Legal Techology

Archived Posts from this Category

10

Surrendering the PGP passphrase

Anyone here remember State v. Levie, 695 N.W.2d 619 (Minn.App. 2005) ?

In Levie, the defendant-appellant’s seized computer contained PGP, a cryptography program, which was inaccessible to the investigator.  In rejecting Levie’s bid for a new trial, said the court, inter alia:

We find that evidence of appellant’s internet use and the existence of an encryption program on his computer was at least somewhat relevant to the state’s case against him.

As a result, this case stirred waves in techie circles & blogs accross the nation and was unfairly characterized by journalists as, “Minnesota court takes dim view of encryption.” (See, e.g., here or here).

I posit that the case was unfairly mischaracterized because the inaccessible PGP archive, by itself, did not result in an adverse jury instruction and the totality-of-the-circumstances was the apparent standard adopted by the trial court.   I.e., the record showed that Levie took a large number of pictures of a minor child with a digital camera and that he uploaded those pictures onto his computer soon after taking them. 695 N.W.2d at 624.

Prof. Orin Kerr came to a similar (albeit differently reasoned) conclusion in his blog post, The Myth of Crypto as a Crime:

Obviously, the idea that using encryption necessarily reflects criminal activity is rather silly; Internet users use encryption all the time for all sorts of legitimate reasons. As many critics of the new decision have noted, it makes no sense to see encryption as inherently linked to crime. But contrary to the blogospheric common wisdom, no court ever said it was.

[emphasis in original]. Kerr reasoned, instead, that the court regarded Levie’s use of PGP as evidence that he was a sophisticated computer user, which might explain why the police found no child pornography or nude child photos on his computer.

In cases like these, attorneys often may wonder, “Can a court force a defendant to give up his passphrase?”  (side note: I always include, in routine e-discovery interrogatories that I prepare for my attorney-clients, specific requests for the passwords and password phrases to all encyrpted archives and other repositories containing potentially responsive ESI).  This question is certain to arise more frequently in the near future, including in civil cases (and especially in domestic relations cases).1

To help answer that question, the U.S.D.C. for the District of Vermont court declined to compel a defendant to surrender his PGP passphrase, finding that compelling a defendant to surrender his PGP passphrase would violate his Constitutional right not to incriminate himself.

The case, In re Boucher, involved child pornography, as you might have expected. Yet, the case law involving the compulsory surrender of encryption passphrases is quite unsettled.

If this case is appealed, it has the potential of creating an important precedent.

___________________________

1 Unfortunately, perhaps, we should not be looking to domestic relations case law for guidance on issues of substantive constiutional law (such as the privilege against self-incrimination).  See, e.g., David N. Heleniak, The New Star Chamber, 57 Rutgers Law Review no. 3 (Spring 2005), 1009, discussing the “due process fiasco” of family law and characterizing family courts “an area of law mired in intellectual dishonesty and injustice.” In the article, Heleniak identified six commonplace deprivations of fundamental due process: seizure of children and railroading innocent parents into jail through denial of trial by jury; denial of poor defendants to free counsel; denial of right to take depositions; lack of evidentiary hearings; lack of notice; and improper standard of proof). In family law, “the burden of proof may be shifted to the defendant,” according to a handbook for local officials published by the National Conference of State Legislatures.

Posted: 19 Dec, 2007 | Comments Off on Surrendering the PGP passphrase
Categories: Legal Techology | Tags: | By: Sean Harrington.  

8

Blogger’s Use of Trademark Protected as News Reporting

In its October 22, 2007 Order granting defendant Philip Smith’s motion for summary judgment, the District Court of South Carolina dismissed defamation, trademark infringement, and invasion of privacy claims brought by plaintiff BidZirk LLC, an auction listing company.

The claims arose out of the pro se defendant-blogger’s publication of articles on his blog, featuring plaintiff’s trademark, that were critical of plaintiffs’ eBay auction listing business.  Plaintiffs asserted that defendant’s use of their mark in an article critical of plaintiff’s business tarnished their famous trademark in violation of the Federal Trademark Dilution Act (“FTDA”). The Court held plaintiff’s trademark dilution claims failed because defendant used the mark in connection with “news reporting and news commentary,” a non-actionable use under the Federal dilution statute.

Pursuant thereto, a party cannot be found guilty of diluting the mark of another if the mark is used in “news reporting or news commentary.” 15 U.S.C. § 1125(c)(4)(C).  The Court held that Smith’s use of the trademark was, in fact, a protected use in the course of “news reporting or news commentary.”. The court noted that, while “not all bloggers are journalists, some bloggers are, without question, journalists.”  The Court had examined “the content of the material, not the format, to determine whether it is journalism.”   The Court found that it was not written solely to denigrate plaintiffs but, rather, it was written for the purpose of conveying information to the public about the use of auction listing companies, based on the author’s personal experience and supported by his research. It also provided a checklist to aid consumers in selecting such companies.  These attributes “evidences [an] intent to report what [Smith] believed was a newsworthy story for consumers.”

The court further dismissed plaintiffs’ defamation claim, finding the challenged statements non-actionable statements of opinion.  Said the Court, “Opinion statements, defamatory or otherwise, are not actionable unless they contain provably true or false connotations.” The statements were an opinion statement that could not be fairly characterized as true or false and, which statements included terms that have, “different meanings to different people.”  Thus, because the statement was not capable of being characterized as false, there was no liability for defamation.

Finally, the Court dismissed plaintiffs’ invasion of privacy claim, arising from a link found on Smith’s blog to a picture of plaintiffs found elsewhere on the Internet, accompanied by Smith’s commentary.  According to plaintiffs, the accompanying text implied that they were ‘irresponsible and overcommitted’ and impermissibly cast them in a false light. The Court rejected this claim, finding that South Carolina does not recognize a claim for false light invasion of privacy and, even if it did, the claim would fail as the article did not cast plaintiffs in a false light and (“Nothing about Smith’s statements would be highly offensive to a reasonable person,” an essential prerequisite to a false light invasion of privacy claim”).

Similarly, plaintiffs’ ‘wrongful appropriation of personality’ invasion of privacy claim failed: A required element of such a claim is the “intentional [non-consensual] use of the plaintiff’s name, likeness, or identity by the defendant for his own benefit,” which was missing here. Smith did not use a picture of plaintiffs but, instead, only linked to one found on another site.  In addition, plaintiffs waived any privacy right they had in the photograph in question by consenting to its use on the other non-password protected internet site. Finally, there was no apparent benefit to Smith by his use of the link.

The Court sua sponte sanctioned plaintiffs’ attorney, Kevin Elwell, under Rule 11, for filing a lis pendens against Smith’s condominium. The Court fined Elwell $1,000, which he directed be paid directly to Smith.

Posted: 17 Dec, 2007 | Comments Off on Blogger’s Use of Trademark Protected as News Reporting
Categories: Legal Techology | Tags: | By: Sean Harrington.  

1

Labor Cost Advantages of “Offshore” Locations Decline in 2006 According to 2007 A.T. Kearney Study

Following last weeks informative CLE presentation on legal process outsourcing (LPO) by Jeffrey A. Proulx, we should be mindful of the 2007 A.T. Kearney study that finds costs slippage in the previous year attributable to off-shoring. The report found that although the wage advantage of offshoring locations for office services is set to last for another 20 years, it is on the decline as offshore wages for IT, business process and call center services have risen. Paul Laudicina, managing officer and chairman of A.T. Kearney., reported:

What is most striking about the results of this year’s Global Services Location Index is how the relative cost advantage of the leading offshore destinations declined almost universally, while their scores for people skills and business environment rose significantly . . . These findings reinforce the message that corporations making global location decisions should focus less on short-term cost considerations and more on long-term projections of talent supply and operating conditions.

Because of the infancy of legal outsourcing models in India and abroad, the Kearney study probably is equally applicable thereto as it is to IT or call-center services at the present. However, as legal outsourcing diversifies and matures, as is predicted,1 indepedent studies will need to be applied to these divergent models.

_____________

1 Forrester Research has estimated that the number of jobs outsourced in the legal services area will grow to 35000 by 2010 and up to 79000 by 2015.

Posted: 05 Nov, 2007 | Comments Off on Labor Cost Advantages of “Offshore” Locations Decline in 2006 According to 2007 A.T. Kearney Study
Categories: Legal Techology | Tags: | By: Sean Harrington.  

4

Use mediocre computer forensics expert and discover that the “Safe Harbor” provision is very shallow!

In April, Damien Riehl brought us the story of the Eight Circuit’s ruling in Greyhound Lines, Inc. v. Wade that there was no abuse discretion in a trial court’s denial of sanctions for spoliation, where the movant failed to demonstrate intent and prejudice. In another post, last month, I discussed the precarious possibilities of forensics experts, who can ruin a case.

Bringing these two topics together, we have the case of Doe v. Norwalk Community College, where the U.S. District Court in Connecticut imposed spoliation sanctions for a party’s failure to prevent the destruction of evidence. Defendants sought shelter under safe harbor provision of Fed.R.Civ.P. 37(f), but the district court disallowed the defendants to take advantage of the provision, since they made no attempts to preserve relevant evidence. The credibility of the computer forensics experts (or non-experts, depending how one might characterize them) decided the outcome of this case. >> read more >>

After two years of litigation, plaintiff Jane Doe persuaded the court that the defendant college was withholding electronic evidence. The college was ordered to produce the computers of key witnesses for inspection by Doe’s computer forensic expert. The expert inspected the college computers over a two day period. Delay’s inspection showed that several of the computers had no data, they were literally all zeros. Doe then filed a motion for spoliation sanctions, alleging “the hard drives of key witnesses in this case were scrubbed” or “completely ‘wiped’ of data” and, which resulted in several affidavits by Doe’s expert and the college’s counter-expert (its in-house Information Technology technician).

The trial court scheduled two evidentiary hearings during which the experts testified and were cross-examined about the suspicious circumstances of the missing ESI. During one of these hearings, the college produced another alleged expert, the Information Technology Systems Manager. Both of the college’s experts testified, inter alia, that they did not believe that the state’s two year document retention policy applied to them or to “normal computer usage,” directly contradicting the hearing testimony of the college’s Dean and the college’s principle expert produced a litany of reasons for why two computers could be “full of nothing”: He began with the assertion that it was the wrong computer; then that it was imaged, but not wiped; and, as a last resort, that the “all zeros” problem was the result of “computer failure.” The most compelling and interesting aspect of the spoliation proceedings was the exposè of the term ”wiped.” 1

Plaintiff’s expert correctly stated that wiping is a “process that overwrites existing data on the hard drive, making this information unrecoverable,” and that the “all zeros” condition of the hard drives was indicative that the hard drive had been intentionally scrubbed of all data. Id. at n.3 This is because computers write and read information as binary bits of either ones or zeros (electrically ‘on’ or ‘off’). Any combination of eight ‘on’ or ‘off’ bits comprise a byte (a typical hard drive today has hundreds of billions of bytes). Information can only be stored when both ones and zeros are used in varying permutations. (Thus, if a hard drive or any other ESI device contains all zeros (or all ones), it contains no information). The college’s expert, took exception with the term “scrubbed,” and attempted to substitute the word “imaged,” where the college’s IT department modifies the structure of the hard drive (without scrubbing it). He further suggested that one particular hard drive, which may have appeared to have been “scrubbed,” was because it was in the process of failing, which he testified could produce inconsistent or corrupt results. Id. at n.6.

Unpersuaded, the court accurately defined “scrubbed’ or “wiped” as “more than overwriting or ‘reimaging;’ it means eliminating all data from the hard drive, such that none of the old data can be read or still remains on it.” Id. at 11. Contrary to the college’s expert’s testimony, a computer which has been imaged or one that is failing, would not contain all zeros. Some information (some combinations of ones and zeros among the billions of bits on a hard drive) would remain. The trial court explained it this way:

Delay found that it contained all 0’s, indicating that every sector had been overwritten. Delay testified that, if the drive had data on it but was failing, as Bissell testified, then data would be seen on it with Delay’s forensic software, which instead recognized that the hard drive was unpartitioned and contained no data. Moreover, Seaborn’s new computer had traces of other users’ information on it, thus showing an inconsistent result in NCC’s process of re-imaging hard drives. Even if it was consistent with NCC’s policy, the fact that Seaborn’s new computer showed other users’ information indicates that “imaging” does not eliminate everything from a hard drive, but leaves some data from old users on it, prompting the question why Seaborn’s old computer–or Schmidt’s computer–did not have any evidence of other users on it. The answers provided by the defendants–a failing drive or “re-imaging”–are rejected by the court as not credible.

The irregularities in PST files that Plaintiff’s attorney uncovered also led the trial court to suspect that relevant evidence had been intentionally destroyed by several of the college employees. He discovered the Microsoft Outlook PST files, which house electronic mailboxes, of four individuals had inconsistencies “that indicate [ ] that data has been altered, destroyed or filtered .” For example, one person’s PST file contained no Deleted Items and only one Sent Item and the Inbox and Sent Items contained data starting August 2004, “even though other activity is present starting in 2002.”

The trial court did not credit the testimony of the defense experts. Overall, they served to make a bad situation worse.

The trial court not only rejected the defense expert testimony but, it also rejected the legal arguments of defense counsel (including that an effective legal records hold could not be implemented without revealing the true name of Jane Doe). The court said defendant’s counsel should have conferred plaintiff’s counsel. Defense counsel’s arguments as to when the duty to preserve commenced were also not countenanced.

Ultimately, the court found that the defendants’ actions were at least grossly negligent and concluded that a party to litigation can only invoke the good faith provision when that party has taken affirmative steps to prevent the spoliation of evidence. The trial court granted Doe’s motion for an adverse jury instruction based on this grossly negligent failure of the college to preserve ESI and awarded Doe her expert witness’s costs.

This case aptly illustrates why the quality of experts can make or break a case. Don’t rely on an in-house or jack-of-all-trades IT Tech, who tries to fast-talk a judge with “computerese” and specious theories. It may fool many attorneys, but it is likely to not stand up under cross-examination by an attorney working with a qualified expert.

________________________

1See, e.g., United States v. Krause (In re Krause), 2007 WL 1597937, 2007 Bankr. LEXIS 1937 (Bankr. D. Kan. June 4, 2007) (A debtor, an attorney proceeding pro se in a bankruptcy, was caught destroying evidence using a popular software program)

Posted: 27 Aug, 2007 | Comments Off on Use mediocre computer forensics expert and discover that the “Safe Harbor” provision is very shallow!
Categories: Legal Techology | Tags: , , , | By: Sean Harrington.  

« Previous Page