CONSULTING
|
DIGITAL FORENSICS
|
E-DISCLOSURE
LEGAL NEWS Issue 10
www.cclgroupltd.com
JACKSON – THRILLER IN THE MAKING? by Umar Yasin
IN THIS E DITION.. . > Jackso n – Thrille r in the makin g?
Lord Dyson, Master of the Rolls, as well as Lord Justices Stephen Richards, Davis, Lewison, and, of course, Lord Justice Jackson himself. Together they make up the Jackson Five, the quintet of Court of Appeal judges that will oversee the interpretation and implementation of the Jackson Reforms. At least one judge from this quintet will be on the bench for any appeals arising from the Jackson Reforms, although Lord Justice Jackson’s report originally called for just two. This is meant to ensure consistency as far as the Court of Appeal’s interpretation and application of the new Rules is concerned. The courts have been busy over the last six months; there have been a number of cases where parties have fallen foul of the new Rules and have been denied relief from sanctions. Of course, the most high-profile of these has been Mitchell v News Group Newspapers [2013] EWHC 2179(QB), regarding the libel action of Andrew Mitchell against The Sun over the Plebgate furore.
The Mitchell case was heard on the 7th November and the general consensus seems to be that the Court of Appeal will uphold Master McCloud’s decision not to allow relief from sanctions. Mr Mitchell’s lawyers had failed to serve a costs budget seven days before the first CMC, so Master McCloud restricted Mr Mitchell’s budget only to the applicable court fees. The Master then refused to grant relief from sanctions, and she went on to say that all parties ‘were well aware that this was a case for which budgeting was required.’ There have also been a clutch of other cases where a stringent approach to compliance with the new Rules has been adopted, such as Biffa Waste Services Ltd v Ali Dinler [2013] (QB), where Mr Justice Swift overturned an order granting relief from sanctions. Also, in the case of Michael v Middleton [2013] EWHC 2881 (Ch), where there was a failure to provide satisfactory disclosure despite an unless order and a delay in serving witness statements, HHJ David Cooke struck out the action and dismissed the claimant’s application for relief.
> Handlin g ESI for disclosure > The be nefits of pre-proce ssing > The Re al CSI > CPD co urses > About CCL
In PGF II SA v OMFS Company 1 Ltd [2013] EWCA Civ 1288, the Court of Appeal considered a refusal to even respond to an invitation to participate in ADR. ADR forms a cornerstone of the Jackson Reforms and in this case the Court of Appeal signalled that the courts will not tolerate the unreasonable refusal of parties. Lord Justice Briggs upheld the costs sanction, saying that the courts had to encourage more proportionate conduct of civil litigation and ‘it is appropriate to emphasise that message by a sanction which, even if a little more vigorous than I would have preferred, nonetheless operates ‘pour encourager les autres.’ Continued on page 3…
1
SIMON SHAYLOR, Mobile Device Laboratory Manager Simon is the Mobile Device Laboratory Manager at CCL and is responsible for a large team of mobile device analysts ensuring that cases are completed within the agreed timescales and to the highest possible standard. Simon has been with CCL for over four years and has risen from a trainee analyst to his current position. His background in technology and management from previous employment makes him well suited for this position. Also, with over 500 cases completed and over 1,700 individual exhibits under his belt, it is fair to say that he has a wealth of experience and proficiency within the forensic field.
Simon’s thoughts for the month Are Apple and the NSA collaborating to acquire fingerprints from around the globe using the new iPhone 5s fingerprint scanner? Perhaps not. But on a serious note, two new iPhones have been released and Apple is hoping to gain more consumers than ever by releasing a ‘cheaper’ iPhone for emerging markets with the iPhone 5c. In the mobile device lab we already see a huge number of Apple devices, and it looks like this is set to increase substantially due to its ‘cheaper’ price, which will no doubt appeal to a wider spectrum of potential buyers. What does this mean for us? Well, with the new iPhones comes the new operating system iOS 7. We need to continue to stay ahead of the game by providing our clients with the best possible analysis of these devices. We already develop our own in-house software and programs to deal with the ever-increasing types of data stored on these devices, which already includes many chat and social networking applications as well as detailed web browsing history. We also have an in-house specialist tool called epilog, which recovers deleted data from application databases and provides our clients with a wealth of deleted information which the standard forensic tools do not recover. With this in mind, our R&D team are continually working on future-proofing ourselves by developing tools and techniques to acquire more and more valuable data from these devices.
ALEX CAITHNESS, Senior Digital Forensic Analyst – Research & Development Alex works in the Research and Development department at CCL, where he develops new tools and techniques to extract and present data from today’s ever-expanding range of digital devices. Alex’s areas of expertise include: reverse engineering and understanding binary file formats, database forensics and smartphone investigations. He has also developed some of CCL’s best-selling commercially available forensic tools including epilog, which recovers deleted records from SQLite database files. Alex also writes and delivers a range of digital forensics training courses on behalf of CCL and is a regular speaker at industry conferences.
Alex’s thoughts for the month Installing applications to add functionality to a digital device is nothing new, but what has changed with modern smart devices is the delivery mechanism. With PCs the delivery mechanism is dispersed: if you want to install an application on a PC you must first find the application. This might mean searching on the internet, or even taking the ever so archaic route of walking into an honest to goodness, real-world, physical shop. Next you have to check that the application is compatible with your computer, and then you have to negotiate one of many payment methods... After all that you’re expected to install the application yourself; the indignity! In stark contrast to this you have the ‘single-point’ nature of smart device ‘app stores’: a single marketplace which is always with you on your smart device and allows you to go from zero to installed in around four or five taps of the screen. Couple this great convenience with the fact that there are around one million apps on each of the two major app stores and the likelihood that a user will customise the functionality of their devices to suit their personal requirements is very high indeed. When examining a smart device during a digital investigation it is often the data generated by these applications, these user-desired customisations, which give the greatest insight into a user’s activities and behaviour. However, with such a wide range of applications on the market it would be folly to expect off-the-shelf forensic tools to deal with the data generated by every last one – with over a million apps available even a small fraction would be a tremendous amount of work. Because of the breadth of applications and the wealth of evidential opportunities that their data can bring to an investigation, the R&D department here at CCL dedicates a good proportion of time to developing tools and utilities to deal with these third party apps, so that we’re able to present the insights that their data can provide in the way that is most useful to the investigation.
2
Continued from page 1… In another case involving an unless order and disclosure, Smailes & Anor v McNally & Ors or Re Atrium Training Services Ltd [2013] EWHC 1562 (Ch), the question for Mr Justice Birss was whether a party should be struck out for failing to comply with an unless order for disclosure. In this case, the court had made a peremptory order whereby the liquidators’ claim would be struck out unless they carried out a reasonable search under CPR 31.7 for those documents falling within CPR 31.6, provided the former directors with disclosure lists and allowed inspection of documents. The disclosure list was served in time but the respondents argued that the list was defective, with relevant documents missing, and that therefore there had been non-compliance with the unless order. A key issue for the judge in this case was the qualitative nature of the disclosure; i.e. was the disclosure exercise adequate enough to constitute compliance with the obligations to carry out a reasonable search under CPR 31.7? Mr Justice Birss quoted Mr Justice Morgan in Digicel v Cable and Wireless [2008] EWHC 2522 (Ch) that the rules do not require ‘no stone to be left unturned’, so it was perfectly possible that a reasonable search was carried out but some relevant documents were left inadvertently undisclosed. The e-disclosure exercise carried out by Unified in this case was properly planned and despite the oversights and shortcomings, the liquidators had, by way of detailed witness statements, candidly explained these errors. This candour meant that Birss J was satisfied that ‘a serious effort was made on the liquidators’ behalf to perform a proper disclosure exercise.’ On the adequacy of the disclosure exercise and whether it was compliant with CPR 31.7, ‘a court could infer lack of good faith where it was obvious from patent deficiencies in the list that it had been prepared in apparent but not real compliance with the obligation to give discovery.’ However, in this particular case, the deficiencies in the e-disclosure exercise and resulting disclosure arose from ‘honest and understandable errors’, and although the court could infer whether a disclosure exercise was done in good faith or not, ‘the deficiencies relied upon have to be so significant that it can be said that a reasonable search simply had not happened.’ In this case Mr Justice Birss found that there was no breach of the peremptory order, no need to consider relief against sanctions and applications for a further unless order were dismissed. Another important case where the court was also concerned with breach of a peremptory order for disclosure was Wyche v Careforce Group Plc [2013] EWHC 3282 (Comm). An order made earlier by Mr Justice Burton on the 26th November 2012 included various directions,
including in paragraph 2 an unless order for e-disclosure, detailing the requirements of the e-disclosure and stating ‘unless the defendant complies with this paragraph it shall be debarred from defending.’ Paragraph 2 also contained a list of keyword searches and paragraph 3 required the defendant to also produce witness statements on the disclosure contemporaneously with the e-disclosure exercise. Briefly, there were a number of issues with the e-disclosure exercise, errors admitted by the defendant. One of which was that the independent experts in the case, Kroll Ontrack, mistakenly used the operator OR instead of AND when carrying out the keyword searches. This resulted in too many documents being returned. Another error was the misspelling of the word ‘Cheshire’ as ‘Chesire’, although this mistake was spotted at the time. This then led to hits being returned and so this variation ‘Chesire’ was also included in the keyword searches. Further mistakes were made in applying parameters in conjunction with search parameters further up the page. All in all, rather than circa 65,000 documents being disclosed, 177,339 ended up being disclosed. A further mistake was made in miscategorising 65 documents as privileged. The claimant applied for the defence to be struck out and the defendant applied for relief from sanctions under CPR 3.9. Mr Justice Walker reviewed the various attempts at disclosure and the errors that occurred during the e-disclosure exercise undertaken by Kroll. The defendant accepted that the e-disclosure exercise meant it had not complied with the court’s earlier order, but requested relief from sanctions. Mr Justice Walker was satisfied that the ‘errors were innocent, quickly and easily resolved, committed by a third party and did not endanger the trial timetable.’ He went on to say that he fully recognised ‘the major change which has come about with the new CPR 3.9(1).’ However, in this case he also recognised that the errors were inadvertent, and ‘if it is intended to say that human error can never be a ground for relief, takes matters to an unacceptable extreme’ adding that ‘even where there is a material breach, the court’s role is not automatic. It does not apply the rules unthinkingly, nor does it accept that human beings, who must carry its orders into effect, will act as automatons.’ Mr Justice Walker granted relief from sanctions, saying ‘that human error intervened is regrettable, but to debar the defendant from defending the claim as a consequence would be a travesty of justice.’ These cases provide useful and important guidance on the implementation of the Jackson Reforms so far. They also highlight the importance of properly planning and documenting e-disclosure exercises, as well as the benefits of being candid with the court when the exercise does not go as planned.
For more commentary and discussion on the impact of the Jackson Reforms, please visit our E-Disclosure Blog: www.cclgroupltd.com/edblog 3
HANDLING ESI FOR DISCLOSURE AS PART OF CIVIL by Rob Savage
Electronically stored information (ESI) relates to any information that is created, manipulated, communicated and/ or stored electronically, requiring the use of computer hardware and software. Most commonly within the context of disclosure as part of civil litigation the term ESI is used to refer to emails and documents such a Word and Excel files, however the term can extend to more esoteric items such as voice recording, technical drawings and databases of information. ESI falls within the scope of a disclosure exercise as defined by Part 31 of the Civil Procedure Rules. It is tempting, and it is often a methodology employed, to handle ESI for disclosure in the same way as a user’s own electronic data is handled, with little or no procedures, reporting or safeguards in place. This presents a significant risk, as through these informal processes it is not possible to defend the completeness of the disclosure and guarantee that no corruption of data or failings in the review process have occurred. To demonstrate this point I will explain two real life contrasting approaches to comparable document searches that I have encountered in the course of my work. In both of these cases the scope of the search was relatively narrow; both involved the searching of a single user’s mailbox.
Approach A – Uncontrolled The solicitor took delivery of an extract of the user’s mailbox from the client in PST format, which had been extracted from the live mail server by the client’s in-house IT team. The solicitor copied the PST file onto their computer and opened it in Outlook. The solicitor proceeded to run keyword searches one by one using the in-built keyword search facility in Outlook. With each keyword search they reviewed all responsive emails and, where an email was found to be relevant, they would save a copy locally to their computer. The resulting repository of saved emails would form the disclosure bundle.
Approach B – Controlled The solicitor took delivery of an extract of the user’s mailbox from the client in PST format, which had been extracted from the live mail server by the client’s in-house IT team. The solicitor provided the data to a third party e-disclosure provider, who then loaded the PST file into a review platform and provided access to the solicitor. The solicitor ran keyword searches across the data using the platform and created a single batch of documents for review. The solicitor reviewed the responsive documents, applying a tag denoting ‘Relevant’, ‘Not Relevant’ or ‘Privileged’ and applying comments and/or redactions as required. At the end of the review the e-disclosure provider produced a copy of all relevant documents, stamped with a unique document reference for the solicitor.
4
LITIGATION – THE RISKS OF DOING IT YOURSELF It may not be immediately obvious why a controlled approach should be adopted for such an exercise, however there are many benefits which make the output of Approach B more defensible, reliable and potentially cost-effective: • The e-disclosure platform used for the controlled approach (B) logs all user actions, meaning that at any point in time, should the completeness of the exercise be called into question, or should the solicitor need to examine the processing of any given document, reports can be run to provide granularity of detail to demonstrate this. • De-duplication of documents has the potential to save significant amounts of time and effort. Where duplicate documents exist an e-disclosure platform, such as that used in the controlled approach, has the ability to remove duplicates, meaning that each document is reviewed only once. By attempting to search ESI using Outlook or Windows based searches a reviewer may end up reviewing the same document multiple times, wasting time, effort and money. • In the controlled approach the reviewer is able to assign tags to the documents. This is useful not just for identifying relevant documents, but also for streamlining future review exercises. Take, for example, a situation where the review has been completed and subsequently an additional keyword is introduced. Using the e-disclosure platform it would be possible to search for just those documents that contain the new keyword, but which have not already been tagged. Using the uncontrolled approach this would not be possible, meaning a reviewer would have to review documents he may have already reviewed. This may also lead to duplicate documents being disclosed, which goes against the spirit of the principles in PD31B. • It is not uncommon for a review exercise to be done under significant time pressures. By using an e-disclosure platform it is possible to have multiple reviewers working concurrently whilst ensuring they are not reviewing the same documents. • Undertaking the review exercise from within an e-disclosure platform allows reports to be run on the document set. This can include reports on the progress of the review or lists of tagged documents that can be used as a disclosure list. • At the conclusion of the review exercise it is possible to export relevant documents from an e-disclosure platform in a number of formats. The documents can be exported in their original format (known as a native production) or converted to PDF which can include stamping each document with a unique number. In addition there are also several disadvantages to an uncontrolled approach, which may cast doubt over the completeness of the disclosure exercise: • Keyword searching using Outlook will not search within compound (zip) or encrypted files. Any documents that have been sent as an attachment to an email within a zip file may be overlooked. On a recent case we found that in a single user’s inbox there existed 114 zip files that had been attached to emails. Within these zip files were 506 documents which may have been overlooked had an uncontrolled approach been adopted. Adopting a controlled approach will ensure all files are indexed and searched. • As well as allowing a user to search and read emails, Outlook also allows a user to edit and delete them. This presents a risk, as it is possible for the reviewer to delete or modify the content and as a consequence, at the conclusion of the disclosure exercise cannot state with absolute certainty that they have not inadvertently altered the data during the process. • It is not uncommon, when dealing with ESI, to encounter corrupt files or files which are unrecognisable and cannot be read. It may be possible to mitigate out of processing and disclosing these files on the basis of proportionality, however, this decision needs to be defensible and supported by intelligence detailing the impact of such a decision. Tools such as Outlook will not have comprehensive error handling procedures, where it encounters an unrecognisable file it will simply ignore it and not notify the user. In contrast e-disclosure platforms will flag and report any file that it has not been able to search. • Metadata is information about data. Within the context of ESI this, more often than not, refers to the date and time at which a file was created or modified. It is possible, by processing the data outside of a controlled platform that the metadata may be altered.
For more information on how to deal with ESI, please call us on 01789 261200 or email edisclosure@cclgroupltd.com 5
CASE STUDY Robbery – cell site analysis THE CASE: A solicitor’s client was accused of a robbery, which took place in the early hours of the morning in Lowestoft, Suffolk. The defendant claimed that he was at a different location – Blackpool, Lancashire, at the time when the robbery took place. The solicitor contacted CCL to discuss how cell site analysis could prove the geographical location of his client. WHAT CCL DID: A member of CCL’s cell site team assisted the solicitor in obtaining call data records for the client’s phone. These records showed the calls that were made on the phone, which mast was used to make them, and other technical data. CCL’s cell site team was then able to use advanced analysis and mapping techniques to build a picture of how – and where – the phone was used by the accused. THE OUTCOME: This analysis proved the phone – which was attributed to the defendant – was indeed in Blackpool at around the time in question, but not at the exact time. Further analysis of the call patterns and locations was able to prove that it was not possible to have made the journey from Blackpool to Lowestoft and back during the times the phone calls were made. *Locations have been changed, but distances and concepts are of similar orders of magnitude, therefore the interpretation of the story remains unchanged.
THE BENEFITS OF PRE-PROCESSING E-disclosure platforms are not just for large cases with large volumes of electronic data… At CCL we have been investigating technology solutions for both large and smaller e-disclosure exercises. With the Jackson Reforms putting the focus squarely on proportionality and keeping control of e-disclosure costs, it is useful to have tools that are suitable for both. An important factor in controlling e-disclosure costs lies in carefully selecting what data to process and culling down documents for review. While advantageous in large cases, it is essential in cases that fall under the cost-budgeting requirements of the CPR. CCL has a range of pre-processing tools, which complement our end-to-end e-disclosure solutions. These are designed to quickly reduce data volumes prior to processing and review, helping our clients to take a proportionate approach to e-disclosure on both large and small cases alike. Pre-processing tools allow you to use your knowledge of the case to identify the relevant documents and document sources, in order to get a snapshot of case data early on, get an indication of the volume of data to be processed and guide your e-disclosure strategy. Cost benefits: • Significantly reduce the overall cost of processing/indexing data – as there is no technology charge for pre-processing (only minimal professional services costs) • Filter by custodian, date range and file type for a more targeted and efficient approach • Filter irrelevant program files with one click, significantly reducing volumes of data and therefore review costs • Accurately estimate disclosure budgets and timelines – a key requirement of the Jackson Reforms Tactical advantages: • A summary of case data collected for early case assessment – early settlement CPR: • Get a visual summary of data captured, highlighting the number of emails and documents, for completion of the Electronic Documents Questionnaire Effective pre-processing is the first step to proportionate e-disclosure costs.
If you would like to know more about CCL’s preprocessing capabilities, contact us on 01789 261200 or email edisclosure@cclgroupltd.com
6
THE REAL CSI: MOBILE PHONE FORENSICS by Sarah Turner Picture the scene: 4am in a sleepy West Miami suburb. The peace is suddenly broken by a well-dressed man sprinting through the streets. Sweating profusely, he dodges past dustbins and vaults over picket fences. Three detectives are hot on his heels.
Give it up, Diaz! We’ve been watching you for six months, we know all about the fraud. Shouts one of the detectives. Diaz turns his head as he continues to make his escape:
Prove it! You haven’t got anything on me. There’s no evidence, you just… CRASH. He hurtles into some dustbins left on the kerb and comes crashing to the ground scattering bins, lids and rubbish in all directions. Quickly picking himself up, he hops over another fence and disappears into a hedgerow. The detectives arrive at the mess of bins and rubbish.
We lost him! One of the detectives spots something glinting in the streetlight…
It seems he’s lost something too. We’ve got his phone! Let’s get it to the lab. Back at the lab, in the modern, glass-partitioned office in Miami, the investigator turns on the phone and searches for that all important evidence…calls, texts, chat logs… As exciting as this is, and while perfect for an episode of CSI: Miami, this represents a rather simplistic approach to mobile phone analysis. Examining a mobile phone for potential evidence is not as straightforward as simply turning it on and having a look. As with computer forensics, it is important not to turn the device on. If the phone being examined is live, it will connect to a network cell and start downloading data as soon as it is switched on. This can alter or overwrite any potentially incriminating data that may be stored on the device. At CCL we use a Faraday Box to minimise the risk of any potentially useful data such as texts and calls being altered by switching the phone on. While calls, contacts,
SMS and logs often contain crucial information and are always worth investigating, there are other potentially valuable sources of intelligence on a modern smartphone that could also aid an investigation, which could be overlooked. These include social media content, third party applications and web history, all of which can provide useful intelligence. CCL has built up broad experience in extracting this more advanced data from mobile phones, and our R&D team can decode new applications as needed. Then there is deleted data to consider, as in many cases a suspect may attempt to hide any potentially incriminating data by deletion. This kind of data cannot usually be obtained by simply using commercial forensic tools. At CCL, where possible our analysts will take a full read of the phone’s memory for a raw binary file, bypassing the phone’s operating system and taking as much data from the device as possible. We then use internally developed software to convert that data (which can include: contacts, calls, SMS, organiser, emails, app data, etc.) from its database format into a more easily interpreted format. Data that is not stored in databases would be searched for using a script. Again, this is a capability that CCL has developed in-house, as it is not widely supported by commercial forensic tools – so our friends in Miami may struggle here. Developments in mobile technology are coming thick and fast, presenting increasing challenges in obtaining data and crucial evidence – whether it is live or has been deleted. The expertise lies not only in being able to access and present this everexpanding range of information, but also in ensuring that the processes and methodology that define how this evidence is obtained guarantee its integrity. Unfortunately, this often means that the process is a lot less ‘Hollywood’ than TV would lead us to believe.
For more information about mobile phone forensics or CCL’s other products and services please visit www.cclgroupltd.com or call 01789 261200.
7
CPD COURSE ‘ELECTRONIC EVIDENCE AND E-DISCLOSURE’ CCL provides CPD courses specifically for commercial litigators. These cover everything you need to know about the ever changing landscape of the e-disclosure market. Course topics include: Electronic evidence and e-disclosure • • • •
E-disclosure and predictive coding (technology assisted review) • Using predictive coding as a prioritisation tool • Benefits of predictive coding over paralegals • How predictive coding ties into proportionality and costs budgeting
Practice direction 31B EDQ Controlling costs Key cases
E-disclosure and financial litigation • Data sources: knowing where to look • What regulators expect • The role of a forensic accountant Scan the QR code with your smartphone for more content.
ABOUT CCL
g provider ry, and a leadin to ra bo la s ic ns re ings as an largest digital fo om our beginn Fr . es ic rv CCL is the UK’s se y nc rvices to and IT consulta veloped our se de ve ha e w , of e-disclosure 86 ance of consultancy in 19 creasing import in e th , gy lo independent IT no 01, we setup nces in new tech protect it. In 20 d an r ve respond to adva co re rensics ed to manage, largest digital fo e th w no is data, and the ne L C .C 5 standard nsics laboratory d to the ISO1702 ite ed cr ac our digital fore e on ly provide UK, and the on boratories. We la av N t Sa provider in the d an ing from law r, mobile phone ganisations, rang or of e ng ra for our compute d oa e clients. services to a br rms to corporat fi w la al in digital forensics im cr encies, civil and enforcement ag te, has e 2009 and to da nc si t ke ar m re the e-disclosu CCL has been in cases. 200 e-disclosure completed over
THE S E IC V R E S OUR RS E B M U N es ic rv e-disclosure se • Part 31
ics • Digital forens systems - All operating mobile phones - Smartphones/ - Tablets is - Sat Nav analys is ys al - Cell site an - CCTV analysis • Collections and • Part 25 search
seizure orders
es rt witness servic • Part 35 expe
8
er 100 full-time CCL employs ov f, including 65 members of staf ve analysts who ha consultants and completed: sure cases • 200+ e-disclo l forensic (PC) • 4,000+ digita cases ile phone cases • 50,000+ mob tancy • 2,000+ consul engagements d criminal cases • 700+ civil an witness • 450+ expert assignments
Missed an issue of Legal News? Don’t worry, all issues are available on our website at
www.cclgroupltd.com
COMING UP NEXT MONTH: Manual v auto ED Looking forward to 2014 For more information call Rob or Umar on
01789 261200
email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com