CONSULTING
|
DIGITAL FORENSICS
|
E-DISCLOSURE
LEGAL NEWS Issue 12
www.cclgroupltd.com
JACKSON – TOUGH LOVE? by Umar Yasin
As discussed briefly in the last issue of Legal News, the decision of the Court of Appeal in Mitchell v News Group Newspapers Ltd [2013] EWCA Civ 1537 was undoubtedly seen as a watershed moment in terms of the strict approach to compliance adopted by the courts post-Jackson. Despite what has, at times, seemed to be a bit of a phoney war when it comes to enforcing the Jackson Reforms, this decision by the Court of Appeal should leave no litigator in any doubt that non-compliance is a serious issue; the courts will continue to take a tough and less forgiving approach, especially when considering any relief from sanctions under the new CPR 3.9. Both the background and timeline to the ‘Plebgate’ case are well-known, where Mitchell’s solicitors failed to file a costs budget in time, consequently leading to his budget being limited only to the applicable court fees. Master McCloud then refused to grant relief, saying that ‘the stricter approach under the Jackson Reforms has been central to this judgment.’ For the Court of Appeal, the central
IN THIS
EDITIO N... > Jacks on - toug h love? > Thou ghts for th e month > Big d ata a informati nd on gove rnance > The fu ture of v oice processin g > The re al CSI: C CTV analysis > CPD cours commerc es for ial litigato rs > Abou t CCL
question here was: how strictly should the courts now enforce compliance with rules, practice directions and court orders? The court went on to quote approvingly from Lord Dyson’s 18th implementation lecture on the Jackson Reforms, from 22nd March 2013, where he made clear that ‘the tougher, more robust approach to rule-compliance and relief from sanctions is intended to ensure that justice can be done in the majority of cases….parties can no longer expect indulgence if they fail to comply with their procedural obligations.’ The court discussed in detail the key considerations under CPR 3.9, and, despite the court being required to consider ‘all the circumstances of the case, so as to enable it to deal justly with the application,’ the two key considerations which are specifically mentioned within the Rule ought to be given more weight. This means that the emphasis is now firmly on the need for litigation to be conducted efficiently and at proportionate cost, with the need to enforce compliance with rules, practice directions and orders, and, as the Court of Appeal
pointed out, ‘these considerations should now be regarded as of paramount importance and be given great weight.’ The Court of Appeal also considered trivial breaches, warning that ‘wellintentioned incompetence, for which there is no good reason, should not usually attract relief from a sanction unless the default is trivial.’ In Wyche v Careforce Group [2013] EWHC 3282 (Comm), which we also discussed in Legal News Issue 10, Mr Justice Walker did grant relief from sanctions, despite finding that the failures in that case were ‘material in the sense that they were more than trivial.’ The Court of Appeal made clear that the principle ‘de minimis non curat lex’ (the law is not concerned with trivial things) applies equally here when considering relief under CPR 3.9, as it does across other areas of law, and if a breach was considered to be non-trivial, then the onus was on the defaulting party to persuade the court that relief should be granted. Continued on page 3…
1
ARUN PRASANNAN, Senior Digital Forensic Analyst - Research & Development Arun is a member of the Research and Development team at CCL. He joined CCL’s mobile device laboratory as a computer science graduate in 2009 and became part of the R&D team soon afterwards. He has since developed many of the data extraction techniques used in CCL’s mobile device laboratory as well as many of the tools and scripts that CCL’s analysts use to speed up and improve their investigations. Arun also plays a key role in the mentoring of junior analysts and in the documentation and validation of procedures to implement ISO17025 – the international standard for the competence of testing and calibration laboratories. When he isn’t reverse engineering data structures or taking apart electronic devices, Arun enjoys watching episodes of Star Trek, reading and tinkering with computers.
Arun’s thoughts for the month Apparently ‘cloud computing’ is going to change everything! But what exactly is it? Put simply, it represents the availability of computing services over a network, often via the World Wide Web. This obviously isn’t a new concept; for example webbased email has been around for nearly two decades. But the nature of the services available has undoubtedly become more sophisticated. So has the means of accessing such services. Let’s consider a simple, online note-taking application. A user might create an electronic notebook while using a desktop PC at work or school. She might add to it later while at home using an ebook reader. When she is outside she could add a photograph from her mobile phone. The notebook might even be accessed from an internet-enabled television or refrigerator. I hope this illustrates the dynamic nature of content stored online. It is constantly being updated, copied and moved. Data acquired from one device at any one time may not represent the original or the current state, and it need not have been created on that device. A more serious concern is whether any data can be recovered at all; unlike traditional digital forensics, it may not be possible to collect data from the service provider if their physical servers are located in a different jurisdiction. Our experienced analysts are able to adjust their methods to ensure that they recover as many artefacts as possible when dealing with web-based services. By looking at operating system resources and temporary internet files we are able to recover documents viewed using web-based services including web-mail services such as Outlook, file-hosting services such as Dropbox, and office suites such as Google Docs. We can then piece together the data obtained from multiple sources. Cloud computing is a rapidly changing field, and as ever, our forensic and e-disclosure capabilities are rapidly advancing too.
RACHAEL BLADES, Client Projects Executive – Forensic Solutions Rachael has been a member of CCL’s Client Projects Executive Team for over four and a half years, playing a key role in ensuring the smooth-running and effective administration of all CCL’s digital forensics and e-disclosure projects. Rachael is primarily responsible for handling exhibits, ensuring evidential continuity, and being a main point of contact for CCL’s clients. Before joining CCL, Rachael worked for a debt management company, coordinating collection agents across the country. Although now working in a very different sector, Rachael is able to bring her project coordination skills to CCL, supporting the timely delivery of projects to a range of clients including law firms, criminal defence, corporates and law enforcement.
Rachael’s thoughts for the month Teamwork is very important to me in my role; it’s crucial in ensuring that the Client Projects Executive Team functions efficiently and continues to provide CCL’s clients with excellent levels of customer service. We always work together to achieve our goals and I think that without working as a team we would not be able to be the best at what we do. At CCL, every day is different. We see new cases come in from a variety of clients, each with very different requirements. There are always new challenges, which is why teamwork, with effective communication between CCL and our clients, is so important - to ensure we meet these challenges and adhere to the high standards that CCL has become known for. On the Client Projects Executive Team our objective, first and foremost, is always to provide excellent customer service. In addition to this, we support all of CCL’s business divisions and laboratories, and continually look to improve and streamline the processes and procedures which CCL works to. If you try to achieve those goals on your own, you are only ever going to get so far; as a team putting our minds together, we can do so much more.
2
Continued from page 1…
The Court of Appeal here seemed to suggest that Mr Justice Walker’s tolerance of what he accepted in this case were more than trivial breaches, should not be taken to mean that this signals a more relaxed approach to non-compliance. However, as we discussed in Issue 10, the errors during the e-disclosure exercise in the Careforce case were inadvertent, and easily and quickly resolved, and as the failings had been explained candidly to the court, relief from sanctions here was granted. As Mr Justice Walker said, to debar the defendant from defending would be a ‘travesty of justice.’ The Court of Appeal in Mitchell concluded by saying that ‘we hope that our decision will send out a clear message. If it does, we are confident that, in time, legal representatives will become more efficient and will routinely comply with rules, practice directions and orders.’ In the first opportunity to consider CPR 3.9 in light of this stern stance adopted in Mitchell, the Court of Appeal in Durrant v Avon & Somerset Constabulary [2013] EWCA Civ 1624 said that ‘the present appeal provides an early opportunity to apply that guidance.’ In this case, the Court of Appeal kept closely in mind the earlier Mitchell ‘judgment’s clear endorsement of a tougher, more robust approach towards enforcing compliance…’. This case was concerned with an earlier decision to grant relief from sanctions under the new CPR 3.9, and that earlier decision to grant relief in this particular case was made before the benefit of the recent guidance from the Mitchell case. The Court of Appeal briefly reiterated the points made earlier in Mitchell, adding that ‘if the message sent out by Mitchell is not to be undermined, it is vital that decisions under CPR 3.9 which fail to follow the robust approach laid down in that case should not be allowed to stand.’ The Court also confirmed that the two key considerations within CPR 3.9, namely the need for litigation to be conducted efficiently and at proportionate cost, and the need to enforce compliance with rules, practice directions and orders, should be given greater weight than any other factors when considering an application under CPR 3.9. The Court of Appeal went on to say that what we now have post-Jackson is a ‘much less tolerant approach towards noncompliance…’. Coupled with the earlier comments in Mitchell, that ‘from now on relief from sanctions should be granted more sparingly than previously’ and it is abundantly clear that the courts will take non-compliance extremely seriously.
CASE STUDY E-Disclosure THE CASE: Our client was acting as the claimant solicitors in a case involving the sale of Interest Rate Hedging Products. There was a requirement to search the email accounts of five individuals, and the client’s internal IT resource had collected the mailboxes and uploaded them to CCL’s FTP site. WHAT CCL DID: The client was able to restrict the relevant date range to a sing le year. A decision was made early on that only emails and Microsoft Office suite files were of interest. This enable d CCL to filter down the data so that while a total of 15GB of email was collected, only 2G B was loaded into the review platform. This data was culled down further when a keyword list was applied, bringing the number of documents for review dow n from 30,000 to 5,000. THE OUTCOME: The review was completed within a month, and relevant and privileged files were produced into an ‘e-bundle’ format.
And for anyone who may still have any doubts left after these two Court of Appeal decisions, as Lord Dyson said in Mitchell, ‘There will be some lawyers who have conducted litigation in the belief that what Sir Rupert Jackson described as ‘the culture of delay and non-compliance’ will continue despite the introduction of the Jackson Reforms.’ But despite accepting that changes will not occur overnight, the Master of the Rolls made clear that ‘no lawyer should have been in any doubt as to what was coming.’ Not only do these recent decisions leave very little room for either non-compliance or any subsequent relief from sanctions, but they also leave no doubt at all as to how strict an approach is going to be taken by the courts.
3
BIG DATA AND INFORMATION GOVERNANCE by All those terabytes and petabytes within the average corporate IT environment and the explosion in the volume of electronic data that is being created. What does this mean for information governance and e-disclosure, whether the disclosure is in response to litigation or a regulatory investigation? Let’s take a fairly small-sized business and its information technology and electronic data landscape as a typical example. With 200 employees, we’d expect at least one terabyte of emails floating around this business. There is likely to be some sort of file share system, totalling around half a terabyte. Apart from this one and a half terabytes of electronic information, most businesses will have backup tapes in circulation, so, as a conservative average, there are likely to be a further ten terabytes stored on backup tapes. In addition, even if just 150 employees from the 200 have work-issued laptops or desktops, and these devices are being utilised at around 30%, this would mean a further six terabytes of information. Throw into the mix the fact that 50 of the most senior employees would also have a work-issued phone, and with smartphones being much more like computers these days, whether the latest BlackBerry or iPhone, would hold an additional half a terabyte of information. As you can see from the above example, even within a small business with average IT usage, there are around 18 terabytes of electronic information. If we consider cloud storage and cloud-based file shares and email systems, what this means is businesses are creating and storing electronic information at an astonishing rate. All this means that organisations, particularly those which are listed companies or operating in regulated sectors, are now becoming increasingly aware of the benefits of effective information governance. These organisations need to have effective and efficient information governance procedures, so that they can quickly and easily find and interrogate their electronic information, when needed. Throughout 2013 we saw a number of highprofile incidents of data loss during investigations, by corporates and even by regulators (e.g. the embarrassing episode with the SFO). This highlighted both the need for robust information governance procedures and the fact that information
4
governance is a direct reflection of the standard of corporate governance within a business. Whether due to regulation, legislation or a mix of both, there has always been a need for corporates, as well as local authorities/statutory bodies and charities etc., to preserve certain information. Now, whether in response to a piece of litigation or an internal/regulatory investigation, the way in which the relevant information is collected, reviewed and produced, has also become a crucial consideration. Having good information governance in place from the outset provides the best environment from which to efficiently and effectively disclose documents. Even for run-of-the-mill subject access requests, let alone large-scale disclosure exercises during litigation, an internal investigation or in response to a regulatory request, effective information governance can make all the difference. Spiralling costs during disclosure exercises are much more likely when data is unstructured or, even worse, when the IT landscape is either obscure, fragmented and confusing, even to an apparently omniscient IT director. We will be exploring information governance in further detail across upcoming editions of Legal News. We will shed some light on the essential elements of good information governance for all businesses or organisations, regardless of size or sector. We will also be delving deeper into the interplay between information governance and litigation and/or forensic readiness, as well as looking at certain sector or issue specific scenarios, from looking at an internal investigation, regulatory investigation/request and disclosure during litigation, as well as the implications for listed companies.
Example data profile of an SME 200 employees ÂŁ6m turnover Based out of a single office
email: 1TB (1,000GB)
+ File Shares: 0.5TB (500GB)
+ 150 Laptops/Desktops: 6TB (6,000GB)
+ 50 Mobile Phones: 0.5TB (500GB)
+ Backup Tapes: 10TB (10,000GB)
= TOTAL: 18TB (18,000GB)
THIS REPRESENTS A STACK OF PAPER 990KM HIGH!
Umar Yasin
5
CASE STUDY E-Disclosure instructed THE CASE: CCL was complex by the defendants in a of issues, er mb nu a case involving unterclaims. as well as potential co re spread The client’s IT assets we s, from across multiple location ations and loc ore sh off , mainland UK electronic central Europe, and the of emails, information consisted messaging spreadsheets, instant orded voice chat transcripts and rec 09. Due to the data, dating back to 20 siness, data nature of the client’s bu ntiality protection and confide were key. deployed a WHAT CCL DID: CCL sites across team of analysts to five urrently Europe, who then conc data. of B 0G 72 er collected ov n the re we s he arc Keyword se ent’s cli the at te -si on conducted s, applying date various office location ich ensured and file type filters, wh unconnected that no data relating to s processed. parties to the case wa searching After extensive keyword the emails, CCL then segregated files and Excel Bloomberg XML chat re then spreadsheets, which we the client’s uploaded for review by L engaged the instructed law firm. CC ion company services of a transcript worth of voice to transcribe 85 hours uploaded to the data, which was then rm. All in all, a Clearwell review platfo were loaded for total of 487,624 items first pass review. law firm and THE OUTCOME: The yers were the client’s in-house law files having presented with all the mpiled into an been indexed and co t. easily searchable forma ning a CCL also assisted in run ord and number of further keyw er to pinpoint concept searches in ord certain key documents relating to m wanted to issues that the legal tea ir counterclaim, explore as part of the re then the results of which we senior prioritised for review by documents lawyers. The remaining ders for were batched up in fol n of in-house review by a combinatio d forensic and external lawyers an accountants.
6
THE FUTURE OF VOICE PROCESSING by Rob Savage
Voice data has long been a useful avenue of investigation or source of disclosable information for civil litigation, particularly within the financial sector, where the recording of traders’ conversations (either over the phone or faceto-face) is insisted upon by regulators. In Issue 7 of Legal News, James Lawson discussed the different approaches to processing voice data and outlined the two main approaches: transcription and phoneme searching. With every year that passes users are becoming more aware of the most common avenues of investigation that a company like CCL will use to locate relevant (and potentially incriminating) information. For example, it is now not uncommon for individuals who are ‘up to no good’ to avoid putting any details of their actions into emails or electronically stored documents. However, the requirement to ‘discuss it’ still exists, and we are seeing a movement towards methods of communication that are perceived to be more private, specifically phone calls, text messages and instant messaging chat. Specifically within the financial services sector, instant messaging ‘chat’ has been used on a number of occasions as a source of intelligence for investigations or data for disclosure. In November 2013 instant messaging was identified by a number of banks as a potential ‘weak point’ through which traders have been seen to be discussing ‘market topics’. In response to the LIBOR scandal of 2013 a number of banks have now banned their traders from accessing these communal chat facilities in favour of their traders having ‘one-to-one’ conversations over the phone. In summary, there are many influences which are likely to increase the requirement to search voice data. The capability to do this is of course reliant on these conversations being recorded. As technology evolves we may see an increase in the number of companies recording their telephone conversations for exactly this purpose. It is worth being mindful of these evolving methods and considering voice recordings when scoping your next exercise. Many companies have an on-site voicemail system which may also hold recorded voice data.
For more information on voice data or CCL’s other products and services, call us on 01789 261200, email edisclosure@cclgroupltd.com or visit www.cclgroupltd.com
THE REAL CSI: CCTV ANALYSIS by Sarah Turner Picture the scene: 13:25: the midday sun is beating down on Miami-Dade County. The Lieutenant leads a chase through the busy streets of central Miami – shades on, gun in holster, barely breaking into a sweat. Three of his officers follow close behind. The suspect dodges between shoppers and hurried workers out for lunch. Sweating profusely, he dives down a side street and then back out into the main shopping street. Suddenly he dashes over to a waiting car and jumps in as the vehicle speeds off with the passenger door still open. The Lieutenant slows to a jog and then stops, gasping for breath as the suspect speeds away:
An accomplice! Find out who was driving that car!
a more detailed, recognisable face. The computer then cross-references this with its database of thousands of photos. It flashes through image after image, until it spots a match. The Lieutenant dispatches his officers to the address on screen… As entertaining as this is, how does it compare to the reality of CCTV analysis? In reality, there is only so much that ‘enhancement’ of CCTV footage can achieve. Enhancement can only work with the pixels that already exist within the footage; it cannot add extra detail or pixels that are not already there, as is commonly portrayed in cop shows. What it can do however, is to improve aspects of the footage like the brightness, contrast or clarification. These can help to improve the clarity and quality of the CCTV footage, making details easier to view and potentially highlighting new, previously unseen information as well.
Luckily, one of Miami’s CCTV cameras had captured the face of the getaway driver moments before, when he quickly stepped out of his car to check a tyre, unaware that he was recorded on one of the many CCTV cameras around the city.
Also, there is a lot more intelligence available from CCTV analysis than just image enhancement and facial identification, which features prominently in the majority of cop dramas. CCTV analysis can also be used for clothing or object comparisons, height estimation, establishing the time of an offence, vehicle comparison, voice comparison, and even gait analysis, all of which can provide useful intelligence for a variety of matters.
Back at the modern, glass-partitioned lab the large wall-mounted monitor lights up as the Technical Specialist rewinds the footage back to a few moments before the suspect reached the vehicle. As the driver steps out of the vehicle, the Specialist pauses the video on a shot of his face and zooms in. The monitor flickers as he keys in the instructions for the computer to enhance the image. The computer whirrs as previously blurry pixels become sharper and begin to form
For example, CCL was involved in a case where CCTV footage was being used to identify a suspect by his facial features – as our friends in Miami did above. Unfortunately, the images were too low resolution to be used to identify the suspect. However, CCL was able to use other information contained within the footage to achieve the same objective. CCL’s experts re-examined
Let’s check the CCTV of the area shouts one of the officers.
some known footage of the suspect and noticed that he had an unusual and distinctive gait. The analyst took frames from the known footage that highlighted the suspect’s legs and feet, and did the same with the CCTV exhibit footage. In this way, the analyst provided comparative still images to show the similarities between the legs and feet of the known footage and in the CCTV footage. CCL’s analyst also edited several sequences to show side-by-side, to highlight the similarities of the unusual gait between the films, which enabled the suspect to be identified. The truth behind the forensic analysis and enhancement of CCTV footage may not be quite as quick and spectacular as police dramas may lead us to believe. But with the wide range of analysis and enhancement tools and techniques available, CCTV footage can still be a valuable source of information during an investigation.
For more information on CCTV analysis or CCL’s other products and services please call us on 01789 261200, email edisclosure@cclgroupltd.com or visit www.cclgroupltd.com
7
ABOUT CCL
er of civil CPD b m u n a d re o il CCL has ta l y for commercia ll a c ifi c e sp s e rs cou are: litigators, they
CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we setup our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one accredited to the ISO17025 standard for our computer, mobile phone and Sat Nav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms to corporate clients.
CLOSURE CE AND E-DIS EN ID EV IC N O ELECTR ction 31B • Practice dire stionnaire ocuments Que • Electronic D costs • Controlling VE CODING/ AND PREDICTI E-DISCLOSURE EW ASSISTED REVI ol TECHNOLOGY prioritisation to a as ng di co e tiv ic gals • Using pred ng over parale predictive codi of ts nality fi tio ne or Be op • s into pr tie ng di co e tiv • How predic and Jackson LITIGATION D FINANCIAL N A RE SU LO C E-DIS re to look s: knowing whe • Data source tors expect • What regula untant a forensic acco • The role of s can be ble, and course la ai av e ar s ur of PD ho imum number One to three C subject to a min , es is em pr ur held at yo attendees. further would like any or ns tio es qu y contact If you have an courses, please PD C l vi ci r ou . information on 01789 261200 ltd.com or call up ro lg cc d@ cp
CCL has been in the e-disclosure market since 2009 and to date, has completed over 200 e-disclosure cases.
OUR SERVICES • Part 31 e-disclosure services
Missed an issue of Legal News? Don’t worry, all issues are available on our website at
Scan the QR code with your smartphone for more content.
www.cclgroupltd.com
• Digital forensics - All operating systems - Smartphones/mobile phones - Tablets - Sat Nav analysis - Cell site analysis - CCTV analysis • Collections • Part 25 search and seizure orders
COMING UP NEXT MONTH: E-Disclosure: changing the paradigm Challenging the other side’s EDQ
For more information call Rob or Umar on
01789 261200
8
email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com
• Part 35 expert witness services
THE NUMBERS CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed: • 220+
e-disclosure cases
• 4250+
digital forensic (PC) cases
• 55000+ mobile phone cases • 2200+
consultancy engagements
• 750+
civil and criminal cases
• 475+
expert witness assignments