Ride The Lightning

ROBES ON A RAMPAGE: ANOTHER JUDGE SIGNALS ZERO TOLERANCE FOR SPOLIATION

Judges have been getting angrier and angrier over what seems to be a non-stop escalation of spoliation and the reckless handling of electronic evidence. In the recent copyright infringement lawsuit filed by The Motion Picture Association of America (MPAA), Judge Florence-Marie Cooper (U.S. District Court for the Central District of California) minced no words as she granted a the MPAA a default judgment against the operators of the TorrentSpy file sharing website. Cooper found that the defendants had destroyed server logs, user IP addresses and other information that another judge had ordered them to maintain.

Clearly incensed, Cooper called the defendants’ conduct “obstreperous” and wrote “They have engaged in widespread and systematic efforts to destroy evidence and have provided false testimony under oath in an effort to hide evidence of such destruction.” Ouch.  She went on to say that “A substantial number of items of evidence have been destroyed . . . Defendants were on notice that this information would be of importance in this case.” Double ouch.

Though the decision is expected to be appealed, this is yet another case in a long year of judges taking defendants guilty of ESI spoliation to the judicial woodshed.

E-mail: snelson@senseient.com  Phone: 703-359-0700

PARKINSON’S MEDS CAUSED ME TO SOLICIT A MINOR ONLINE (and other folderol)

When you do computer forensics for a living, you think you’ve heard it all. Then you read the newspapers, and something still more bizarre comes blazing from the headlines. We have heard that solicitation of a minor (generally captured online by law enforcement) was caused by 1) some unknown someone who mysteriously had access to the computer; 2) alcoholism; 3) drug abuse; 4) depression; 5) insanity; 6) curiosity; 7) journalistic research; and 8) the belief that that the other person was an adult pretending to be a child (that gets points for sheer creativity). Mind you, I am not disputing that drug abuse or alcoholism might be contributing factors, though in my experience, people are quick to reach for any excuse to justify unjustifiable conduct.

But I was taken aback by a headline from the Kane County Chronicle in Illinois, where a defendant accused of soliciting a minor online claims that his conduct was caused by medication he was taking for his Parkinson’s disease. The essence of the claim is that the medication caused hypersexuality, which of course means you’ll find that medication at your nearest online Canadian pharmacy shortly. Thomas Maurer is 64 and the allegation is that he solicited a girl he thought was 14 – I’m not entirely sure what kind of drug could possibly make that conduct pass moral muster in Mr. Maurer’s mind, especially since he had been on the drug for 6 years preceding his arrest. Maurer previously admitted to his crime and was sentenced to 24 months probation, but based on this “new evidence,” is asking for a new trial.

Sadly, I think the “my meds made me do it” defense is likely to be seen more and more often. In our pill-popping, 19th nervous breakdown, mother’s little helper society, that defense is just a natural. I hope judges and juries look long, hard and skeptically at any such defense before giving someone a get out of jail free card.

E-mail: snelson@senseient.com      Phone: 703-359-0700

EVEN A CAVEMAN CAN DO IT: HACKING INTO THE TELECOMS

Convicted hacker Robert Moore, who is now in federal prison, says breaking into 15 telecommunications companies and hundreds of businesses worldwide was incredibly easy because of simple IT gaffes. As much as we deal with this truism in forensics and lecture on it non-stop, this is a train that just keeps on chugging down the track to doom. Moore, who pled guilty to conspiracy to commit computer fraud, laughed in his Information Week interview, telling the reporters that hacking is a piece of cake: "It's so easy a caveman can do it . . . when you've got that many computers at your fingertips, you'd be surprised how many are insecure." Moore said that the biggest insecurity was (what an old refrain) default passwords and that 85% of the time, he got in through routers with default passwords.

So is Moore upset that he’s going to prison? Not so much, according to the self-defined “mega-geek.” He’s just pissed off that they won’t allow him access to a computer. Imagine that.

E-mail: snelson@senseient.com      Phone: 703-359-0700

A ROSE BY ANY OTHER NAME IS NOT A ROSE: THE NEW F.R.C.P AMENDMENTS

Effective on December 1, 2007, the new Federal Rules of Civil Procedure are often referred to as “the style rules” and some lawyers have complacently chosen not to take a close look at them. This way lies a minefield however – you really do need to look at the new rules because both numbering and captioning have been changed in some places, including some of the electronic discovery provisions.  No one wants to make that mistake in a brief. A small number of the rules have been called “style-substance” amendments. Now THAT’s clear as mud. In any event, if you have the old rules, put them aside and work with the new rules, which may be found at http://cfr.law.cornell.edu/rules/frcp/index.html#toc.

E-mail: snelson@senseient.com  Phone: 703-359-0700

COURT DECLINES TO FORCE SURRENDER OF PGP PASSPHRASE

In computer forensics, encryption is usually a killer. You groan when you encounter it. Or sometimes not . . . in a couple of notable cases, we’ve found wonderful documents like “passwords.txt” and (better yet) “stuffnottoforget.doc” which had the decryption keys in them because the doggone things are so long and hard to remember. Sometimes, manna does rain from the heavens.

But what if you’re not lucky enough to have one of those files? Can a court force a defendant to give up his passphrase? A Vermont court declined to do so on November 29th, finding that compelling a defendant to surrender his passphrase would violate his Constitutional right not to incriminate himself. The case involved child pornography, which always inflames the situation, but the essential truth is that case law involving the compulsory surrender of encryption passphrases is quite unsettled, with even the commentators coming down on both sides of the issue. If this case eventually goes up on appeal, it has the potential of being a landmark decision.

The opinion in the case may be found at http://www.volokh.com/files/Boucher.pdf - and thanks to eagle-eyed colleague Jesse Lindmar for sniffing this one out.

E-mail: snelson@senseient.com     Phone: 703-359-0700

INSURERS GET ON THE ED BANDWAGON

It had to happen. Insurance companies have figured out how to get a piece of the ED action. Lexington Insurance Company has announced it has enhanced its Employment Practices Liability (EPL) insurance offerings to include E-Discovery Response(SM), a new endorsement designed to cover an insured´s payroll expenses incurred while retrieving electronically stored information requested during discovery in a covered EPL claim. The new policy actually reimburses the company’s internal expenses associated with electronic discovery, including payroll and fringe benefits. The policy kicks in when information technology employees locate, extract, translate, and/or restore electronically stored data in order to comply with a written discovery request in a covered claim. For the moment, if you are a qualified Lexington ELP policyholder, you can receive this coverage without any additional premium. Pretty good marketing, it seems to me, and I’ll bet they see a real bump in folks signing on as policyholders. Whomever came up with this bright idea deserves a holiday bonus.

Thanks to my friend Rob Robinson, the inimitable blogger responsible for one of my favorite blogs (http://infogovernance.blogspot.com) for passing this story along.

E-mail: snelson@senseient.com      Phone: 703-359-0700

THE FOX INVESTIGATES THE HENHOUSE MURDERS: CIA PROBES ITS OWN DESTRUCTION OF TORTURE TAPES

Has anyone ever explained spoliation to the lawyers at the CIA? Not until today did it become reasonably clear that the CIA was in fact on notice that it was supposed to preserve the infamous torture tapes (including waterboarding) which have dominated the news. The ABA Journal reported today that a motion filed two days ago said that the CIA violated a protective order issued in June of 2005 requiring the government to preserve evidence regarding the torture and mistreatment of Guantanamo detainees. The New York Times has said the date of destruction of the tapes was November 2005 or later. It also reported that CIA lawyers gave written approval to destroy the videotapes.

If you read the cases involving spoliation of evidence, it is clear that judges are fed up with intentional spoliation. Let’s hope that this particularly egregious act of spoliation finds an angry judge who will hold the CIA lawyers (and higher-ups, if they were involved) responsible. Currently, the Justice Department and the CIA itself are investigating the matter. It, of course, makes perfect sense to allow the fox to investigate the murders in the henhouse. There have been numerous calls for an independent counsel to investigate this whole sorry affair - seems like a damn good idea.

E-mail: snelson@senseient.com   Phone: 703-359-0700

MORE HAND-WRINGING: 44% OF COMPANIES UNPREPARED FOR NEW FEDERAL RULES

A recent LexisNexis Corporate Counsel survey underscores what many of us have known from bitter experience. 44% of corporate counsel reported that their companies were ill-prepared for the new federal rules regarding ESI. Among the top challenges: communicating with IT departments (27%), budgeting monies to put systems and tools and in place (25%), getting buy-in from management on the importance of litigation preparedness (21%) and finding e-discovery staff with a good mix of IT and legal expertise (9%). 70% of these attorneys believe that the new rules require production in native format, which is of course incorrect. 76% agree that the new rules have not cut costs or reduced the scope of electronic discovery. Just over half of the respondents reported bringing some elements of the discovery process in-house to control costs and management of the discovery process. More results of the survey may be found at http://www.lexisnexis.com/about/releases/1022.asp

E-mail: snelson@senseient.com     Phone: 703-359-0700

SILENCE IS GOLDEN: ANOTHER SILLY DAY AT SENSEI

*once again, cue Twilight Zone music*

Woman walks in with a computer and will not speak, instead pointing to a note: “Computer is watching and recording everything – it records what we say”

Sensei technologist: “Is the computer on?”

Woman shakes head no.

Sensei technologist: “Then it’s not recording anything. We can talk”

Woman shakes head furiously and writes on her pad: “It’s still recording us!”

Sensei technologist (manfully keeping a straight face): “We’ll put the computer in my office, close the door and come back here to talk.”

Woman nods, clearly relieved and the suspect computer is duly quarantined.

There is NEVER a boring day at Sensei.

E-mail: snelson@senseient.com    Phone: 703-359-0700

SHAME ON YOU PINOCCHIO! CURING COMPUTER VIRUSES WITH A SEVEN-LEVEL WIPE

You just can’t make up the stuff that comes out of Washington D.C. How they say what they say with a straight face is beyond me, but cue the Twilight Zone music and let me tell you the latest federal fairy tale.

The head of the Office of Special Counsel is Scott Bloch. The OSC was charged with investigating allegations that Karl Rove illegally disposed of electronic files. Bloch has been under investigation himself since 2005 for improperly dismissing issues brought before the OSC by whistleblowers and then not protecting them from retaliation. Obviously, the exact right guy to conduct the politically sensitive investigation of Mr. Rove, eh?

So . . . about a year ago, Bloch calls Geeks on Call (they don’t have IT help at the OSC?) and says his computer has a virus corrupting or deleting his files (that, at least, is his highly creative story). According to the Geeks on Call receipt, they provided various services to Bloch, including (drum roll please) a seven-level wipe of Bloch’s computer. Not only was Bloch’s hard drive wiped, but the laptops of two of his aides were also wiped. A seven-level wipe to cure a virus? And I guess the aides had the same virus?

If Mr. Bloch were Pinocchio, his nose would stretch outside the capital beltway.

Thanks to Sensei colleague Matt Leo for sniffing this odiferous item out. For your further reading amusement . . . http://www.washingtonpost.com/wp-dyn/content/article/2007/11/29/AR2007112902401.html

E-mail: snelson@senseient.com    Phone: 703-359-0700