CONSULTING
|
DIGITAL FORENSICS
|
E-DISCLOSURE
LEGAL NEWS Issue 16
www.cclgroupltd.com
INCENTIVISING INEFFICIENCY? FROM CLEMENTI TO JACKSON by Umar Yasin
IN THIS ED
ITION...
> Incentiv ising Ineffici ency? From Clem enti to Jackson > Thought s for the m onth > Informat ion Govern ance under the sp otlight in the new ED RM > Thank yo u, Master Whitaker > The Rea l CSI > CPD Co urse > About
CCL
‘The one great principle of English law is to make business for itself’ Two important trends have been emerging over the last decade that are continuing to take an increasing hold within the legal sector. Firstly, the Clementi report in 2004 and the way in which the 2006 Legal Services Act paved the way, depending upon your perspective, for the liberalisation or commoditisation of legal services. Secondly, and slightly more recently, in the post-Lehman climate of the last few years; those lawyers who have seen the law as a business first and foremost, rather than just a profession, have been propelled to the top of the tree. Threats such as ABSs and the tendency of large corporates to keep in-house as much work as possible, and the propensity to then procure
any external legal services as costeffectively as they can, have meant two things have happened. Lawyers have become more focused on business development and how to add value, above and beyond sound legal advice, which is what is expected anyway. This is to both satisfy existing clients as well as to differentiate themselves in an over-crowded legal marketplace, particularly amongst the rapidlyconsolidating mid-tier segment of the legal market. The second trend that has emerged, and is becoming increasingly more evident, particularly with litigators, is something that was initiated by corporates and their desire for certainty on costs and value for money, and which has now been ratified by the Jackson Reforms and the judiciary post-Mitchell, is this nascent discipline of legal project management. Some legal services have long since started to become commoditised; whether it is through deal rooms for high-value
M&A work or case management systems for high-volume personal injury work; efficiencies have been gained and increased by investing in technology and adopting a proper methodology, and this discipline is now transcending across into commercial litigation. However, the simple fact is that, in an industry which still, by and large, charges in units of time, there is always going to be some recalcitrance and reluctance to adopt technology in order to increase efficiencies. Almost perversely, inefficiency is incentivised in an industry that charges based upon the time taken to complete a particular task, be it due diligence on an M&A deal or a review of 350,000 documents for disclosure during litigation. As Dickens wryly observed in Bleak House, ‘the one great principle of English law is to make business for itself’. Continued on page 3…
1
STEPHEN SWABEY, Forensic Cell Site Analysis Expert Prior to joining CCL’s cell site team in September 2013, Stephen was employed by Orange for over 16 years, focusing on operational engineering roles in both 2G and 3G networks. Stephen holds a BSc. from the Open University, and has spent many years specialising in network performance analysis, which included the investigation of customer complaints and assessing service issues at cell locations using a variety of data sources. Stephen’s work at Orange was built on experience gained in a defence industry company testing for, and often resolving, issues in radio interference in various equipment and vehicles, both military and civilian.
Stephen’s thoughts for the month Working in engineering quickly shows you that something (like a piece of electronics or a dataset), which has a problem, is not always rendered useless. Knowing the limits of the problem often means a sensible use can be made of a part that remains useful. In cell site analysis, there are data limitations, but that does not mean that the data we have is totally unreliable and useless. On the contrary. For example, incoming phone call data has limited reliability of reported calling number if the call originates outside of the reporting network. However, the data about the receiving number, including cell used and time, is still absolutely accurate. Taking things at face value can be misleading. A phone number that one minute is connecting via a Norway based service and the next minute connecting via the Irish Republic is not as impossible as it seems. Also, GPRS data (internet and multimedia connections) is known to have time issues. But if emails are known to come from a phone source at certain times, and if a phone number is shown to have, or not have, GPRS events ongoing over the time periods that encompass those times, then that is supporting evidence for attribution, or not, of the phone. I left a bit of a teaser in the Norway/Republic of Ireland issue above. Looking at all aspects can provide answers to the impossible. The answer is that many shipping companies, including ferry operators, use a Norwegian communications company to provide their on-board phone service via a satellite link. Easy when you know!
DANIELLE PRICE, Client Projects Executive – Forensic Solutions Danielle joined CCL’s Client Projects Executive Team in 2013, and is responsible for the administration of all aspects of CCL’s digital forensics cases for law enforcement and criminal defence clients. She also coordinates projects for corporate and civil law firm clients. A key part of Danielle’s role is to provide the crucial communication link between clients and CCL’s technical departments, and to ensure that clients understand the details and progression of their cases. Before joining CCL, Danielle previously worked as a Lab Assistant at Roar Forensics.
Danielle’s thoughts for the month Organisation is key in my role as a Client Projects Executive. Without this, I would not be able to meet the client’s needs, which could potentially affect CCL’s future prospects of work from existing and new clients. Lacking a controlled and streamlined way of working could lead to errors being made and key information being missed, which could also have an effect on the company’s highly sought-after reputation. My role is crucial both to CCL and to our clients, as the Client Project Executives are the first point of contact and must be aware of every client’s specific needs. Organisation and efficient management of workloads helps me to achieve this. It is crucial for me to know the company policies and procedures to enable me to give the best service I can. Teamwork is also a very important part of my role and I work together with the team to perform to the highest standard. The strength of the team is each individual member; the strength of each member is the team.
2
INCENTIVISING INEFFICIENCY? FROM CLEMENTI TO JACKSON by Umar Yasin …continued from page 1 But with pressure on fees coming from clients, and proportionality pressures from the courts, and with the volume of documents, especially electronic documents, showing no signs of abating, litigators now acknowledge that the only way to deal with e-disclosure efficiently and effectively is by using technology. In our recent experience, those slightly more savvy and astute firms and litigators, also realise that in this age of all-enveloping technology and everincreasing electronic evidence from emails to social media, this does present a real business development opportunity for lawyers. Credit where credit’s due; the Big 4 are great examples of how professional services should be marketed and delivered. The legal sector has a lot to learn from the way in which the Big 4 have not just utilised, but positively embraced technology to increase efficiencies and their offerings, as well as how the Big 4 have marketed themselves and their broad portfolio of services to their core clients. What this has meant is that the Big 4 have been able to create formidable and deeply expansive relationships with their clients. And now, given that the likes of EY and PwC have started to signal their serious intentions to re-enter the legal sector, can law firms actually afford to ignore the Big 4? Here’s a startling fact about the Big 4. Take the annual revenue of just one of these professional services firms. KPMG, Deloitte, PwC or EY each generate more revenue in one year than the top fifteen global law firms combined. From Baker and McKenzie to Hogan Lovells, each one of the global law firms generates annual revenues that is a mere fraction of the revenues generated by just one of these four professional services powerhouses. Yes, I know revenue is not the only key metric to consider, but it is a pretty useful and accurate indicator of how in demand your brand and services are. What the Big 4 also show is how to evolve and respond to the ever-increasing demands and needs of your clients, and how to then offer and deliver services and solutions seamlessly across the client base. There are signs that some law firms are taking these potential business development opportunities seriously and starting to make strides, in order to bolster existing propositions to their clients. Firms such as Eversheds, Schillings and Kemp Little have shown that law firms can extend their portfolio of services beyond just legal advice. By responding to ever-evolving pressures and needs, from advising on BYOD policies or cyber security concerns to assisting with information governance and litigation readiness, firms such as these are able to offer a more holistic and compelling proposition to their clients.
CASE STUDY Mobile Phone Seized at an International Airport THE CASE: CCL received a single mobile phone that was seized from a person importing drugs through a large airport. Whilst there was enough evidence in the fact that the woman was caught in possession of the drugs, the investigation team wanted to interrogate the phone to try and work out the supply chain. Upon initial examination of the mobile device, the examiner found minimal content on the handset. Most notably, there were no call lists and no SMS messages. Using a standard commercial tool we were able to recover and present all the live data shown on the device. Due to the nature of the case and the very high likelihood that the owner of the device would have attempted to hide data by deletion, we investigated ways to recover a fuller read of the chip data, bypassing the phone’s operating system and taking as much data from the device as possible. WHAT CCL DID: CCL’s R&D team devised a solution to obtain a full physical read of the flash chip, which involved a microscope and a steady hand. The R&D team worked with the investigating analyst to reverse-engineer the data stored in the chip read. This led to the successful extraction and presentation of deleted call lists and SMS messages from within the depths of the chip read. THE OUTCOME: The SMS messages served as crucial evidence as they not only detailed the whole act of importation, they also provided enough detail for the investigating authority to raid the premises of the person coordinating the supply chain, leading to further arrests. All of this was possible because of the experience of the analyst who knew exactly when to look deeper, and the resources available to him to carry this out.
3
INFORMATION GOVERNANCE UNDER THE SPOTLI There has been a noticeable increasing emphasis on information governance recently - something that we have covered in recent issues of Legal News. As the volume, velocity and variety of electronically stored information continues to rise rapidly, effective information governance has been seen as crucial for corporates and public sector organisations alike. Now the importance of information governance has been recognised as part of the revised Electronic Disclosure Reference Model (EDRM).
WHY IS GOOD GOVERNANCE NEEDED? General benefits of good governance include: • Delivers strong alignment between IT delivery and the organisation’s strategic objectives
2006
The EDRM has been in existence since 2006 and is used as a workflow framework for e-disclosure exercises, in conjunction with procedural obligations within the relevant jurisdiction(s).
• Provides high-quality and consistent information to support business decisions • Underpins operational excellence • Optimises costs • Contains risk at an appropriate level • Supports statutory and regulatory compliance
The recent revisions to the EDRM places the emphasis firmly on information governance and reiterates the fact that it permeates across all phases of the EDRM. Effective information governance at the start and throughout an e-disclosure exercise invariably results in more effective and efficient e-disclosure exercises.
The information governance square has been changed to a circle, reflecting its holistic nature and importance. The lines at the bottom of the EDRM have also been updated so that all phases of the EDRM, from identification to presentation, link back to information governance. This highlights the fact that no e-disclosure process can be said to be fully complete until it has been linked back to effective information governance.
4
As we’ve started to explore in recent issues, we will continue to focus on what constitutes effective information governance in upcoming editions of Legal News, and highlight the benefits enjoyed by those organisations who take a proactive approach to getting their house in order.
STAGE 1
ST
‘DEFINING SCOPE AND OBJECTIVES’
‘CA ON YO
Pre Information Governance
Identification
Co
VOLUME
IGHT IN THE NEW EDRM by Umar Yasin ASPECTS OF GOOD GOVERNANCE Governance generally
Information Governance
• Defined structure
• Clear record retention policy, reflected in all relevant processes
• Empowered decision making bodies with defined terms of reference
• Complies with specific statutory and regulatory requirements
• Clear and unambiguous accountability
• Clear record declaration policy, reflected in all relevant processes
• Clear policies, processes and procedures • Incorporates both proactive and reactive capabilities • Complies with general statutory and regulatory requirements
TAGE 2
STAGE 3
STAGE 4
APTURING NLY WHAT OU NEED’
‘FINDING SCREENING AND MARKING’
‘PREPARING FOR TRIAL’
Processing
eservation Review
Production
Presentation
ollection Analysis
RELEVANCE
If you need help or advice with your or your clients’ information governance needs, call us on: 01789 261200, email edisclosure@cclgroupltd.com or visit www.cclgroupltd.com
5
THANK YOU, MASTER WHITAKER by Umar Yasin
It is impossible to ignore the influence and contribution of Steven Whitaker, the former Senior Master and Queen’s Remembrancer, who was widely held in high regard by litigators and judges alike. It is also important to acknowledge the immense benefit that lawyers, both within this jurisdiction as well as right across the globe, from Singapore to the States, have derived from Steven Whitaker’s wisdom, experience and guidance on e-disclosure and related matters. As Queen’s Remembrancer, Steven Whitaker was the holder of an ancient judicial office, nearly as old as the office of the Lord High Chancellor, and presided over two of the oldest legal ceremonies, the Rendering of the Quit Rents to the Crown and the Trial of the Pyx. However, Steven Whitaker will undoubtedly be remembered more for his involvement with the development of procedural law around a recent phenomenon; how to deal with electronic evidence effectively, rather than the quaint and archaic ceremonial parts of his role that he also dutifully discharged since 2007. Steven sat on the Civil Procedure Rule Committee from 2002 until 2008. He also set up and led the Working Party that looked at how to deal with e-disclosure. Apart from his contributions to e-disclosure, Steven will also be remembered for the stellar work he did around mesothelioma claims, starting in 2006 when he assisted with drafting the amendments to the Compensation Bill, to reverse the decision of the House of Lords in Barker v Corus. He then went on to
6
establish the specialist mesothelioma list at the RCJ, and his practice on mesothelioma claims has been widely adopted across the world.
on active judicial case management as well as the specific judicial focus on e-disclosure given the new menu option under CPR 31.5A.
Steven Whitaker has provided an essential education in his judicial capacity to both the judiciary and lawyers on the importance of e-disclosure, and he will hopefully continue to impart his considerable knowledge and accumulated wisdom on this topic in a personal capacity too.
Goodale v Ministry of Justice is still certainly the ultimate example of how a judge that actually understands tools and techniques, is then able to ensure e-disclosure exercises are undertaken as effectively and as proportionately as possible. The Electronic Documents Questionnaire he pioneered in this case, which has since been formally incorporated into Practice Direction 31B and has also been explicitly approved by Lord Justice Jackson, still remains the basis for scoping e-disclosure exercises.
From the various tributes, both the personal and professional, the one that stands out most is from another leading early exponent of proper e-disclosure practice and procedure, Chris Dale. Chris has worked with Steven closely, whether as a member of the Working Party or by regularly sharing a platform at e-disclosure related conferences globally. Chris Dale makes two important observations on Steven’s contributions which deserve to be repeated. The first is the way in which Steven Whitaker pioneered preemptive, proactive judicial case management. This now seems as if Steven was acting almost presciently with the Jackson Reforms in mind, with the general emphasis
The final but most important observation that Chris Dale has put so eloquently that I make no apologies for quoting almost verbatim, is that Steven Whitaker’s greatest skill, and arguably the one that will be most sorely missed, was his ability in making procedure the servant of justice. And in doing so, Steven Whitaker has confirmed himself to be, in many minds, a great and worthy servant of justice himself.
THE REAL CSI: SOCIAL MEDIA INVESTIGATIONS by Sarah Turner Picture the scene: 19:23: The Lieutenant sits in his glasspartitioned office, gun holster slung over the chair, cigarette in hand, mug of now cold coffee on his desk. The sun sets over the city docks as he gazes into the middle distance. He has received some intelligence that one of Miami’s largest gangs are planning something. The Lieutenant and his team have been listening into their mobile phone calls, they have bugged their hideouts and even had an undercover agent infiltrate the gang. The Lieutenant is keeping an eye on the social media activities of some of the key players. Each time they login to their social networking account, the Lieutenant’s smartphone beeps giving him the location from which they have logged in.
In the lab the excessively tanned Technical Specialist is also monitoring the gang’s social media activity. Posts from target individuals pop up on the large wall-mounted monitor and automatically arrange themselves neatly in chronological order. It even brings back all posts, photos and messages that had been deleted. The Technical Specialist effortlessly swipes his hand over them, moving them together to indicate links between users and posts, and coded conversations between individuals involved, automatically and effortlessly building a spider diagram linking together the various gang members and themes of conversation.
They seem to be using code words in their posts the Technical Specialist reveals…
Recent posts have been referring to a ‘ball game’ on Saturday. I think they’re planning something big A 3D map pops up and zooms in on the location of the most recent posts. The Lieutenant dispatches his team of impossibly buff officers to go and investigate… Use of social media is growing year on year, and is becoming a more important source of evidence for a broad range of investigations – both criminal and civil. But is it this simple? Is there a difference between just monitoring what’s going on via social media and being able to use that information as evidence in a case? There are many reasons why someone may wish to monitor social media content. From corporates who are looking to protect their brand and reputation from the online actions of angry customers and disgruntled employees, to law enforcement trying to keep on top of major policing events and planned criminal activity (much like our friends in Miami in the story above). Civil matters such as fraud, online bullying, IP theft, defamation and even false misrepresentation may also be partially investigated via social media. There is a lot of intelligence that can be gained from social networking sites, and it helps to look further than posts alone. Useful intelligence can be gained from publicly available information. This can include: names, dates of birth, public posts and conversations, listed family and friends, the occupations/places of work of listed family and friends, photos, locations from where a user has posted from (if they have location
settings enabled), groups they are a member of. All of these can help build intelligence on an individual, their activities and their accomplices. Other data, which is not so easily accessible, such as metadata and IP addresses, can also help to shed light on an investigation. More potentially incriminating information may be found in private data, such as private messages and conversations. It is also possible to review historic posts. CCL has tools that not only monitor any relevant new posts or content that match the keywords set, but also go back over historic content too. These tools can go back to the point when a user account was originally set up, which may provide useful intelligence for a range of investigations from criminal activity to bullying and employee misbehaviour. As entertaining as the scenario in Miami is, it often takes a bit more planning, expertise and human input to get the best information out of a social media investigation tool, which obviously means that the process isn’t quite as swift and automatic as represented in the earlier story. This starts with intelligent selection of keywords to ensure that content of relevance will be picked up. Too few, and you will miss out on crucial intelligence, too many and you will be left with a lot of irrelevant information to sift through. Also, if the team in Miami wanted to use any of the social media information that they gained in court, then they would need to use a tool that not only searches and aggregates all the information from multiple sources, users, locations, etc. but does so in a way that defensibly preserves the information, in order to make sure the evidence would stand up in court. Again, this often means a more process-driven and proceduralised method than depicted on TV!
For more information on social media investigations or CCL’s other products and services, call us on 01789 261200, email edisclosure@cclgroupltd.com or visit www.cclgroupltd.com
7
ABOUT CCL CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we set up our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one accredited to the ISO17025 standard for our computer, mobile phone and Sat Nav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms to corporate clients. CCL has been in the e-disclosure market since 2009 and has completed over 220 e-disclosure cases to date.
Missed an issue of Legal News? Don’t worry, all issues are available on our website at
CPD C O ‘Social URSE Media and The Clo ud’ This co urse
covers to know what le when it gal eviden c o m es to u professionals ce, and sing need ob informa tion fro taining elect social media ronical m the c ly store loud. Deliver d ed by C CL’s inan und ho er legaliti standing of e use team, you vid es will gai n live de , collecting da ential oppor t monstr unities ta and ations , s and inv torage of s estigat a ion too ocial media m s well as ls. onitori CCL’s ‘ ng Social M e course covers: dia and The C loud’ C • Intro PD trai duction ning to soci • App a l media lication and the s • The cloud legaliti es surro eviden unding ce social m • Case edia study a nd dem onstrat ions
www.cclgroupltd.com
OUR SERVICES • Digital forensics and investigations - All operating systems - Smartphones/mobile phones - Tablets - Sat Nav analysis - Cell site analysis - CCTV analysis - Remote forensics - Social media forensics • E-Disclosure services • IT consultancy • Information security • Digital forensics hardware and software • Early case assessment tools • Data collections • Training • Search and seizure orders • Expert witness services
8
THE NUMBERS CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed: • • • • • •
220+ 4250+ 55000+ 2200+ 750+ 475+
e-disclosure cases digital forensic (PC) cases mobile phone cases consultancy engagements civil and criminal cases expert witness assignments
COMING UP NEXT MONTH: - Client-led vs outsourced e-disclosure - Disclosure - don’t get caught out by the deadlines!
For more information call Rob or Umar on
01789 261200 email: edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com