We are regularly brought in for situations when an executive hops from one company to another, and takes data with them on the way out the door. Sometimes we conduct the internal investigation which uncovers the data theft (politely called data exfiltration), other times we assist with the clean-up.
Here is a story which, I hope, will illustrate how messy these clean-ups can be.
At the start of a matter, you need search, you need filters, you need to cut out the irrelevant and the chaff. Document review platforms are terrific for that - you can't live without them if you have more than 1,000 documents in your case. But once you get down to the relevant documents, get them OUT of your review platform and into a thinking platform.
I'm the guy that actually reads the insurance policy text. So, our policy renewal arrives in the mail yesterday and I read it.
The part about "Cyber Protection" catches my eye - we are in that business after all. Intact, our insurer, offers a program they have trademarked called "my Identity". Among other things it includes up to $25K for Cyber Protection. What's that?, you might well ask….
Knowing "What" is important. It is a 'necessary but not sufficient' condition to take a page from our mathematician friends. It is finding out the "Why" that is reason for our investigations. And yet so many investigations stop short and simply present the "What".
Let me explain.
We've noticed a pattern.
When a case might settle why should you spend money preparing the evidence? Perhaps just inexpensive 'bluster' will win the day and with less spend on the case everyone is happy. The trouble is when opposing counsel calls your bluff or bluster fails…
Remember in the 'olden days' on the back of many of the photos that were shoved into a photo album there was some handwriting? Usually the writing described when the picture was taken, where and what it was a picture of…
Collecting and interpreting data from digital photographs may seem straightforward - but just like Grandpa's squiggly cursive handwriting, sometimes you need an expert to tell you precisely what the notes on the back mean.
Persuasion. The ability to persuade is one of the 'core competencies' of a litigator. You spend your life honing the skill. You turn an ability into an income and a lifestyle.
You are a story-teller. Stories persuade. All the affidavits, discoveries, cross-examinations, transcripts, exhibits, motions, factums, testimony, and your stirring closings are there to tell the story.
The best stories draw us in.
…we successfully broke into the encrypted storage container and recovered photo evidence of the spouse entering the home (contravening the retraining order) and retrieving the logs via USB stick.
The client loved us. The spying spouse, not so much.
One of our most frequent requests are social media captures - Facebook data, Instagram, WeChat, the list goes on and on.
We were recently asked to collect data from a home security system.
Knowing "What" is important. It is a 'necessary but not sufficient condition' to take a page from our mathematician friends. We are brought in to investigate to find the "Why". Yet so many investigative reports we read stop short and simply present the "What".
Let me explain.
We who battle to advance law and technology are accustomed to setbacks and defeats at the hands of the old guard. Although the world has gone digital, litigation and litigation lawyers remain by and large fixed in a pre-digital world. Change, as a recent SLAW post observed, comes slowly.
It’s not really a word. It's an acronym. But you still need to know it.
The EDRM. The Electronic Discovery Reference Model. If you are in business, you need to know about it. If you are a lawyer you need to know about it. Which means: most people need to know about the EDRM.
Why? Let’s begin with what.
Here at ellwood Evidence we spend a lot of time telling lawyers and business people that You just can’t put screen shots of social media posts in as evidence, any more than you can a handwritten copy of a letter. You have to collect social media posts forensically, and authenticate them.
A recent Law Technology News article by Vancouver journalist/lawyer Marlisse Silver Sweeney focuses on gathering digital evidence from departed employees.
Now, best practice demands that employers have a protocol for gathering digital evidence at the moment an employee leaves. Otherwise, the ex post facto gathering of evidence is closing the barn door after the horse has left.
But, setting aside this concern, the main point of Ms. Sweeney’s piece is that ex-employees will likely have data - i.e. digital evidence - in more places than the obvious ones.
This is a highly simplified, non-exhaustive listing of some key differences between the Canadian and American legal systems. I’ve left out many details. I simply mean to impart a basic understanding of the Canadian system to someone who knows the American one.
Don’t let the gawky handle fool you. CGSB-72.34-2005 is hugely important. It’s the document from the Canadian Government’s Canadian General Standards Board (i.e. the CGSB) titled *Electronic Records as Documentary Evidence*, and the standards it sets out apply to everyone. Public sector, private sector. For profit, not for profit. People, corporations.