Ride The Lightning

EDUCATION WITH A VIEW: THE PACIFIC LEGAL TECHNOLOGY CONFERENCE

For those readers located within reach of Vancouver, the annual Pacific Legal Technology Conference (on October 10th) offers a great day of multi-track legal tech, and a good dose of electronic evidence factored  into the mix. To find out more about the conference, please visit http://www.pacificlegaltech.com/index.html. My partner John and I will both be among the distinguished faculty - if you'll be there, please come and look us up!

E-mail: snelson@senseient.com   Phone: 703-359-0700

CHRISTMAS FOR THE DEFENSE: WHEN THE AUTHORITIES MUCK IT UP

No one who does computer forensics will be surprised by the observation that law enforcement and the prosecution frequently blunder and hand defense counsel unexpected gifts that demonstrate, at the very least, an underwhelming amount of competence. The last two days have been extraordinary examples. Yesterday, we received (via U.S. mail no less) a print-out of electronic evidence - and I'm not even going to point out how ridiculous that is. The amazing thing was that the print outs were sent to us via the Office of the State Attorney for a neighboring state - and they contained graphic images of child porn in direct violation of federal law. Since, according to the federal government, no one outside of law enforcement may have custody of child pornography, even as a defense expert with a state court order, this would (to phrase it mildly) put us in the soup. We promptly notified the Fairfax police that we had received this evidence and shredded it, to protect ourselves. The thought of the authorities blithely mailing this stuff out is somewhat horrifying, to say the least.

Today was more comical. Courtesy of the Department of Homeland Security, we received evidence in a case. While we are entitled to the evidence files in the case, the comedy is that the forensic examiner for the government neglected to follow proper procedure and wipe the drive before transferring evidence files to it. As a result, we have his full forensic analysis of the case, which he deleted, but did not wipe. Christmas in September. Isn't it great?

E-mail: snelson@senseient.com   Phone: 703-359-0700

EXCELLENT E-DISCOVERY RESOURCE: INFORMATION GOVERNANCE BLOG

It is always a pleasure to pass on a terrific resource by another blogger. One of my favorite blogs is the Information Governance Engagement Area (www.infogovernance.blogspot.com) The Information Governance Engagement Area is primarily an on-going aggregation of key compliance, electronic discovery, and enterprise content management news, views, notes, and quotes, from across the Internet. Updated by Rob Robinson, a technology marketing professional who has held leadership positions with several key electronic discovery vendors, and with over 2,800 posts in just under two years – the site is a very regularly updated (multi times daily) and an objective (long on news, short on opinion) source of the latest  updates in the legal discovery arena. I've had the pleasure of corresponding with Rob - he is unfailingly gracious and always knowledgeable. His blog is as objective as mine is opinionated, which makes for a splendid contrast. Great job Rob!

E-mail: snelson@senseient.com    Phone: 703-359-0700

MAKING THE FEDERAL RULES REAL: LITIGATION MAGAZINE

Those who litigate are really well served by belonging to the American Bar Association's Litigation Section. Though the Section does many, many things, I especially appreciate its Litigation magazine, which never fails to educate with wit and style. This is one magazine that never gathers dust on my desk. This month's issue has an article especially useful for those who may be novices at dealing with electronic evidence under the new federal rules. By constructing an imaginary mail and wire fraud case, author S. Kirk Ingebretsen does a great job of taking you through the case step by step in "Crafting A Discovery Plan."  He references the new rules as he goes along so you can actually understand their relevance in a practical setting. I would gently disagree with his statement that native format evidence is more costly to review (it can be, but not usually, and it sure as heck avoids the sometimes massive costs of converting to TIFF or PDF with load files), but overall, this is an article that skillfully uses "make believe" to "make it real." Nice job!

If you belong to the ABA, you can access the article here: http://www.abanet.org/litigation/journal/

E-mail: snelson@senseient.com    Phone: 703-359-0700

WACKY, WACKY, WACKY: D.C. SPEAKS ON METADATA MINING

Is is ethical to mine metadata? The American Bar Association says sure. New York and Florida don't think so. Alabama makes a strange delineation between documents exchanged between counsel and other electronic documents. Now D.C. has spoken and the nuttiness continues. The Legal Ethics Committee of the District of Columbia Bar has issued Ethics Opinion 341. A portion of the opinion reads:

"A receiving lawyer is prohibited from reviewing metadata sent by an adversary only where he has actual knowledge that the metadata was inadvertently sent. In such instances, the receiving lawyer should not review the metadata before consulting with the sending lawyer to determine whether the metadata includes work product of the sending lawyer or confidences or secrets of the sending lawyer’s client."

Actual knowledge? Who would ever have that knowledge? What about due diligence to the client, which the opinion also references? In an effort to "sorta compromise," this is just another wacky attempt to address the issue. The ABA got it right. If the sender is crazy enough to send you metadata, you can look. In this day and age, an attorney that doesn't know enough to scrub metadata is breaching his/her duty to preserve confidentiality, period.

The opinion may be found at http://www.dcbar.org/for_lawyers/ethics/legal_ethics/opinions/opinion341.cfm

E-mail: snelson@senseient.com    Phone: 703-359-0700

NO ELECTRONIC EVIDENCE IN WYOMING? AND HOW TO HOOK THE WRONG END OF A TROUT

John and I have just returned from lecturing to the Wyoming State Bar at their annual conference in Jackson Hole, one of the most beautiful places we have ever been. We cannot say enough about Wyoming hospitality - our hosts were incredibly gracious, even arranging a fly-fishing trip for us. I do not fly fish (I tried it once and the guide promptly dubbed me "Train Wreck Nelson" which was a fair assessment of my casting ability), but John loves it so I sit in the back of the boat and immortalize his victories through photos. It was a glorious day on the Snake River and our guide Tom was amiable and full of fish lore ("The 'mend' is your friend"). John caught 8 cutthroat trout over the course of the day - the only one of appreciable size was the one that he manage to hook firmly in its posterior. Tom, grinning, noted that this was the very first time he'd seen one of his guests manage to do that. The fish, happily, seemed quite unfazed and cheerfully swam off once released.

The Wyoming conference featured us as guest speakers for a plenary session - the night before the session, we had the chance to talk to some of the attendees. One woman, very bright and very nice, explained that she was glad she was going to hear us, but that she wasn't too worried about electronic evidence, because she didn't think it would get to Wyoming for another decade or so. Sometimes, it is hard to keep a straight face! I think she might have been surprised the next day, when at least 20% of the audience indicated that they had handled electronic evidence cases already - and the majority of the audience clearly knew that the winds of change were blowing. They knew they needed to be ready, and though the fields of computer forensics and electronic evidence were largely foreign to them, they were apt pupils. We met up with the nice lady at the wine-tasting held by the Bar later in the day, and she commented that maybe 3-5 years would have been a better time frame (at least she's getting closer!). Anecdotally, one attendee rushed up to the stage immediately after the presentation, having received (during the presentation) an e-mail message from his office that a new case had arrived involving electronic evidence - so, as you might imagine, he had a few questions. While it is still true that many rural areas are not precisely hotbeds of e-evidence at the moment, things are changing rapidly - and attorneys who do not educate themselves in this area are likely to go the way of the dodo bird.

E-mail: snelson@senseient.com   Phone: 703-359-0700

HAVE A COMPANY CELL PHONE? IS YOUR BOSS WATCHING?

Most people are delighted to receive a company cell phone. It's a perk, right? But is your boss watching you? In particular, is your boss watching where you are? John Halpin, a construction supervisor for the New York City Department of Education, had no clue that there was a GPS (Global Positioning System) in his cell phone tracking his movements. Apparently, Mr. Halpin was not where he claimed to be much of the time and his phone ratted him out, effectively proving that he left early on 83 days in a six month period. Not bad work if you can get it. Except he doesn't have that job anymore. He was fired last week, and the Administrative Law Judge in the case was unmoved by Mr. Halpin's protestations that no one had told him about the GPS. She pointed out that the department was under no obligation whatever to tell him what means they were using to uncover his misdeeds.

Monitoring employees is big business and getting bigger. Truckers have long been monitored by their employers who install GPS devices on the trucks, but using cell phones to track employees is a relatively recent development. Only two states, Connecticut and Deleware, currently require that employers notify employees if they are using GPS devices to monitor them.

So . . . do YOU have a company cell phone? Do you know whether or not your boss is tracking you? In the electronic era, privacy is rapidly becoming a memory of another time.

E-mail: snelson@senseient.com   Phone: 703-359-0700

THINK OUT OF THE BOX: USE HASH VALUES FOR BATES STAMPING

For years, we have argued that hash values could operate as Bates stamps, thereby defeating the tired old argument that native format production is objectionable because it can't be bates stamped. One admittedly genuine sticking point was that hash values are LONG. An MD5 hash has 32 alphanumeric values and SHA-1 has 40. But thanks to the dedicated work of attorney Ralph Losey, we now have a workable methodology of truncating the hash values to six places, using the first and last three values. Mathematically, this avoids collisions 98.6% of the time. It isn't perfect - but where there is a match, it is possible to consult the underlying hash values to clear up any confusion or suggestion that data has been altered. You can download Ralph's terrific article "HASH: The New Bates Stamp" at http://ralphlosey.files.wordpress.com/2007/09/hasharticlelosey.pdf

E-mail: snelson@senseient.com   Phone: 703-359-0700

NO BLINDFOLDS, NO CIGARETTES: CONDEMNED HARD DRIVES

Around here, we do a lot of hard drive wiping. Normally, we use utilities that do a single wipe, which is generally quite sufficient. We wipe the drives of our law firm and corporate clients and we wipe drives that have contained electronic evidence in court cases. Sometime, when folks are especially anxious, we wipe seven times, according to the Department of Defense specifications. More expensive, but we'll do it if asked. In reality, we've never seen the restoration of data from a drive that's been wiped once.

However, if you really, really, really want to be sure that data is gone, I recently read of a company that is providing that kind of insurance. A New Jersey company called Back Thru the Future Computer Recycling, Inc. (http://www.backthruthefuture.com)  is very serious about the total destruction of hard drives and any other digital media. Hard to believe, but they use an extraordinarily secure tracking system, armored trucks and armed, uniformed guards for transport. Once the condemned hard drives, etc. are received onsite, their tracking tags are photographed, they are inventoried and a secondary confirmation is obtained from the client that the media should be destroyed.

In a shower of sparks and hums, crackles and pops, the media is rendered into shreds by a machine that looks much like an industrial air conditioner. It is then photographed once more in its altered state and an Affidavit of Destruction is issued to the client. Overkill? Perhaps, but data destruction is reputedly a more than $2 billion per year business.

The company is laudably very "green" in its approach and recycles its waste. That Coke can you're holding could well have originated from condemned law firm hard drives. Quite a thought.

E-mail: snelson@senseient.com   Phone: 703-359-0700

DIGITAL COPIERS AND THE LUST FOR CHOCOLATES

Most of the law firms we see haven't a clue that their digital copier (typically configured as a network printer too) may contain recoverable data. The majority of currently available digital copiers contain a hard drive. It is prudent to buy or lease a digital copier that can perform a secure wipe, thereby ensuring confidentiality. Our own copier is set to do a secure wipe after each job, probably a good practice for most lawyers to implement.

Pertinent to this subject is a very funny TV ad sent to me by reader Rob Robinson. The concept is adult, but it is G-rated. The young lady in the ad has a lust for chocolate which proves her undoing - and yes, a digital copier is involved. Thanks for sending this along Rob. http://veryfunnyads.com/index.html?id=24922

E-mail: snelson@senseient.com   Phone: 703-359-0700