CONSULTING
|
DIGITAL FORENSICS
|
E-DISCLOSURE
LEGAL NEWS Issue 9
www.cclgroupltd.com
PARALEGALS, PREDICTIVE CODING AND PROPORTIONALITY PRESSURES by Umar Yasin
IN THIS E
DITION.. .
> Paraleg als, predic tive coding an d proportio nality pressures > Though ts for the m onth > Life ou tside the M 2 5 > Comple ting the E DQ – Part 2 > The Re al CSI > About CCL > CPD co urse
Offshoring, nearshoring and onshoring. Legal process outsourcing (LPO) currently comes in many forms, and it is no longer the preserve of the larger City firms, nor is it confined to outsourcing disaggregated transactional-type work, such as M&A due diligence or contract review. As can be seen from the nascent trend towards nearshoring or onshoring, engaging with an LPO provider is also no longer a choice between sending work to paralegals based in South Africa, India or the Philippines. In fact, it seems that the current conundrum for some law firms is whether to use a lower-cost paralegal centre in UK locations such as Belfast, Glasgow or Manchester or in nearshore locations such as the Isle of Man or Poland. Offshoring is what usually crops up in the mind of most lawyers when thinking about LPO; sending disaggregated and commoditised legal work offshore to e.g. India or the Philippines, in order to save costs. Onshoring is a similar initiative to cut costs, whereby law firms open up a low-cost paralegal centre elsewhere in the UK, such as Herbert Smith in Belfast, Mills and Reeve in Norwich or Addleshaw Goddard in Manchester. Nearshoring is looking slightly further afield than your own immediate borders,
but still within the confines and comfort of the EU perhaps. We at CCL are acutely aware of the general downward cost pressures that lawyers are facing, and have seen closely the increased interest amongst litigators in exploring the use of LPO for disclosure exercises. Generally, law firms and in-house legal teams have long been aware of the need to have a cost-effective method of dealing with routine transactional work. Specifically for commercial litigators, the new era of proportionality and/or costs budgeting that has been ushered in by the Jackson Reforms means that litigators are also actively looking for ways to control costs. This surge in interest for LPO alternatives to the usual way of reviewing documents during litigation is to be expected, particularly as the LPO route has become a well-trodden path in transactional legal areas. The overwhelming proportion of costs during the vast majority of disclosure exercises has always been in the document review phase, whether during electronic disclosure exercises or purely paper disclosure exercises. So it is not surprising that many litigators are looking at alternatives to traditional review, such as using an LPO provider for managed review.
With the emphasis now firmly on proportionality, in a particularly document-heavy dispute, what do you do if there are tens of thousands of documents that need to be reviewed, whether for relevance or privilege, and the cost of just the review process by paralegals or junior lawyers is £1.2 million but the entire quantum is no more than £10 million? How proportionate would that be? Or, if your case is caught under the costs-capping regime, how can you persuade the court that your figure in Form H is proportionate, where just to review, mark for privilege, redact, produce and exchange documents is estimated at £80,000 but the claim itself is worth no more than £925,000? There are infinite variations on the above scenarios and this is a situation that more and more litigators are finding themselves in, with the pressure to control costs coming from courts and clients alike. In some of these situations outsourcing the document review process to an LPO with a team of properly-qualified and suitablyexperienced paralegals could prove to be a cost-effective solution. Continued on page 6…
1
RICHARD OLEJNICZAK, Digital Forensic & Investigations Team Manager Richard is one of CCL’s Digital Forensic & Investigations Team Managers with over nine years’ experience in conducting digital data investigations. Richard has completed well over two hundred investigations and has given evidence in court on numerous occasions. Richard graduated in 1995 from Coventry University with a BSc (Joint Honours) in Computer Science and Geography. He then joined the IT consultancy division of the business before moving over to digital forensics in 2004. Richard has worked on the full spectrum of cases, from employee fraud cases through to murder investigations.
Richard’s thoughts for the month Much has changed since I started in digital forensics. Back then, we could be given several weeks to analyse a single computer case comprising a 40GB hard drive. One of the challenges we now face is big data sets; not just the amount of data to process, but its numerous potential sources, its complexity and the rate it is generated. This presents challenges in terms of collection, analysis and presentation, and is why we have developed our early case assessment and e-disclosure services to provide the latest processing and review technologies and methodologies to be able to respond quickly and effectively. In my team a key part of our job is also to build client relationships and understand their requirements, ensuring that the work is done efficiently and proportionately without compromising quality. A recent example demonstrates many of these principles. The case involved the examination of laptop computers for evidence of fraud. The data was processed using a typically proportionate stage one approach; filtering in common document types, emails, internet cache and filtering out unknown system and program files. The client was then invited to review the data which was driven by a keyword search strategy. The results of the initial review were disappointing, with little of evidential value found. Following further discussions with the client we examined the forensic images. This activity identified a number of mobile phone backup files which were initially overlooked by the reviewer. Aided by specialist software developed by our in-house R&D team, we were also able to associate internet form data with internet history records. These reports were provided for the client to review. The results provided firm evidence to support the client’s suspicions and also identified weaknesses in their current IT security policy.
DOUG PINNEGAR, Forensic Solutions Manager Doug has been with CCL for over five years and is an experienced digital forensic analyst with an extensive background in mobile device forensics and digital investigations. He has worked on a large range of cases covering offences such as assault right through to large scale drug importations and VAT fraud, where avoidances have reached millions of pounds. His time at CCL has been spent within the Mobile Devices Lab where he led the team and managed the key client accounts. Doug now focuses on the e-disclosure division of CCL, supporting the technical delivery of projects with responsibilities covering technical infrastructure architecture, account management, project management and assisting on sales proposals.
Doug’s thoughts for the month The world of digital investigations is an ever-changing one. We are rapidly seeing a real shift towards cloud computing in the personal world, yet an influx of storage devices in the professional world. BYOD is drastically changing the way that people work and the communication mediums they use to do so. People are storing more and more data on devices and you should be prepared to deal with this change. In a corporate environment that has BlackBerry devices you might find people communicating over BlackBerry Messenger rather than email for certain topics. You certainly won’t recover that information by simply checking the emails on the corporate server. In order to do the best job you can for your clients you should have a real grasp of the technological landscape. Understanding where data used to be stored is not as helpful as understanding where data is now stored, and having a good idea as to where it’s going to be stored in the future. But at the same time, you should also understand what data is relevant and what data is not going to assist the investigation; just because there is more data around does not mean you need to investigate all of it.
2
LIFE OUTSIDE THE M25 by James Maxwell
CCL resides in the heart of the country, Warwickshire, which is one hour and fifteen minutes from London, less than forty-five minutes from Birmingham and two hours from both Manchester and Leeds. The proximity to these legal hubs means that CCL has been able to foster various relationships with many leading law firms across the country, therefore being able to offer our clients a national presence for a variety of solutions and services. CCL also has a number of strategic partnerships, such as those we have in place with Fujitsu, Kinetic Partners and Legastat. This partner network enables CCL to access offices and resources across the UK and right across the globe. We offer trial bundle preparation with Legastat, who are experts in reprographics and specialist litigation support for the legal sector. Legastat provide a range of legal document management services, such as copying, printing, scanning, digital archiving, media duplication and conversion. Legastat’s client base includes top 200 law firms, corporations, government agencies, small to medium sized enterprises and sole practitioners. Additionally, CCL’s strategic partnership with Kinetic Partners allows us to work closely with a leading professional services firm focussed on the financial services sector. This gives CCL access to a full range of regulatory consulting, compliance consulting, tax, forensic, risk and assurance services for its client base. Specifically, Kinetic Partners’ Forensic and Dispute team also offers a range of forensic accounting services, including litigation and dispute advisory services, financial, regulatory and due diligence investigations, fraud and financial crime prevention, restructuring and bankruptcy forensic services. Both Legastat and Kinetic Partners support CCL’s focus on the e-disclosure market by giving us access to potential e-disclosure opportunities within their client bases and by enabling us to offer a more broad range of litigation support services. This means that CCL can compete with the likes of the ‘Big 4’ and other large providers, as we are able to offer an end-toend e-disclosure solution and seamless ‘one-stop shop’ approach, whilst focussing on our core competencies and remaining cost-effective. Similarly, our commercial partnership with Fujitsu for the resale of forensic workstations means that we have access to this world-class highperformance information technology manufacturer’s offices based in the UK and worldwide, which are ideally positioned for meetings and scoping exercises. CCL is already seeing the benefits of these successful partnerships and we have won business as a result. They continue to provide good collaborative opportunities for all our clients now and also in the future.
CASE STUDY Drugs – mobile phone analysis THE CASE: A man was arrested under suspicion of possession and supply of Class A drugs. His mobile phone was seized by police and sent to be analysed. A number of incriminating text messages were recovered from his mobile phone as well as some phone book entries which linked him to other suspects. WHAT CCL DID: CCL was employed by the defence team to investigate the claims made by the prosecution and to identify any further information which may be relevant to the case. CCL’s analyst was able to find deleted text messages within the suspect’s inbox, which were not recovered during the initial analysis. THE OUTCOME: The deleted messages recovered by CCL’s analyst indicated that the drugs had in fact been purchased for personal use, and therefore the suspect received a reduced sentence.
So life outside the M25 isn’t always as it may seem. With strategic alliances based in the cities, CCL can offer a fantastic end-to-end service without being weighed down by the overheads of a London-based location. In the post-Jackson era, any cost savings for your clients will be seen as a very positive step forward.
Check out our partners’ websites for more information on their services: www.kinetic-partners.com www.legastat.co.uk www.fujitsu.com
3
COMPLETING THE EDQ – PART 2: THE DISCLOSURE O
te an article for Last month I wro t the Electronic Legal News abou stionnaire or Documents Que al name, Form to give it its offici le I covered the N264. In this artic the time to fill benefits of taking t as a proactive out this documen ovided some step and also pr on things to guidance notes lling out Part consider when fi nnaire entitled 1 of the questio . To recap, the ‘Your Disclosure’ g proactive benefits of bein Form N264 are when filling out as follows:
EDQ is • A completed oping the basis of a sc n assist document and ca ers of third party provid ve accurate gi e-disclosure to cost estimates. e EDQ can • Completing th vantage offer a tactical ad ter and lead to grea e terms of th er influence ov disclosure.
EDQ • Filling out the promotes early the consideration of d scope requirements an Doing this of the exercise. e helps to at an early phas rol costs. reduce and cont the EDQ • Exchanging of ctations explores the expe early of the other side prevent lp he on. This can potentially unexpected and scope costly changes in line. further down the
PART 2: THE DISCLOSURE OF OTHER PARTIES Part 2 of the questionnaire gives you the opportunity to influence how the other side undertake their disclosure. Bear in mind that it is likely that the other side will be filling in the questionnaire also and will have ideas of their own, which will form their Part 1, however this is the opportunity for you to suggest what you consider to be relevant and proportionate. Completion of Part 2 is harder than Part 1 in the sense that you are unlikely to have much, if any, information on what systems they are running, how much information is available and how readily available it is, however this information should be provided to you in their completed questionnaire.
4
OF OTHER PARTIES by Rob Savage Question 18 - do you at this stage have any proposals about the date ranges which should be searched by other parties to the proceedings? It is entirely possible that this date range will be the same as in Part 1, however if the other side are likely to hold relevant data over a greater time period than yourself then this is the time to specify it. Remember, generally, the older the data the harder, and more costly it is to retrieve it so you may not get all that you ask for.
Question 19 - do you at this stage have any proposals about the custodians or creators whose repositories of documents should be searched for disclosable documents by other parties to the proceedings? You may not, at this stage, have all of the custodian names from within the other side’s organisation. You may only, for example have job roles or job functions that you are interested in. Be as specific as possible; remember in the Guidance Notes it states ‘Some of the questions in the Electronic Documents Questionnaire require only a brief answer which may need to be elaborated after Electronic Documents Questionnaires have been exchanged’. Do not forget that there may be previous employees who are relevant custodians or the job role you are interested in may have been held by a number of individuals during the scope period.
Question 20 - do you consider that the other party(ies) should disclose all available metadata attaching to any documents? Unless it is not available or, for whatever reason, it is considerably more expensive to preserve the metadata, it is almost always useful to have.
Question 21 - do you at this stage have any proposals about the keyword searches, or other automated searches, which should be applied by other parties to their document sets? In contrast to Part 1, this question on keyword searching does not explicitly request you to define a list of keywords. It is however, much broader and gives you the opportunity to define what you expect of the other side in much broader terms.
Questions 22 & 23 - both of these questions relate to the format in which you would like the other side to disclose documents to you. It is worthwhile putting some thought into this. This is your opportunity to define how the other side will provide their disclosure to you. If, for example, you are expecting a large volume of data then it would be wise to request this in a searchable format, whether that be native or searchable PDF. If you are planning to load this into an e-disclosure platform such as Clearwell, then it would be worthwhile requesting it in a ‘load file’ format. If however you are expecting small volumes of data then hard copy or non-searchable PDF may be sufficient.
As mentioned in the first part of this article, this document is not expected to be a complete and final strategy for the disclosure exercise. However, the more accurate it is, the more accurate you can be on your cost and time estimates. It is therefore worthwhile taking the time to get it right.
If you missed ‘Completing the EDQ - Part 1’ from Issue 8 of Legal News - you can find it on our website www.cclgroupltd.com/legalnews
For mor e informat ion on th e EDQ ple ase call Rob or U mar on 01789 2 61200 or email edisclos u cclgroup re@ ltd.com
5
PARALEGALS, PREDICTIVE CODING AND PROPORTIONALITY PRESSURES by Umar Yasin …continued from Page 1 In some cases, where there are a seemingly overwhelming or daunting amount of documents, the whole process can be made more cost-effective by employing a hybrid solution. In such a situation, utilising predictive coding or technologyassisted review, which you can read about in more detail in Issue Three of Legal News, as a method of prioritising the review process can prove to be very effective. And it doesn’t take millions of documents in order for it to be a viable alternative to law firms attempting to review a large set of documents by throwing in partners, associates and trainee solicitors alike, particularly with the pressures of proportionality and costs budgeting. Even in cases where there may only be tens of thousands of documents, but the review costs of all those billable hours seems to be disproportionate, by either making judicious use of technology or managed review, or a combination of both, we can ensure that the disclosure exercise is effective and proportionate. Let’s consider a scenario where a large document set needs reviewing, whether it is for relevance or privilege. A team of senior lawyers would first ‘teach’ the predictive coding software, and it would then categorise the document set accordingly. Taking a tiered approach to the manual review, the highly relevant or privileged documents could then go straight to the senior lawyers for review and the potentially relevant or potentially privileged documents reviewed by trained paralegals sitting either in a completely offshore facility in a far-flung location or in a nearshore facility closer to home. Of course, whatever the nature of any review exercise, any percentage of the documents marked as either privileged, relevant or responsive etc. could also always be sent to a senior lawyer for quality control purposes. Utilising technology and managed review in suitable cases is also being considered by some law firms that are looking to benefit from the cost advantage of using an LPO for managed review, so that the law firm can effectively scale-up for certain cases. A litigation boutique or law firm without an army of paralegals or junior lawyers to call upon for document review can leverage both LPO and predictive coding, enabling it to deal with a document-intensive case effectively and efficiently. This means that the law firm won’t lose out on the instruction to a larger law firm with more internal resources, allowing it to compete effectively and possibly even punch above its weight, and outsourcing the linear manual review to an LPO allows the law firm to focus on running the litigation. Pressure on costs from courts and clients alike, huge advances in technology, and a fast-developing LPO market offering access to a wide variety of lower-cost centres all mean that LPO is no longer just confined to the largest law firms and their own back-office functions or to transactional work; more and more litigators are also actively exploring the LPO route. Discussions around when and how to leverage LPO and/or predictive coding technologies will undoubtedly become more and more commonplace and we will continue to discuss using LPO during litigation in upcoming editions of Legal News.
CASE STUD Y Casino frau d– computer f orensics
THE CASE: CCL were in structed by police force a UK to assist the m with a casino fraud case in volving a loss to the casin of hundreds o of thousand s of pounds. The accused had entered a ‘not guilty’ and were no plea t co-operati ve with the p olice. WHAT CCL DID: Two of CCL’s programmin g experts w e re immediate assigned to ly the case, clo se ly liaising with the polic e force at eve ry stage of the investig ation. Altho ugh a techn challenging ically case, as the accused we experts, CC re IT L’s experien ced analysts quickly able were to identify th e programm tools used to ing hack the casi no’s equipm and also the ent, sequence o f attacking st (deploymen eps t, installation , execution hiding track and s). A diagram of the attack drawn and d was elivered to th e officer in charge. THE OUTCO ME: The susp ects subsequentl y pleaded g uilty and we sentenced. re Their convict ions are belie to be the firs ved t where peo ple have be caught mish en andling the computer technology behind Brita in’s gaming industry.
6
THE REAL CSI: COMPUTER FORENSICS by Sarah Turner The Lieutenant stands on the docks, shades on, looking out to sea as the gang of drug dealers make their escape on a stolen luxury yacht, while their latest victim lies motionless on the ground at his feet.
We missed them by a few minutes. They won’t get far… With the sun setting behind him, the Lieutenant - hands on hips, oozing effortless cool, looks down at the victim, who with his last breath manages to whisper an address in downtown Miami. Within minutes a team of police cars screech to a halt outside the property in a flurry of smoke and sirens, and bash down the door. A number of computers have been left in the property. One of the crime scene investigators goes over and turns them on, then starts searching through email accounts and instant messages to see if there is any intelligence on the gang’s next move… While this scenario has all the drama and excitement of a Hollywood blockbuster, the investigator is making a crucial mistake that, in the real world, could jeopardise the case before it has even begun. The first mistake was switching the machine on – this in itself can alter the data that is stored on the device, including any data which may support the case, and so could ruin the chances of a potential conviction. So what would CCL do differently? In order for any evidence found on the computers to stand up in court, the first step is to take a forensic image of each of the computer hard-drives. It is those images that are then examined, rather than the content of the machines themselves. This ensures that evidential continuity is maintained and any information or crucial evidence that may be on the computer is not altered or affected by the forensic examination, and so will stand up to court scrutiny. Also, while emails are a useful source of intelligence and potentially incriminating data – there are a lot of other avenues for investigation on a computer that non digital forensics specialists may not consider. These include: Skype messages, internet history, social media activity and deleted content. We have worked on cases where all of these sources have provided evidence that supported a case. While in some cases it may be easy to find incriminating data on a computer, the processes and methodology that define the way this evidence is obtained, and ensure its integrity, are crucial. Although less cool than the Hollywood depiction, these can mean the difference between a successful case and it being thrown out of court.
For more information about computer forensics or CCL’s other products and services please visit www.cclgroupltd.com or call 01789 261200. 7
ABOUT CCL
CPD COURSE e c n e d i v e c i n o r ‘Elect ’ e r u s o l c s i d e d an
CCL is the UK’s largest digital forensics laboratory, and a leading provider of e-disclosure and IT consultancy services. From our beginnings as an independent IT consultancy in 1986, we have developed our services to respond to advances in new technology, the increasing importance of data, and the need to manage, recover and protect it. In 2001, we setup our digital forensics laboratory. CCL is now the largest digital forensics provider in the UK, and the only one accredited to the ISO17025 standard for our computer, mobile phone and Sat Nav laboratories. We provide digital forensics services to a broad range of organisations, ranging from law enforcement agencies, civil and criminal law firms to corporate clients.
rs. urses for lawye co D P C s e d vi know CCL pro ing you need to th ry ve e r ve co sure of These nce and disclo e d vi e ic n ro ct about ele n. ored informatio electronically st ur CPD ouse counsel, o -h in r u o y b d Delivere ding of u an understan yo e iv g ill w for you e rs cou its implications d an ce n e d vi e electronic . and your clients closure’ ence and e-dis d vi e ic n ro ct le CCL’s ‘e and course covers: ctronic evidence le e to n io ct u d • Intro e-disclosure e EDQ ction 31B and th • Practice Dire costs • Controlling chniques • Tools and te • Key cases
CCL has been in the e-disclosure market since 2009 and to date, has completed over 200 e-disclosure cases.
OUR SERVICES • Part 31 e-disclosure services
Missed an issue of Legal News? Don’t worry, all issues are available on our website at
Scan the QR code with your smartphone for more content.
www.cclgroupltd.com
• Digital forensics - All operating systems - Smartphones/mobile phones - Tablets - Sat Nav analysis - Cell site analysis - CCTV analysis • Collections • Part 25 search and seizure orders
COMING UP NEXT MONTH: Jackson - thriller? Handling ESI: the perils of doing it yourself For more information call Rob or Umar on
01789 261200
8
email edisclosure@cclgroupltd.com or visit: www.cclgroupltd.com
• Part 35 expert witness services
THE NUMBERS CCL employs over 100 full-time members of staff, including 65 consultants and analysts who have completed: • 200+
e-disclosure cases
• 4,000+
digital forensic (PC) cases
• 50,000+ mobile phone cases • 2,000+
consultancy engagements
• 700+
civil and criminal cases
• 450+
expert witness assignments