Ride The Lightning

ABA RESOUNDINGLY SAYS “NO PI LICENSES FOR COMPUTER FORENSICS”

At its annual meeting in August, the American Bar Association spoke strongly to the states on the inadvisability of requiring those who perform computer forensics services to obtain a private investigator’s license. Here is the resolution itself:

RESOLVED, That the American Bar Association urges State, local and territorial legislatures, State regulatory agencies, and other relevant government agencies or entities, to refrain from requiring private investigator licenses for persons engaged in:

• computer or digital forensic services or in the acquisition, review, or analysis of digital or computer-based information, whether for purposes of obtaining or furnishing information for evidentiary or other purposes, or for providing expert testimony before a court; or

• network or system vulnerability testing, including network scans and risk assessment and analysis of computers connected to a network.

FURTHER RESOLVED, That the American Bar Association supports efforts to establish professional certification or competency requirements for such activities based upon the current state of technology and science.

Hat tip to Rob Lee from the SANS Institute for sending the resolution along. And to our mutual friend, Jody Westby, for tirelessly working to get this resolution written and passed. I am very proud that my own ABA Section, Law Practice Management, was a co-sponsor.

Keep an eye on proposed legislation in your state and make sure that legislators considering a PI licensing requirement are made aware of this resolution. Also, tell the EDD bloggers, so we can rally the troops.

A computer forensics certification, carefully crafted, would be a good thing for all of us. But let’s hope we can undo the damage already done in those states which have instituted the PI requirement. If you live in one of those states, consider contacting your legislators to see if they will agree to submit proposed legislation overturning those ill-advised laws.

E-mail: snelson@senseient.com       Phone: 703-359-0700

CHERRY PICKING JURORS USING SOCIAL NETWORKING SITES

I’ve long told folks: 1) watch what you put out there on social networks lest it comes back to haunt you (e.g. those college photos where a perfectly nice but wholly inebriated young woman concludes it is a good idea to remove her bra and twirl it for the camera) and 2) lawyers, private investigators, prospective employers and other folks in search of information about people need to be aware that social networking sites are a treasure trove of information.

As electronic evidence, we see these sites used all the time in court. I have used them myself as a screening tool when hiring: Imagine my surprise when one prospective applicant described herself online as “sexually very adventurous, ready for almost anything, anywhere, and you won’t believe what I can do with my stilettos!” Somehow, that didn’t quite fit in with our office atmosphere and professional image. Though I confess, I didn’t give the young men around here a chance to vote on the issue.

Social networking sites have developed a new fan club – jury consultants and lawyers involved in picking juries. The National Law Journal recently carried an article on this subject. While picking juries, lawyers and consultants have used information on social networking sites to find jurors they want, jurors they don’t want, jurors who lied on their questionnaires and the kinds of argument that might appeal to specific jurors. They find far right or left leanings, personal and professional affiliations, perhaps even a history of claustrophobia (do you really want that person on a jury in a case where someone was injured and trapped in a malfunctioning elevator?).

Once again, a brave new world.

Still wondering about those stilettos . . .

E-mail: snelson@senseient.com     Phone: 703-359-0700

THE BLACK HAT REPORTS: DNS CACHE POISONING

Make sure you follow the seven or so reports that Keith Jones and Brian Dykstra will be posting on Law.com detailing their experiences at the 2008 Black Hat security conference in Las Vegas, N.V. I got the willies just reading the first posting on August 20th about DNS cache poisoning. There truly is nowhere to run, nowhere to hide.

The first report may be found at  http://www.law.com/jsp/ihc/PubArticleIHC.jsp?id=1202423911432

E-mail: snelson@senseient.com     Phone: 703-359-0700

WHAT CAN CUSTOMS AGENTS DO WITH YOUR LAPTOP? ALMOST ANYTHING THEY WANT TO

Probably one of the hottest topics on the legal tech lecture circuit today is what can happen to your laptop when you pass through Customs. We’ve heard of many laptops being examined (most often for child pornography) and some that have actually been detained by Customs agents so that they could examine the laptop’s data more extensively. Scary for those of us who are lawyers, and indeed for anyone traveling with confidential business or personal data.

So what’s the state of the law? We’ve had two interesting recent decisions on this issue. One is U.S. v. Arnold (9th Circuit) decided April 21, 2008. In that case, the defendant was ordered by Customs officers to boot up his laptop. Once booted, the agents clicked on folders entitled “Kodak Pictures” and “Kodak Memories,” finding a photo of nude women. Upon further examination, the officers found images that they believed to be child porn. Two weeks later, federal agents obtained a warrant. Arnold was charged under 18 U.S.C. Sec. 2256(8)(A). He argued that reasonable suspicion was needed to examine the contents of his laptop, and the trial court agreed. The appellate court, however, reversed and held that reasonable suspicion is not needed for Customs officials to search a laptop or other personal electronic storage devices (yikes! Think about those smart phones and iPods!).

The other case is In Re Boucher (U.S. District Court, Vermont) decided on November 29, 2007. Boucher had crossed the Canadian border into Vermont, where a Customs officer inspected his laptop, finding evidence of child porn. Boucher explained that he downloaded a lot of porn from newsgroups but deleted anything once he saw that it was child porn (oh sure). When asked by the officer to show him where these downloaded files were, Boucher navigated to “Drive Z,” entering a password which the officer did not see. The officer found several CP images and videos of child porn and arrested Boucher. The laptop was then seized – and shut down. Turns out (could you see this coming?) that Drive Z was encrypted and that the computer forensics experts couldn’t get past the encryption. The grand jury subpoenaed Boucher to provide the password or the files themselves, and he refused, citing his Fifth Amendment right against self-incrimination. The court accepted that argument since the act of providing the password or the files would effectively be testimonial in nature.

It will not have escaped your attention that both of these cases are about child pornography and this is a problem. While child pornography is despicable, and everyone is hot to stop folks from trafficking in CP, we must be mindful of Constitutional rights – which exist for a reason. In all honesty, I’ve never seen a case where Customs agents were after anything except child porn, at least to date. But the way we treat child porn will govern the way we treat other kinds of data as well. This is simply another instance of electronic data changing the way we live, with legal implications that no one had heretofore thought through. Frankly, I worry about John and I traveling with sensitive client data, something which we no longer do when we leave the country.

What’s a travel-savvy professional to do? There is always DriveCrypt (http://www.securstar.com/home.php) which encrypts your drive and allows you to have an additional set of entirely phony data on the laptop. If the nice (or not so nice) Customs officer wants to have a look-see, you simply put in the secondary password and the bogus data comes up. Hopefully, they simply let you go on your way, none the wiser.

However, in these days when laptops are sometimes detained for weeks, we are recommending that our clients travel with a clean laptop (nothing you wouldn’t mind the officers seeing). Once you get to your destination, connect via a secure connection and download anything you need to work on. Send it back securely and then use a targeted wiping program to securely delete the data. Better safe than sorry.

E-mail: snelson@senseient.com         Phone: 703-359-0700

CYBERWARFARE - GEORGIA ON MY MIND

Does anyone seriously think that any country would go to war today and not include cyberwarfare as part of its attack strategy? And yet the newspapers and blogs have been full of researchers/pundits suggesting that the attacks on ill-secured Georgian sites were little more than the work of over-excited Russian kids. So what kind of Kool Aid have these guys been drinking?

War without cyberwar? Unthinkable – today.

The sad thing is that what electronic evidence we have doesn’t tell us much about the underlying source of the attacks, nor is it likely to. The Russian government, hardly a paradigm of moral conduct, would not likely miss out on a chance to conduct cyberwarfare while attacking Georgia, though it has done a good job of scrubbing its footprints.

The Wall Street Journal pointed at least one finger at the Russian Business Network, which is known to act as a carrier for online criminal activities. I agree with those security experts who have concluded that the Russian government is in bed with the criminal elements (assuming they are not one and the same thing) to give itself plausible deniability. Give the criminals an IOU, take a pass on some prosecutions, funnel a little money here and there, dole out a little protection, etc. etc. A useful quid pro quo.

And the response? Computer Emergency Response Teams have been sent in from other countries to aid Georgia in fighting the Distributed Denial of Service and other cyberattacks. Apparently, allies still “send in the troops”, but now they send in “cyberwarriors.”

Unimaginable just a couple of decades ago, cyberwarfare is here to stay and represents one of the greatest challenges for all governments. I hope the U.S. government is watching what has happened in Georgia and is taking notes. I have very little faith that we are well prepared for a true cyberwar.

E-mail: snelson@senseient.com      Phone: 703-359-0700

SHOULD GEEK SQUADS BE INFORMANTS?

Sassy title, but this was part of a question from a reader. I’m not sure whether he wished to remain anonymous, so I won’t name him, but he asked what he must report to law enforcement as an IT person with a private company.

Do you give up all right to privacy when you take your computer in to be repaired? I actually had to put on my thinking cap a bit, because the average citizen is not held to the same standards as a practicing attorney. As Joe Citizen, I would think that if you truly stumbled across evidence of a felony, whether it be murder, a threat against the President, or a terrorist conspiracy, you have an ethical duty to report it. But this is not generally (and I’m willing to be corrected here if someone knows more than I) a legal duty. There are a couple of states which have oddball exceptions to this, but nothing major. I thank my paralegal Nicole who researched this for me.

However, if you run across child pornography while a machine is in your possession, you are instantly guilty of a federal crime (no joke, even an attorney has been arrested for having CP in his possession under the protection of a state court order). The “affirmative defense” to this crime is that you reported it to law enforcement and gave access to the evidence. In essence, you must report or risk being charged yourself. Once that report is made, the police then have probable cause and don’t need a warrant. The law, by the way, may be found at http://www4.law.cornell.edu/uscode/uscode18/usc_sec_18_00002252----000-.html

It is for this reason that when computer forensics here turns up CP, we put in a call to a Fairfax City detective who comes over to determine whether or not it is CP and to refer it to the proper jurisdiction if it is CP. Happily, the detective is a friend as well as a professional colleague, so his visits are always pleasant – for us. Not so much for the person who placed the CP on the machine.

Should the tech squad guys be snooping around in machines? Of course not. If they do, my reader asked, is it actionable? You’d have to prove it, and I suspect that would be problematic – in some manner or other, the technician would say that he/she stumbled across it – difficult to disprove. And, since you would then be facing federal charges on the possession of child pornography, you would likely be somewhat preoccupied.

We, of course, get paid to snoop on the computer forensics side of our company, so the scenario there is somewhat different. However, on the IT side of our company, a consultant who snooped around the data of the law firms we service would be fired instantly.

This same reader posed another question we often hear – what can customs officials do with my laptop? Most lawyers we know are appalled by what we tell them in answer to this question, but this post is long enough. More on that alarming subject shortly.

E-mail: snelson@senseient.com        Phone: 703-359-0700

A MOST CUNNING LINGUIST: CRAIG BALL ON EDD

Why am I laughing while composing this post? Because my colleague and friend Craig Ball once confided to me that he was dying to use the words “cunning linguist” in an EDD column, but didn’t quite dare. Beat you to the punch Craig. And yes I know, payback is hell and I’m sure it’s coming!

The e-discovery 2.0 blog recently posted a marvelously clever interview with computer forensics technologist Craig Ball. Because I know him so well, I can tell you he had (forgive me) a ball writing his answers to the questions. His joy at stringing words together like pearls is evident – it is rare to read something so informative about EDD that simultaneously makes you smile at the linguistic artistry. He is indeed a cunning linguist.

This is a superb piece with no punches pulled. Not all EDD vendors will be happy to read it. Be forewarned.

Run, do not walk, to read the thoroughly entertaining and enlightening piece to be found at http://www.clearwellsystems.com/e-discovery-blog/2008/08/12/five-e-discovery-questions-with-craig-ball/

Had to laugh at Craig’s last answer. My husband John also seems quite attentive when the female Olympic volleyball players are on. No wonder you boys get on so well. And are both married to endlessly patient women.

E-mail: snelson@senseient.com      Phone: 703-359-0700

EDD VENDOR RANKINGS, NEVERMORE! THE SOCHA-GELBMANN SURVEY MORPHS

The influential Socha-Gelbmann EDD Survey has been under fire for some time for its methodologies and rankings. Every year, I groan when my Inbox fills with the chest-beating of firms who get a good ranking based on unverified information that the firms themselves submit.

My own criticism of the survey has been somewhat muted. I like George and Tom – they are gracious colleagues who have always been quick to courteously answer any questions I posed to them. I was also aware of my own self-interest. The way the survey was structured, it simply didn’t reflect the virtues of small firms like my own. “Big” simply looked “better” in the survey. To their credit, George and Tom have consistently said “anyone who makes buying decisions primarily on these rankings is a fool.” But as they also said, “so much for the effectiveness of warnings.” Too much was being made of the rankings, and unintended harm resulted. So they have decided to dispense with rankings and to retool their survey.

I’m not quite ready to say “The king is dead, long live the king” – it’s a terrific challenge to try to get an objective perspective on EDD vendors. But I salute George and Tom for recognizing that change was needed and trying to reinvent their survey. I look forward to seeing what they come up with.

If anyone has suggestions, George and Tom ask that they be sent to survey.suggestions@sochaconsulting.com.

George’s posting announcing the change may be found at http://commonscold.typepad.com/eddupdate/2008/08/the-socha-gelbm.html

Thanks to reader Sean La Roque-Doherty for making sure I paid attention to this while I was at the ABA Annual meeting!

E-mail: snelson@senseient.com      Phone: 703-359-0700

“EXIT HER ASAP!” DINNER WITH LAURA ZUBULAKE

We never dreamed that one of the highlights of our trip to the ABA Annual Meeting in NYC would be dinner with one of the most famous plaintiffs in the history of electronic discovery cases, Laura Zubulake. So it was with surprised pleasure that we accepted an invitation to dine with Laura and our colleague Tina Ayiotis. Laura, who is very bright (no surprise there), impeccably dressed and coiffed (it is New York, after all) and very friendly and charming, took us through many of the highs and lows of a bumpy, seven decision case. She avoided only the settlement details, which remain confidential.

Suffice to say, she no doubt received a pile of money. In 2005, she received a $29.2 million jury verdict for compensatory and punitive damages in her sex discrimination suit against UBS Warburg LLC. Rather than go through a grueling, multi-year appeal, she chose to settle, undoubtedly financially secure for life. And why throw the dice on the always uncertain appellate process? But she’s still impassioned about what happened to her and has been working hard on a book relating her ordeal, tentatively entitled “Exit Her ASAP,” a quote from one of the smoking gun e-mails revealed in the case.

I wouldn’t spill the beans on Laura’s book – hopefully it will be published within a year – but I did ask if I might write this blog posting and she graciously agreed. In particular, I was taken aback by one small but little-known fact. For years, John and I have lectured about the Zubulake case. Like most lecturers, we’ve cited the adverse inference instruction in the case (the judge told the jury that it could draw a negative inference with respect to the missing UBS Warburg e-mails) as a probable prominent factor in the jury’s decision. Not so, Laura told us. Apparently the jury was polled post-verdict, and its members indicated that the adverse inference instruction really didn’t impact their basic decision – they had already been persuaded by the evidence that the discrimination had taken place. However, the punitive damages were undoubtedly impacted by the defendant's conduct with respect to the electronic evidence.

Clearly, Laura’s counsel had done a very persuasive job. Conversely, UBS Warburg provided a great exemplar of how not to treat an employee and how not to preserve evidence. For those of us who are ESI junkies, Laura’s book should be a terrific read.

E-mail: snelson@senseient.com      Phone: 703-359-0700

DUMB AND DUMBER IN PENNSYLVANIA: E-DISCOVERY BRAWLING

In a July 15th decision (Square D. Company v. Scott Electric Company, W.D.PA) Judge Nora Barry Fischer had clearly had enough. The electronic discovery motions had become a small avalanche, as the defendant continuously obstructed computer forensics experts from examining the evidence, in violation of the court’s order. A full year of scrapping ensued. As an exemplar of how not to behave, the case is terrific.

Defendant Globe Electric Supply, which had been obdurate throughout, was ordered to pay for the forensic examinations and the judge warned the defendant “that any further restrictions unilaterally imposed by it or its counsel on the forensic inspection (in any regard) as well as any other baseless barriers impeding the completion of discovery will be met with sanctions.” Gee, do you think she’s angry?

My eye was also caught by the judge’s terse comments regarding the pleadings filed by the defendant. Check this out: “While the Court has previously declined to comment on Defendant Globe's filings with this Court, its response brief and brief in support of cross-motion consists of a series of stream of consciousness, run-on sentences riddled with spelling and grammar errors, which the Court deems wholly inappropriate to file in any court or proceeding.”

Ouch. Sounds like someone needs to go back to English 101.

Hat tip to Tina Ayiotis for passing this case along.

E-mail: snelson@senseient.com     Phone: 703-359-0700