CONSULTING
|
DIGITAL FORENSICS
|
E-DISCLOSURE
LEGAL NEWS Issue 1
www.cclgroupltd.com
THE JACKSON REFORMS
serviCes
gy – developing the strategies Do you know where tothat lookensure for electronically
storedbusiness information (ESI)? vely supports objectives.
ess case – understanding the lifetime costs,
Do you know what it costs to collect, process, review and produce electronic documents?
and wider implications of a planned IT project,
e our clients to make the right decision for
iness. What are your obligations to your clients how–they preserve electronic documents? tion andabout selection bringing our unrivalled
IN TH
IS ED ITION ... > D ata ch alleng and es > PD ESI 31B a nd Jack > CC son reform L’s e s servic -disclosure e s > D igital f orens and ics > W e-disclosu ho are re > CP C D cou CL? rse
ge of the market to help clients select the right
Could you present and justify a detailed m for their business. e-disclosure costs budget at the first case negotiation - ensuringconference? that our clients’ interests management
ected at all times and that suppliers deliver on their
How do youterms ensure that e-disclosure , with well-defined that suityour business needs. strategy is efficient and proportionate?
management – using our proven project
ment methodology to reduce the risk of IT projects
How do you break down your
ure they e-disclosure are completed on time, to budget and costs?
ectives.
DOCKETED JUDGES, COSTS BUDGETING AND RULE 31.5A: ARE YOU READY? The global electronic disclosure (e-disclosure) market is expected to increase by 275% from 2012 to 2017.1 Likewise, the volume and relevance of ESI has exploded in recent years, and continues to increase. This has made the process of litigation much more costly and time-consuming, with e-disclosure representing around 35% of the total cost of litigation.2
need to be proactive in devising an appropriate disclosure strategy. Rule 31.5A, and the rigid enforcement of Practice Direction 31B is meant to encourage lawyers, and their clients, to consider disclosure of electronic documents at an earlier stage. Lawyers will also have to be able to present and justify a detailed disclosure budget at the first case management conference.
The changes in the Civil Procedure Rules in April 2013, as part of the wider Jackson Reforms, are designed to address this, by ensuring that disclosure costs are controlled and proportionate. These changes mean that the types of cases that are covered by e-disclosure obligations will expand to include all multi-track matters. Jackson’s new Rule 31.5A also means that there will be no default option of standard disclosure, so lawyers will
Those lawyers who deal with disclosure in a proactive and proportionate way will gain a strategic advantage. You may well see more instances of ‘budget brinkmanship’ come April, with parties attempting to force the other side into mediation or settlement by deliberately overinflating costs budgets. Active judicial case management will also mean that those lawyers who think about disclosure at an earlier stage will be 1
more successful in dictating disclosure on their own terms, rather than being dictated to, either by the judge or the other side. CCL provides you with the support and expertise to effectively engage in the e-disclosure process. As the UK’s leading supplier of digital forensic investigations and data collection services, we have been in the e-disclosure market for a number of years, using our digital forensics capability to help law firms collect and analyse digital evidence. Our partnerships with leading e-disclosure software providers means that we can help you throughout the entire e-disclosure process – from identification, through to production and presentation, providing certainty and clarity on costs at all times.
Transparency Market Research
2
Pillsbury Winthrop Shaw Pittman LLP
1
CASE STUDY File searching was called in by THE CASE: CCL gal firm to help a large ‘top 20’ le a case which them investigate g for documents involved searchin a vast amount of and emails within s ation. The case wa electronic inform d an , ial nt confide urgent and highly to attend the st aly an an required possible. scene as soon as CCL is always WHAT CCL DID: round-the-clock t ready to carry ou t notice, and work at very shor arrived at the an on-call analyst in Central London solicitors’ offices ist necessary special – along with the s. ur ho o in tw equipment – with ically sound copy CCL took a forens rd drive, which of the suspect ha seized by had already been e drive was Th . am the legal te , and contained particularly large bytes of data in hundreds of giga nce this imaging various formats. O set up, the process had been l team to ga analyst met the le ents of the m ire discuss the requ d on a number case, which centre of crucial emails. a number of Having identified ds and specific important keywor analyst was able search terms, the e to home in on th to index the data d ise The special most crucial files. meant this L CC tools used by a fraction of could be done in tional search the time of conven g time, and techniques, savin . ultimately, money l eant that the lega Crucially, it also m d te le de access to team had instant otected by pr e os files, and th ng that they had passwords, meani h of data that they access to a wealt y be able to view. wouldn’t ordinaril The legal team THE OUTCOME: th the indexed was presented wi archable format, files in an easily se search for the enabling them to her information messages and ot the case. most relevant to mpleted within 24 All of this was co l firm contacting hours of the lega them to take the CCL and enabled continue with this necessary steps to urgent case.
2
THE CHALLENGE OF ELECTRONICALLY STORED INFORMATION The volume of electronically stored information (ESI) has exploded in recent years, and continues to increase. According to IBM, every day, we create 2.5 quintillion bytes of data. This means that 90% of the world’s data was created in the last two years.3 The range of new technology and devices on which ESI can be stored, and consequently from which evidence can be collected, is also expanding. This exponential growth in ESI and data sources has a direct impact on the cost and duration of the e-disclosure process, and presents many challenges to lawyers and their clients. It is becoming increasingly costly to collect, process and review the growing amounts of data that may be relevant to a case.
‘Even in medium-sized actions, where all the documents are in paper form, disclosure can be a major exercise which generates disproportionate costs. In larger actions where the relevant documents are electronic, the problem is multiplied many times over.’ Lord Justice Jackson DATA CHALLENGES: • Understanding the ESI landscape – what it is, where it is located, and how to get it • Familiarisation with data retention policies • Understanding the dangers of failing to properly preserve and produce ESI • Awareness of the potential sources of electronic evidence • Developing more targeted collection methods that include crucial metadata, and will support defensibility in court • Using new technologies such as pre-processing and predictive coding to reduce the cost and duration of the e-disclosure process CCL’s wealth of experience in digital forensics means that we have a thorough understanding of ESI – what it is, where to look for it, and how to get it. We can help in the identification and collections phases of an e-disclosure project to ensure that all relevant sources of ESI are considered. Collection is an expensive phase in the e-disclosure process; we ensure that it is done right first time.
For more information call Nikki or Marie on 01789 261200 or email edisclosure@cclgroupltd.com 3
IBM: http://www-01.ibm.com/software/data/bigdata/
PRACTICE DIRECTION 31B AND RULE 31.5A Practice Direction 31B and Rule 31.5A, which comes into force April 2013, are designed to assist lawyers with overcoming the challenges posed by growth in ESI and data sources. With the removal of standard disclosure as the default option, lawyers will have to: • Consider e-disclosure at the earliest possible opportunity • Be prepared to collaborate much more closely with the other side • Be able to present and justify a detailed costs budget at the first case management conference
‘It is inevitable where parties have relevant material electronically, that electronic disclosure is a practical necessity rather than an optional course’ Lord Justice Jackson PRACTICE DIRECTION 31B
WHAT THIS MEANS TO YOU
PD31B came into force in October 2010.
Rule 31.5A, combined with PD31B, is designed to encourage both parties to consider e-disclosure at the earliest possible opportunity and collaborate much more closely, in order to agree a disclosure option that is cost-effective and proportionate to the value of the case. A detailed costs budget will subsequently be presented and justified by the lawyer at the first case management conference.
‘The purpose of this Practice Direction is to encourage and assist the parties to reach agreement in relation to the disclosure of Electronic Documents in a proportionate and cost-effective manner.’ Ministry of Justice A key part of PD31B is the ESI questionnaire, designed to help both parties establish what ESI they have and agree a proportionate disclosure strategy.
This represents a cultural shift for lawyers, and throws up a number of challenges. From 1st April 2013, you will need to: • Consider the scope and cost implications of disclosure of ESI through all phases of the e-disclosure process, from collection through to production, before the first case management conference • Ensure that the e-disclosure strategy is efficient, cost-effective and proportionate to the value of the case • Identify ESI relevant to the case, where it is stored, custodians and date range
RULE 31.5A
• Know where to look – all the potential sources of relevant ESI
As a consequence of the Jackson Reforms, the UK Rule 31.5A comes into force on 1st April 2013. This means that while the volume and variety of ESI is ever increasing the types of cases that are covered by e-disclosure obligations will also expand, to include multi-track matters. It also removes the default option of standard disclosure in favour of a menu of disclosure options.
• Identify how much it is going to cost to collect, process, review and produce responsive ESI • Produce a transparent breakdown of e-disclosure costs • Present and justify this breakdown of costs at the first case management conference.
Apr il 20 13.. . • N od disc efault opt • N losu ion owh re for first ere t o c h ase ide co • S nferen manag at cop ce eme nt cas e of p es w ote nt A il • C pril (m l be wi ial ultider our read ts will track) in m corp ily pen ore a defi orates lise c e-d iencie for isclo s sure in the pro ces s
3
CCL’S E-DISCLOSURE SERVICES STAGE 1
STAGE 2
STAGE 3
STAGE 4
‘DEFINING SCOPE AND OBJECTIVES’
‘CAPTURING ONLY WHAT YOU NEED’
‘FINDING, SCREENING AND MARKING’
‘PREPARING FOR TRIAL’
Processing Preservation
Information Management
Identification
Review
Production
Presentation
Collection Analysis
VOLUME
RELEVANCE
CCL’s e-disclosure services cover all phases of the Electronic Discovery Reference Model (EDRM). • Information Management - CCL’s e-disclosure and Digital Forensic Readiness Audits • Identification: - Mapping data estate - Sources of information - Early cost estimates • Preservation - Taking immediate action to protect relevant sources of information • Collection: - Forensic collections – covert or overt - 24-hour callout - Ability to collect from disparate sources
4
• Processing: - Pre-processing for early case assessment – identify risk and reduce processing costs - Industry leading tools • Review: - Flexible workplan for reviewers - Computer assisted review (predictive coding) • Analysis: - Concept searching - Transparent searching • Production: - Range of formats - Bates stamping • Presentation: - Expert witness
DELIVERY: • Hosted (Software as a Service) - Managed remotely - Hosted remotely - Buy-as-you-go • In-house solution - Infrastructure - Integrated solution - Project management - Training & implementation All of our services can be delivered as managed services or a fully implemented in-house solution. The majority of firms we work with opt for managed services, benefitting from our resources, specialist knowledge and stringent quality procedures to ensure defensibility and reduce the cost and duration of e-disclosure.
BENEFITS O F CCL’S SERV ICES: • Meet your obligations un der the CPR, having carrie including d out a reaso nable search targeted colle through ctions, includ ing forensic collections w here necessar y • Targeted in telligent keyw o rd searching enables colle ction of only the relevant d and reduce th ata e costs and ti me involved the review pro in cess • Expert assi stance in com pleting the E questionnaire SI requirement of PD31B • Fixed scop e, fixed price , fixed time ap ensures that proach you compile an accurate, defensible an d fully propo rtionate costs helping you to budget, control costs • Provides yo u with an opp ortunity to as risk at the ea sess rliest possible stage, giving snapshot of ev you a idence, releva nt trends and themes • Our solutio ns and servic es form a key your strategy, part of whether at th e pre-action stage, or even protocol with a view to • Our exper settlement tise ensures th at we identify and collect al , preserve l data in a way that maintains evidential inte its grity • Our produc t-agnostic ap proach means we match the that solution to our client, rather matching the than client to the so lution.
CASE ST Contra UDY ctual d ispute THE C A premis SE: CCL was e
a s client’s at short no sked to atten tice, to extern d a law e a contra ctual d l hard drive a xtract data f firm’s rom a ispute s part . of a WHAT C quickly CL DID: The , and s analys ta t imagin g. This rted the pro arrived on-sit cess o meant from th f foren e th e hard sic drive w at data was made extrac to the ithout ted o a riginal volum ny cha eo m ng of hou f data on th edia. Due to es being rs, e th consult during whic drive, this to e large ok a nu h time ancy a dvice o the an mber eviden aly n ce indexe be located where furthe st provided .O rd d, access which mean nce imaged ata and , the d t that t to the ata wa he soli data in s c a man ageab itors had eas THE O le form y UTCO . ME formed a signifi : This data s analys ubseq cant p tk ue a to ens ept in close rt of the cas ntly e, and ure tha contac CCL’s t with t tt was m h aximis he potentia ed. l of the e law firm eviden ce
Y CASE STUD e tanc The impor g the of choosin l right digita artner forensics p
firm had a ‘top 30’ law A FT : E S A C THE ond to an O eded to resp e e n th f o o h w o t n Tw clie -fixing. lly n into price io ca si at n ig re st fo ve in to be ps needed the law client’s lapto stigation, so ve in r e h rt nsics fu r fo fo , digital re imaged eir existing th d s e e ct ag ru im st firm in ies of the o this. Cop d . is to ys r e al d an vi pro CL for be sent to C would then ion, e investigat stages of th ly les ar fi e e e th th one of During ighlighted: h n as e p w ap m h le a prob asionally uld This can occ o t. w p u u rr yo co ly was r, normal sit; howeve ed out during tran r file. It turn te as m e th to refer back rrupt. was also co that this file er ested anoth : CCL requ ID D w L e C vi C re T n WHA age. Upo forensic im arent copy of the ecame app b owever, it h e, but a le fi ag is im th c f o ot a forensi n r as w le fi drive. Rathe that the uter’s hard p m r co lie e p th p f clone o age, the su a forensic im is not than taking achine. This m g in at lic p u d nt, had used a of equipme -sound piece o lly n ca d si e n in re ta n fo a image co e th at th t a cial in case and mean n prove cru ca h ic h w a, metadat like this. , the ith the case progress w to r d to CCL, e re rd e o ri In to be cou ad h p to p n. second la e to be take rensic imag for a full, fo completed E: This was M O C arrived T U O THE – the device rs u o h g in rk o was then within 24 w d the data an , ay d ri F a w on the at CCL on ient to revie cl e th r fo available ling the case rning, enab Monday mo . to continue igital e original d failings of th e d th e rr to cu e u in D ient vider, the cl igation st ve in re ti forensics pro n and the e s st ks. co e al w n by two e additio ily delayed ar ss ce e n n was u f using a portance o im e th ts h al forensics This highlig edited digit cr ac d L an d res that CC fully vette ity procedu al u q e h ct T ri r. st provide we follow , mean that sent has in place s that repre re d procedu an data s ta e e ss m ce e pro , preserv e ic ct ra p st grity. Digital industry be dential inte vi e y e te an these qualit and guar es without ri to ra o b l la ve forensic tee this le nnot guaran g standards ca d up costin n e ich could h w , e e ic m rv ti of se nificant ur client, sig you, and yo and money.
5
E-DISCLOSURE & DIGITAL FORENSICS e-disclosure and digital forensics go hand-in-hand; this is why CCL, having provided digital forensics services since 2001, is one of the strongest providers of e-disclosure services in the UK.
DIGITAL FORENSICS
Deleted data
Small volumes
All No stone Depth of unturned/ evidence e-disclosure meticulous approach exercises Technical should be investigation Court ready underpinned by digital forensics principles.
E-DISCLOSURE Large volumes
Collections, Processing & Filtering
Breadth of evidence
Selecting the most responsive documents
Non-technical reviews
Efficiency
Court ready
If you do not adopt a forensically sound approach from the start, it is possible that crucial data could be overlooked or compromised during the e-disclosure process. It is not uncommon for metadata to be pivotal to a case, so protecting this through forensically sound capture, handling and processing is vital to the success of the exercise. Forensic collection means taking an exact copy of a hard drive, server or other device at disk level, which includes metadata, and can even include deleted data, without altering any of the original data in the process. A key aspect of forensic collection is that it can be proven that the image is an exact copy of the original data. A non-forensic data collection can alter and corrupt the data being collected – especially the metadata – which reduces defensibility in court and makes a subsequent forensic collection ineffective. By collecting data forensically, CCL can guarantee its defensibility in court; however, there is more to it than that. Forensic data collection also ensures that the maximum amount of information is extracted, meaning that collection, which can be a costly exercise, is as efficient as possible and will not need to be repeated. The skills that our analysts have developed from over a decade in digital forensics are immediately applicable to e-disclosure, which is one of CCL’s key services. We often work on cases of a highly sensitive nature – particularly cases involving allegations of impropriety or dishonesty, where a covert approach is required. Using digital forensic tools, we undertake collections remotely without alerting individual custodians to the exercises and minimising business disruption. Our skills and experience in both of these disciplines means that we are able to select the right tools and techniques for the requirements of your case and your client.
DIGITAL FORENSICS APPROACH: • Full chain of custody – data is tracked and logged through each phase of the e-disclosure process, from collection through to production, with fully documented and traceable processes • Maximum amount of information can be extracted – including metadata, and encrypted, password-protected and deleted data • Fully defensible • Robust collection – efficient collection that does not need to be repeated • Digital forensics methodologies and processes are embedded within our business, so you benefit from the stringency this approach brings, but not at the expense of efficiency
6
WHAT IS METADATA? Metadata is data about data. The information that is stored about files, such as when they were created, on what system, by who, when they have been edited, last saved and by who, as well as the file size and short summaries on text files.
COMPANY HISTORY
THE NUMBERS
Our roots go back over 27 years. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology and the increasing importance of digital information – and the need to recover, manage and protect it. CCL has been working with law firms for over a decade, in cases where digital evidence is a crucial component. We have been in the e-disclosure market since 2009.
CCL employs over 100 full-time members of staff, including 60 consultants and analysts who have completed: • 200 e-disclosure cases
1986
Independent IT Consulting
1989
• 2,500 digital forensic (PC) cases • 50,000 mobile phone cases
Expert Witness Services
2001
• 2,000 consultancy engagements
Digital Forensics
2009
e-disclosure
PHILOSOPHY & VALUES 1. Quality: CCL is the first, and still the only, digital forensics provider in the UK to be accredited to ISO17025 for our computer, mobile phone and SatNav laboratories. We work within a framework that ensures industry-recognised best practice and quality standards are followed throughout. What this means to you is that evidential integrity is maintained, and that our methods are fully defensible and will withstand scrutiny from your opponents. 2. Fixed scope, fixed price, fixed time: This approach is in our DNA, and is a cornerstone of the forthcoming Jackson Reforms. With the focus squarely on cost-effective and proportionate disclosure of ESI, CCL provides certainty and clarity on costs at all times. 3. Commitment to R&D: CCL has a dedicated R&D team who develop scripts, tools and techniques to efficiently extract and present more data from the ever-expanding range of digital devices. We have developed over 300 scripts to aid investigations, and sold our software licences to customers in more than 40 countries – ranging from law enforcement agencies to multi-national corporations. 4. Methodology-driven: Our Equipped™ methodology incorporates key values of the business. We use our methodology to bring clarity, consistency and objectivity to our projects, through repeatable, tried and tested processes; this benefits our clients in terms of quality of work, cost and time savings, and peace of mind.
• 450 expert witness assignments
CASE STU DY Internal f raud THE CAS E: A well-k nown cloth manufactu ing rer, with a number o the UK, su f sit spected in sider deali es around or more o ng among f its staff, after a nu contracts mber of m one with store ajor s were no Concerns t being re were heig n ewed. htened w that long-s hen it em tanding c e rg ed ontracts w newly form ere going ed busine to sses. An anony mous tip-o ff s confidenti al informa uggested detailed tion was b from the c eing leake ompany to d these new The depa rtment tha competito t negotiate rs. contracts d these was large , and spre sites, and ad across the firm h three ad as to who , if anyone little or no suspicio n , was resp leaking th onsible fo e informa r tion. WHAT CC L DID: CC L securely terabytes im of data fro m the com aged servers, a pany’s s well as c olle backup ta pes, datin cting dozens of g back se veral years . This was c arried out u sing cove to avoid a rt techniq rousing su ues spicion, a adherenc nd with str e to ACPO ic t g that, shou u ld the com idelines. This mea n t p any disco suspiciou ver any s activity, it c o action if it uld pursu e legal wished.
THE OUT CO and culled ME: CCL processe d this data an , relevant, to y information that was not ensure the effective a process w nd propo rtionate. T as costwere then he docum categorise ents d and pre format tha sented in t was easy a for the cli to review. ent comp any
7
OUR ACCREDITATIONS: • ISO17025: the main ISO standard used by testing and calibration laboratories • ISO27001: information security management system, designed to bring information security under explicit management control • ISO9001: the International Standard for Quality Management Systems (QMS). It provides a set of principles that ensure a logical approach to the management of business activities, to consistently achieve customer satisfaction • Investors in People: the UK’s leading people management standard, specialising in transforming business performance through people • Accredit UK: the standard of quality for ICT companies in the UK
‘CCL works with lawyers to streamline and optimise their entire e-disclosure process, saving time, reducing costs and helping them meet their obligations under Practice Direction 31B and the forthcoming Rule 31.5A. With an excellent range of technology partners, all of whom are leaders in the e-disclosure market, CCL selects the most appropriate solution for our clients, to enable them to see the data they really need, in a much more efficient and effective way.’ Andrew Krauze, Managing Director, CCL
ACTIVELY WORKING TOWARDS: • ISO14001: environmental management standard to ensure CCL incorporates environmental policy and procedures into our day-to-day activities, as part of our commitment to corporate social responsibility • ISO17020: for our cell site analysis services – to ensure that the high standards we set within our laboratory are adhered to when we are conducting cell site analysis work off-site • ISO17025: for e-disclosure services. This standard does not currently exist for e-disclosure services, so CCL is working with UKAS with a view to becoming the first ISO17025 accredited e-disclosure services provider
s’ CPD course ackson Reform J e th d n a re u to ‘e-disclos hing you need e cover everyt
tice r lawyers. Thes ion under Prac CPD courses fo stored informat lly CCL provides ca ni . tro ril ec Ap el sclosure of into force in know about di forms coming the Jackson Re d an B, 31 n io Direct u are urse ensures yo sel, our CPD co un sclosure. co di se eou on -h s in r own ckson Reform Ja e th of Delivered by ou your ts at en m can be held eet the require and the course e, prepared to m bl la ai av e ar D hours ees. One to three CP mber of attend a minimum nu to t ec bj su s, office covers: forms’ course the Jackson Re d an re su lo isc CCL’s ‘e-d ction 31B • Practice Dire sclosure di sts c ni co g tro llin ec el ro • Cont • What is A .5 31 le • Ru chniques • Tools and te
For more information call Nikki or Marie on
01789 261200
8
email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com
SNAPSHOT OF BENEFITS: • e-disclosure approach underpinned by digital forensics best practice: our forensically sound approach ensures that no crucial data is overlooked or compromised during the e-disclosure process • Fixed scope, fixed price, fixed time: giving you accuracy, transparency and certainty on costs, at all times • Product-agnostic approach: we mix and match the solution to our clients, rather than matching our client to the solution • ISO17025 accreditation: it minimises the risk of the integrity of your evidence being challenged in court • With over 25 years in IT consultancy, we bring this consultative approach to our e-disclosure services, working in partnership with you to ensure you can effectively engage in the e-disclosure process
Coming up next month: • Budget brinksmanship, costs... disclosure – lessons from Henry • DBAs – changing the future of litigation