CONSULTING
|
DIGITAL FORENSICS
|
E-DISCLOSURE
LEGAL NEWS Issue 8
www.cclgroupltd.com
THE SFO, SELF-REPORTING AND DPAS... IN THIS E
A ‘PECULIARLY BRITISH’ ARRANGEMENT
Deferred prosecution agreements, or DPAs, are set to arrive on these shores in 2014. The Serious Fraud Office has a consultation running until September and the Crime and Courts Act 2013 received Royal Assent back in April 2013, with Section 45 and Schedule 17 of the Act putting DPAs on a statutory footing. What is a DPA and how may DPAs affect the way corporate white-collar crime is dealt with? We will explore these and other issues in this and coming editions. A deferred prosecution agreement is an enforcement tool for prosecutors, and is essentially an agreement for a set period of time that results in the deferment of prosecution. DPAs are entered into by a prosecuting agency, such as the SFO or, in the States the DoJ, and a corporate; they are not available to individuals. Under
a DPA the corporate submits to the timetable and requirements imposed by the prosecutor, such as financial penalties, implementing or improving internal compliance procedures, paying compensation and paying the prosecutor’s costs. There are to be some important differences to the proposed ways in which DPAs will be governed, compared with the States, which, in the words of the Solicitor General, would make them ‘peculiarly British.’ For a start, a British corporate entering into a DPA would not automatically waive legal privilege. DPAs in the UK will have to be overseen by a judge, who will ultimately decide whether a DPA was ‘in the interests of justice’ and ‘fair, reasonable and proportionate.’ This is to perhaps ensure that UK-style DPAs do not suffer the same perceived lack of transparency that DPAs stateside suffer from.
DITION.. . > The SF O, selfreporting and DPAs > Thoug hts for the month > Costs budgetin g > Comp leting the EDQ part 1 > Fox-IT Tracks Inspector > The re al CSI > About CCL > CPD c ourse
The SFO has also made it clear that DPAs are to be a discretionary tool; corporates have no right to request a DPA, and an invitation to discuss entering into a DPA is no guarantee that a DPA will be offered. There is to be a two-stage test, evidential integrity and public interest, and the SFO’s draft Code states that a prosecution will usually take place unless there are public interest factors against it. Much has been said recently about the perceived sluggishness of the SFO to deal with any significant cases postBribery Act 2010. It could be that the SFO is waiting for DPAs to become a reality, and then use its newly-gained enforcement tool to deal with these cases. With resources under constant pressure, the SFO must be hoping for a rise in self-reporting and selfinvestigating by corporates, which could then be dealt with using a DPA.
1
JAMES MAXWELL, Senior Account Manager James joined CCL after gaining five years’ experience working in the Legal IT industry at Merrill Corporation. James has previously worked on many high profile cases on behalf of the CPS, SFO and FCA providing consultative solutions to clients on a range of pre-trial and trial IT services within the Criminal, Regulatory and Commercial Litigation Sectors. James’s key priorities at CCL are to focus on building relationships with law firms involved in all aspects of litigation, whether that is in respect of commercial disputes, employment, intellectual property, competition or regulatory matters. James helps clients to understand and identify their digital forensic and electronic disclosure requirements, particularly in light of the costs capping and proportionality changes ushered in earlier this year.
James’s thoughts for the month The amount of digital data that exists today is so vast, it is estimated that the volume will double again within three years, with the average person generating 10 megabytes of data per day. This is particularly interesting in light of the Jackson Reforms, which require litigants to be more efficient when collecting and reviewing data so that the costs are proportionate to the dispute. It is therefore imperative that lawyers are able to advise their clients on the best practices for data collection and analysis given that over 90% of documents in business are created and stored electronically, and almost 70% of documents produced by companies are never actually converted to hard copy. So if our clients can be guided in how to manage their data more efficiently from the beginning, then the process of electronic review and disclosure will be far less daunting when presented with several terabytes of data for a relatively small claim. At CCL, we understand electronic data and provide a targeted collections service to ensure you only get the evidence you need and want, saving you time and money. Additionally our e-disclosure approach is underpinned by our digital forensics best practice, guaranteeing that no crucial data is overlooked or compromised during the e-disclosure process.
VICKI HEMMING, Client Projects Executive – Forensic Solutions As a member of CCL’s Client Projects Executive Team, Vicki is responsible for the administration of all aspects of CCL’s digital forensics cases for law enforcement and criminal defence clients. She also coordinates projects for corporate and civil law firm clients. Vicki has been with CCL for a year and a half. Her key responsibility at CCL is to respond to client enquiries regarding proposals for digital forensics. Vicki has previously worked as a Legal Assistant within a solicitors firm, dealing mainly in Criminal Law but also providing a helping hand in court within employment cases. In June 2012, Vicki achieved a Bachelor of Law degree and uses her legal knowledge and experience to better understand the requirements of both CCL’s criminal and civil law clients.
Vicki’s thoughts for the month From my experience of working for a solicitors firm I have developed a clear understanding of the importance of tight timescales and looming court dates. So, regular communication with clients and ensuring they receive an efficient and accurate service from CCL are an essential part of my role as a Client Projects Executive. Upon first contact with a client, whether they are new or if we have worked with them before, I help to establish their needs at a detailed level and what is required to assist in their case. The more information received from the client at this first point of contact will assist in a full and accurate proposal being produced, detailing the technical scope of what is required to be completed by our experts. From initial contact with a client, I aim to have a proposal drawn up and sent out within 24 hours to avoid any further delays to the case.
2
COSTS BUDGETING LIFTING THE EXEMPTIONS? by Umar Yasin As most readers will be aware, the run-up to the 1st April Jackson kick-off date saw some frantic last-minute changes, especially to the extent that high-value cases would be covered by the costs budgeting regime. Jackson LJ had originally called for the Commercial Court to be exempt from mandatory costs budgeting. In his report, he had mentioned that the large commercial entities that tend to litigate in the Commercial Court were ‘unconcerned’ about the level of costs. An eleventh-hour intervention by the judiciary meant that any TCC, Admiralty and Mercantile cases worth supra-£2 million would also be exempt from costs budgeting, in order to avoid litigants ‘forum-shopping.’ At the time the exemptions were announced, a commonplace cynical view was that the courts were not interested in interfering in the way large multi-national corporations or feuding billionaire oligarchs conducted litigation. For some, as foreign litigants were already showing a willingness to incur additional legal costs by choosing to use the English courts as a forum in the first place, any mandatory costs budgeting in these courts would risk deterring these foreign litigants from using our courts. A sub-committee was set-up by the Civil Procedure Rules Committee to review these blanket exemptions, which, at the time of writing, has just closed its consultation on the matter, and is due to report back to the Committee in October. The initial view of the sub-committee has been to suggest that a ‘blanket ban is inappropriate’, as courts have the power to exempt a specific case from costs budgeting, if it is felt that costs budgeting in the particular case would be inappropriate. There have been some forthright opinions expressed by some of the litigators that represent the largest litigants. The City of London Law Society’s Litigation Committee responded that ‘there is no evidence that automatic costs budgeting is either needed or wanted in commercial litigation of the sort conducted in the Commercial Court.’
CASE STUDY Identification of a suspect – CCTV analysis THE CASE: CCL was asked to analyse some CCTV footage which was to be key evidence in a drugs case. The police investigator originally wanted to use the footage to identify a suspect by his facial features, but the quality of the film was too poor. Unfortunately, the images were also too low resolution to be used to identify and match the suspec t’s clothing. WHAT CCL DID: CCL’s CCTV expert re-examined some known foo tage of the suspect and noticed tha t he had an unusual and distinctive gait. The analyst took frames from the known footage that highlighted the suspect’s legs and feet, and did the same with the CCTV exhibit footage. In this way, the analyst provid ed comparative still images to sho w the similarities between the legs and feet of the known footage and in the CCTV footage. CCL’s analyst also edi ted several sequences to show side-by-si de, to highlight the similarities of the unusual gait between films. THE OUTCOME: The suspec t initially denied that he was the subjec t of the CCTV footage – and continu ed to deny his presence throughout the interview stages. But when police sho wed him the gait comparison film – he ple aded guilty. By finding an alternative solutio n to the police force’s problem, CCL helped to avoid a costly and lengthy tria l.
The sub-committee’s views are keenly awaited; it has itself made clear that it will explore the effect of lifting the blanket exception ‘on the willingness of commercial organisations in international transactions to agree upon the jurisdiction of the Courts of England and Wales.’ With the rise in foreign litigants, especially those from the CIS (something we covered in Issue no 6), it is essential that the Committee strikes the right balance between the need for certainty and consistency across the courts and the need to ensure that litigating in English courts remains the most attractive option for foreign litigants. Previous issues of Legal News can be downloaded from www.cclgroupltd.com
3
COMPLETING THE ELECTRONIC DOCUMENTS QU ters n it comes to mat final position whe involving ESI. ates: dance Note 4 st For example, Gui tronic estions in the Elec ‘Some of the qu only stionnaire require Documents Que be hich may need to a brief answer w ents um oc D Electronic elaborated after d. ge an ch ex promotes early nnaires have been io Q st ED ue e Q th t to ou is • Filling ch questions the requirements The purpose of su entifying the points consideration of is th in id e exercise. Doing assist the parties der and scope of th d elaboration in or an ire ce qu du re re ay to m s lp ch he hi w e take place at an early stag ful discussions to ng ni ea m r fo control costs. between them.’ e es th the EDQ explor states: ‘Further • Exchanging of early de uidance Note 3 si G r he nd A ot e th of e to parties’ expectations pected facts and matters may com ex un t en ev pr e course of the on. This can help attention over th changes in ly st co answers to lly ia nt te and po which affect the s ng di ee e. oc lin pr e ionnaire. wn th ocuments Quest scope further do the Electronic D ation is not yet of a re detailed inform s he si W ba e th is Q ED e Electronic • A completed third available at the time th lp he n ca d an t is first scoping documen ts Questionnaire en ve gi um to oc D re su lo sc ve such of e-di parties should gi , party providers ed er sw an lement timates. ey can, and supp accurate cost es information as th he furt r eir answers when th d en am or a r s should e EDQ can offe available. Answer is n io at r rm • Completing th te fo in ea ies e and lead to gr tifying other part no by d te da tactical advantag up . re d in be su t undue delay, an e terms of disclo ou ith w t ur co e th t influence over th and case managemen ch ea re fo be t en any ev a sure is likely to article I have had ce at which disclo en er nf co Since writing this rs sions with lawye be considered.’ number of discus t this ou ng lli fi of es iti al d into two about the practic a copy it can be aire itself is divide ng nn di tio oa es nl w qu e do n Th form. O twenty nine pages and sections: quite daunting; tronically ec el t ou ab ns three questio ality it disclosure n. However in re • Part 1: Your stored informatio . re of other ar pe ap 2: The disclosu may first it rt as Pa lt • cu ffi di as is not e parties n of the Guidanc A quick inspectio s ve gi Q to the ED Notes attached cus on Part 1. ses, is issue, we will fo that your respon th e In nc ra sue. su as re e som rt 2 in the next is Pa do not , at te ok ra lo cu ill ac w e be W whilst needing to your client’s be to ve ha ily necessar
article ths ago I wrote an on m of r be m nu A give t the EDQ, or, to ou ab s ew N l ga for Le is article Form N264. In th it’s official name: e time nefits of taking th I covered the be ctive cument as a proa do is th t ou ll fi to ise: step. To summar
4
UESTIONNAIRE
by Rob Savage
PART 1: YOUR DISCLOSURE Part 1 deals with everything to do with your client, their data and the processes you, as the instructed solicitor, are going to follow to identify the documents to disclose. This part can be further divided into five areas: 1.
Questions 1-5: Extent of reasonable search. These questions are designed to scope the client’s ESI estate and to establish not just what and where relevant ESI exists, but also what (if any) date range and custodian restrictions can be applied. Answering these questions will require assistance from the client’s internal IT function. Be mindful of your suggested date range and custodian list. Explore with the client how data is backed up and how long the backups are kept. It is possible that your date range or custodian list will exceed what is available in the live system.
2.
Questions 6-9: Method of search. The purpose of these questions is to allow you to outline your proposed approach to searching and reviewing your client’s data. While this strategy is something that is defined by and affects you rather than your client, it is important to take into consideration factors such as the likely volume of data, timeframes/deadlines and the type of data involved. Try to find examples of previous cases of a similar nature to see what approaches are suitable and consult with an e-disclosure provider who will be able to comment on candidate strategies. Choose keywords carefully. Overly broad keywords may yield large volumes of documents to review, whereas overly specific keywords may miss vital documents and/or be challenged by the other side. The following articles from previous editions of Legal News may be of help: a. b.
3.
‘Keyword Searching’ in Legal News, issue 7 ‘Predictive Coding’ in Legal News, issue 3
Questions 10-12: Potential problems with the extent of search and accessibility of Electronic Documents. These questions address a number of issues and allow you the opportunity to caveat the information provided in the first nine questions. Question 10 asks if any of the data sources identified in the responses given so far raise questions of proportionality. When answering this, take into account factors such as: • • • •
The volume of data you will encounter – how long is it going to take you to review? The complexity and type of the data – will it be overly complex or expensive to review? The ease of access – will it take a long time or be overly expensive to collect/collate? The likelihood of discovering relevant information – is it likely to be a waste of time, money and effort?
When answering question 11, it is worthwhile finding out if your client uses any specialist encryption software. Even if they do not, the standard version of Microsoft Office now allows a user to encrypt files, so it is feasible that this will be an issue regardless. 4.
5.
Questions 13-14: Preservation of Electronic Documents. Question 13 is about document retention policies and is something that will be specific to your client. It is also possible that there will be multiple document retention policies for different areas of the business. Identifying those which are relevant will depend on the data sources identified in the first section. Questions 15-17: Inspection. These questions relate to how you are going to provide the other side with the output from your e-disclosure exercise. There are a number of ways that data can be produced, the most appropriate will be dependent not only on the volume and type of data involved in the exercise, but also on how the other side are intending to handle it. Speak to an e-disclosure provider to understand the options available and the respective advantages and disadvantages.
In the ne xt issu News, we e of Legal will look at Part 2 of the EDQ – th e disclosure of other parties. If you wo uld like m or informat ion or ne e assistanc ed e in com pleting the EDQ , CCL on 0 please call 1789 26 12 or email edisclosu 00 re@ cclgroup ltd.com
5
FOX-IT TRACKS INSPECTOR: PROPORTIONATE EARLY CASE ASSESSMENT CAPABILITY – IDEAL FOR SMALLER CASES At CCL, we have invested in a new early case assessment tool from Fox-IT. Initially designed for senior investigating officers and other non-technical investigators within police forces, Tracks Inspector represents an opportunity for legal teams. When it comes to smaller cases, many e-disclosure services and solutions can seem disproportionately costly. At CCL, we have been working to ensure that we have a solution that matches your clients’ requirements and budget. Our range of tools and technology means we can support large cases with high data volumes as well as smaller e-disclosure exercises and anything in between, using the most appropriate tools for the case and tailoring our service to the scope of the exercise and budgetary constraints – a solution for every case and budget. Originally developed in The Netherlands and tested by the Dutch Police, Tracks Inspector is an early case assessment tool that could support digital data investigations where there are a number of PCs or laptops involved. The key to controlling costs lies in carefully selecting what to process and culling down data for review. By using Tracks Inspector, lawyers can quickly and easily get a very early initial view of the data that has been collected from multiple custodians and devices, on a system that is designed specifically for non-technical users. By using your knowledge of the case to identify the relevant documents, you can reduce processing and review costs further down the line. You can see a snapshot of volume and relevance early on in a case, and get an indication of the volume of data to be processed. CCL works closely with lawyers at this stage, honing details of custodians, date ranges, file types and preliminary keywords in order to ensure that only relevant data is selected for processing. Tracks Inspector can be accessed via a web browser, allowing lawyers to access the same data, share links, add comments to data, and collaborate from different locations at any time. Tracks Inspector is purely an ECA tool. So while not intended to replace laboratory-quality solutions such as FTK, EnCase, Clearwell and others, Tracks Inspector provides early case assessment for a minimal cost, which is ideal for smaller cases where large e-disclosure tools may not be proportionate.
For more information, please call CCL on 01789 261 200 or email edisclosure@cclgroupltd.com 6
CASE STUDY ‘Clean and dirty’ phone analysis in a drugs case – cell site analysis THE CASE: Many criminals will use two mobile phones: known as the ir ‘clean’ and ‘dirty’ phones. The clean ph one is their everyday phone used for leg itimate means. The dirty phone is used for the commission of crime. Cell site analysis is use ful in proving that these two phones were tra velling together, hence attributing an individ ual to a phone used in criminality. In this case, police raided a number of premises as part of an invest igation into large scale organised drug dealin g. A number of mobile phones were seized , the contents of which were subsequently analysed. This showed a handful of commo n phone numbers which were either called by, or called, the seized phones. However, the phones bearing those numbers of interest we re not found during the raids and it was unknown at that time to whom they may be long. Some time later, police were given a name of a potential suspect in the cas e, and the enquiry took a different direction. As part of this, his mobile phone was examined and the call data records obtained. WHAT CCL DID: The police called in CCL’s cell site experts, who analysed the call data from the suspect’s phone in con junction with the data records already obtain ed. The aim was to analyse whether the phone s were moving together with the suspect’s legitimate phone. They paid particular attention to the patterns of usage – where phones we re used first thing in the morning and last thin g at night. They also analysed the location in relation to the suspect’s workplace, home address and other notable locations in the inv estigation. THE OUTCOME: By carryin g out measurements at all these locations, it was possible to assess the movem ent and areas of common usage of the ph ones which were prevalent in communic ation about the drugs operation. In additio n, CCL was able to take concerns raised by the defence cell site expert, and prove scientifi cally that their claims were not valid. CCL was able to link the ‘clean’ and ‘dirty’ phones by showing that the probability of their observed movements was infinitesimally small if they had been moving randomly and controlled by unconnected individuals.
THE REAL CSI: CELL SITE ANALYSIS by Rob Savage PICTURE THE SCENE: 10:15am in a modern, glass-partitioned office in Miami. Two good looking and heavily tanned individuals gather around a desk, their figures lit only by the reflective glow of the large flat screen monitor which is the focus of their attention. In the background yet another unusually good looking individual walks by with a box labelled ‘body parts’ while another is painstakingly re-assembling bullet fragments. The first of the two tanned individuals begins typing.
We know that the suspect used two mobile phones Right replies the second, as she flicks her hair and shows off her impossibly white teeth.
and we know that his first mobile phone was at the harbour at 9am… With a brief flurry of keystrokes a map appears on the screen and a flashing green dot identifies the harbour.
all we need now is to overlay the position of the second device… Another flurry of keystrokes follows and a hexagonal grid appears over the map on the screen. At first, all of the cells are highlighted but iteratively they begin to disappear. The tension (and dramatic music) builds as the possible location of the second device is narrowed down until...
That’s our guy! He’s at the harbour!
Is this the world CCL works in? Unfortunately not. For a start our pool car is an Astra and employees are encouraged to drive safely and responsibly in the car park. The world of CSI is an extreme dramatisation of the real world of forensics, however quite often the analysis they conduct has its roots in the real world. Take the situation above; although this is very ‘Hollywood’, the need to establish the geolocation of a device over time and compare this with the geolocation of a secondary device is a very real requirement and one which our cell site team are regularly faced with. In reality, the process of cell site analysis takes longer than five minutes and requires an in-depth understanding of the way mobile phone networks are built and operate. Start to finish, an exercise of this nature would take anywhere from 2 to 22 days and would require the mobile phone networks to send over data detailing the cell towers a device has connected to. The expertise lies in interpreting this data and taking into account factors such as terrain and structures that will distort the service area of the cell towers, all of which has to be done in a defensible, documented and repeatable manner. Not something achieved in seconds by simply typing a few commands into a flash computer.
Look out for next months real CSI article, when we take a look at PC forensics. For more information about cell site analysis or CCL’s other products and services, please visit www.cclgroupltd.com or call 01789 261200.
The two grab their guns, rush out to the car park and jump into a Hummer, speeding off in a cloud of smoke and burnt rubber.
7
ABOUT CCL
OUR SERVICES THE NUMBERS
CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we setup our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one accredited to the ISO17025 standard for our computer, mobile phone and Sat Nav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms to corporate clients. CCL has been in the e-disclosure market since 2009 and to date, has completed over 200 e-disclosure cases.
Missed an issue of Legal News? Don’t worry, all issues are available on our website at
www.cclgroupltd.com
COMING UP NEXT MONTH: Completing the EDQ part 2 Legal process outsourcing
For more information call Rob or Umar on
01789 261200
email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com 8
• Part 31 e-disclosure services • Digital forensics - All operating systems - Smartphones/mobile phones - Tablets - Sat Nav analysis - Cell site analysis - CCTV analysis
CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed: • 200+
e-disclosure cases
• 4,000+
digital forensic (PC) cases
• 50,000+ mobile phone cases
• Collections
• 2,000+
consultancy engagements
• Part 25 search and seizure orders
• 700+
civil and criminal cases
• Part 35 expert witness services
• 450+
expert witness assignments
Scan the QR code with your smartphone for more content.
CPD C OURS E ‘Electr onic e videnc and ee disclo CCL p sure’ ro cover vides CPD everyt course hi s e
n lectro f nic ev g you need or lawyers. id stored T t inform ence and d o know abo hese isclosu ation. ut re of e lectro Delive nically red by course our in -hous will gi e v electr onic e e you an u counsel, ou nde vid rC and yo ur clie ence and it rstanding o PD s impl nts. ication f s for y CCL’s ou ‘electr onic e course v i dence co and e • Intr vers: -disclo oduct sure’ ion to e-disc electr l o s o u nic ev re • Pra idence ct and • Con ice Directio n 31B trollin and th g cost • Too s e EDQ ls • Key and techni ques cases