Ride The Lightning

REPLY TO: GOOGLE TO THE (E-DISCOVERY) RESCUE?

I am including below a reponse I received to the original post referenced above:

**********

Google has solved search in the public Internet however applying the same technology to the enterprise is a different story.  In order to index the Internet Google has built massive data centers to process the data.  In processing this data they make a cache copy of all web pages (perform a Google search and you will see a link "Cached" next to each search result. This process works for the web where you can spread the cost among billions of users.  This process does not work for the enterprise.  Having exabytes of enterprise data that would need to be cached (replicated) is not practical.  I would require the doubling of the entire enterprise storage environment - something no company would undertake.

In order to make exabytes of ESI discoverable you need to build an affordable solution that is designed to be efficient (small index footprint), scalable (billions of objects per server), and fast (1TB/Hour/node processing speed).  This is not what Google has delivered.  It is a fine point solution for smaller projects, but when you talk terabytes or exabytes you need to look elsewhere.

Jim McGann

Index Engines

http://www.indexengines.com

**********

By the way, John agrees that Google, for any number of reasons, is not an appropriate EDD tool. It simply is not EDD-specific. It is limited in the number of file formats it can handle even though it supports more than 200. It is designed as an internal file indexer and doesn't appear to even deal with user's e-mail stores. At least Google desktop will index your Outlook mailbox even though it doesn't properly deal with attachments. The Google Search Appliance doesn't even seem to deal with e-mail period. That's a killer right there.

E-mail: snelson@senseient.com       Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

U.K. HIGH COURTS RULES GOOGLE NOT LIABLE FOR DEFAMATORY SEARCH RESULTS

In a case that has attracted a lot of global attention, a British High Court ruled that Google is not the publisher of defamatory words that appear in its search results.  Google's U.S. and U.K. operations were sued in England by a training business based in London.  Metropolitan International Schools Ltd. (MIS) runs distance learning courses, which some user forums called "nothing more than a scam" among other derogatory comments.

Noting that there were precious few precedents, Mr. Justice Eady found that Google was merely a facilitator of the search results and therefore not liable for any defamation, even upon notice of the allegedly defamatory search results.

Google had in fact blocked specific URLs identified by MIS. Justice Eady agreed with Google's contention that "it is practically impossible, and certainly disproportionate, to expect [Google, Inc.] to embark on a wild goose chase in order to determine where the words complained of, or some of them, might from time to time 'pop up' on the Web."

The decision left open what might have happened if Google had not blocked the URLs in question, leaving many of us to wonder what a search engine's responsibility may be when it is notified of the existence of defamatory material.

Justice Eady thought the proper course of action was against the company (Designtechnica) which hosted the defamatory comments on its Digital Trends website.

My thanks to my colleague across the pond, Ian Henderson, for passing this case on.

E-mail: snelson@senseient.com       Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

IPHONE SECURITY? A COMPLETE MISNOMER

My Vice President, John Simek, has been foaming at the mouth about the iPhone's lack of real security. He finally got agitated enough to write a post for me. So if you've implemented the iPhone in a business environment . . . read on.

**************************************

The words iPhone and security do not belong in the same sentence, although you would never know it from the Apple marketing blitz. Some of the advertised features of the iPhone 3GS are the inclusion of encryption and remote wipe functions. As most folks know, encryption is a killer for computer forensic examiners and a fine way to protect your data. So what does encryption do for the 3GS? Not a heck of a lot. From my foxhole, it appears that encryption was an afterthought and not inherent in the iPhone design. The iPhone is feature rich and has lots of consumer appeal – but secure? Nope.

So if the 3GS is encrypted, how can we get to the user’s data? Jonathan Zdziarski has demonstrated how easy it is to gain access to a supposedly secure iPhone 3GS. Should we believe him? I certainly do, especially since I own his book on iPhone forensics and have personally seen the mountains and mountains of electronic evidence that is stored on an iPhone. The key to gaining access to the data is to extract a disk image from the device. First off you “jailbreak” the phone by placing it into recovery mode and installing a custom RAM disk to the iPhone. Jonathan mentions that the tools are only available to law enforcement (nice thought, but not so), but also acknowledges that it is fairly simple to develop your own. Several products like Red Sn0w and Purple Ra1n are freely available to “jailbreak” the phone. You then install a Secure Shell (SSH) client to port the raw disk image onto your computer.

Those of us in the forensic community know that sucking a disk image from an encrypted drive to a destination drive just gets you another encrypted image which is no earthly good to you. What makes the iPhone 3GS any different? This is the part where Apple is so very, very helpful. Even though the data on the iPhone disk is stored in an encrypted form, the iPhone actually decrypts the data as it feeds the zeros and ones through the SSH connection. You call that security? What genius at Apple came up with that one?

Just as Billy Mays would say, "But wait…it gets even better." In order to secure your iPhone, make sure you configure an unlock code. Then again, tsk, tsk, tsk, perhaps you shouldn’t waste your time. Jonathan has another demo where he replaces the passcode file with one that contains a blank password, effectively removing the unlock code. How is this possible? Just like the previous explanation, putting the iPhone into recovery mode doesn’t require the passcode PIN. What a great design. As I said before, security appears to have been a complete afterthought to the phone’s developers. Don’t they test these things? Geez.

So let’s summarize. The iPhone encryption is a non-starter and accessing the device is child’s play even if it is password protected. Now, granted, in both cases you have to have physical access to the device. And no one ever loses their phone, right?

Apple says losing your phone is not a problem. If you leave your iPhone in the back seat of a taxi, you just use the remote wipe feature to “kill” all of the personal data. Alas and alack, there’s a problem with that too. Apparently, the remote wipe feature requires that the iPhone be connected to the cellular network. Oh, my. The last I checked, removing the SIM card or placing the phone in a Faraday box would solve the network connection problem. Take the phone off the cellular network and you can take all day to retrieve the disk image (in an unencrypted form) from the iPhone 3GS. Again, what a crud design. Seriously, Apple (like Ricky Ricardo) has a lot of 'splaining to do. Even Microsoft (and yes, it hurts to say something nice about Microsoft) has a secure remote wipe function with Windows Mobile that actually works. When you establish a security policy for Windows Mobile, the device does not have to be on the network to destroy the data. Define the number of invalid PIN attempts before the wiping begins and the personal data is gone, network or no network.

Bottom line…I love the iPhone. Not because of its technical superiority, but because its design gives us access to more electronic evidence than any other phone we’ve ever seen. Keep up the good work Apple. We now believe you when you say the ‘S’ in 3GS stands for speed and not security. If you’ve implemented the iPhone (which is clearly a consumer phone and NOT an enterprise phone as currently designed), you’ve hung yourself out to dry if a phone “goes missing” with confidential data.

**************************************

Pass this one around to the IT and security folks – and Apple, are you listening? We’d love to print your response.

E-mail: snelson@senseient.com        Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

SCRUBBING A MAC'S METADATA: A BIT OF A PUZZLER

It's always good to be humbled by conference attendees and have to admit, "I don't know."

That happened last week as we were lecturing for the Virginia State Bar and someone asked, "How do you scrub metadata on a Mac?"

I felt a little better when I went to my friend and legal tech colleague Brett Burney, one of the nation's foremost lecturers on Macs. Even he had do some research! But the results were most helpful and I share them here:

"Alas, there is no metadata scrubber specifically for the Mac, which means many Mac-using lawyers have cobbled together various methods for cleaning their digital documents. Most legal-related documents created on the Mac come from Microsoft Word 2008, Pages (from Apple's iLife Suite), or other various word processing applications available for the Mac.

First and foremost, many folks just simply convert a document to PDF, especially since that feature is built-into the Mac operating system (i.e. no need for a full version of Adobe Acrobat). Converting a document to PDF gets rid of most, but not all, of the metadata piggybacking on a document.

Next, some savvy metadata detectives will go into the properties of a document and manually delete any revealing information. To automate this process, I've heard of über-Mac-geeks who create an AppleScript or Automator Workflow to do the same thing.

The really thorough crowd will actually send a file into a Windows virtual environment (powered by Paralells - (http://www.parallels.com) - or VMware Fusion - (http://www.vmware.com/products/fusion/), use a proven scrubber such as Metadata Assistant (http://www.payneconsulting.com) or the free Doc Scrubber (http://www.javacoolsoftware.com) to clean the document, and then send the document back to the Mac side.

One last possibility comes from a company called 3BView, which graciously offers a free, online service for scrubbing your documents, located at http://trial.3bview.com/3BTrial/pages/clean.jsp. The site is a tunnel for driving additional traffic to 3BView's site where they sell a beefier version of their metadata cleaning application, but the online service serves a good purpose. You can only upload one document at a time, but you can select if you want all metadata cleaned, or just the potentially problem areas of track-changes and embedded notes (regularly found lurking in Microsoft Word documents).

I found that 3BView's online service did a great job of erasing the metadata, but they left a convenient note in the "Comments" section of my Microsoft Word document mentioning who did the dirty work. You can erase the comment of course, but it's a little annoyning - much like the fact that there is no native application for scrubbing metadata for the Mac."

Thanks Brett, for making me a little smarter. I would have asked our friend Ben Stevens to chime in too, but I think he's off honeymooning, which is far better than discussing legal tech on a blog!

E-mail: snelson@senseient.com     Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

HOW GOOD LAWYERS SURVIVE BAD TIMES

Today I exert a blogger's privilege of departing from the primary subject in order to let readers know that my new book, How Good Lawyers Survive Bad Times, is now available for pre-order from the American Bar Association.

Written with renowned legal technologist Ross Kodner and Oklahoma's noted law practice management advisor Jim Calloway, the book offer suggestions for those who have lost their jobs, are afraid of losing their jobs or are trying to navigate their law firms through the harrowing economic waters.

We offer financial, marketing, management and legal technology tips - there is, we hope, something useful for lawyers in every conceivable situation.

As of July 5th, the Layoff Tracker on Law Shucks reported that 12,820 people have been laid off at major law firms, including 4,985 lawyers and 7,844 staff since January of 2008.

It's not pretty out there - and no one is predicting a dramatic turnaround. We hope you'll find practical advice in our new book. Wishing all lawyers calm seas and fair winds . . .

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

HOW E-DISCOVERY IGNORANCE CAN AFFECT YOUR BOTTOM LINE

You can always trust Craig Ball to be on point and pithy. His latest post, about a hapless EDD rookie lawyer who had her $300/hour requested fee reduced to $200/hour by the court because of her EDD inexperience.

Read the post and, if you are not well equiped to deal with EDD - start signing up for CLEs.

No doubt embarassing to have her inexperience immortalized in a court opinion. I feel for her, but Craig is right - if nothing else we presenters say will move you to learn about electronic discovery, perhaps $100 an hour will.

E-mail: snelson@senseient.com     Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

GOOGLE TO THE (E-DISCOVERY) RESCUE?

My thanks to Alan Goldberg for suggesting that I note a recent blog post from E-Discovery Bytes dealing with the Google Search Appliance 6.0 (GSA). The post discusses the potential value of the GSA in reducing electronic discovery costs by helping lawyers cull more easily through exabytes of electronic data.

I asked John about this and he merely snorted. I took this to be a negative reaction, though he apeared to think he had answered me fully. I am going to ask him to explain himself more clearly while we drive to speak to the Virginia State Bar today.

In the meantime, I confess I have no knowledge about Google's Search Appliance - and would be very interested to see if any my readers have any experience with it or can contribute to the discussion after reading the post.

Thanks in advance for your thoughts - please e-mail me at the address below.

E-mail: snelson@senseient.com     Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

MUCH ADO ABOUT NOTHING? COMPUTER FORENSICS AND THE MELENDEZ-DIAZ CASE

There has been a lot of chatter on the airwaves about the June 25th decision of the U.S. Supreme Court in Melendez-Diaz v. Massachusetts (the case can be found here). Is it worth all the hullaballoo? Not in my judgment, at least not where computer forensics is involved.

Mind you, it is a very significant case for forensics generally, especially in those areas of forensics where labs have been allowed to produce "certificates" showing results of lab work. In this case, state lab analysts submitted sworn certificates as to the quantity, quality and composition of cocaine connected to the petitioner.

In short, the Court held that allowing such certificates in evidence without an analyst present to testify violated the petitioner's Sixth Amendment Right to confront the witnesses against him. It was a close call, 5-4, with some unusual alliances amongst the Justices.

So, yes . . . this is going to cause overburdened forensics labs a lot of heartburn, as valuable time will have be allocated to being present in court. But probably not computer forensics labs.

I cannot think of any case I have ever heard of or been a part of where a computer forensics report was in issue without experts testifying about the report. Whether it is a local police officer or an FBI CART agent, they must come. What we do for a living is not "neutral lab work." We work for one side or the other. Computer forensics is both art and science - and skill levels vary widely. We cannot simply weigh something on a scale or apply a solution and measure composition.

Our work is far more akin to the expert aviation engineer who examines the evidence to prove how the plane went down or the doctor who examines a patient and opines that he is insane. We are called upon to testify how a document came to be backdated, or an entire database transferred out of a corporation or whether electronic evidence was fabricated or deliberately spoliated.

We will always be present in court, irrespective of Melendez-Diaz. For us, I don't think this opinion has changed a thing.

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

AUTHENTICATING ELECTRONIC EVIDENCE: TEXT MESSAGES AND E-MAILS

I read with interest Josh Gilliland's recent post on the admissibilty of text messages in State v. Loye, 2009 Minn. App. Unpub. LEXIS 660, 1 (Minn.Ct.App. 2009), in which the court ruled there was no error when the lower court failed to admit a handwritten transcript of text messages.

Handwritten is pretty unusual, but printed copies of e-mails and text messages are fairly routinely accepted as evidence in most courts. Why? Because no one objects. If the attorneys are smart, and they want to use paper, they stipulate as to authenticity before they set foot in a courtroom. More commonly, they aren't that prepared - but in the absence of an objection, the evidence usually comes in anyway. Courts take the practical view that "it is what it purports to be, unless there is some reason to believe it is not."

The clear exception is in Chief Magistrate Judge Paul Grimm's courtroom, which all those who follow electronic evidence cases will understand . . .

Back to the real world: Where there is an objection, you have to be ready to lay a proper foundation. "Did you send this e-mail?" "Did you receive this text message?" The trouble generally comes when one party or the other says that a printed e-mail or text message is not an accurate representation or, indeed, an outright fraud - as often happens with spoofed e-mails in divorce cases.

This is where it is invaluable to have the original electronic evidence. This doesn't always involve computer forensics, but when it does (especially where e-mail or text messages were deleted), you need your expert present to testify as to the methodology and software used, supporting the authenticity of the offered evidence.

It pays to come to court prepared.

E-mail: snelson@senseient.com      Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

DIVORCE ATTORNEYS SUED OVER E-MAILS GLEANED FROM SPYWARE

I've been waiting for this case. It was just inevitable that attorneys (as opposed to spouses) would one day be sued for using evidence obtained from spyware.

A two million dollar lawsuit has been filed in Tennessee against the law firm of Berke, Berke and Berke (think they're related?). Allegedly, the firm used or tried to use e-mails intercepted by "eBlaster," a popular spyware program, in violation of federal and state wiretap laws. Individual attorneys were sued along with the firm itself.

This is the first such case I've run into - but I've long predicted it would happen. The attorneys say the suit will be "vigorously defended." No kidding. $2 million doesn't qualify as chump change. But if they really did what they are alleged to have done, they may also have an ethics problem with their state bar.

I shall watch this one with great interest.

E-mail: snelson@senseient.com     Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq