Ride The Lightning

POOL PARTY! THANKS TO GOOGLE EARTH

The electronic evidence in this case certainly proved to be entertaining - and very new age. During June, police in Britain have been receiving reports of massive trespassing from homeowners who own pools and have returned home to find the debris from teen pool parties. It turned out that the teens were using Google Earth to identify desirable homes with large pools and then arranging their parties using Facebook and Bebo, leaving digital evidence of their misdeeds behind.

Given the British climate, homes with large pools are a rarity, but the enterprising teens have scoped them out. The new craze is called “dipping” – parties have been arranged at most homes while owners were away on holiday and once while they were sleeping (they woke up to in shock to behold scantily clad, beer-infused teenaged invaders taking over their pool).

In case you wondered, the dress code is formal dress (right up until skinny dipping becomes de rigueur) and it is BYOB (Bring Your Own Bike) – fast getaways being essential.

E-mail: snelson@senseient.com     Phone: 703-359-0700

MICHIGAN GETS IT WRONG: COMPUTER FORENSICS AND SAM SPADE

How does this keep happening? Michigan has now joined a handful of other states in requiring that computer forensics technologists have PI licenses. It is no surprise that the PI lobby WANTS to horn in on the money in computer forensics, but where are the experts who can/should be testifying before state legislatures telling them how ridiculous these laws are before they get enacted?

You don’t need to be a PI to analyze blood, bullets, or nearly anything else. There is almost no correlation between the two professions. Computer forensics is (or should be) a true science, having nothing whatever to do with the old world detective work of a Sam Spade. Should the profession be licensed? Quite possibly – but not under the PI laws. Moreover, as this sort of work is more and more national and international, inconsistent state laws make no sense whatsoever and are a huge headache for law firms and their clients.

In Michigan, you can now receive up to a four-year prison term and a $25,000 fine for engaging in computer forensics without a PI license. C’mon guys. Did anyone really look at this law and think through the implications?

The unfortunate consequence of these laws is that folks in Michigan no longer have the opportunity to select the expert of their choice anywhere in the country. Moreover, it is very likely that outsiders will seek to collaborate with PIs in Michigan as a “front” to sidestep the law. The whole law smacks of protectionism – and of the power of the PI lobby to enact a law which tries to put a square peg in a round hole.

Silly, dead silly. For the record, if any readers become aware of bills being introduced in a state, please pass the information along – John and I are happy to write (and to get our friends to write) in protest. We are even willing to appear before legislative committees if necessary.

Sidebar note:  I must note the excellent and informative post of my friend Jim Calloway, who picked John’s brain about an inexpensive way to document cell phone contents yesterday and turned the results into a humorous and informative post in one of our favorite blogs, the aptly named Jim Calloway’s Law Practice Tips Blog. The post may be found at http://jimcalloway.typepad.com/lawpracticetips/2008/06/preserving-mobi.html

E-mail: snelson@senseient.com       Phone: 703-359-0700

SKEPTICAL JUDGE CAUSES WOBBLY KNEES

It is always extraordinary what lawyers will argue to judges.

We recently had the honor of lecturing on electronic evidence with The Honorable Gerald Bruce Lee (E.D.V.A.), who not only is a great presenter but looks both dapper and elegant in a seersucker suit and a straw hat. Now, if you know Judge Lee, you know he is a great entertainer – his real calling is as a raconteur.

His story of the day was about a hapless attorney who insisted that her three clients, who had bolted from Plaintiff’s company and gone to a competitor, had only taken one important e-mail with them, which could not be recovered because it had been deleted. Judge Lee, in classic form, said “Oh, really? So counselor, your clients have the only computer in the world where, when they delete something, it can’t be recovered? Imagine that.” I can only imagine the wobbly knees of the badly misinformed lawyer.

Compounding her difficulties, the lawyer continued to insist that her client had only taken with them the one e-mail and nothing else. Cynical as always, Judge Lee pressed his point. “Well, this is going to be a very interesting case because I’ve never seen a case where employees left a company for a competitor and only took one e-mail. But I’m ready for that case – in fact, I’m mighty eager for that case. But should the evidence come to prove they took more, then you might seriously want to advise your clients to talk settlement."

Predictably, they settled. Judge Lee doesn’t figure he’s ever going to see a real “we only took a single thing” case and he’s probably right. For sure, we never have.

Thanks for the pleasure, Judge Lee – if ever the judge gig doesn’t work out for you, we’re happy to take you on the road with us anytime!

E-mail: snelson@senseient.com      Phone: 703-359-0700

THE EVIL INTERNET DEFENSE: FOR REAL THIS TIME?

The “evil Internet” defense is the bane of computer forensics. Normally, we hear this argument from those who are charged with child pornography – inevitably, they profess their innocence and their normal ludicrous argument is that a virus, worm or Trojan must have caused the pornography to appear on their computers. As you might imagine, it is generally quite provable that they were: 1) searching for child porn and/or 2) that a human being actually created folders into which the porn was deposited. Others things can be proved as well, but those are the most common. Usually, the evidence we find is used as a baseball bat by the defense attorney, who figuratively beats the client over the head while advising the client to “take the plea.”

But . . . rather to our amazement . . . we have finally found not one but two cases where the “evil Internet” may actually have been responsible for the downloading of child pornography unbeknownst to the user. The first case involved Department of Industrial Accidents investigator Michael Fiola, who was fired from his job for allegedly downloading child pornography on his work laptop. He was later prosecuted. His computer forensics expert opined that his laptop was running corrupted virus protection software, and that the machine was assaulted by spammers and hackers who bombarded its memory with images of incest and child porn not visible to the user. All of the images were located in the laptop’s Internet cache. Normally, we might raise an eyebrow and look askance, but two separate forensic examinations conducted by the Massachusetts Attorney General’s Office concurred with the findings. When the prosecution and defense experts agree, the result is usually correct – it sure doesn’t happen very often.

Further information about the Fiola case may be found at http://www.bostonherald.com/business/technology/general/view.bg?&articleid=1101074&format=&page=1&listingType=tec#articleFull

The second case involved 16-year-old Matt Bandy, who faced charges of possessing child porn on the family computer. His expert found that there were more than 200 viruses on the hard drive, the anti-virus software had been disabled, there was no firewall, a number of the viruses could allow someone to remotely control the computer, there was never a way to tell who was on the computer because there was only one login, one of the viruses even renamed hundreds of files, making it difficult to track activity and there were a number of suspicious executable programs that started running during the time period when the child pornography images were allegedly transmitted. The family took and passed polygraph exams with flying colors. They also went through psychosexual assessments and passed with flying colors. With all the evidence, the prosecution finally agreed to reduce the charges but not to drop them. Faced with the uncertainty of a jury trial, and based on legal counsel, Matt finally pled guilty to three lesser offenses and received 18 months probation with sex offender terms attached, the latter finally dismissed by the court.

Once again, there was at least a credible showing of evidence which might have exonerated Matt. Matt’s story may be found at http://www.justice4matt.com/MattsStory.html.

Now, having read the available defense forensics reports in both cases, my technologists have shaken their heads – there were some errors and omissions in both reports according to them. And more that they thought should have been done. Finally, we were all bemused to see that the forensic expert had the child porn evidence in her possession in contravention of the Adam Walsh Act. She had a court order, but we we all know, the feds have said that there is no court order that protects the forensic expert from the Act - and they have made at least one arrest of a computer forensic expert for child porn possession.

My technologists say they would need to evaluate the evidence from scratch to see if the “Evil Internet” defense holds water in these two cases. But, strikingly, these are the first two cases my guys have seen where (based on the published facts) they were really willing to consider the possibility that the “Evil Internet” defense might be valid. Their fingers were itching to have the evidence accessible through their keyboards. Sorry boys - maybe next time.

Hat tip to Jesse Lindmar for sending these along.

E-mail: snelson@senseient.com    Phone:          703-359-0700      

EXPECT ZERO PRIVACY AT WORK

Heidi Glynn, from NPR, recently interviewed me and wrote a very nice piece which can be found at http://www.npr.org/templates/story/story.php?storyId=91604666.

Note how the percentage of employers monitoring employees has continued to rise: “According to a 2007 American Management Association survey of 304 U.S. companies, 43 percent of employers store and review employees' e-mail messages. Nearly 30 percent of them have fired workers for e-mail misuse — for violating company policy, for using inappropriate or offensive language, for excessive personal use, and for breach of confidentiality.”

And yes, I suppose my Vice President (and husband) might be monitoring me. As I’ve cheerfully admonished him, if he chooses to do that, he’s going to spoil all his Christmas surprises. But for the rest of you, en garde. The boss is very likely watching.

E-mail: snelson@senseient.com    Phone: 703-359-0700

R. KELLY ACQUITED: BOTCHING THE EVIDENCE

On June 13th, hip-hop star R. Kelly was found innocent of child pornography charges which involved a DVD of an adult man having sex with a 14-year-old girl. Amid the circus that always accompanies such trials, it was striking to read about the blunders of the prosecution. Once again, we had evidence – in this case a DVD – that contained extraordinary evidence of a crime. Did the prosecution follow forensic protocol and make an exact copy of the DVD? Of course not. Instead, an inferior quality reproduction was given to defense counsel and represented as an exact copy, which caused an angry Judge Vincent Gaughan to label the DVD “the rotten tomato in the barrel.”

Somehow, the prosecution and defense came to some sort of agreement as to how this evidence would be treated, and that agreement was not disclosed publicly. The botched copy followed the inexplicable inability of the prosecution to explain where the DVD came from, and was then followed by a statement from the alleged victim that it was not her on the DVD. Some jurors acknowledged that they believed it was R. Kelly in the video, but overall, they did not find that the prosecution had met its burden of proof, a conclusion with which most commentators agreed.

I certainly do not know enough about the case to know whether R. Kelly was guilty – but this much is clear – a crime occurred – and if it was R. Kelly, a botched prosecution, including the mishandling of the electronic evidence, helped to set him free. The young woman on the DVD was victimized twice – once by the criminal and then again by a bumbling prosecution.

E-mail: snelson@senseient.com    Phone: 703-359-0700

LAWYER SNOOP RECEIVES TWO YEAR SUSPENSION

On May 23rd, the West Virginia Supreme Court of Appeals suspended Michael P. Markins from the practice of law for two years after he broke into his wife’s law firm computer system while looking for evidence that his wife was being unfaithful. See details in a former post: http://ridethelightning.senseient.com/2008/03/electronic-peep.html

In a per curiam opinion, the court conditioned reinstatement on the lawyer's taking an extra 12 hours of continuing legal education in ethics (gee, do you think?) and said he must also submit to one year of formal supervision once he resumes practicing.

Markins admitted the offenses but argued that the recommended sanction was too harsh in light of his extreme emotional distress over his wife's suspected infidelity, his lack of criminal intent, the absence of harm to his or any other clients, and the fact that he never divulged any confidential information. He further stated that he was remorseful, had no discipline history, was highly regarded by his peers, had cooperated fully, and had already suffered significant financial losses.

In its decision, the court noted Markins did not stop spying until his wife's law firm expended significant time and money investigating who had breached their e-mail security. Moreover, it added, the firm was forced to disclose the breaches to its clients, exposing itself to potential lawsuits and professional embarrassment. The court also noted that the story had appeared in a local newspaper and that one client had already put the firm on notice of a potential claim for damages.

A cautionary tale indeed. The court is to be commended for making sure this kind of criminal and unethical conduct by a lawyer was dealt with harshly, lest there be more miscreants thinking they can “take a walk” on this sort of unethical behavior.

Hat tip to Tina Ayiotis for passing this along.

E-mail: snelson@senseient.com      Phone:          703-359-0700      

WHALES SWALLOWING WHALES: FTI ACQUIRES ATTENEX

On June 10th, FTI Consulting Inc. announced that it had signed a merger agreement to acquire Attenex. Purchase price? Approximately $88 million in cash. This is now an electronic discovery and ESI processing behemoth and quite a force to be reckoned with. Stay tuned for further developments in EDD company shakeouts – just when you get to know the players, the roster is scrambled yet again!

E-mail: snelson@senseient.com      Phone: 703-359-0700

ANTI-CHILD PORN TACTIC DOOMED TO FAILURE?

It’s no secret that those who seek out child pornography are usually ensnared by a web of electronic evidence. On June 10th, three ISPs announced that they would block access to online child pornography. While their goal is laudable, a recent report suggests that their decision may actually make it harder to combat this kind of crime. The report, by the Financial Coalition Against Child Pornography (formed by credit card issuers and Internet service providers to cut off funding for these crimes) states that the ISPs’ efforts are pushing child pornographers toward unregulated Web companies that allow anonymity in purchases.

How is it done? As an example, a user would submit monies to a currency exchange company. Most are (surprise!) located in foreign countries, who are ever-so-helpful (not) to law enforcement agencies. Many do not require proof of identity. Once they receive the funds, the currency exchange companies facilitate the transfer of funds to an online payment company, e.g. Paypal, which allows transactions over the Net. From there, the money is sent to the pornography site and the user’s identity is cloaked. One such payment system is called WebMoney, which is based in Belize and frequently used in Europe. These kinds of sites are frequently alleged to facilitate money laundering through gambling sites. They are reportedly welcoming the child porn industry with open arms.

Curiously enough, if the ISPs leave well enough alone, tracking those who seek child porn might be far easier.

E-mail: snelson@senseient.com      Phone: 703-359-0700

DRIVECRYPT: FOILING LAPTOP BORDER SEARCHES

Ah, those pesky Customs agents who insist on searching laptops with nary a probable cause in sight. Most of the time, the offending material discovered is child pornography. As always in the world of electronic evidence, law enforcement is limping (badly) behind technology. Witness the fact that SC Magazine recently awarded its Best Intellectual Property Protection award to DriveCrypt, a powerful full disk encryption software package with pre-boot authentication that allows for the hiding of the entire operating system.

Now mind you, hiding child porn was not the intent of this software (I’m sure the thought was the protection of proprietary data), but it surely can be used to hide criminal undertakings of any kind. So when the nice customs official asks for your passphrase, you provide a pre-arranged phony one, which thereupon provides a splendid set of entirely false and innocuous data – and everyone goes away happy.

As the Wicked Witch of the West exlaimed in the Wizard of Oz, “What a world! What a world!”

E-mail: snelson@senseient.com Phone:          703-359-0700