Ride The Lightning

WILL SOMEONE PLEASE SAVE THESE PEOPLE FROM THEMSELVES? THE ABYSMAL STATE OF REDACTION IN THE U.S. MILITARY

I didn’t know whether to laugh or cry when I saw a recent Army draft intelligence (definitely a misnomer) paper on potential terrorist uses of technology. Mind you, some of the subject matter absolutely bears study. It is certainly plausible that terrorists could use GPS devices on phones for travel plans, surveillance, and targeting, use mobile phone cameras as surveillance devices and use voice changing technology to make phone calls.

I’m even prepared, though there is no substantiating electronic evidence to date, to believe that Twitter also could be employed as a terrorist tool - the report imagines a “Red Team” scenario where terrorists send other terrorists “tweets” as real time updates of an attack.

But hey guys, if you want to be taken seriously on the subject of technology, you don’t use a MAGIC MARKER to redact someone’s e-mail address before converting it to PDF. Think I’m kidding? The draft report may be found at http://www.fas.org/irp/eprint/mobile.pdf  Look at the bottom of numbered page “1” and you’ll see an e-mail address clearly “redacted” by a magic marker. I was able to read it without even blowing it up, but look at the address at 500% size and you can see it plain as day.

Doggone hard to take this report seriously when the tech savvy seems so catastrophically low!

As Tony Blair famously says of the monarchy in The Queen, “will somebody please save these people from themselves?”

E-mail: snelson@senseient.com        Phone: 703-359-0700

UNFILTERED ORANGE: TAKE A BITE

Readers are always asking me about my favorite electronic discovery resources. Some time back, I announced the debut of "Unfiltered Orange," a weekly compilation of news posts related to EDD published by Orange Legal Technologies. Now that I have enjoyed this resource for a while, it seemed appropriate to note how valuable it has become to many of us involved in computer forensics and electronic discovery.

Kudos to friend and colleague Rob Robinson for harvesting the news and distributing such a useful digest to those of us who are always trying to keep from going under for the third time!

If you missed this train, you can get aboard at http://orangelt.us/about/news-events/unfiltered-orange/

E-mail: snelson@senseient.com       Phone: 703-359-0700

THE DEVIL DEFROCKED: TRO GRANTED AGAINST CYBERSPY SOFTWARE

On November 17th, the Federal Trade Commission announced that it had secured a temporary restraining order against a Florida company accused of peddling spyware. At the request of the FTC, a U.S. district court in Florida issued a TRO against CyberSpy Software, LLC, halting the sale of the company's "RemoteSpy" software. The defendants were also ordered to disconnect from the Internet any of their servers that collect, store, or provide access to information gathered by the spyware.

The FTC’s endgame is to seek a permanent injunction and to have the defendants give up any ill-gotten gains. The agency is suing under the FTC Act, which prohibits unfair and deceptive practices.

Like all spyware manufacturers, defendants touted RemoteSpy as "100 percent undetectable" and able to "spy on anyone from anywhere.” Unfortunately, the rubes that these folks sucker have to pay the price for violations of the federal and state wiretap acts when computer forensics technologists prove just how wrong the ad hype is.

Like so many modern spyware products, this one was intended to be disguised as an innocuous file, such a photo attachment (“want to see the cute pictures I took of the girls this weekend?” is a common line that induces women to open attachments). Click on the attachment and the spyware silently and invisibly installs itself, after which it records the victim’s every keystroke, captures images of the computer screen and records websites visited. To access the information gleaned, CyberSpy clients would log into a website maintained by the defendants.

The commission accused the company of violating the FTC Act by engaging in the unfair advertising and selling of software that could be deployed remotely by someone other than the owner or authorized user of a computer; installed without the knowledge and consent of the owner or authorized user; and used to surreptitiously collect and disclose personal information. The company is also accused of unfairly collecting and storing personal information gathered by the software and disclosing the data to third party clients.

We’re glad to see the FTC work on these cases, but disappointed that the Department of Justice’s policy is generally to keep hands off. Only rarely does the DOJ tackle these cases, in spite of blatant Net advertising that clearly violates federal law. Just last night, we had the pleasure of speaking as a panelist with Eric Welter, from the Department of Justice, who did a splendid job of explaining the law, but could only reiterate DOJ policy that these kinds of cases “are not a priority.”

It was clear at the seminar that most of the attending lawyers thought it should be!

Hat tip to friend and colleague Dave Ries for sending this story along. 
Documents in the case are available at
http://www.ftcgov/os/caselist/0823160/index.shtm.

E-mail: snelson@senseient.com    Phone: 703-359-0700

SURPRISE WITNESS: A METROCARD

In today’s New York Times, an unexpected witness (a MetroCard) made an appearance. Every time we think we’ve seen every possible form of electronic evidence, something else comes along.

In May, Jason Jones was arrested in connection with a fatal shooting in the Bronx after a witness tied him to the shooting. He told police what now appears to be the truth. He had left work, ridden the bus with co-workers, cashed his paycheck and took the subway to see his girlfriend.

Federal prosecutors charged Jason and his older brother Corey in the shooting, alleging that they had shot the victim because he had been a government witness in drug and gun cases.

A retired detective, working for Jason’s lawyers, retrieved Jason’s wallet from a city jail. His lawyers went to the New York City Transit and asked for an account of his movement on the night of the shooting. Sure enough, the evidence showed that the card has been used on a bus and later on subway five miles away from the shooting. It turns out that centralized computers store data on where and when the cards are used, retrieving the information from buses and subway turnstiles. The lawyers also had a photo of Jason as he cashed his paycheck, as well as the time at which he stamped out from his job as a forklift operator. It appeared that it was impossible for him to have committed the crime and both Jason and his brother have been released on bond while prosecutors continue to investigate the case.

Judge Marrero, who had originally refused bond, even paraphrased the Greek philosopher Heraclitus (THAT doesn’t happen often), saying “The river now flowing by is not the same river that passed by yesterday.”

The moral of the story? Hang on to those MetroCards. You never know when you might need an alibi.

Hat tip to friends and attorneys Susan Butler and Carl Roberts for sending the story along.

E-mail: snelson@senseient.com       Phone: 703-359-0700

WHAT WE’VE GOT HERE IS A FAILURE TO COMMUNICATE: THE DIGICEL CASE

From across the pond, courtesy of friend and colleague Ian Henderson, comes a landmark British decision in Digicel et al v. Cable & Wireless, et al. The parties got themselves in Dutch with the judge in traditional fashion. In the words of the warden in Cool Hand Luke, “What we’ve got here is a failure to communicate.”

Caribbean telecom operator Digicel and British telco Cable & Wireless are in a pitched battle over Digicel’s accusation that C&W unlawfully failed to connect Digicel to its networks, engaging in a constant delaying action and conspiracy to prevent the connection.

So what went wrong? The defendants did not sit down and talk with the claimants about their search for ESI. They simply did it on their own, with their own search terms and methodologies. Claimants were able to show that additional search terms were needed to obtain potentially relevant evidence. Additionally, the defendants cavalierly decided that backup tapes containing potentially relevant e-mails of seven ex-employees were simply too much trouble to restore.

The essence of the Justice Morgan’s opinion says “Wait a minute. Not so fast. You didn’t talk to the other side, made a number of questionable decisions and now you want me to rubber stamp those decisions? I don’t think so.” The Civil Procedure Rules (CPR) of the U.K. required the parties to confer with each other about the scope of a search before it is instituted, which did not happen here.

This is a big case. The court was told that the defendants’ discovery had consumed 6700 hours of lawyers’ time and cost more than 2 million pounds. While the defendants argued that the increased discovery was not proportional to the case, the court noted that conspirators don’t leave a lot of written evidence behind, but might well leave evidence in e-mails. Along the way, Justice Morgan cited approvingly several U.S. opinions, including Zubulake, and the work of the Sedona Conference. In the end, he used balancing tests similar to U.S. tests to determine the extent of discovery that justice would require.

Of the 19 additional terms that Digicel wanted to have searched, the court settled on eight. As the court noted, when one side unilaterally selects search terms without consultation with the other side, it exposes itself to the risk that the court will conclude that the search was inadequate and order further searching. As to proportionality, the court said there is no precise answer as to where proportionality lies, but that this was a determination for the court. The court noted that some of expense would be negated by running negative key word searches to exclude documents which were processed in the first round of searches.

With respect to the backup tapes, the same old song was sung yet again, with claimants contending that the expense and burden were not all that great, and defendants compiling a host of worst case scenarios to demonstrate how wildly expensive and burdensome the restoration would be. The court ordered that the parties meet to discuss how best to work at restoring whatever backup tapes might be needed to search the 7 e-mail accounts in question. Commentators in the U.K. have seized upon the decision as a kind of watershed, opening up U.K. “disclosure” to a more Americanized and broader form of “discovery.”

The decision in the case may be found at http://www.bailii.org/ew/cases/EWHC/Ch/2008/2522.html

E-mail: snelson@senseient.com Phone: 703-359-0700

FROM THE IVY COVERED WALLS: IS THE DISCOVERY PROCESS BROKEN?

This week, we had the opportunity to speak at the George Mason School of Law and George Washington University. Casting aside my abject horror at the fact that these students seem to get younger each year, they are a sharp lot.

It is very different lecturing to lawyers, who tend to be . . . well . . . technophobic as a class. The younger generation not only knew most of the technologies to which we referred, but taught the teachers a thing or two about how they use technology, which is as it should be.

Several things struck us about these lectures. First, the unrelenting curiosity – we were peppered with questions. At GW, where we were lecturing about electronic evidence generally, we came nowhere close to getting through our materials, even in two and a half hours – there didn’t seem to be a slide that didn’t engender half a dozen questions. Though some legal audiences are reasonably curious, these students set a new standard!

At GMU, where we were addressing the student body on the high cost of electronic discovery, it was clear that the panel and the students were in basic agreement that the cost of electronic discovery has spiraled out of control. It was apparent that Civil Procedure, as it is taught in law school, doesn’t cover the pragmatic aspects of electronic discovery. The five person panel, as one voice, concluded that the discovery system is so badly in need of repair that it is perilously close to being broken. At this point, settlements are far too often made in fear of daunting e-discovery costs – and too many worthy cases are not filed because of the same fear.

More on that next week in this blog – having finally read the Mancia case and Sedona’s recent publication on Collaboration, there is a great deal more to say.

John and I are off to build a high tech gate in W.V. to help protect the black bears of Spring Mountain from slaughter – in the splendid serenity of our mountaintop retreat, I shall entreat my muses to speak to me on the subject of e-discovery collaboration.

E-mail: snelson@senseient.com     Phone: 703-359-0700

STRANGE BEDFELLOWS: GUIDANCE SOFTWARE AND ACCESS DATA

Like so many others, I’ve been watching the tango between Guidance Software (maker's of EnCase) and AccessData (maker's of FTK) with interest. AccessData, which is privately held, had offered to buy all of Guidance’s outstanding stock for $4.50 a share in early October. On October 31st, Guidance rejected the offer. For those of you who haven’t been watching Guidance’s stock price, it has been sinking like a rock, losing about 79% of its value over the last year.

AccessData’s CEO, Tim Leehealey, is formerly a Guidance executive, so yes, the plot thickens. Is this a grudge match? No love lost for his former employer? Some sort of revenge? I’ve no idea. But Leehealey is not taking Guidance’s “no” lying down, and has said he will take his offer directly to the shareholders.

While antitrust lawyers have been cited as saying the deal won’t go through because Guidance and AccessData are the top two vendors of computer forensics software, I have my doubts. If Sirius and XM were allowed to merge, I can’t see the government stopping this merger. It wouldn’t be rocket science for another well-funded company to develop competitive software, and there are other vendors already out there, though not with the capacities of Guidance and Access Data products.

Quite a business brawl shaping up here. Stay tuned.

E-mail: snelson@senseient.com    Phone: 703-359-0700

STALKING PORNOGRAPHY IN THE WORKPLACE

When you do computer forensics, you see the computers of folks who spend more than half of every workday viewing pornography. Having pornography on computers at work is every employer’s nightmare. Hostile environment actions are only the tip of the iceberg.

Yesterday, forensics software maker Paraben introduced enterprise software designed to detect pornography at work. Though it cannot distinguish between child pornography and adult pornography, it does offer a number of sophisticated parameters which grades images at three levels. The cost is about $17,000 for 500 computers.

Mind you, this is for computers only- not cell phones and other devices that connect to the Net. But it is a welcome first step for many employers.

Hat tip to Dan Fuller.

E-mail: snelson@senseient.com    Phone: 703-359-0700

SHERIFFS WHO SEND US CHILD PORNOGRAPHY

Not for the first time, yesterday we received child pornography via FedEx from our attorney client, who had been given it by a sheriff’s office in Virginia. It was on a CD marked “Sterile.” In our world, that means no CP. Or it’s supposed to mean no contraband. But there it was, which meant (sigh) we had to call our assigned detective in the Fairfax City Police Department and advise him that we were in possession of child pornography, in accordance with our protocol with the Department.

When he heard that a sheriff’s department had distributed the child porn, he laughed. He could afford to laugh. Not us. Because the CD had been identified as sterile, it had been placed in a folder on our server. We had to selectively wipe that folder. We also performed a long erase of the backup tape from the server, thereby overwriting every inch of mylar. We hashed the CD contents and completely scanned our analysis computer to verify that no data was transferred. We destroyed the CD and notified both our attorney and the hapless sheriff’s office. Our amused detective and friend confirmed that we had done everything according to the book, still laughing at the misadventures caused by his colleagues.

This, of course, is how new policies are created. In our case, as of today, whenever we have a case that might involve CP, we review the data in a non-persistent virtual environment to confirm no contraband is present, since we apparently can't even rely on law enforcement to comply with the law. The files associated with the virtual environment are stored on an individual hard-disk drive assigned to the case. Upon review, a file listing including hash values of the items is generated. Upon conclusion of the review, the files associated with the virtual environment are wiped and/or the storage device is wiped. If no contraband is present, the original storage media will be available for additional review and files can be uploaded to the server or forensic workstation if required.

Out of a major nuisance a new policy is born. Just another day at the office. “Sterile” my foot!

E-mail: snelson@senseient.com     Phone: 703-359-0700

PAPER BALLOTS VS VOTING MACHINES: NO CONTEST

Yesterday, John and I were amazed to find paper ballots available at our polling place - we've been using voting machines with touch screens for years. We were given the choice: "paper ballot or voting machine?" We looked at each other, grinned, and said in one voice, "paper please."

And we were not alone. Friends reported that, given a choice, the overwhelming majority of Virginians chose paper over voting machines. Clearly, the mistrust of electronic voting is profound - as is the conviction that this is one form of electronic evidence that is likely to remain vulnerable to the shennanigans of those who would "steal" elections.

That aside, the day went pretty smoothly, once again affirming the greatness of this country, where the transition of power takes place peacefully, even when divisions among its people run deep.

Long ago, outside the Constitutional Convention in Philadelphia, a woman asked Ben Franklin: "What sort of government have you given us Dr. Franklin?" He replied, "A republic, madam, if you can keep it."

We're working on it Ben.

E-mail: snelson@senseient.com    Phone: 703-359-0700