Computer Forensics and Legal Technology Blog

A new site, LinkBunch, enables you to consolidate multiple URLs into one link.  The service is quite simple: paste in each URL and click the “Bunch” button.  LinkBunch creates a unique URL that, when accessed, launches a window containing all of your selected links.  This could be useful in siutuations where space is at a premium, such as IM, texting, email, blogging, etc.  One particularly useful application that comes to mind would be to bundle a number of links to photos stored on a site like Photobucket or Flickr.

Notably, members of the Minnesota State Bar Association have free access to FastCase through the MSBA website. While it may not be as comprehensive as Westlaw or Lexis, it may serve as a good start for cost-sensitive or pro bono clients.

Lawyers will probably want to stay with their research tools of choice, but the Public Library of Law is worth noting, as a service that clients (or future clients) may be relying upon before seeking your advice.

Public Library of Law
http://www.plol.org/

[via]

The court heard evidence from the firm’s IT administrator that the firewall setting was modified —without notice to these particular attorneys— in response to complaints from some of the firm’s employees concerning sexually explicit junkmail.  Moreover, although the administrator added the Colorado state courts to the whitelists, he failed to add the cod.usCourts.gov (U.S. Court, District of Colorado) domain.

Although the magistrate found that the neglect was not willful or wanton, he nevertheless found that the attorneys were, “the responsible persons to adopt internal office procedures that ensure the court’s notices and orders are brought to their attention once they have been received.”  Thus, under Fed.R.Civ.P. 16(f), they were jointly and severally sanctioned for attorney fees and costs relating to the settlement conference and the additional hearings incident thereto.

This decision, `though not a precedent, is another salient reminder that attorneys are increasingly being required to keep up with technology that often is out-of-scope for their training and expertise or, alternatively, to retain competent staff.

Along similar lines, a ethics opinion released recently by the Maine Board of Bar Overseers addressed the ethical implications of using a third-party to process and store a law firm’s electronically stored information (ESI). (Hat tip to The Legal Profession Blog for this one). The opinion provides, in pertinent part:

With the pervasive and changing use of evolving technology in communication and other aspects of legal practice, particular safeguards which might constitute reasonable efforts in a specific context today may be outdated in a different context tomorrow. Therefore, rather than attempting to delineate acceptable and unacceptable practices, this opinion will outline guidance for the lawyer to consider in determining when professional obligations are satisfied.

At a minimum, the lawyer should take steps to ensure that the company providing transcription or confidential data storage has a legally enforceable obligation to maintain the confidentiality of the client data involved. See ABA Ethics Opinion 95-398 (lawyer who allows computer maintenance company access to lawyer’s files must ensure that company establishes reasonable procedures to protect confidentiality of information in files, and would be “well-advised” to secure company’s written assurance of confidentiality); N.J. Sup. Comm. Prof. Ethics Opinion 701 (“Lawyers may maintain client files electronically with a third party as long as the third party has an enforceable obligation to preserve the security of those files and uses technology to guard against reasonably foreseeable hacking.”)

In the U.S., there is presently neither a universal code of professional conduct or responsibility nor a national licensing body for computer forensics examiners or legal technologists. Certainly, there is none that I know of for data warehousing. In addition to the suggestions I made in the earlier post (which included working under a well-drafted contract), one consideration in selecting an expert is whether he or she belongs to a professional organization (e.g., IACIS, HTCIA, etc.) that imposes a code of ethics on its members and offers hortarory guidelines for separation of duties, among other things.

The hapless attorney who mis-mailed a document outlining a billion dollar settlement deal may have simply been the victim of his/her email program’s address autocomplete function, resulting in the message being sent to a New York Times reporter with the same surname as the intended recipient.  Outlook has that autocomplete function, as do some of the webmail services (e.g., Gmail).

It goes without saying that any “attorney-client privileged…for intended recipient” signature file that may have been included had no effect whatsoever in stopping the Times reporter from scooping the story.

Cheers.

For the current ‘good faith’ discovery system to function in the electronic age, attorneys and clients must work together to ensure that both understand how and where electronic documents, records and emails are maintained and to determine how best to locate, review, and produce responsive documents.

So said the Court in Qualcomm v. Broadcom, (S. D. Calif.) in its Jan. 7, 2007 Order imposing sanctions and referring six attorneys to the State Bar of California Office of Chief Disciplinary Counsel because plaintiff failed to produce emails that were clearly requested in discovery and witnesses testified falsely on an issue that “became crucial to the…litigation.”

One witness identified twenty-one emails that were believed to be both substantially probative and relevant, yet counsel did not produce the emails or conduct a further search. After the trial, Qualcomm’s general counsel “admitted Qualcomm had thousands of relevant unproduced documents and that their review of these documents ‘revealed facts that appear to be inconsistent with certain arguments that [counsel] made on Qualcomm’s behalf at trial and in the equitable hearing following trial’ ” There were over 46,000 such documents. The Court further noted:

It is inconceivable that these talented, well-educated, and experienced lawyers failed to discover through their interactions with Qualcomm any facts or issues that caused (or should have caused) them to question the sufficiency of Qualcomm’s document search and production…the Court finds that these attorneys did not conduct a reasonable inquiry into the adequacy of Qualcomm’s document search and production and, accordingly, they are responsible, along with Qualcomm, for the monumental discovery violation.

The Court ordered Qualcomm to pay $8.5M to Broadcom but, because “the attorneys’ fees sanction is so large,” the Court declined to fine Qualcomm, noting that, “If the imposition of an $8.5 million dollar sanction does not change Qualcomm’s conduct, the Court doubts that an additional fine would do so.”

The court referred six attorneys to the attorney regulation counsel, finding:

the Sanctioned Attorneys assisted Qualcomm in committing this incredible discovery violation by intentionally hiding or recklessly ignoring relevant documents, ignoring or rejecting numerous warning signs…the Sanctioned Attorneys then used this lack of evidence to repeatedly and forcefully make false statements and arguments to the court and jury.

Significantly, the Pennsylvania Superior Court held that defendant’s acquiescence to the installation of a DVD drive was a de facto acquiescence to the installation of software (whether he knew it or not). The court reasoned that he, therefore, “volitionally relinquished any expectation of privacy in that item by delivering it to CircuitCity employees knowing that those employees were going to install and test a DVD drive.”

In arriving at this conclusion, the court employed the legal theory of “abandonment,” whereby an individual evidences an intent to relinquish control over personal property (“whether a person prejudiced by the search had voluntarily discarded, left behind, or otherwise relinquished his interest in the property in question so that he could no longer retain a reasonable expectation of privacy with regard to it at the time of the search”) (quoting Commonwealth v. Shoatz, 366 A.2d 1216, 1220 (1976)).

Yet, although the court explained that the legal construct “revolves around the issue of intent,” it rejected defendant’s assertion that he did not intend for CircuitCity employees to access his personal video cache any more than he expected them to access his personal financial information or other files.  The court specifically noted that defendant “failed to either inquire as to how the DVD drive would be tested or otherwise restrict the employees’ access to his computer files.”  The court also noted that CircuitCity was employing a commercially acceptable manner for testing the DVD drive, rather than setting out to discover illicit contraband.

While I take no position on the ruling of the court, it occurs to me that this is an instance where “ignorance” commands a higher premium than “intent.”  Another such case was Long v. Marubeni America Corporation, 2006 WL 2998671 (S.D.N.Y., October 19, 2006), where that court held that both the attorney client and work product privileges were waived by employees using a company computer system to transmit otherwise privileged communications to private counsel, which communications were sent from private password-protected accounts (not from the employer’s email system).   Significantly, a cache of the emails were retained by the company’s system as “temporary internet files.” Because the company could and did obtain these emails by reviewing its own system, the court held that the waiver was created through employees’ failure to maintain the confidentiality of these communications with regard to the company’s electronic communications policy, which policy advised employees not to use the company system for personal purposes and warned that they had no right of privacy in any materials sent over the system. The court reached this result notwithstanding its factual finding that employees were without knowledge that a cache of their email communications had been retained.

Thus, in these cases, and including the recent In Re Boucher (defendant, who used PGP to encrypt alleged contraband not required to divulge passphrase), we see where a presumption of a reasonable expectation of privacy can be overcome by a defendant’s failure to take specific precautions to safeguard property or communications. The phrase, “knew or reasonably should have known” is employed in these cases to mean that lack technological expertise on the part of a layperson may result in waiver.

The latter objective is to be accomplished, in part, by “transferring the functions of the existing Computer Crime and Intellectual Property section (CCIPs) that relate to intellectual property enforcement to the new IP Division” and to provide the DoJ with new resources targeted to improve IP law enforcement, including local law enforcement grants and additional investigative and prosecutorial personnel. It also requires that DoJ prepare an annual report that details its IP enforcement activities.

The Press Release is located here: http://judiciary.house.gov/newscenter.aspx?A=887

purchased a CD to transfer that music into his computer.” [emphasis in the orig.]

The case is Atlantic Recording Corp. v. Howell.

In fact, the RIAA Web page concerning piracy does state, in pertinent part:

[T]here’s no legal “right” to copy the copyrighted music on a CD onto a CD-R. However, burning a copy of CD onto a CD-R, or transferring a copy onto your computer hard drive or your portable music player, won’t usually raise concerns . . . Enjoy the music.

However, like the Minnesota PGP case that I characterized in another post as widely misrepresented, I believe that the position of RIAA and Atlantic in this case appears to be similarly misconstrued. If one actually reads the supplemental brief, Atlantic makes clear that the gravamen of the claims isn’t the possession of a backup copy of legally purchased materials but, rather, the fact that the backup copy resided in a folder share that was utilized by a file-sharing program:

It is undisputed that Defendant possessed unauthorized copies of Plaintiffs’ copyrighted sound recordings on his computer. Exhibit B to Plaintiffs’ Complaint is a series of screen shots showing the sound recording and other files found in the KaZaA shared folder on Defendant’s computer on January 30, 2006. Virtually all of the sound recordings on Exhibit B are in the “.mp3” format.  Defendant admitted that he converted these sound recordings from their original format to the .mp3 format for his and his wife’s use.  The .mp3 format is a “compressed format [that] allows for rapid transmission of digital audio files from one computer to another by electronic mail or any other file transfer protocol.”  Once Defendant converted Plaintiffs’ recording into the compressed .mp3 format and they are in his shared folder, they are no longer the authorized copies distributed by Plaintiffs. Moreover, Defendant had no authorization to distribute Plaintiffs’ copyrighted recordings from his KaZaA shared folder. Each of the 11 sound recordings on Exhibit A to Plaintiffs’ Complaint were stored in the .mp3 format in the shared folder on Defendant’s computer hard drive, and each of these eleven files were actually disseminated from Defendant’s computer. Each of these actual, unauthorized disseminations ofPlaintiffs’ copyrighted works violates Plaintiffs’ exclusive distribution right under the Copyright Act. In addition, Defendant unlawfully distributed all 54 of Plaintiffs’ Sound Recordings by making unauthorized copies of the recordings available to other KaZaA users for download.

Id. at 15-16. [citations to the record and authorities omitted; emphasis supplied].

Notably, Atlantic complained that Howell had spoliated evidence of his alleged wrongdoing, an allegation that we’re seeing raised more and more often in litigation, as lawyers start catching on to electronic discovery practices:

One of the best ways to test a defendant’s denial of responsibility for illegal file sharing would be to look at the contents of the defendant’s computer hard drive, which would show, among other things, the existence of peer-to-peer software programs, the user’s chosen preferences for the use of such programs, the dates of use of such programs, the profile of the individual using such programs, and any sound recordings that were downloaded using such programs. A forensic examination might also provide indications of particular instances of distribution from Defendant’s shared folder. That information, however, has now been intentionally “wiped” from Defendant’s computer. Defendant’s intentional destruction of this evidence severely and irreparably prejudices Plaintiffs’ ability to prove their claim against Defendant and warrants harsh sanctions.

Supplemental brief at 14.