Ride The Lightning

WHITE HOUSE TAKEN TO WOODSHED AGAIN OVER MISSING E-MAILS

First, apologies for taking a blogging sabbatical while in London, but all work and no play makes Jack a dull boy. Or Jill a dull girl. Business in London frequently involves a splendid pub lunch and always a pint of ale. We really need to import that tradition. More on “forensic computing” in London soon, but for now I wanted to make sure to update the circus over the missing White House e-mails.

Judge John Facciola, polite but firm, has noted the contradictory statements by White House officials explaining the government’s archiving efforts. On April 24th, he issued an order directing the administration to collect and preserve all e-mails in .pst files for individuals employed at the White House between March 2003 and October 2005. Millions of e-mails appear to be missing from this period, which covers the start of the Iraq war, the Valerie Plame incident and the White House’s response to Hurricane Katrina.

The White House has admitted that there are a lot of e-mails missing but says the e-mails are on back-up tapes and drives that haven’t yet been found. Hmmm. Judge Facciola also recommended that the preservation order be extended to data on flash drives and other portable media. If the White House is to be believed, there is no monitoring or tracking of any of these devices – everything is left up to user discretion (anyone familiar with IT security is no doubt cringing at this folly). He further ordered that the White House advise the court as to whether all backup tapes created between 2003-1005 have been preserved and to specify any dates for which no backups exist. Though the opinion is polite, the court’s frustration with the government failure to be wholly forthcoming and specific is clear.

Given the blatant contradictions (we overwrote backup tapes/no, no, of course we didn’t do that), the real status of the missing e-mails is clear as mud. In the private sector, the entire IT staff would be pink-slipped if they couldn’t identify (and quickly) the status of the backups. How often confusion is convenient.

The court’s order may be found at http://www.citizensforethics.org/files/Document%2067%20(4-24-08)_0.pdf

E-mail: snelson@senseient.com     Phone: 703-359-0700

GREETINGS FROM ACROSS THE POND!

No, I am not being a slacker. In fact, I'm in London with John interviewing computer forensics experts for an article for the ABA. Though there is lots to say (when I'm back home), I thought it amusing that the first thing I heard from our British colleagues was that "forensic computing" is definitely the 'right' term and that "computer forensics" is - well - entirely incorrect. Forensic, they tell me in a patient tone, is an adjective. When I queried, "So do the Yanks have it wrong again?," there was a grave nod and the words "'fraid so." Two countries separated by a common language, yet again!

Quite on another subject, John and I were greatly amused to hear yesterday that a gentleman was subject to a jail term of up to two years because he was a repeat offender whose "wheely-bin" (trash can) was open a full six inches. Well, there you go. England is serious about crime.

Forevermore in our lives, garbage cans will be "wheely-bins" and the very words will make us chuckle.

For now, time to "top up our Oyster" (look it up) and then get home to an expensive room the size of a broom closet and sleep on our twin beds. It's been years since I had a dorm room. Now I remember why. :-)

E-mail: snelson@senseient.com      Phone:          703-359-0700      

PHISHING WITH BAITED SUBPOENAS

Just when you think you’ve seen everything, the bad guys invent a new spin on an old game. Phishing for data is now old hat – we’ve all received notices from banks where we have no accounts telling us we must verify our accounts. This year, it was pretty clever when the phishers came up with an e-mail from the IRS requiring us to enter information to collect our “refund.” That certainly suckered in thousands of folks who apparently didn’t want to look a gift horse in the mouth even when they KNEW they shouldn’t be getting a refund. Never underestimate the power of greed.

The latest twist is a pseudo-subpoena from a court. I’m actually quite chagrined that I did not receive one of these – my friend Ross Kodner was kind enough to send me his. I really felt excluded from the Cool Kids Club. It was fun to take a look at the “subpoena.” The underlying idea is ingenious in one sense, because almost everyone is afraid of getting in trouble with a court. Of course the execution of the idea was execrable – what might been a great scam was foiled by an author who never made it out of 3rd grade English.

As an example of the mangled language, here is a verbatim part of the document. "Any organisation not a party to this suit thas is subponaed for the taking of a deposition shall designate one or more offcers, directors, or managing agents, or other persons to testify on its behalf, and may set forth, for each person designated, the matters on wich the person will testify. Federal Rules of Civil Procedures,20(b)(6). Failure to appear at the time and place indicated may result in a contempt of court citation. Bring this subpoena with you to the courtroom and oresent it to the bailiff. Direct any questions to the person requesting you to appear: City Prosecutor."

Though a fairly pathetic example of phishing, the link to a document which users were told to download carried the usual virus harvesting passwords, account numbers, credit card numbers, etc. In spite of the clear red flags, VeriSign’s iDefense Labs estimated that 1,800 recipients clicked on the link. Though the incident is being investigated, law enforcement and computer forensics experts rarely catch the phishers, who decamp with predictable regularity after quickly socking away what data they can. In this incident, the point of origin appears to have been a server in Singapore, which is probably a kiss of death for the investigation, though I’d love to be wrong on that score.

The Administrative Office of the U.S. Courts posted an alert on its website after (unsurprisingly) receiving a lot of calls. The law.com article may be found at http://www.law.com/jsp/article.jsp?id=1208342617032 and the AO notice may be found at http://www.uscourts.gov/newsroom/2008/alert.cfm

E-mail: snelson@senseient.com       Phone: 703-359-0700

HIDE THE BALL, PASS THE BALL: LOSEY SCORES!

I always enjoy the postings of colleague Ralph Losey. He is both imaginative and colorful, qualities which make electronic evidence subjects approachable even for those who are not technically adroit. He has scored once again with an excellent posting about how to handle e-evidence from beginning to end, framed in basketball terms (must be a guy thing Ralph).

So today I just want to point folks to that posting – my one addition is something that a judge once told me about lawyers who play “hide the ball” with electronic evidence. He pointed at his head and said firmly, “I log that lawyer’s name here. I never forget it. When that lawyer shows up in my courtroom again, I remember not to trust him.”

Now that’s enough to give even a “sharp practitioner” religion.

Ralph’s posting may be found at http://ralphlosey.wordpress.com/2008/04/13/what-game-does-an-e-discovery-team-play/

E-mail: snelson@senseient.com   Phone: 703-359-0700

"LOOK AT ALL THESE PINHEAD LAWYERS": THE CIRCUS IN DETROIT

On April 9th, the Detroit Free Press reported that one of Mayor Kwame Kilpatrick's attorneys in the whistle-blower lawsuit filed by two former police officers told the City Council he saw no obligation to inform the City Council of a confidential agreement to settle a whistle-blower lawsuit. Apparently, when the Council approved an $8.4 million settlement with three former police officers, it was not told of a secret deal between Kilpatrick and the officers to keep secret text messages exchanged between Kilpatrick and former chief of staff Christine Beatty showing they lied under oath at trial when they testified that they were not having an affair.

"I did not believe that this agreement, which is a tentative agreement, necessitated my proactive advice to the council," said attorney Wilson Copeland II during a Council hearing into the scandal.

Another candidate for an Ethics 101 class. In fact, if one reads the whole sorry mess, it appears that there were quite a few candidates for an Ethics 101 class.

My favorite part of this circus was one of the posted comments, which read in part:

“Look at all these pinhead lawyers: one signed an agreement he didn't read (Johnson), one forgot about negotiating a secret agreement which she signed (Colbert-Ossamuede), one conspired not to report Part II of a secret agreement to his client, City Council, (McCargo) and now this fool Copeland II testifies under oath that in his humble opinion divulging any of this was unnecessary.”

I could not have said it better. The Mayor, who you might think would have some interest in explaining himself to Council, has declined to appear. I’ll bet he knows – now - a great deal more about the long, tenacious life of electronic evidence.

Relevant articles may be found at http://www.freep.com/apps/pbcs.dll/article?AID=/20080408/NEWS01/80408083 and http://www.mlive.com/newsflash/index.ssf?/base/news-52/120783715513900.xml&storylist=newsmichigan

E-mail: snelson@senseient.com      Phone: 703-359-0700

RIVERS OF RUPEES: OUTSOURCING ELECTRONIC DISCOVERY REVIEW

Mind you, it isn’t just India, though India has leveraged the cost of e-discovery review in the U.S. into a very comfortable living for many of its lawyers. Is it any wonder that news reports yesterday indicated that associates in Indian law firms have seen their salaries rise by 50% in one year?

Even so, Indian lawyers are a bargain, generally charging something like $60 an hour for legal services. The lawyers themselves take home $6,000-$30,000 annually, a far cry from the typical $225/hour associate taking home in excess of $160,000 annually.

Forrester Research has projected the offshoring of 29,000 legal jobs by the end of 2008 and as many as 79,000 by 2015. Mindcrest Legal Outsourcing, headquartered in Chicago, hired 390 lawyers in India last year alone and 75% of them are working for FORTUNE 500 companies.

Is outsourced data secure? That’s an open question, but great strides have been made in security. Often, data is not stored locally at all - the lawyers work directly on the client’s server over a secure line. There is often biometric access to the facilities, camera monitoring and computers without disk drives, usable USB ports or CD burners and without printing capability. In some facilities, guards even search attorneys’ belongings to make sure they are not carrying flash drives or laptops.

Document review is often priced per page, at about $1.00 per page (versus $7-$10 per page in the U.S.). TransUnion, a Chicago company, says it paid less than $10 per hour for reviewing a million e-mails in electronic discovery, which would it said would cost $60-$85 per hour in the U.S.

What hasn’t happened yet, but inevitably will, is a major security breach. Will it slow the outsourcing juggernaut? That remains to be seen. But it is wise to bear in mind that India (and other countries commonly used to provide outsourced legal services) does not have the same ethical constraints that exist in the U.S., nor the same privacy and data breach laws. So when the proverbial horse is out of the barn, recourse may be dicey – and has the attorney managing the outsourcing exercised due diligence throughout?

Don’t know about you, but it would give me the willies.

The article which gave rise to this post may be found at http://www.time.com/time/magazine/article/0,9171,1727726,00.html

E-mail: snelson@senseient.com      Phone: 703-359-0700

CITY CYBERSLACKERS NABBED BY COMPUTER FORENSICS IN QUEBEC

Computer forensics is a wonderful circus – we get to see all the animals in all conceivable environments. Here’s an example of one investigation we’ve never taken part of – though it’s logical enough.

So what do YOU do at work all day? Any cybersurfing? Is it enough to make you an official cyberslacker? That’s what the government of Quebec City set out to discover when it charged a law firm and a computer forensics company with conducting a sting operation against 27 municipal employees suspected of indulging in too much playtime on the Net.

As a result, the city sanctioned 15 employees, with 10 of them receiving unpaid suspensions. Separately, 12 police officers were referred to their internal disciplinary committee. In Canada, cyberslacking (love that term) is conservatively estimated to cost business more than $16 billion in lost productivity annually – in the U.S., that figure is estimated to be more than $80 billion.

Terrible, terrible. I can’t believe folks take a paycheck and are such wastrels on the job.

Excuse me, must run, need to find a pad thai recipe on Food Network and check the theme of this week’s American Idol episode.

The full article may be found at http://www.canada.com/montrealgazette/news/business/story.html?id=32125d78-a479-497a-ae19-4f461ea18060

E-mail: snelson@senseient.com      Phone: 703-359-0700

TAKING LAWYERS TO THE WOODSHED FOR E-MAIL DELETION

Former Harris County District Attorney Chuck Rosenthal was ordered to pay more $18,900 in sanctions after he was found in contempt of court for deleting more than 2,500 e-mails that had been subpoenaed for a federal civil rights lawsuit. The Houston Chronicle reported that the e-mails included explicit sexual images and potentially racist content. There was more than one scofflaw in the office – the general counsel for the district attorney’s office, Scott Durfee was held jointly responsible for paying $5,000 of the sum because he didn’t appropriately advise Rosenthal about his duties of compliance.

So let’s see. We have two attorneys who we hope have heard of the concept of spoliation of electronic evidence. A subpoena is received and one actively destroys evidence and the other apparently doesn’t raise the issue of evidence preservation. Do these guys ever go to ethics CLEs? Congratulations to U.S. District Judge Kenneth Hoyt for taking both of these guys to the woodshed and applying a powerful verbal spanking along with the sanctions, calling Rosenthal’s conduct “venomous and hostile to the judicial process” and his testimony "unreliable and incredible."

The judge’s order may be found at http://www.khou.com/images/0803/rosenthalcontempt.pdf

E-mail: snelson@senseient.com      Phone: 703-359-0700