Ride The Lightning

Craig Ball: Current Issues in Computer Forensics

That's the title of our recent Legal Talk Network podcast which features Craig Ball. As promised earlier, readers now have the link.

Craig is nothing if not direct. While discussing the absurdity of processing ESI into TIFF images, Craig likened it to an act of malpractice as TIFF is the dumbest and most cumbersome format there is. He also noted that using TIFF is just as silly as saying that you have to convert all white paper into canary yellow before we'll review it. Since I can think of nothing pithy to add, I'll leave it there and just note my agreement. Why lawyers continue to use TIFF baffles me - unless they've simply been bamboozled by self-interested vendors.

While I don't want to give away the whole podcast, I'll also note Craig's statement that a recent prestigious panel agreed that 70% of the monies spent on EDD was wasted and that most of that waste was due to lawyer incompetence.

Some folks might raise an eyebrow at that statement, but in all honesty, John and I concur. And, like Craig, we've become more than a little cynical, because lawyers and vendors both profit by waste. There seems to be little incentive to change unless vendors and lawyers are driven - and driven hard - by clients or judges - most of whom don't know enough to challenge the lawyers and vendors. And where greed falls off, incompetence steps in to complete the train wreck that is a typical e-discovery project.

So what's a hapless e-discovery naif to do?  Scout for brains and experience of course. Most of all, search for integrity amongst the vendors. Let's hope that your search is more fruitful than that of Diogenes.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Ball in our Court: On Legal Talk Network

Yesterday, we had the great pleasure of interviewing our distinguished computer forensics colleague (and great friend) Craig Ball on the second edition of our Digital Detectives podcast on Legal Talk Network. When this podcast is released, I'll be sure to post the details.

Without spoiling all the fun, my favorite moment in the podcast was when Craig quoted Justice Oliver Wendell Holmes, who said, "Even a dog knows the difference between being kicked and being stumbled over." As always, it was the application of the quote that was enchanting. Craig was talking about spoliation and how it is always clear to judges and forensic examiners when evidence is missing through incompetence or a mere technical "whoops" and when it is deliberate. Amen to that Craig. I've added that quote to my long list of memorable quotes to use again . . .

And to Maddy and Josie, my labs, I am deeply grateful that you know mom would never kick you but is dependably clumsy and often stumbles over you two. On the other hand, you always manage to be planted precisely where I wish to go, especially in the kitchen on the chance that some food may drop suddenly to the floor. No matter, I apologize, you guys kiss me and all is well. All of life should be that simple and forgiving!

And do stay turned for Craig's pearls of wisdom on why it is so crazy to automatically TIFF ESI as a first step, waste in EDD, the wrong-headed view many courts have about computer forensics, the challenges of search, the use of neutral examiners and how Craig's mindset is shifting about where computer forensics can find the most useful data.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http//twitter.com/sharonnelsonesq

Metadata Assistant (Enterprise Version) for the Big Guys

In my recent post about metadata, and how attorneys finally seem to be climbing about the Metadata Scrubbing Express, I mentioned how much we like and recommend Metadata Assistant when we lecture.

Metadata Assistant is indeed a terrific program for smaller firms. I should have (and didn't) mention Metadata Assistant (Enterprise Version) which is a great solution for any firm with 25 or more users. Donna Payne is the CEO of Payne Consulting which is the company that developed Metadata Assistant. She is also a longtime friend (and has more than her share of humility - a rare and wondrous quality among vendors). Donna wrote to ask me politely if there was something wrong with the Enterprise Version and if that was why I had failed to mention it.

It was now my turn for humility - and the truth is that our clientele is on the smaller side and doesn't tend to use the Enterprise Version so I had no familiarity with it.

Last week, I was "taken to school" by Janet Del Aguila, one of the nice ladies who provides support for all the versions of Metadata Assistant, so I can speak with slightly more authority today.

Enterprise Version 3.1, which is Office 2010 ready, runs easily in enterprises with 50,000-100,000 users. It looks much like the simpler version I know, but for four magic XML files which allows IT administrators to set up and enforce global metadata policies.

One of the nice features of this software is that the company will work with customers to install and customize it. And if you want to upgrade from the regular version to the Enterprise Version, you'll be sent those four little files, then provided with support to customize and your upgrade is done.

There's a lot of financial incentive to upgrade (and I'd upgrade just to enforce global policies because we all know that users are not to be trusted with security decisions). A single Metadata Assistant license is $89. Once you hit 25 users, the per user cost comes down to $64 for a purchase total of $1600, which includes one year of maintenance, software upgrades and telephone and e-mail support. At 100 users, the per user price comes down to $46 for a purchase price of $4600, which includes the same one year of maintenance, etc. After that, if you continue to use the program, 25 users would pay $320 annually and 100 users would pay $920 annually for the maintenance, upgrades and phone and e-mail support.

So there you have the benefit of my education for the day. John was with me in the virtual classroom and he applauded what he saw, which is technical affirmation of what I liked as a consumer. I should also note that Donna (and her company) have a great reputation for integrity (not a word I use lightly). So whether you are large or small, you can use either Metadata Assistant or Metadata Assistant (Enterprise Version). Thanks for the education Donna and Janet!

E-mail: snelson@senseient.com   Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

No E-Discovery Project Management Plan Survives Contact with the Enemy

As a fellow columnist on the Canadian legal blog SLAW, I was pleased to see that my friend and e-discovery expert Peg Duncan had written an article on e-discovery project management. This phrase has now become as trendy as early case assessment and seems to mean different things to different people.

The essential message of Peg's article is pretty much encapsulated in the title of this post. Just as no battle plan survives contact with the enemy, these plans also morph with developments and circumstances - but that doesn't mean you shouldn't have one, just that you should be prepared to revise the plan as needed.

Plans are helpful to establish what you know and what you need to find out. They also provide a roadmap and checklist. We find them useful in providing clients with estimates - better yet, when the plan changes, the client truly understands why the costs have changed.

Peg provides a very helpful list of things to consider when drafting an e-discovery plan - well worth a look. You should write more often for SLAW Peg, eh? :-)

E-mail: snelson@senseient.com   Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Metadata Scrubbing: Are Lawyers Finally Getting the Message?

Lawyers will race to the courthouse to file suit like the proverbial hare, but when it comes to changing their technology habits, they are more likely to emulate the tortoise.

Only with painful slowness have lawyers come to recognize that unscrubbed metadata presents a threat. How many years have we all seen cases where metadata played a critical role and been to lectures where we have been told that it is an ethical duty to scrub metadata to protect client confidentiality?

The progress of the legal profession in adopting metadata scrubbers has been a steady crawl, but we do appear to be making more substantial progress recently. At this point, the 2010 ABA Legal Technology Survey Report notes that metadata scrubbing software is now available at 59% of respondents' firms, up from 46% in the 2009 survey. Unsurprisingly, large firm respondents report the greatest availability (92%, up from 86% in 2009).

While this is good news from an ethical standpoint and smart in an e-discovery world, it is a little scary that, when asked to identify which metadata scrubber they used, a large percentage of respondents said "Adobe Acrobat." While we love this product and constantly recommend it, it is not designed as a metadata removal tool. In fact, we often joke that Acrobat is the "poor man's metadata scrubber" because it does remove MOST but not ALL of the metadata in a document.

If you're looking for a metadata removal tool, our favorite tool for all but the largest firms is Metadata Assistant from Payne Consulting. We've used it for years, as have many of our clients, and it has truly been a workhorse. I know how fast I move (and therefore how fast I can make mistakes electronically) so I am delighted that Metadata Assistant insists on popping up a dialog box asking me if I REALLY want to send out an attachment without cleaning it (and of course, sometimes you do, especially if you are collaborating and using "tracked changes" which cleaning would remove).

Glad to see the legal profession catching on to the necessity of metadata removal. Even a tortoise will ultimately reach its destination.

E-mail: snelson@senseient.com   Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Sensei Debuts "Digital Detectives" Podcast on Legal Talk Network

Unabashedly, horn-blowing time.

The first edition of our new monthly podcast entitled Digital Detectives had its debut last Friday on Legal Talk Network. The podcast is sponsored by the global e-discovery firm Applied Discovery and the podcasters are moi and my other half and Sensei Vice President, John Simek. The first podcast takes a look at recent data breaches, data breach notification laws, how to prevent and respond to data breaches and how data breaches may be affected by SaaS/cloud computing.

We are very grateful to Legal Talk Network and Applied Discovery for the opportunity to present these podcasts. We'll be covering our favorite subjects, including computer forensics, e-discovery and security. As readers of this blog will know, we'll be candid about our opinions.

We're especially looking forward to our second podcast which will feature our good friend and nationally renowned computer forensic technologist Craig Ball.

You may listen to the first podcast here:  http://websrvr82il.audiovideoweb.com/ny60web16519/LTN/TDD/TDD_062410_DataBreach.mp3

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Lawyer's License Suspended: State Police Tape Lawyer with Client

Here's how you get yourself suspended as a lawyer: Visit your client in prison, hug her at the end of the meeting, and then pull her hand into your crotch while asking her, "Wouldn't you like to say goodbye to your little friend?"

This earned 72 year old Virginia lawyer Robert Armstrong a 30 day suspension of his law license, which was negotiated to prevent further action by the state bar. State police, after being alerted to the client's charges of ongoing sexual molestation, had videotaped the meeting.

Mr. Armstrong had previously been convicted on a misdemeanor sexual assault charge stemming from accusations by the same client. He pled no contest, was given a 30-day jail sentence and ordered into counseling. The client has since filed a civil lawsuit against Mr. Armstrong. Mr. Armstrong maintains that any sexual contact was consensual.

Human peccadillos aside, it is astonishing that, in such a highly electronic era, a lawyer might think himself safe from observation in a prison.

Presumably, the "little friend" was doing the thinking that day . . .

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

The Benefits of Delivering E-Discovery Software Via the Cloud

I recently had the opportunity to chat with some of the folks from CaseCentral. I really liked their blueprint for cloud-based e-discovery (link below) and invited them to submit a guest post. Thanks for writing!  Here's their post:

Cloud computing and social media are dominating eDiscovery conversations lately. And with the state of the economy and new fiscal realities, it is no wonder. Corporate law departments and law firms are being charged with taking control of eDiscovery at a time when data volumes and associated costs are exploding.

Cloud computing offers some game-changing economic, risk and time benefits for eDiscovery. “Cloud-based eDiscovery software can provide important benefits to corporations and law firms,” said George Socha Jr., Esq., founder of Socha Consulting. “These benefits can include lower costs and improved service delivery, resulting in less time and waste.”

First and foremost is the removal of the infrastructure burden. Consumers of cloud-applications do not have to buy, implement or maintain hardware and software. Instead, users access the software via an Internet browser and pay a subscription for what they use. When eDiscovery is active, users have the benefit of the large shared infrastructure. When eDiscovery is slow, they dial back the subscription, something that can’t be done when managing your own servers and software.  This usually equates to significant savings.

Cloud-based applications provide the latest features and enhancements immediately for all users worldwide. As users sign on, they always have the latest software. No need to wait for IT to upgrade each desktop and server, and no chance of missing a critical software patch.

Companies and law firms can also centralize eDiscovery in the cloud, managing multiple cases and collaborating with teams both inside and outside the firewall. This minimizes requests for IT departments to modify corporate networks for third party access, which increases security risks. It also provides the ability to centrally manage eDiscovery as a consistent, repeatable and defensible business process, which lowers risk, cost and time.

Determining what part of the eDiscovery process to perform in the cloud and what the implications and considerations are can be confusing. CaseCentral recently published a “Blueprint for cloud-based eDiscovery.” The blueprint is a framework that surfaces key points to guide decisions in terms of security, privacy, control, risk and cost practices at corporations and law firms looking to bring eDiscovery in-house via the cloud.

Steven d'Alencon, Chief Marketing Officer, CaseCentral

E-mail: snelson@senseient.com   Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Social Media at Coca-Cola and Sprint

We enjoyed our recent trip to New York City (too many gerbils in that cage) where we attended ALM's General Counsel Conference. The conference was excellent, we were pleased to discuss the new Sensei/Applied Discovery SM-ART (Social Media - Assessment, Risks and Techniques) offering with Valerie Pelton from The Posse List and Katey Wood from The 451 Group.

In one excellent session, representatives from Coca-Cola and Sprint discussed how their companies use social media. Both companies embrace its use, calling their cadre of social media users "ninjas" on behalf of their companies. In both companies, Facebook is the third most visited site, which they seem to accept good-naturedly while recognizing that a certain amount of the visits are undoubtedly personal.

Misuse of social media is not presumed - as they pointed out, if someone is really spending way too much time on social media, their work performance will suffer and it will become evident. Also (and they had a keen sense of humor about this), misuse of social media is often policed by colleagues, who are apparently quick to rat out an errant co-worker to a supervisor.

As to their social media policies (and these are critical) - if you boil them down, the essence is: "Be responsible for what you write - and don't be stupid." It takes several pages to say that, but that's the core message.

I also want to thank Dan Flannery of BRMW and Associates, Inc. for writing to contribute to the previous discussions of social media archiving. His company has a business product for social media archiving which may be found at https://www.arkovi.com.

Back to e-discovery for my next post, discussing online review tools. Don't change that dial. Amazing how outmoded that phrase has become.

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Computer Forensics and Personal Computers in Business Cases

I am a long time fan of Bow Tie Law's Blog, but I especially enjoyed a recent post discussing Genworth Fin. Wealth Mgmt. v. McMullan (2010 U.S. Dist. LEXIS 53145 (18-19) (D. Conn. June 1, 2010).

Let me say at the outset that judges are indeed loathe to order forensic examinations of personal computers in business cases. Our bright line question is: "Have you ever used your personal computer for business purposes?" There can be permutations on the question and follow up questions, but once you've established that there might be some relevant data on the personal computer, judges become more amenable to forensic examination, so long as the search is narrowly tailored.

In the Genworth case, a defendant provided false testimony and engaged in all manner of shady behavior, which probably made it even easier for the judge to determine that forensic analysis was warranted. In this case, the judge ordered the hiring of an independent expert, with Defendants paying 80% of the cost and Plaintiff 20%.

Mind you, the Defendants (as should always be the case) were allowed to review the ESI first for privilege and responsiveness. This is how it should be, though we've sometimes (incredibly) seen computers simply turned over to the other side for imaging and analysis - once in a while, even without a search protocol. This is clearly not the right approach, and we are seeing it less and less often. In the paper world, you could not simply forage through files so we have long thought it strange that there are cases in the electronic world where foraging has been allowed.

This case, with a neutral third party expert and cost-allocation, strikes a good balance. Well worth reading the post and the underlying case. Nicely done Josh.

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq