Ride The Lightning

EDD’S GRIM REAPER: THE FLOUNDERING ECONOMY

Once again, we are on the road lecturing. We took a break from a warm and enthused West Virginia audience and had lunch with some of our faculty colleagues who follow the electronic evidence arena, including good friends Ross Kodner, Catherine Saunders-Reach and Brett Burney, who authors the well respected blog, ediscoveryinfo.

Everyone involved in EDD is hearing the whispers of doom. Corporations are slashing litigation budgets and limiting the use of outside counsel. Law firms, eager to make clients happy and avoid clients bolting, are more aggressively seeking to lower EDD costs, often pursuing settlements instead of litigation.

Consequently, there are a lot of folks in the EDD world who have the willies. Amongst our luncheon group, we talked about the recent demise of two mega law firms and wondered how much longer it would be before this phenomenon moved over to EDD companies. The consensus was “not long.” For the Goliaths of EDD, this has got to be a nervous time. If they are not well-capitalized, if they owe a lot of VC or other money, if their overheads are enormous, indeed they may be in trouble. Some of the EDD firms owe their existence to prosperity. In the absence of prosperity, it may be that only the strong will survive.

Our little group fears that there will be many in the electronic evidence world who are likely to receive a most unwelcome visit from the Grim Reaper. An apt, if gloomy, Halloween image.

E-mail: snelson@senseient.com    Phone: 703-359-0700

NO “MAGIC LAMP” - RUNNING HASH VALUES CONSTITUTES A SEARCH

Amazing how many times child pornography cases end up making law. It has happened again, this time in Pennsylvania in U.S. v. Crist (M.D. Pa. October 22, 2008). Bottom line, law enforcement ran child porn hash values against a forensic image of a computer without a warrant.

The facts in the case were pretty comical. Defendant Crist was behind on his rent payment. His landlord hired a father and son team to remove his belongings though there was no official eviction action in place. The son had a friend named Hipple who needed a computer, so Crist’s computer was free pickings for Hipple, who came to pick it up. Shortly thereafter, Crist returned home and discovered the father and son team removing his belongings and reported his computer stolen to the police. OK, not bright, but these guys tend not to be rocket scientists. Hipple then found child pornography on the machine and flipped out. He called the police.

The police, not precisely rocket scientists either, were now aware that the computer had been reported stolen and that there was potentially CP on the machine. Nonetheless, they contacted the Attorney General’s office to have the computer forensically examined. Warrant? We don't need no stinking warrant.

Agent Buckwash, who conducted the warrantless examination on behalf of the Pennsylvania Attorney General’s office, found five videos containing known child porn and 171 videos containing suspected child porn. The hash set he used was from the National Center for Missing and Exploited Children. He then switched to the “gallery view” function to see the images, which was certainly the kiss of death, ultimately finding 1600 CP images. He also extracted the Internet history, and used the program NetAnalysis, sorting for suspected child pornography.

The question before the court was whether running the hash sets constituted a Fourth Amendment search. The court concluded that it was and ruled that the child pornography evidence would be suppressed. Long-standing precedent would suggest that Crist lost any privacy rights in his computer as to the images viewed by the private party. The issue is whether he lost any privacy rights as to the remaining files on the computer. There are several schools of thought on this, basically revolving around whether a computer is one container (like a briefcase) or many (which this court seemed to find). If a briefcase, the police would have been ok – the finding of contraband by a private party would have permitted the search of the rest of the briefcase without a warrant.

Among other claims of the U.S. – the searches were done in good faith and the evidence should be allowed. This resulted in my favorite line in the opinion: “good faith is not a magic lamp for police officers to rub whenever they find themselves in trouble.”

So far as I know, this was a case of first impression, and it would appear that running the hash values alone would be sufficient to constitute an illegal warrantless search. The government is expected to appeal.

This is definitely a case to watch. For my Christmas list, I would very much like a magic lamp which would absolve me of all errors. Are you listening, Santa?

Further information and a link to the opinion may be found at http://arstechnica.com/news.ars/post/20081029-court-rules-hash-analysis-is-a-fourth-amendment-search.html

E-mail: snelson@senseient.com     Phone: 703-359-0700

HOW DO I AUTHENTICATE A GOOGLE EARTH PHOTO?

After the electronic evidence has been gathered, getting it admitted in court can be a fearsome headache. You would THINK that there would be some fairly standard rules that a reasonable lawyer could follow. You’d be way off the mark.

A recent question: “How do I authenticate a Google Earth photo?”

Here’s how I answered:

To some extent, the answer depends on whether you are in state or federal court. In general, state courts are looser about authentication (though a state judge I lectured with Monday staunchly said, "we are not looser - just more practical"), but even the federal courts run the gamut.

Stipulations or Requests for Admissions are the easiest way to get the evidence in. Failing that, most courts will allow a declaration, affidavit, etc. Minus opposition from the other side (and they need to have a credible argument), it should come in without a problem. Some federal courts have really tightened the standards, but in general, it will be admissible using one of the aforementioned techniques, though whether it is what is purports to be is remains subject to the determination of the fact-finder unless the other side has agreed that it is what it purports to be.

The good news is that electronic evidence is generally found to be what it purports to be in the absence of indicia to the contrary.

The cases on this are all over the map. Every time I lecture on Authentication and Admissibility, I get a headache. And no two judges seem to have precisely the same "take" on this. Find someone who knows your court to get court-specific advice.

Of course, you could always get someone knowledgeable from Google to testify, but see the alternative below, offered by another attorney:

My opposing counsel got a Google Earth map admitted by having a witness who was testifying about related matters testify that he often used Google Earth for navigation purposes in his professional capacity (the witness was a Water Patrol officer). He asked the witness questions to establish that:
1) Google Earth is used in the ordinary course of business by the Water Patrol for navigation purposes
2) In the patrol officer's experience, Google Earth is generally accurate
3) The particular map offered by Respondent was an accurate depiction of the location at issue

A related and interesting tidbit from my mailbox: 
 
In Indiana a couple years ago, I attended a CLE where about 25 lawyers and judges 'ruled' on evidence. Of the 12 judges, half were trial court and the other half appellate.  For a solid day they were given real evidentiary hypotheticals (created by trial lawyers from experience) and ruled by pushing buttons that tallied the votes on a big screen. The judges were all over the block on most every ruling. The lawyers were the most consistent and appeared to follow the rules more consistently. It was amazing. By the end of the program, the moderator was actually picking out some of the judges and asking 'on what grounds could you possibly exclude that evidence', etc.

Misery loves company and it appears that I’m not the only one with a headache.

E-mail: snelson@senseient.com       Phone: 703-359-0700

VOTING MACHINES: IT’S NOT A BUG – IT’S A FEATURE

With the election so close, it was timely to read recently about the faux pas committed by voting machines. For years, I’ve been preaching that these machines are NOT reliable – and Lord knows, the students at Princeton have busy proving it. Check out this link: http://citp.princeton.edu/

So . . . from West Virginia . . . a cautionary tale about a crucial piece of electronic evidence. In Jackson County, a very Republican County, three early voters had a really hard time voting for their preferred candidates. According to Virginia Matheney, "When I touched the screen for Barack Obama, the check mark moved from his box to the box indicating a vote for John McCain." When she reported the problem, she said, the poll worker in charge "responded that everything was all right. It was just that the screen was sensitive and I was touching the screen too hard. She instructed me to use only my fingernail." So she dutifully used her fingernail. Same problem.

Calvin Thomas, 81, also experienced difficulty. "When I pushed Obama, it jumped to McCain. When I hollered about that, the girl who worked there said, 'Push it again.' I pushed Obama again and it stayed there. Then, the machine did the same thing for other candidates.” Thomas insightfully wondered how many other people, especially older folks, might not notice that something was amiss. So what did the authorities have to say? Well, sometimes machines can become miscalibrated when they are moved from storage facilities to early voting areas. Yeah, ok, so how come you don’t test them when you make the move? Even Homer Simpson might scornfully say “D’oh.”

Jackson County Clerk Jeff Waybright’s response to the issue? “After we got a call from the Secretary of State's Office, we recalibrated the machine. We had already voted over 400 people with no problems." Voting problems occur when voters touch the screen, Waybright said, but do not put their fingers inside boxes for their candidates. Waybright blamed the problem on voters. Well now, that’s mighty convenient. Clearly, in the case of the individuals cited above, the problem wasn’t user error.
I was delighted to hear that my current and former paralegals are helping to monitor polling places for this election. I’m glad to see so many law students and lawyers are working on election day, “keeping them honest.” It doesn’t matter which way you vote, but let’s all be comfortable that votes are being recorded faithfully. At least with paper our biggest worry was chads.

E-mail: snelson@senseient.com    Phone: 703-359-0700

ONLINE DIVORCEE JAILED AFTER KILLING VIRTUAL HUBBY!

Well, that’s a stopper of a headline, isn’t it? In Japan, they take their virtual worlds seriously. Of course, they can’t quite charge you with murder for anything that happens in the virtual world, but the electronic evidence in this case may certainly result in a computer hacking charge.

Police reported the arrest of a 43-year old woman, whose abrupt divorce in a virtual game made her so irate that she “killed” her online husband’s digital persona. Allegedly, the woman used the “former husband’s” ID and password (which she got when all was wine and roses with her virtual husband) to log onto the popular game “Maple Story” and then axed his avatar. The man complained to the police when he discovered that his online avatar was dead.

In Japan, where they take these things seriously, the woman scorned may now face a prison term of up to five years or a fine of up to $5000.

I have enough trouble with one husband in real life. Another husband in a Second Life sounds like far more trouble than I can handle. I have always kept in mind the adage of the wag who wrote, “If it comes with tires or testicles, it’s going to be trouble.” One husband is quite enough, thank you.

E-mail: snelson@senseient.com   Phone: 703-359-0700

FROM THE MAILBAG: A LARGE GRAIN OF SALT

In a recent post, I reported on the release of a new litigation hold and e-discovery study from CGOC and Huron Consulting Group. In response, I received an interesting e-mail from a reader who preferred not to be named. A portion of the e-mail reads as follows:

“I have real trouble with this study. It suggests Atlas has a gargantuan installed base (84% of companies with $5 billion or more in revenues) but it omits from the cover the role Atlas' publisher, PSS, played in the survey and, more to the point, it doesn't seem to offer any insight on the overall number of respondents. Might it be like Guidance Software polling EnCEs and concluding that virtually everyone uses EnCase? I'm not meaning to pick on PSS, but isn't it weird how surveys that omit the sample size and response rate so often come out in favor of the sponsor's product?

The Atlas product is great and almost certainly is the leader in a field that only lately has seen any competitors. But leaving PSS off the cover and failing to share even the broad details of the methodology sets off alarm bells. We all know marketing is suspect, but when you pass it off as something more, you owe something more to readers.”

I agree with my correspondent and, of course, should those involved in the study wish to respond, I’ll be happy to post their comments.

E-mail: snelson@senseient.com    Phone: 703-359-0700

WHAT LAWYERS NEED: BRAIN DEAD SIMPLE EDD REVIEW

I have commiserated with many of my colleagues over the absence of a user-friendly EDD review tool for small to mid sizes cases. I never knew exactly how to describe it – until I had pleasure of having breakfast at an ABA conference with Browning Marean, a partner at DLA Piper. He is an extraordinarily good lecturer on all things involving electronic evidence, and as gentlemanly a lawyer as I have ever met. One of the things I like best about Browning is his ability to phrase things in street parlance so they are clearly understood. We were discussing the e-rooms that his firm uses to conduct business with clients and he commented that they worked so well because they were “brain-dead simple – even lawyers can figure them out.”

So, for anyone who might be thinking about developing EDD review software, or indeed any software intended for lawyers, remember to keep it “brain-dead simple.” Put the term right in the Scope of Work so you don't forget!

Quite apart from computer forensics and EDD, I also added a new entry to my lexicon, courtesy of one of our Canadian colleagues, Richard Ferguson. Richard is well known for his ability to ingest remarkable quantities of single malt scotch without any apparent ill effect – but he confessed to me that he has no tolerance for red wine, three glasses of which will render him “wobbly pop.” A charming term. As I compose this, the hallowed hour of 5 p.m. approaches. I look forward to a libation or two but shall endeavor not to get “wobby pop.”

E-mail: snelson@senseient.com    Phone: 703-359-0700

LITIGATION HOLDS: WHAT ARE THE BIG GUYS DOING?

When I lecture, I always point out the obvious: when your spinach is sending people to hospital and your cattle, who can’t stand up but you kill them anyway and send hamburgers to market that kill people, you are probably under a litigation hold. You can reasonably anticipate in both cases that litigation will ensue.

Litigation holds seem to be fraught with fog – clients have trouble understanding when they are under a litigation hold and what, precisely, the duties of a litigation hold really are. So . . . if you were wondering what the “big guys” are doing, we now have a new survey to give us some guidance. CGOC, a practitioners’ forum focused on records retention and preservation practices, and Huron Consulting Group, a provider of financial and operational consulting services, have just released the results of a survey on legal holds and e-discovery practices of Global 1000 companies. The findings highlight the changes in processes and technology within these companies and the methodologies used to issue legal holds, manage preservation, and conduct e-discovery.

For me, one of the more striking statistics was that 80% of respondent companies issued legal holds for every matter, while 20% used risk and case analysis to determine which matters required legal holds. I am not arguing with the latter approach, merely noting that it is interesting. Also of interest, approximately 85% of the respondents used Atlas LCC legal holds software, while 14% used Access databases and Excel spreadsheets, and the remaining 1% developed their own custom software.

If you read the judicial opinions, the failure to appropriately follow litigation holds is a sure invitation to sanctions, so this may be worth reading.

You may find the survey here.

E-mail: snelson@senseient.com     Phone:                   703-359-0700       

FULBRIGHT & JAWORSKI 2008 LITIGATION TRENDS SURVEY

This is always one of my favorite surveys. Lots of wheat, little chaff. And this year, it gave me good news. Since I make my living from the litigation business (and new case filings were down this year) and since I am known within the family as “The Bank of Mama,” I was pleased to note that litigation is predicted to be on the rise this year, in part due to the shrinking economy. When companies fail, there is always a legal bloodbath around the corner.

With respect to electronic evidence (a small part of the survey), 12% of the companies responding said they had been before a court or other litigation tribunal ill-equipped to deal with complex electronic data discovery. For financial services and technology firms, which have mounds of e-files and other electronically stored data, 19% and 18%, respectively, reported facing courts and tribunals not up to the challenge.

Everyone dealing with EDD review has discussed the outsourcing of that review to foreign shores. So far, a handful of U.S. companies – 2% – are availing themselves of such services. However, for billion-dollar firms with much greater volumes of cases the number was a more notable 8%. Technology firms were the most comfortable with the practice, with 12% willing to send their document review offshore, followed by financial services firms at 11%.

Nice job on the survey guys – it is always instructive. The Bank of Mama likes your news.

Thanks to pal Toby Brown for the heads-up.

E-mail: snelson@senseient.com     Phone: 703-359-0700

MD5 COLLISIONS . . . THE ODDS ARE AN "UNDECILLION"? WHO KNEW?

Guess I struck a nerve with the recent MD5 collision posts. Lots of mail - here’s one more, reprinted by the kind permission of my close friend Craig Ball, who is always a generous colleague. My husband/partner John can keep up with Craig, and indeed they seem to keep each other on their toes,  but I’m afraid I am always eating the collective dust of these extraordinary forensics technologists. Ah, well, humility is a virtue, right?

As always, Craig took me to school in the nicest of ways and expanded both my knowledge base – and my vocabulary. I had never heard the word “undecillion.” Should you too be in the back of the class, listen and learn from one of EDD’s true rock stars:

“There is actually a name for the number of zeros (10 to the 36th power) that follows the estimate of the likelihood of collision.  It's called (I swear) an undecillion, and the spontaneous collision value for MD5 is one-in-340 undecillion.  You used 'billion' beautifully, but personally I prefer the almost-as-alliterative 340 trillion trillion trillion.  Sadly, thanks to Bush, banks, brokers and borrowers, we are coming to regard trillion as a prosaic number.

Since I was a boy, the enormous value of a billion has stayed with me by noting that if you had a billion dollars and counted it out at a dollar per second--24 hours a day, seven days a week until you were through--it would take you 34 years.

MD5 is truly "broken" for certain applications, but not for the way we use it in forensics, leastwise not to an extent that should cause us to stop using it near term.

In a nutshell, if you can control both sides of the input data set, you can achieve a collision between functional, intelligible data objects.  You can, for example, create two different executable programs that do different things (e.g., benign and malicious) but that hash identically.  There are some (harmless-but-troubling) Windows examples from Peter Selinger at http://www.mathstat.dal.ca/~selinger/md5collision/.  You can do the same for security certificates with, e.g., two names. 

Consequently, the "breaking" of MD5 has some genuine consequences for network and transactional security.  Imagine getting an engineered certificate approved by a registrar and then using the collision certificate.  Networks would see them as the same because they would hash identically.  Alternatively, if you could get the major antivirus applications to identify your first engineered application code as benign, you could subsequently promulgate colliding malware and achieve deeper destructive inroads into systems.

So why do I say it doesn't matter much for forensics?  Because with current computing resources you have to control both sides of the equation; that is, you have to vary both collision candidates to secure the match while still producing intelligible content.  In forensics, we don't have the luxury of modifying both the original evidence and an alternate set of data to engineer a collision.  Instead, we confront a block of data (e.g., hard drive or file) that has a certain MD5 hash value.  Engineering a collision to match a particular MD5 value is not what is happening out there.  They are (if I am understanding the work) engineering two files with different content to arrive at any matching MD5 value. 

We are still unable to take a data set of a known MD5 value and create a colliding dataset that contains alternate intelligible content.  As to how far we are from that achievement, I can only say that commentators routinely underestimate codebreakers, especially those who have an X-Box network or several high end graphics cards they can throw at the problem.  Amazing, isn't it,  that the hacker who rocks our world won't be usng a supercomputer by Cray or IBM--it's more likely to be branded by NVidia or Sony Playstation!"

I am always happy to have Mr. Ball in my court – bowing deeply in the general direction of Texas . . . thank you Craig.

E-mail: snelson@senseient.com   Phone: 703-359-0700