data are maintained so that discovery requests can be crafted intelligently. Without knowing how the data are stored and where, it’s more difficult to know whether you’re getting all the information when the other party produces it.

 

The good news (sort of) is that if a party knowingly or intentionally destroys electronically stored information, there are pretty harsh sanctions and a separate cause of action available to the person harmed by the loss of data. The intentional destruction of potential evidence is called spoliation. It’s a fairly easy proposition for a digital forensics examiner to determine if spoliation of electronically stored information has occurred and document it. Armed with the proof that spoliation occurred, courts have ordered pretty severe sanctions that range from ordering an adverse inference about the evidence (meaning that the jury should assume that the evidence was damaging) to default judgments. Money damages have also been awarded, some going into millions of dollars. In Connecticut, spoliation of evidence is a separate civil cause of action for which damages can be awarded.

Lawyers Going Fishing on Facebook – – Is It Ethcial?

Lawyers are all over Facebook and LinkedIn.  What are they doing?  If they are not marketing or social networking, they are fishing or "mining" for information about individuals and businesses.  They are looking for this information to help with lawsuits.  The business and employment trends involving social media are growing and as a result we will continue to see a variety of different lawsuits and legal issues involving some aspect of Facebook, LinkedIn, Twitter, MySpace and YouTube.  For example, read the posts yesterday by Dan Schwartz’s Employment Law Blog detailing how privacy settings on Facebook permit easier production in electronic discovery and how facebook wall postings might be unavailable in discovery and deemed private. 

One of the issues lawyers will have to address when mining for data on Facebook and other sites is how to get the information.  Do you seek the material in discovery and possibly risk a judge deeming the information unavailable as private or irrelevant?  Do you just limit your search to what is publicly available?  Better yet, what about having an investigator try to "friend" your target so you can get access to the information that is not available to public searches?   If you are concerned about the ethics of this type of searching, you good instincts. 

Lawyers fishing on Facebook would be well advised to read through a few ethical opinions on the issue. Recently, the New York Bar Association issued an opinion related to ethical concerns for lawyers "fishing" for information and evidence on Facebook and LinkedIn.  The verdict?  Relying in part on a 2009 Pennsylvania Bar Association opinion, it was deemed ethical for lawyers to search for this information from public pages.  Seeking to "friend" for improper purposes, however, is more problematic and may land a lawyer in ethical trouble.  Specifically, if deception was used (by either the lawyer or a third party directed by the lawyer) to gain access as a "friend," it likely would violate the rules of professional conduct. 

Clearly, LinkedIn and Facebook are treasure troves for litigation attorneys.  However, it is a good idea to be cautious about how you access any information from these sites, especially if the information is not generally available from public searches. 

Can You Record Phone Conversations In Connecticut To Help Your Lawsuit?

You might be surprised how many times I am asked this question.  Of course, the circumstances of every case warrant separate consideration, but here are the basic facts concerning recording of phone conversations in Connecticut as it relates to civil litigation and lawsuits: 

Civil Liability.  You are subject to liability in a civil lawsuit if you violate Connecticut General Statutes 52-570d entitled "Action for illegal recording of private telephonic communications."  The full text of the statute is here, but the basic summary is that an aggrieved person may bring a civil lawsuit for the recovery of damages and attorney’s fees if someone uses a device to record "an oral private telephonic communication" unless the use of the recording device involves:

  • the consent of all parties (some states only require one party consent), and such consent is obtained prior to the recording
  • the consent documented in writing or part of the recording
  • verbal notification given at the start of the recording
  • an automatic tone warning device producing a signal every 15 seconds

There are various exceptions to this rule, including for law enforcement and FCC officials.  In addition, one of the more relevant exceptions is for "any person who, [is] the recipient of a telephonic communication which conveys threats of extortion, bodily harm or other unlawful requests or demands."  For example,if your Mel Gibson’s girlfriend, and you are in Connecticut, its probably safe to record his phone calls. To recover in Connecticut, however, you have to prove actual damages related to the recording.

Many people that want to record phone conversations are trying to document conversations as evidence for potential use in a lawsuit.   However, if the recording is done unlawfully, Connecticut law prohibits the use of the recording in "any court of this state." As such, although an improperly recorded phone call might be available for use in a deposition, it will not be permitted as evidence in any court.  

Whether an improper phone recording is criminal will depend on the circumstances.  For example, it is a Class D Felony in Connecticut to engage in wiretapping or "mechanical overhearing" of a conversation.  Wiretapping and mechanical overhearing are defined to include "intentional overhearing or recording" of telephonic communication or conversations without the consent of at least one person involved.  This is more likely to apply to a situation like the allegations against Shaq O’Neal for intercepting cellular phone conversations he was not a part of as opposed to private two way conversations. However, the possibility of criminal penalty should be factored into any decision to record a phone call.

Keep in mind also that this post is only a summary as it pertains to Connecticut state law. If phone calls involve an out-of-state caller, different laws might apply.  For a good example of the intersection of various state recording laws, visit the website for the Reporters Committee for Freedom of the Press.  In addition to state law, there are federal wiretapping laws that might come into play. For an example of some federal laws, see this post on the Citizen Media Law Project.

The takeaway here is that if you improperly record phone conversations in Connecticut you could: (1) face criminal penalties; (2) face a civil lawsuit for damages and attorney’s fees; and (3) be precluded from using the recordings in court in any civil lawsuit.  As such, if you are planning on recording phone conversations of any kind, you would be well served to contact an attorney and get advice on whether to proceed.