Ccl legal news issue 7 by CCL Group

CONSULTING

DIGITAL FORENSICS

E-DISCLOSURE

LEGAL NEWS Issue 7

www.cclgroupltd.com

PROPORTIONALITY ACROSS THE POND

There is a distinct American theme that runs throughout the entire e-disclosure market, from the actual software to the EDRM, the marketing messages of the major vendors, and the current discussion around predictive coding or technology-assisted review, all the way to the e-discovery Vs e-disclosure debate. Litigators, software vendors, judges and service providers over here, in the UK, have long looked to the States, whether for direction, inspiration or an appreciation of current e-disclosure trends, pressures and advances. So, how relevant is the American experience to us? What is different about the way litigators in the States deal with e-disclosure, and what are the similarities? Over the last couple of months the differing approaches to e-disclosure on both sides of the Atlantic seem to be slowly converging closer together. For the purposes of this particular article, the focus is on e-disclosure during litigation rather than an investigation; the approach to e-disclosure during a multi-jurisdictional FCPA or Bribery Act investigation, or a financial investigation involving the SEC and the FCA will be very different, and perhaps warrants a future article in itself. The Jackson Reforms in England and Wales have seen us adopt our own version of the American-style ‘meet and confer’ under Rule 26(f) of the Federal Rules on Civil Procedure. Rule 8 of Practice Direction 31B, which works in conjunction with Jackson’s new Rule 31.5A, places an obligation upon litigators to discuss, either by telephone or meeting, an approach to disclosure that meets the overriding objective, not less than seven days before the first case management conference. However, we are not yet seeing the drawn-out challenges on admissibility in this country, which are quite commonplace in the States.

IN THIS E

DITION.. .

> Propo rtion the Pond ality across > Thou ghts for th e month > Keyw ord searc hing > CCL’s e-disclosu re tools > Law 2 .0 > Voice processin g > Abou t CCL > CCL’s readiness courses

In a twist of irony, where Lord Justice Jackson seems to have taken the lead from the States on this issue, the States seem to be taking the lead from Jackson on proportionality. The Advisory Committee on the Federal Rules of Civil Procedure has recommended a narrowing of the broad scope that is currently within Rule 26(b)(1), which currently allows for ‘discovery of any non-privileged material that is relevant to any party’s claim or defense.’ The suggested inclusion of ‘and proportional to the needs of the case considering the amount in controversy’ seems strikingly similar to the new Rule 44.3(5) under the CPR in England and Wales, which outlines five factors to be taken into account when considering whether costs incurred are proportionate to the case. Minnesota’s amended Rules, which came into effect on 1st July 2013, already limit discovery with the caveat ‘must comport with the factors of proportionality.’ Further, where the existing Rule 1 mirrored its federal counterpart, in that it required the rules to be ‘construed and administered to secure the just, speedy and inexpensive determination of every action’, the amended Rule obliges courts and parties to ‘examine each civil action to assure that the process and costs are proportionate to the amount in controversy and the complexity and importance of the issues.’ This puts proportionality into the spotlight and ensures that proportionality, rather than defensibility, is the guiding principle. Both the Minnesota amendments and the mooted changes to the Federal Rules also introduce sanctions for parties that fail to cooperate in framing a disclosure strategy. Add into the mix the changing goalposts in both jurisdictions as far as the duty to preserve is concerned, whether it is the point at which the duty bites or the actual extent of preservation, and it seems that both jurisdictions are learning from each other.

JAMES LAWSON, e-Disclosure Analyst James joined CCL in May 2013 to support the growth of CCL’s established e-Disclosure Team. James works closely with CCL’s clients to complete all stages of the Electronic Disclosure Reference Model (EDRM), regardless of the case type - whether it is the review of one user’s email all the way through to the complete facilitation of a complex global exercise with multiple data types. James started out in the industry by completing a Computer Forensics degree and working at a leading forensic service provider specialising in GPS forensics and evidence handling. He then moved to a ‘Big Four’ accountancy firm as a member of the e-Disclosure Team, where he facilitated review cases on a daily basis and developed the leading voice processing solution in the UK. James enjoys providing solutions to clients’ problems rather than to sell a series of products, acknowledging that every client and case has different needs and preferences. One of James’s key priorities at CCL is to ensure that we have a solution for every client scenario.

James’s thoughts for the month There has been a clear message from regulators, particularly in the US, that they are very keen on reviewing the less formal methods of communication, such as voice communications and instant messaging. This has been highlighted in recent cases such as the LIBOR investigation, where these non-standard communication channels are more likely to be used by individuals to ask for favours or break rules, rather than the more formal, traditional methods of communication like email. As such, this information is increasingly being brought into the scope of investigations. Providing our clients with the services to collect, cull, search, review and produce voice and chat data is a must for our 2015 vision. As well as being able to offer the service, we must be able to provide it with a methodology that fits with the clients’ custom solution and make it easy for the client to review. This can be done because the way a reviewer reviews a sound file can use the same methodology as when they review an email or any electronic document. It is up to us as the experts to ensure this process happens as seamlessly as possible.

SELENA OLDHAM, Senior Digital Forensic Analyst Selena is one of CCL’s Senior Digital Forensic Analysts and has over eight years’ experience in casework for both criminal and civil cases. During this time Selena has completed more than 100 cases for both law enforcement and the private sector. Cases she has worked on range from murder and money laundering to ID theft, intellectual property theft and hacking. As well as being an experienced Digital Forensic Analyst, Selena is also a qualified Quality Assurance Lead Auditor with extensive experience and knowledge of the law and investigations. Prior to joining CCL, Selena was employed within the Trading Standards Service for 12 years leaving as a Senior Trading Standards Officer. Selena holds a Post Graduate Certificate in Forensic Computing, as well as a degree in law from the University of Central Lancashire and a Diploma in Trading Standards from the Department of Trade and Industry. In her free time, Selena enjoys sailing, salsa dancing and cocktail sampling.

Selena’s thoughts for the month I have recently been involved in a case for a corporate client who was conducting an internal investigation into employee misconduct. As with most cases, the analysis on this one was driven by keyword searching, to help the client find the documents relevant to the case. This case highlighted the importance of developing a targeted keyword strategy to ensure that you are not inundated with documents to review, yet do not miss any potentially crucial evidence. Getting the balance right is key. Ideally, we would have recommended that the client be as specific as possible with their keywords in order to reduce review time. However, the seriousness of this particular case meant that the scope of the investigation had to be very broad. As a result, the client had a list of around 100 keywords, many of which were quite broad, including things such as employee names. Searching all 100 keywords in one go would result in tens of thousands of documents for review, so we recommended a phased approach to keyword searching. Keywords were grouped into sets according to issue, such as all those related to a particular contract or activity. This allowed review to take place on an issue by issue basis, and helped the client to target their keyword strategy in the process. Each review phase would provide useful intelligence on whether future planned keywords were still relevant, needed tweaking or could be removed entirely. This made the whole process more efficient and reduced the final number of documents for review. The lesson to take away from this exercise is that the more targeted you can be when it comes to choosing keyword sets, the better. CCL has extensive experience in providing advice and guidance to our clients when it comes to keyword searching, and more tips are covered in Rob’s ‘Keyword Searching’ article on page 3 of this issue of Legal News.

KEYWORD SEARCHING by Rob Savage

In the vast majority of e-disclosure and digital forensic exercises that we undertake at CCL, the analysis is driven largely by keyword searching. There are, and have been for a number of years, many discussions within the field of e-disclosure about Technology Assisted Review (TAR) i.e. predictive coding, removing the industry’s reliance on keyword searching. I personally do not envisage a time when keywords are no longer required, I suspect that over the next couple of years TAR will be used on some projects, but keywords will still be the main driver of search and review. Given that keywords are such a fundamental part of an e-disclosure exercise, it is vital to get them right. Selecting a keyword set is often more of an art than a science. It is rarely possible to predict how many hits a keyword will yield, however an understanding of how keywords work and the profile of the data you are searching will help to avoid keywords that may yield too many documents to feasibly review. BELOW ARE SOME QUICK TIPS TO FOLLOW WHEN CHOOSING KEYWORD SETS: • Take time to understand the data you are searching – Avoid commonly occurring words or phrases. What may be a good keyword for one dataset may not be for another. • Be as specific as possible without being restrictive – The more specific the keywords, the better. However, overly restrictive keywords may result in key documents being missed, so a balance between the two is required. • Obtain indicative hit counts before starting review – Most tools will allow reporting on the number of hits to a keyword before loading the documents for review. Use this functionality and adjust keywords if the hit volumes are unexpectedly high or low. • Avoid large keyword sets – The more keywords you run, the more responsive documents for review. Large keyword sets may be appealing to create an all-encompassing population of documents for review, however you may find that this population is unwieldy. • Use wildcards – A wildcard is a character that can be substituted for other characters. For example a search for ‘Brib*’ would return ‘Bribery’, ‘Bribe’, ‘Bribes’, etc. These can help to accommodate for spelling and tense variations. • Use Boolean operators to target documents responsive to more than one keyword – Documents containing ‘payment’ may not be relevant but documents containing ‘secret’ AND ‘payments’ may be. Other operators include: NOT, OR, WITHIN and XOR. • Group keywords into sets – Either by priority or by issue, this can help focus the review process. • Be aware of ‘standard text’ – Check what words and terms exist in commonly occurring email footers and boilerplate terms and conditions. Select keywords that do not occur in these or all of the documents that contain the standard text will be presented for review. Some review platforms, such as Clearwell, allow you to exclude blocks of text such as email footers from the search, enabling you to use keywords that also exist in footers.

CCL’S E-DISCLOSURE TOOLS by Rob Savage WITHOUT PRE-PROCESSING

Data Volume

Data Universe

Targeted Collection Tool

Collected Data

Pre-Processing Tools Processing and Review Tools Processing and Review Tools

Production

TARGETED COLLECTION TOOLS It is not always possible to undertake a full forensic collection of data, especially in civil litigation. However there are best practices when it comes to the copying, moving and archiving of data which should be adhered to. Our analysts are able to advise on best practice and quality check the processes followed by your client’s internal IT teams. Where we are required to undertake a collection, we have a broad range of tools that allow us to collect data from almost any device. These include: • FTK Imager – A lightweight collection tool that can be used to create both full (physical) acquisitions and targeted (logical) acquisitions of data, from both servers and computers. • EnCase Enterprise – A collection tool that enables us to make targeted forensic copies of data remotely over a corporate network without the knowledge of the target custodians. • XRY – XRY is a reliable and highly respected forensic tool which supports a wide variety of mobile devices including mobile phones, Sat Navs and tablets. The software supports the recovery of ‘live’ and ‘deleted’ data from devices and is presented in a user friendly and clear format. • Cellebrite – Cellebrite can perform ‘live’ and ‘deleted’ analysis of a number of mobile devices including mobile phones and tablets. One of the main features of Cellebrite is that it can extract a ‘file system/file structure’ read from a device and will then display the evidence in the exact same way that it is stored on the device. Cellebrite is also an excellent tool for recovering ‘deleted’ data from mobile devices.

Time

WITH PRE-PROCESSING

PRE-PROCESSING TOOLS Pre-processing tools are designed to quickly reduce data volumes prior to loading into an e-disclosure platform. Some pre-processing tools on the market are charged on a per GB basis, however we have adopted a per day pricing model. The per day pricing allows us to undertake high data volume projects at a lower cost than had per GB pricing been applied. We were asked to undertake an e-disclosure exercise across 5TB (5,000,000MB) of data. Had all of this data been loaded straight into a review platform the cost would have been approaching £1 million in processing costs alone. By utilising a pre-processing engine we were able to undertake the exercise for tens of thousands instead. Our suite of pre-processing tools includes the following: • Nuix – Excellent for large volumes of data, Nuix is able to quickly index and search almost all commonly encountered data types, allowing us to rapidly cull out irrelevant data. Nuix is capable of loading all data sources at once enabling us to de-duplicate across exhibits. In a recent exercise we were able to reduce the volume of data that needed to be loaded into the review platform from over 11TB to less than 50GB using Nuix. • EnCase – Historically a tool for forensic practitioners, EnCase can be used for e-disclosure to reduce data volumes and recover previously deleted information if required. EnCase is an ideal pre-processing tool for smaller cases with fewer data sources, but can become labour-intensive on larger cases. Recently, we used EnCase to recover deleted information for inclusion in document review, in total over 1,000 previously deleted files were recovered. • FTK – Can be used in a similar capacity to EnCase. FTK indexes all data on adding to a case allowing fast keyword searching. FTK is ideal for use on cases with large volumes of emails as it is effective at maintaining document families such as emails and their attachments, which is often vital for the e-disclosure process.

PROCESSING AND REVIEW TOOLS Our suite of processing and review tools will initially process the data to enable de-duplication (where not undertaken at a pre-processing phase) and indexing of the data to make it fully searchable for review. This allows us to omit the pre-processing phase where data volumes are small, saving time and effort. All of our review platforms are fully hosted by us, taking the burden of managing the system away from our clients and enabling them to focus on the document review. We provide on-call analysts who offer both technical support and expert advice during the review phase. Our suite of processing and review tools includes: • Clearwell – Arguably the industry leading e-disclosure processing and review platform. Ranked as a ‘Leader’ in the 2013 Gartner Magic Quadrant for e-Disclosure Software, Clearwell offers a broad range of features, provided from within an intuitive, easy-to-use interface. Clearwell is charged on a per GB basis and can be accessed remotely on any computer through our secure encrypted portal. • FTK – FTK offers review functionality that can be effective on smaller cases. Review via FTK can be provided from our custom-built reviewing suites in our laboratory in Stratford-upon-Avon. The functionality is less than that of Clearwell and is limited to one reviewer per exhibit, however FTK is not charged on a per GB basis meaning that it can be a cost-effective solution in some cases.

CASE STUDY Stolen vehicles – is computer analys was asked to THE CASE: CCL ating authority assist the investig garding theft of in a legal case re vehicles destined high class motor erseas. As part of for customers ov crime syndicate, a well-organised ercedes, BMW vehicles such as M olen to order in and Lexus were st re then sealed we the UK. The cars shipped with in containers and perwork that did accompanying pa r true content. not describe thei r was One such containe port, and intercepted at a UK ed. The rm fo the police were in syndicate to a police traced the mpany, which freight shipping co ate business also ran a legitim emises were operation. The pr ter equipment raided, and compu ized. Two s se and paperwork wa in transit y ad re al ts en shipm d searched an were intercepted discovered s om whereupon Cust cles within further motor vehi e ships were Th . rs the containe to port. ordered to return CCL was WHAT CCL DID: lly examine asked to forensica removable d the computer an e premises, th m media taken fro ipping to identify any sh ich could be wh n tio documenta criminal activity. connected to this rd drive and The computer’s ha re forensically we removable media imaged files imaged, and the ined. Several am ex subsequently ents were electronic docum d substantiate ul wo found, which claim against the prosecution’s ese files were the defendants. Th e appendix ed th printed and form rt which was to a forensic repo hibit to the ex submitted as an en requested to court. CCL was th igating authority provide the invest mentation which with further docu the Crown was submitted to ice. Prosecution Serv After a two THE OUTCOME: CCL was asked ich week trial in wh idence, the jury to give expert ev ny directors and found the compa ilty. their associate gu

LAW 2.0

by Matthew Richardson, Barrister at Henderson Chambers Like the Wild West in the mid-1800s the internet in 2013 is the new frontier, and much like the Wild West, is a place where the law does not yet fully reach. Businesses and individuals face a series of challenges across a variety of media. How do you protect your intellectual property across multiple computer platforms being shared on mobile phones via bittorrents? How do you prevent your reputation being damaged via anonymous impersonation on social media? How do you ensure that your brand name is secure and prevent cyber-squatting on a similar domain? Twenty years ago, when most of the High Court Bench were in practice, the questions above had no meaning. The problems that exist now were not even dreamed of. There was no internet, no Facebook, no Twitter, and mobile phones were the size and weight of a house brick and capable only of making crackling voice calls. At Henderson Chambers we have been pioneering new and innovative techniques for enforcing legal remedies in the modern world. In 2009 we were responsible for serving the first injunction via Twitter to stop anonymous impersonation, a technique which has since been used dozens of times across social media in a time and cost-saving manner. Cases of anonymous impersonation are, nowadays, all too common on the internet. Usually, the person being impersonated would need to seek a Norwich Pharmacal order against the social media site, which could be located in a foreign country. This process is costly and time-consuming, sometimes taking months and costing tens of thousands of pounds. However it is now possible to serve an injunction via social media, requiring the perpetrator to reveal their identity to you and cease their wrongdoing. This method has been used time and time again to great effect. Very rarely are these ‘Blaney Orders’ ignored, but when they are, the standard Norwich Pharmacal approach can be taken in the knowledge that the ultimate cost will be borne by the anonymous party when they are finally identified, as a punishment for ignoring the first Order. The law still has teeth on the internet. The High Court has likewise shown a willingness to take high-tech steps in the regulation of bit-torrents and domain names, making orders which were previously unknown to the law in cases like AMP v Person(s) Unknown and Lifestyle Management v Frater. The frontier of the internet is not so lawless after all, and, if a problem does exist the High Court, with the aid of experts in law like Henderson Chambers barristers and experts in technology like CCL, will endeavour to find a solution which is capable of being implemented as quickly and as cost-effectively as possible.

VOICE PROCESSING – THE RELIABLE SOLUTION by James Lawson The need to analyse voice data has greatly increased over the past three years. Before 2010, the process of analysing voice data was to improve contact centre performance or in military tracking. Now it is part of many high-profile investigations, and what was alien to investigators in 2010 will become commonplace by 2015. Since 2010, financial regulators have looked to gather crucial evidence from less obvious sources, such as social media, instant messaging and voice data. In large financial cases such as the LIBOR investigation, evidence obtained from voice data has been crucial. From the fallout of these cases the key message from regulators is that they are very interested in voice and messaging data because people generally do not ask for favours or break rules over emails; they do so on chat and voice messaging systems. Investigators are also aided by the fact that most FCA regulated firms must record their voice data. The e-disclosure market has chosen two distinct paths to investigate and search voice data sound files. To do this we must ‘translate’ the data into something that computers can understand. Firstly, the reliable way is to transcribe the data. Secondly, the more risky route is to index the actual sound files. The transcribed data or the indexed sound file is then searched. Before we transcribe the data we can reduce the initial volume of data using two key techniques: 1. Firstly we can reduce the data by removing periods of silence (or quiet) from the file. This can be done as periods of a certain length and of a percentage of the volume. Removing periods of silence is useful as it quickly removes non-relevant data. 2. Secondly we can reduce the number of files by using the metadata. Metadata is information about the file, for example we could remove files of a certain length, created by a particular custodian or at a certain time.

The transcription option fits nicely with CCL’s tried and tested e-disclosure methodology. The process would be outsourced to a mutually agreed provider and the cost would be a transfer cost, which is estimated to be a small percentage of your review cost. Upon receipt of the transcribed files we can index, search and present them for review as if it was any other electronic data. You will be able to review these files alongside all of your case data. You will also be able to link these files into our pre-processing platform Nuix and our review platform Clearwell. Overall the risks involved with processing voice files using this method would be low. The alternative solution is to index the sound files. This process works by taking every sound character (phoneme). These phonemes are then searched; this method of searching is known as phonetic searching. In our experience this process carries much greater risk and costs. This is because the accuracy of keywords is based on the quality of keyword versus the quality of the data. Unfortunately, the volume of variables involved in generating the index (data) is too great to produce searchable data; variables such as: accent, language, volume at which they are speaking and in what tone, background noise, etc. Coupled with this, the keywords have to be of longer than average length to bring back successful results. This is because so many words sound similar. For example, a standard trading term ‘ones’ either appears in or sounds so similar to many other words. The output of these files cannot be linked with the standard EDRM process. All review platforms handle sound files particularly poorly and are expensive to load on a per GB basis as they are naturally large. In summary, at CCL we have so far chosen to process sound files via the transcription methodology. This is because it is accurate, cheap and reliable. In addition, the files can be added to a standard e-disclosure case with our clients experiencing no disruption.

For more information on voice processing, contact CCL on 01789 261 200 or email edisclosure@cclgroupltd.com

’ S S E N I D A E CCL’S ‘R COURSES

re they are know to ensu to ed ne s client ence are key: e what your d digital evid an a at d re These outlin whe se situations ready for tho R issues, yee issues (H lo p em • Litigation d an and vestigations loyee fraud • Internal in IP theft, emp t, en m ss ra policies, ha collar crime) other white ry requests • Regulato nce • Complia governance • Corporate the digital courses. As e es th er iv to del data (live on devices, tner with you se ar ti p er n p ca ex L e C C de th entified, erts, we provi w it can be id p ho ex d s ic an , ns re ce fo eviden aining on ) and digital rovide the tr p u yo ; ed ys and deleted anal ies and llected and mpany polic co n, io ct te preserved, co ro ata p plications, d the legal im procedures. ts, and those ur requiremen yo to er ed is m o educate oth s can be cust internally to ed us e CCL’s course b so ble. s. They can al ints are availa of your client and CPD po , rm fi ur yo n partners withi mises. or client pre rm fi w la e th on-site at usually held Courses are stigation requiring inve ude: t cl en in d s ci se in ur al o C tern onse to an in • First resp e (BYOD) ic corruption, ev D Own aud, IP theft, fr e ye lo p • Bring Your m (e vestigations • Internal in bullying)

CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we setup our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one accredited to the ISO17025 standard for our computer, mobile phone and Sat Nav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms to corporate clients. CCL has been in the e-disclosure market since 2009 and to date, has completed over 200 e-disclosure cases.

OUR SERVICES • Part 31 e-disclosure services • Digital forensics - All operating systems - Smartphones/mobile phones - Tablets - Sat Nav analysis - Cell site analysis - CCTV analysis

THE NUMBERS

• Collections

CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed:

• Part 25 search and seizure orders

• • • • • •

200+ 4,000+ 50,000+ 2,000+ 700+ 450+

e-disclosure cases digital forensic (PC) cases mobile phone cases consultancy engagements civil and criminal cases expert witness assignments

For more information call Rob or Umar on

01789 261200

email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com 8

ABOUT CCL

• Part 35 expert witness services

COMING UP NEXT MONTH: Bribery Act – Deferred Prosecution Agreements How to complete the ESI questionnaire

Missed an issue of Legal News? Don’t worry, all issues are available on our website at

www.cclgroupltd.com

Scan the QR code with your smartphone for more content.