Post Process

Everything to do with E-discovery & ESI

Archive for the ‘Uncategorized’ Category

Odds and Ends

Posted by rjbiii on September 25, 2012

I just don’t get why people do this:

Seven rent-to-own companies and a software maker are settling charges with the Federal Trade Commission that rental computers illegally used spyware that took “pictures of children, individuals not fully clothed, and couples engaged in sexual activities.”

As per the course, the FTC slapped the hand of DesignerWare of North East Pennsylvania and the rent-to-own companies. The settlement, announced Tuesday, only requires them to halt using their spy tools, which has been employed on as many as 420,000 rentals.

The software, known as Detective Mode, didn’t just secretly turn on webcams. It “can log the keystrokes of the computer user, take screen shots of the computer user’s activities on the computer, and photograph anyone within view of the computer’s webcam. Detective Mode secretly gathers this information and transmits it to DesignerWare, who then transmits it to the rent-to-own store from which the computer was rented, unbeknownst to the individual using the computer,” according to the complaint.

Hard for me to imagine the attitudes of the minds behind junk like this.

Real robot-cars: probably safer than the human drivers I see everyday

At a signing ceremony at the Google headquarters on Tuesday, California Governor Jerry Brown signed into law state legislation that officially makes the Golden State the second in the nation to legalize and regulate autonomous cars.

Google, of course, has already developed a fleet of a dozen cars (mostly modified Toyota Priuses) and has already logged over 300,000 miles of autonomous driving on state roads.

The new law obliges the California Department of Motor Vehicles to draft regulations for autonomous vehicles by January 1, 2015.

Hey!  Someone finally realized that police might not need unfettered access to everyone’s email:

A new bill introduced today in the US House of Representatives seeks to require warrants before police can trawl through your e-mail or track your cell phone, reports CNET. The legislation is backed by several technology companies, including Apple, Google, Microsoft, and Twitter. But given the government’s history with privacy bills, it faces a high chance of getting blocked by the Department of Justice.

The bill was introduced by Representative Zoe Lofgren (D-CA) and would require officers to get a warrant before accessing e-mail or location information. Access to these data types is a notorious gray area in US courts.

Once again…yes, social media IS discoverable:

The dispute quickly started focusing on the discoverability of information on Nicole’s Facebook page. TRW had perused Nicole’s public-facing Facebook profile and had found material undercutting her claims of injury. According to TRW, such material depicted Nicole playing sports, dancing, consuming alcohol, partying, enjoying personal relationships, and offering to share medication with others. Based on these findings, TRW requested all material—public and private—from Nicole’s Facebook page. In response, Nicole objected and produced only redacted copies of her Facebook account history and a limited number of photographs. TRW moved to compel a full production.

The court granted TRW’s request, ordering Nicole to send TRW all recent information from her Facebook account. Noting, however, that litigation does not permit “a complete and open public display of Plaintiff’s life,” the court required TRW to keep the information confidential and provide a list identifying the material TRW believed to be discoverable. The court also set forth a procedure by which Nicole could challenge the discoverability of specific material.

Posted in Uncategorized | Leave a Comment »

Solid State Drives and the Future of Computer Forensics

Posted by rjbiii on March 8, 2011

John Dunn, in an article on TechWorld, cites a study that claims that firmware built into solid state hard drives (SSD’s) erase data, rendering current forensics technologies effective. From the article:

After examining an SSD for traces of data after it had been quick formatted, the team expected the purging routines to kick in around 30-60 minutes later, a process that must happen on SSDs before new data can be written to those blocks. To their surprise, this happened in only three minutes, after which only 1,064 out of 316,666 evidence files were recoverable from the drive.

Going a stage further, they removed the drive from the PC and connected a ‘write blocker’, a piece of hardware designed to isolate the drive and stop any purging of its contents. Incredibly, after leaving this attached for only 20 minutes, almost 19 percent of its files had been wiped for good, a process the researchers put down the ability of SSDs to initiate certain routines independent of a computer.

For comparison, on the equivalent hard drive all data was recoverable, regardless of the time elapsed, as a forensic examiner would expect.

The study cited in the article may be found here (PDF).

Posted in Uncategorized | Leave a Comment »

Case Blurb: Lebowitz; Authentication of ESI Discussed

Posted by rjbiii on May 17, 2010

The Defendant questioned the authenticity of email transcripts, “instant messages,” and “chats” due to the incompleteness and integrity of the evidence. “The requirement of authenticity . . . as a condition precedent of admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” Fed. R. Evid. 901(a). Though K.S. did not testify at the hearing, Officer Suber testified that the communications were provided to her by K.S. FN2. Also, other evidence, including recorded telephone conversations, corroborated the communications. There are obvious omissions in some of the communications. However, the Court finds that those omissions do not support excluding the communications. The omissions go to the weight rather than the admissibility of the evidence. Based upon the evidence presented at the hearing, the Court finds that Defendant has not demonstrated that the evidence should be excluded at this time. Defendant’s Motion on the Authenticity of Purported Electronic Communications is DENIED.

FN2: For purposes of the hearing, Officer Suber’s testimony was sufficient. However, before the communications will be admissible at trial, the testimony of K.S. or someone with actual knowledge about the communications will be required.

United States v. Lebowitz, 2010 U.S. Dist. LEXIS 7026 at *4-5 (N.D. Ga. Jan. 27, 2010)

Posted in 11th Circuit, Authentication, Case Blurbs, Chat Room Content, email, FRE 901(a), Instant Messaging, Judge Richard W. Story, N.D. Ga., Uncategorized | Leave a Comment »

Case Summary: Carter; Authentication of Database Records discussed

Posted by rjbiii on March 8, 2010

United States v. Carter, 591 F.3d 656 (D.C. Cir. 2010)

Procedural History: Appeal by a criminal defendant of a of a 150-month sentence imposed by the United States District Court for the District of Columbia upon entry of his guilty plea to five counts of bank robbery.

Facts: At trial, Defendant plead guilty to charges associated with five robberies committed in the Washington, D.C. area. He was sentenced to 150 months in prison. The sentence was significantly affected by the district court’s finding that his criminal history included four theft convictions in Maryland. Carter appealed, challenging the admissibility of the evidence underlying the court’s finding.

Nature of the Dispute: At the sentencing hearing, the State produced Maryland state court records of the disputed convictions. These records were in the form of paper printouts of entries from the District Court of Maryland Criminal System Inquiry Charge/Disposition Display database. The entries for each conviction included Carter’s name, other identifying characteristics, the charge, the case number, the plea, the disposition, and the sentence. The Maryland court clerk’s office certified each printout. Carter objected to the sufficiency of the evidence, arguing that the possibility of data-entry errors rendered the computer records inherently unreliable. He suggested the government needed to produce a copy of the “actual court jacket” for each proceeding to prove the prior convictions. The district court offered to postpone the hearing to give Carter an opportunity to present contrary evidence. Carter declined. The district court then concluded that the printouts were reliable evidence of Defendant’s convictions in Maryland.

Issue at Appeal: When seeking a sentence enhancement, the government must prove a prior conviction by a preponderance of the evidence. Carter argued the printouts the government proffered were insufficient to meet this burden because they are unreliable.

Discussion: The court cited sec. 6A1.3 of the U.S. Sentencing Guidelines Manual (2008) for the proposition that [e]vidence is competent to support factual findings at sentencing if it bears “sufficient indicia of reliability to support its probable accuracy.” The court stated that under the advisory’ committee’s notes for FRE 803(8), certified records of a state court are considered presumptively reliable. The reliability of public records is “found in the declarant’s official duty and the high probability that the duty to make an accurate report has been performed.”

In challenging the records’ reliability, Carter cited no case holding certified records from a state court’s disposition database insufficient to support a finding of a prior conviction by a preponderance of the evidence, and the court continued that it was unaware of any such holding.

Carter argued, however, that the records could not be reliable, because there was no assurance that they conformed to the official case files or signed judgments of conviction. The court acknowledged that there existed a possibility of human error. But this does not warrant the conclusion that these records were inherently unreliable. A defendant must have the opportunity to refute records, an opportunity offered to, and declined by, Carter.

For the first time on appeal, Defendant pointed to a discrepancy between the computer record corresponding to his 1998 theft conviction and the Presentence Investigation Report’s description of the same offense. Alleging no other inaccuracies in the records, Carter presented this discrepancy as demonstrative evidence of their general unreliability. The court was not convinced by this argument, reasoning that a single alleged inaccuracy does not introduce clear error into the district court’s holding in favor reliability.

The court noted that in this case, the discrepancy, even if it truly existed, would not have changed the result of the calculation upon which the sentence was based. Therefore, even in the event that the discrepancy exists, this single inaccuracy does not introduce clear error into the district court’s conclusion, or reversible error into its calculations for sentencing.

Carter attempted to discredit the records, noting that some information they contain were truncated. The records do not cite the statute under which Carter was convicted, and Carter suggested that these omissions render the records inadequate for the purposes for which they were used by the lower court. The court was not persuaded, reasoning that these records contained information sufficient for the district court’s need.

Carter also argued that the decision in United States v. Price, 409 F.3d 436, 366 U.S. App. D.C. 166 (D.C. Cir. 2005) precluded the district court’s conclusion that the records were reliable. The Price court concluded that this unadorned reference was insufficient to “demonstrate that the description in the [PSR] is based on a sufficiently reliable source to establish [its] accuracy.” The court, however, maintained that Carter had interpreted Price too broadly. The Price court did not have before it any specific documentation supporting the alleged convictions, unlike the case here. The court did not describe what information its hypothesized docket listing contained or whether the docket listing was an officially certified court record. Here, the sentencing court had before it certified records with information sufficient to identify the defendant and make the necessary criminal history calculation. It did not rely simply on an unadorned PSR reference to state court records; it had the records themselves.

Because the district court did not err in concluding the certified computer records of the Maryland courts were sufficient to prove his prior convictions, the appellate court affirmed Carter’s sentence.

Posted in Admissibility of ESI, D.D.C., Fed. Circuit, Judge Thomas Beall Griffith, Uncategorized | Tagged: | Leave a Comment »

ABA’s Chart Comparing Lit Support Applications

Posted by rjbiii on February 22, 2010

May be found here. Note it is a PDF.

Posted in Uncategorized | Leave a Comment »

Case Summary: Elec. Mach. Enters.; Spoliation arising from a Bankruptcy Claim

Posted by rjbiii on December 9, 2009

Elec. Mach. Enters. v. Hunt Constr. Group, Inc. (In re Elec. Mach. Enters.), 416 B.R. 801 (Bankr. M.D. Fla. 2009)

Procedural History: Adversary Proceeding arising from Chapter 11 filing by electrical contractor, in the jurisdiction of the Middle District of Florida. Plaintiff electrical contractor (EME) sought damages from construction manager for, inter alia, spoliation of evidence.

Factual Background: A construction management business, Construct Two Construction Managers, Inc., was formed specifically to manage one particular project: the building of a the Orange County Convention Center in Orlando, Florida. Construct Two was a joint venture between two large, national construction-related businesses, Hunt Construction Group (HCC) and The Clark Construction Group (CCG). During the project, there were scheduling and coordination issues that resulting in the need for re-work, resulting in plaintiff’s claim for additional charges. Also during the project, the plaintiff electrical contractor filed for relief under Chapter 11 of the bankruptcy code. EME finished all of its designated tasks associated with the construction project despite this filing.

During the project, EME hired Richard Coble, a construction dispute consultant, to assist in compiling information, initially to determine what was happening on the Project and subsequently to determine possible claims that EME might have in connection with the Project. In December of 2003, after completion of the construction project, Mr. Coble became aware that project documents belonging to HCC were being thrown into a dumpster located on the project site. EME instituted this suit to prevent the further destruction of documents related to its claims against HCC. The court also issued an injunction requiring HCC to retrieve and preserve whatever thrown-away Project documents still existed from the job site dumpster, at its own cost.

Discussion on the Spoliation Claim:
HCC did not convincingly dispute the fact that their documents ended up in the dumpster. It did argue, in its own defense, that no one at HCC was aware of possible litigation from this project until EME filed this adversary proceeding. The court was not persuaded by this, however, given the numerous complaints, claims, disputes, threatened and actual lawsuits, and public records requests advanced by EME and others. Although both CGG and HCC had a document retention policy, there was no policy for the joint venture entity created for this project.

One HCC official testified that no attorneys from either Hunt or their outside counsel advised him not to throw away Project documents during the month of July 2003. That same official also testified that no one ever advised him that HCC needed to maintain all records relating to EME. This testimony confirmed Mr. Sterling’s testimony that HCC employees were to use their own judgment as to what to destroy. Until receiving this court’s TRO prohibiting the destruction of relevant documents, HCC took no action to preserve documents relating to the Project. Thereafter, the parties participated in a massive effort to retrieve and restore the discarded documents. This required restoration of physical documents as well as the retrieval of electronically stored documents. The court then analyzed what, if any, remedies were available to EME for spoliation under the law.

Spoliation as a Cause of Action
The court began by citing Sterbenz v. Attina, 205 F. Supp. 2d 65, 74 (E.D.N.Y. 2002) to note that there is no federal cause of action for spoliation. The court stated that at one time, the State of Florida recognized both a first-party cause of action brought by a party to the underlying lawsuit and a third-party cause of action brought against a non-party for either negligent or intentional spoliation of evidence. After the Florida’s Supreme Court’s decision in Martino v. Wal-Mart Stores, Inc., 908 So. 2d 342 (Fla. 2005), there is no longer a first-party cause of action for spoliation against the same defendant as in the underlying litigation. The court commented that in Martino, the state Supreme Court held that the availability of sanctions, including the imposition of evidentiary presumptions and inferences, provides sufficient protection to the plaintiff where the defendant in the litigation commits negligent or intentional spoliation of evidence. A cause of action brought by a third-party still exists.

Spoliation Sanctions
The began its analysis of possible sanctions by noting that Federal Courts were split on the question of whether the Federal or State law governs the imposition of spoliation sanctions in federal courts sitting in diversity. The Eleventh Circuit has held that Federal Law governs, but is informed by state law. The court, therefore, addressed the applicable federal case law on spoliation sanctions in the Eleventh Circuit before turning to the principles of Florida law governing the imposition of spoliation sanctions.

The court began by noting that the Eleventh Circuit has not enunciated a standard for the imposition of spoliation sanctions where the underlying cause of action arises under Florida law. In Flury v. Daimler Chrysler Corp., 427 F.3d 939, 944 (11th Cir. 2005), the panel adopted the law of the state (Georgia) to guide its analysis. The panel also found that Georgia law was “wholly consistent with federal spoliation principles.” While defendant argued that Flurry applied to this case, the court stated that Georgia law materially differs from Florida law in this area, leading the court to reject applying the Flurry factors to the instant matter. Instead, the court fully followed the standards set under Florida law.

The definition of spoliation, under Florida law, is the “intentional destruction, mutilation, alteration, or concealment of evidence.” Impositions of sanction are meant to ensure the non-spoliator does not bear an unfair burden, and to serve as a deterrent to “miscreant defendants.”

The court explained that the Fourth District Court of Appeal has articulated the following three threshold questions that a court must answer before imposing spoliation sanctions in Florida:

  1. whether the evidence existed at one time,
  2. whether the spoliator had a duty to preserve the evidence, and
  3. whether the evidence was critical to an opposing party being able to prove its prima facie case or a defense.

The court concluded that the first factor had been adequately proved by EME. The second factor, however, was less clear. In Florida, the court explained, a duty to preserve evidence can arise by contract, by statute, or by a properly served discovery request (after a lawsuit has already been filed). The court noted that the majority of Florida courts have held that there is no common law duty to preserve evidence before litigation has commenced. While the court agreed that there was no doubt that HCC destroyed arguably relevant documents before EME’s lawsuit, EME had not provided sufficient argument that there existed any duty under Florida to retain those documents. EME’s citing of Federal cases to bolster its argument that a duty to preserve evidence arises either “when the party has notice that the evidence is relevant to litigation or when a party should have known that the evidence may be relevant to future litigation,” did not meet the court’s definition of being “informed by state law.” Because of this, the court could not justify the imposition of sanctions. The court noted that in an unreported case arising under Georgia law, the Eleventh Circuit recently stated that spoliation includes “the destruction or significant alteration of evidence. or the failure to preserve property for another’s use as evidence in pending or reasonably foreseeable litigation.” The court, nevertheless stated that unlike in Florida, under Georgia law, spoliation includes the destruction of evidence “that is necessary to pending or contemplated litigation.” Thus the court found its own conclusions to be consistent.

Although the court found that the existence of a duty was not proved by plaintiff, it noted that there was some support for imposing an adverse inference where critical evidence was destroyed intentionally, pre-litigation, even where no duty to preserve existed. In Martino, the Florida Supreme Court, while dividing remedies for spoliation into “lighter” and “stronger” groups, had found that where evidence is “intentionally lost, misplaced, or destroyed” the appropriate sanctions would be found in Florida Rule of Civil Procedure 1.380(b)(2) and include applying an adverse jury inference; whereas, where “the loss of the evidence was determined to be negligent the . . . rebuttable presumption of negligence for the underlying tort” applies. The court discussed the Fourth District Court of Appeal’s decision in Golden Yachts, Inc. v. Hall, 920 So. 2d 777 (Fla. Dist. Ct. App. 4th Dist. 2006), that opened up the possibility of applying the “lighter” sanction of adverse inference where no duty existed if the pre-litigation spoliation was intentional.

The court drew a correlation between this principle and the Federal principle of imposing sanctions where bad faith on the part of the spoliator was evident. It observed that the 11th Circuit requires a finding of bad faith before imposing an adverse inference sanction.

The final factor examined by the court was whether the destroyed evidence was critical for proving a prima facie case or a defense. The court reasoned that if spoliation sanctions are imposed “to assure that the non-spoliator does not bear an unfair burden,” then there is no reason to apply sanctions where no harm comes from the spoliation. The court noted that EME produced substantial evidence in this case to establish its claims in the underlying litigation. The court determined that while the disposed documents may have further undermined HCC’s defenses or supported EME’s claims, none of the destroyed documents were truly critical to EME’s case. Accordingly, the court concluded that under Florida law, it could not impose sanctions on HCC.

Posted in 11th Circuit, Adverse Inference, Bankruptcy Court, Bankruptcy Judge Michael G. Williamson, Case Summary, Case Summary-FL, M.D. FL., Sanctions, Spoliation, Uncategorized | 1 Comment »

Case Summary: U-Haul Int’l; Authentication of Database Summaries and the Underlying Data

Posted by rjbiii on October 16, 2009

Lumbermens Insurance company objected to a Trial Court’s admission of computer generated summaries of payments for loss adjustments produced by another insurance company. Each summary related to a specific individual insurance claim. Lumbermens appealed to the ninth circuit.

Lumbermens first contended that the summaries are hearsay not fitting within the business records exception (FRE 803(6)) of the FRE, and therefore should have been excluded.
The court began by explaining that FRE 803(6) allows records of regularly conducted business activity meeting the criterial laid out as follows constitute an exception to the prohibition against hearsay evidence:

A . . . report, record, or data compilation, in any form, of acts, events, condition, opinions, or diagnoses, made at or near the time by, or from information transmitted by, a person with knowledge, if kept in the course of a regularly conducted business activity, and if it was the regular practice of that business activity to make the . . . report, record or data compilation, all as shown by the testimony of the custodian or other qualified witness . . . unless the source of information or the method or circumstances of preparation indicate lack of trustworthiness.

The court then reiterated its previous stance that it is immaterial that business records are maintained in a computer rather than in company books. The logical extension of this principle is that evidence that has been compiled from a computer database is also admissible under the business records exception, provided it meets the criterial of FRE 803(6). The court quoted several decisions, including Weinstein’s Federal Evidence, which stated that “The important issue is whether the database, not the printout from the database, was compiled in the ordinary course of business.”

The court concluded that the summaries fit squarely within the exception provided under FRE 803(6). It noted that the trial court had concluded:

  1. the underlying data was entered into the database at or near the time each payment was made;
  2. the persons entering the data had knowledge of the payments that precipitated the data entry;
  3. the data was kept in the course of regularly conducted business activity; and
  4. Mr. Matsush, the authenticating witness, was qualified to testify to this information.

The court concluded that nothing in the record indicated that any of these findings were clearly erroneous.

Mr. Matush’s testimony that data entry for each payment occurs at the time of the payment, and that employees routinely queried the database to generate summaries. The court continued it’s description:

Matush testified that he was familiar with the record-keeping practices of the company, testified regarding the computer system used to compile and search the insurance claim records, and testified regarding the process of querying the computer system to create the summaries admitted at trial. This description of the process used to create the summaries was sufficient to authenticate the evidence, and the district court did not abuse its discretion in holding that a sufficient foundation was laid to admit the exhibits.

(Emphasis added).

Finally, the court was unconvinced by Lumbermens’ arguments that the summaries were inadmissible under FRE 1006, allowing summaries of “voluminous” writings to admitted only if the original data is accessible. The court stated that the summaries themselves are the business records, and so no additional data needed to be made available.

Posted in 9th Circuit, Admissibility of ESI, Authentication, Case Blurbs, Circuit Judge J. Clifford Wallace, Databases, FRE 1006, FRE 803, Uncategorized | Leave a Comment »

Paper Claims ‘Strong Passwords’ Accomplish Nothing

Posted by rjbiii on July 13, 2009

But make it hard on users, that is. The abstract (PDF) follows:

We find that traditional password advice given to users is somewhat dated. Strong passwords do nothing to protect online users from password stealing attacks such as phishing and keylogging, and yet they place considerable burden on users. Passwords that are too weak of course invite brute-force attacks. However, we find that relatively weak passwords, about 20 bits or so, are sufficient to make brute-force attacks on a single account unrealistic so long as a “three strikes” type rule is in place. Above that minimum it appears that increasing password strength does little to address any real threat. If a larger credential space is needed it appears better to increase the strength of the userID’s rather than the passwords. For large institutions this is just as effective in deterring bulk guessing attacks and is a great deal better for users. For small institutions there appears little reason to require strong passwords for online accounts.

H/T: Schneier on Security

Posted in Uncategorized | Leave a Comment »

(Some) Lawyers to IT: You guys deal with ESI, please.

Posted by rjbiii on November 2, 2008

An increasing number of attorneys are looking at IT departments and telling them its their job to develop and enforce policies on handling ESI, and Andrew Conry-Murray says that’s a good thing. In an article for Information Week, Mr. Conry-Murray cites a survey indicating that rising numbers of attorneys who have decided that IT owns the issue. Why is that a positive sign? From the article:

[T]he discovery problem is so complex, on both the technological and legal fronts, that IT and legal must acknowledge they need each other to manage it correctly. This survey indicates a growing recognition of IT’s critical role in an enterprise’s litigation preparedness.

Courts want to see discovery processes that are policy-driven, consistent, repeatable, and defensible (i.e., that the company has clear justifications for how it handles discovery). IT has the technological tools and the experience in driving repeatable processes and can apply them to the discovery effort — with input from legal to make sure discovery efforts meet case law precedents and withstand the scrutiny of opposing counsel.

A favorite past-time of mine is to look at how legal requirements are “mapped” to technological processes, and I find this terrain, viewed as something of a grey area between the legal and tech groups, to be the place where the ball is most often lost.

Posted in Uncategorized | Leave a Comment »

Information Week Writer Reviews E-Discovery Applications

Posted by rjbiii on September 19, 2008

Andrew Conry-Murray writes two reviews on e-discovery software. The first article, which discusses offerings from Clearwell, Kazeon, and Stored IQ is here. The second article, examining Guidance’s EnCase and Axcelerate eDiscovery from Recommind, is here.

Happy reading!

Posted in Uncategorized | Leave a Comment »