Ride The Lightning

MARYLAND SPIES ON "FRINGE PEOPLE"

What, you might reasonably ask, are "fringe people?" A wooly-headed Thomas Hutchins, a former Maryland State Police Superintendant, somehow defined this as people who wish to disrupt the government, a chilling distinction not to be found in the United State Constitution.

In yet another misbegotten police misadventure, 300 hours of time was devoted to surveillance of individuals who belonged to peaceful groups opposed to capital punishment, the war in Iraq, military recruiting in high schools, global warming and other cases. These groups were infiltrated by "Lucy," an undercover Maryland State Police trooper. 53 individuals, including two nuns, were subsequently entered on a suspected terrorist list and information about them was shared with state and federal agencies, including the NSA. They were given such designations as "Terrorist - Environmental Extremist" and "Terrorist - Anti-Government."

After a blistering report by Stephen Sachs, a former Maryland Attorney General, and legislative hearings in October, the police promised angry legislators that they would notify the 53 individuals that their names had mistakenly been entered on the terrorist list and give them a chance to review their files before they were destroyed.

One has to wonder who's running the show here, and why a decision was made to illegally monitor peaceful groups in a state that reported 36,000 violent crimes last year. No one, of course, has been disciplined.

The Los Angeles Times' December account of the story, which includes more updated information, may be found at http://www.latimes.com/news/nationworld/world/middleeast/la-na-cop-spy7-2008dec07,0,1237214.story

In our times, sadly, the very word "terrorist" has become a excuse to violate the Constitutional rights of Americans. In the words of Benjamin Franklin, "Any society that would give up a little liberty to gain a little security will deserve neither and lose both."

Thanks to my friend Craig Ball for suggesting that this story would make a good "lightning ride."

And a very happy, healthy and safe new year to one and all!

E-mail: snelson@senseient.com   Phone: 703-359-0700

THE "WHATEVER" CASE: GUTMAN V. KLEIN

"Whatever. I told him whatever. I did whatever I felt right to do, whatever.”  These were the evasive and unintentionally comic words of a witness in Gutman v. Klein (Oct. 15, 2008), surely one of the most egregious spoliation cases to find the light of day in a published opinion. In this case from the Eastern District of New York, the judge cites chunks of hilarious testimony to underscore the failure of defendant Klein and another witness, a computer technician related to Klein who performed many acts of spoliation, to persuade him of their veracity.

A pivotal laptop in the case was produced late, hot to the touch, with a screw missing from the hard drive enclosure. Nice of them to provide a clue that something was amiss.

All sorts of data was deleted, the operating system was reinstalled and the computer clock was changed seven times in the hours prior to forensic imaging. Seriously, these people went out of their way to look like bad guys. In this dumb and dumber escapade, an ID was deleted and another created with the apparent intention of making the evidence "hang together," but the result was simply cartoonish and easily unveiled by the plaintiff's forensics experts.

And then there was a missing laptop, which was supposed to be produced, whose theft was never reported to the police. Magistrate Judge Levy barely accorded this claim the time of day, citing the untrustworthiness of Klein's testimony.

The court found that a default judgment in plaintiff's favor was the only remedy strong enough to meet this extraordinary set of facts. Do read the opinion, but not while drinking coffee. I laughed so hard at the testimony that I ended up having to clean my keyboard!

Hat tip to Tina Ayiotis.

E-mail: snelson@senseient.com    Phone: 703-359-0700

BRIGHT YELLOW SUITCASE SCREAMS "SEARCH ME!"

As the holidays approach, I had a number of very serious electronic evidence postings that were possibilities. Much too serious for the season, I finally decided.

My friend Ross Kodner was kind enough to send me some light-hearted moments in IT and I found one that really resonated with me. After talking about customs agents searching laptops in some of my posts, I chuckled over a story from the 80s in which a software developer was sent abroad to do some software updating and training at his corporation's South American office. He was handed a very large, very ugly, incredibly yellow suitcase that was bound to scream "Search Me!" to a customs agent.

Inside the suitcase was a number of computer components - as the employee knew, this spelled trouble, for the country to which he was heading was very protectionist when it came to its nascent computer industry. He began to have images of foreign jail cells and rubber hoses.

Management made sure to give him a piece of paper with the name of an attorney at a London-based international law firm in case he had a problem. Comforting, huh?

Mind you, John and I have had many of our own problems with security and customs. John, in particular, is frequently carrying evidence or various devices for use in computer forensics. They always stop just short of strip searching him, but he sure gets "special" treatment. And because I'm traveling with him, I get the same treatment. Lovely, always.

But this story had a happy ending, largely demonstrating the power of good marketing. As it happens, the component pieces that the employee carried in the suitcase that he had dubbed "The Yellow Peril" bore the IBM logo. In this particular South American country (unnamed in InfoWorld's "Off the Record" blog), IBM had just concluded an extensive marketing company campaign trumpeting the virtues of its then new PC.

The customs agent did indeed open "The Yellow Peril" suitcase and initially looked confused by all the computer components encased in bubble wrap. But then she spotted the familiar IBM logo and asked "IBM Personal Computer? Yours?" When the nervous employee nodded yes, she was done. She closed the hideous suitcase and sent him on his way. Not all border stories have happy endings, especially where computers are concerned.

The moral here is if they think they know what they're looking at, they are often satisfied. Now why does that bring the word "DriveCrypt" to mind?

Happy holidays to all my readers! Ride the Lightning will return next Monday . . . .

E-mail: snelson@senseient.com        Phone: 703-359-0700

MORE STATE RULES ADDRESSING ELECTRONIC EVIDENCE

Hard to keep up these days. Just when we have some sense of what all the new federal rules mean in practice, we are all scrambling to make sure we know what is going on in the states. Arkansas, Iowa, Kansas, New York and North Carolina have all added new ESI provisions.

Links to all the new state rules may be found at http://www.ediscoverylaw.com/admin/trackback/100862

Back to that last minute Christmas shopping!

E-mail: snelson@senseient.com    Phone: 703-359-0700

LOSEY LETS LOOSE ON KROLL

You have to love a guy who self-effacingly acknowledges that he is a smart-aleck. Ralph Losey's e-Discovery Team blog is always a good read, but I especially enjoyed his December 15th post reviewing a recent listing by Kroll OnTrack of its "top five" significant EDD cases in 2008.

Ralph didn't see the cases in the same light, to put it mildly. Somehow, the Mancia and Qualcomm cases didn't even make the list. And some of the ones that did were a bit quirky. I was going to write my own thoughts about the Kroll list, but thanks to Ralph, all the heavy lifting's been done.

Enjoy his post and form your own conclusions. One thing we can all agree on - the courts are sick of EDD misbehavior and negligence - and the sanctions are mounting up fast. Fully 25% of the 138 cases that Kroll analyzed from 2008 involved sanctions. It is way past time for attorneys to pay attention lest they get their knuckles rapped in court and make legal headlines.

E-mail: snelson@senseient.com     Phone: 703-359-0700

AUSSIE MEMO: PUT SHRIMP ON BARBIE, SERVE LEGAL NOTICE ON FACEBOOK

G’day mates. Ah, those Aussies – always up to mischief, these descendants of convicts. At first I thought it was someone having a bit of fun, having had perhaps a bit too much grog at the local billabong and concocting a Fred Nerk tale, but no, strewth - I had read correctly.
 
For the first time in the world (I think), a court has found that a notice of a default judgment can be served on defendants through a Facebook page. Master Harper of the Australian Capital Territory Supreme Court approved lawyer Mark McCormack's application to use Facebook to serve the legally binding documents. Previously, there had been several failed attempts to contact the couple at their house and by e-mail to notify them that a lien had been placed on their home after defaulting on a loan. Australian courts have given permission in the past for people to be served via e-mail and text messages when it was not possible to serve them in person.

Australian courts take pride in being high tech, but this seems like piffle and waffle on our shores. Joe Bloggs (whose U.S. cousin is John Q. Citizen) might accept this dramatic change in process but I doubt our “Johns” would. They’d likely think the Master Harper a hoon and give him a loud “In yer boot!”

Being a bit of a stickybeak, I’d like to ask Master Harper about his notions of due process, but I’m probably just getting agro for nothing. This decision seems a little shonky to a Yank, rather crook. Not ready to say “good on ya” to Master Harper, but I'm not in the mood for a kafuffle either.

No worries. I’ll just go walkabout and pretty soon I’ll be happy as Larry. 

Ooroo mates!

“Ta” to Tina Ayiotis for the story.

E-mail: snelson@senseient.com     Phone: 703-359-0700

DATA RECOVERY HELPS CONVICT RAPIST

At the worst moments, technology sometimes chooses to fail us. On December 11th, it was reported that the recovery of data from a damaged DVD helped to convict a California man of multiple rapes. Michael Barnes was never a poster child for law abiding citizens -  a 41-year-old convicted kidnapper, he had been charged with a raping a woman while on parole.

Actually, three women accused Barnes of rape. Unfortunately, one of the victims’ original police interview was on a DVD that had become unreadable. When the judge ruled that she could not testify at trial because of disputes over her original testimony, prosecutors did not have enough evidence to build a case for multiple counts of rape without the DVD evidence.

Two local firms said the DVD was unrecoverable, which just proves that there is data recovery and data recovery. Seagate Recovery Services found there was damage to the lead-in section of the data so that normal playing software could not get past the beginning. Once Seagate extracted an image of the data from the DVD, it was able to repair the damaged lead-in portion of the DVD, making the data - which had always been intact - viewable.

With the restoration of the DVD, prosecutors charged Barnes with multiple rapes involving three different women. Barnes was sentenced to 24 years in prison on December 5th after pleading guilty in the face of the evidence.

Hat tip to Dan Fuller for forwarding this story.

E-mail: snelson@senseient.com     Phone: 703-359-0700

BLACK EYES FOR LAW ENFORCEMENT: MISHANDLING OF ELECTRONIC EVIDENCE

The need for more law enforcement training in the handling of electronic evidence is acute. This week has brought us more than our usual share of bumbling and fumbling from our friends in blue. This week’s harvest included:

1. A police department that turned a computer on and off (hey guys, this is original evidence you’re stomping on!) six times within two days of seizure, accessing numerous files.
2. A police department that handed over evidence containing child pornography to the city’s IT director for analysis (um . . . gotta read that Adam Walsh Act chaps!)
3. Last but not least, we were once again sent child pornography in the mail by a Public Defender’s Office – and sadly, this is the second time in a month – and generated by the same individual. You would think, after we reported the previous incident just weeks ago, that corrective measures would have been taken. Apparently not.

Note to law enforcement: We love working with you. We are all professional colleagues in search of the truth. But please get your folks trained so you don’t blow your cases! And yes, John and I do training in the proper handling of electronic evidence and would be happy to help. Let that school bell ring!

E-mail: snelson@senseient.com    Phone: 703-359-0700

REMOTE SPY SOFTWARE GIVEN REPRIEVE BY COURT

On November 21st, I reported on the temporary restraining order that the Federal Trade Commission had secured against the sale of Remote Spy software. Things have changed since then, and the CEO of CyberSpy software, Tracer Spence, wrote to ask me to update the story. Fair enough.

On November 25th, the U.S. District Court for the Middle District of Florida declined to impose an outright ban on the sale of RemoteSpy keylogger spyware, but the court did bar its parent company from marketing the product for deceptive purposes while it considers a complaint from the FTC that the software may violate the FTC Act. The defendants are also barred from providing others with the means to falsely represent a keylogger program as an innocuous file, such a photo or music file.

The court instead issued a more narrowly tailored preliminary injunction. CyberSpy altered its website accordingly and, as of December 3rd, the software was again available for sale and users could access their accounts.

One notable quote from the injuction: "RemoteSpy is designed to be installed without the knowledge or consent of the owner or authorized user of a computer, and defendants' marketing touts this function . . . In light of these marketing efforts, the potential for devastating abuse far outweighs the possibility of benign use."

CyberSpy is seeking to dismiss the entire lawsuit. I don't mind reporting this victory as requested, but it may be a temporary triumph. The makers of spyware skirt the law when they agonizingly come up with language that doesn't openly suggest violation of the law when anyone with the mental capacity of a toad knows that the allure of the product is overwhelmingly to those who wish to use the product to spy illegally on someone else.

The documents in the case may be found at http://www.ftc.gov/os/caselist/0823160/index.shtm

E-mail: snelson@senseient.com      Phone: 703-359-0700

YOU'LL SHOOT YOUR EYE OUT! AND OTHER RUMINATIONS FROM JAMAICA

Only a complete fool would be in Jamaica composing a blog post. Enter the fool.

I tried to be helpful and open our champagne on our final night in Jamaica, but John immediately forbid that, intoning one of his favorite lines from the movie A Christmas Story, "You'll shoot your eye out!" Probably right too.

So I got to write this post and was served bubbly at the same time. Not bad duty.

While poolside today, I was thinking about all the CLEs we've taught and attended over the course of the year. Though we've given and attended dozens and dozens of electronic evidence seminars, only one really struck me as truly novel - and that was a seminar which was the brain child of Craig Ball, who gave the session with my John and Tim Opsitnick at Georgetown's recent E-Discovery Conference.

The session truly dissected the problems and intricacies of dealing with e-mail, which comes in many forms and flavors, but is so often the crux of what clients are looking for in e-discovery. More smoking guns are found in e-mail, active and deleted, than anywhere else. And yet, attorneys have a very limited understanding of how e-mail works and where/how to find what it is they are looking for. Do you know your "imap" from your "mapi?"  Your "pst" from your "ost?"

The audience seemed to enjoy this more advanced look at e-mail thoroughly. In a post seminar survey, only a few seemed to be deer in the headlights and another few thought they knew a lot about this subject already. The overwhelming majority thought that the level of this session was exactly right and that they learned a great deal.

Honestly, there was a good bit I didn't know that these three charming and brilliant technologists taught me. And that got me to thinking . . . there really seems to be a tendency to retread e-discovery seminars over and over, without bringing fresh meat to the table. While I know we do need the "same old stuff" for those attorneys who are just getting their feet wet in EDD, I think we've now come far enough that conference organizers need to take a fresh look at their curriculums and offer some more advanced seminars for those who are no longer novices.

I'd write more, but my glass is empty. And it is now safe for me to handle the bottle.

E-mail: snelson@senseient.com      Phone: 703-359-0700