E-Evidence Demands New Expert National Law Journal - March 9, 1998 Digital briefs and storage make forensic techs a must. PHILIP W. HORTON, a partner at Washington, D.C.'s Arnold & Porter, was recently in Chicago's federal court defending a routine contract dispute involving $750,000. His last witness, Jason M. Paroff, took the stand. Suddenly, Senior U.S. District Judge Milton I. Shadur, who had been relatively quiet during the bench trial, was transformed, says Mr. Horton: "The judge displayed a high degree of interest and became quite animated....It was almost Phase Two of the trial." Mr. Paroff, who says he testified longer than almost any other witness, was not a party to the case, Rumsavich v. Borislow, 96-C-2744. He is a software forensics consultant, retained for $2,000 a day to determine the likelihood that a document was created on the defendants' computer system, as the plaintiffs claimed, or was a forgery, as the defense asserted. Judge Shadur, who says he is not computer-literate, has handled software copyright infringement cases, but he needed to understand how this expert gathered and preserved evidence. "I wanted to make sure that what I was getting from this fellow really demonstrated the false nature" of the document, he says. The judge ultimately ruled it a forgery. This was Mr. Horton's first foray into software forensics. But witnesses like Mr. Paroff, a prosecutor-turned- oftware detective with Kroll Associates, have become rather common these days. Similarly, litigators, who increasingly are making requests for copies of electronic mail and backup tapes during discovery, are having to grapple with new rules about filing briefs on disks and CD-ROMs. The era of digital evidence and electronic filings seems to have arrived. The first CD-ROM brief filed in the 2d U.S. Circuit Court of Appeals was submitted in late January by New York sole practitioner Daniel P. Levitt, who incorporated video depositions into the appellate record. The court recently amended its rules to allow electronic filings. As of Jan. 1, a copy of all briefs submitted to the 1st Circuit must be on a 3.5-inch disk. This requirement stems, in part, from a wish to accommodate vision-challenged Judge Bruce M. Selya, who needs to magnify the size of a document's typeface on his computer screen in order to read it. But disks are also much easier for a court to store than are paper copies. The Supreme Court and the Federal Circuit both accepted their first briefs on CD-ROM last year. "I think [the new disk filing requirement] is terrific," says Alan Goldberg, a partner at Boston's Goulston & Storrs. "But no one has thought through the outer limits of this....Suppose there's a discrepancy between the paper copy of the brief and the disk. Which governs?...Which is the original?" Having founded the Boston Law Firm Technology Partners' Group, Mr. Goldberg emphasizes that he's not anti- technology, but merely concerned about electronic file storage and related issues. Appeals can take years, he notes, and electronic files can fade. As computers permeate our working lives, digital documents and virtually paperless trials are no longer rare. But because some businesses have integrated computers so thoroughly into their practices, questions are arising about gathering and preserving computerized evidence, and dealing with the new software forensic experts. Start at the Beginning Michael R. Overly, special counsel to Foley & Lardner's information technology group, lectures on electronic discovery issues. He begins by asking how documents are stored in the ordinary course of business. "Because of the growing focus on electronic evidence, many businesses are now implementing electronic document retention policies to cut down on the amount of information retained electronically," he e-mails. These policies target e-mail particularly. "We recommend deletion after 30 days," says Mr. Overly. Otherwise, businesses may be confronted with volumes of e-mail when responding to discovery requests. It is almost cheaper to produce every e-mail sent during a particular time rather than search it, even with software tools. E-mail, by its nature, seems to invite candid remarks that would never appear in formal memorandums and must be screened not by software, but by human eyes. But overzealously discarding e-mail can also spell trouble. "Businesses must be careful to comply with any applicable statutory or contractual retention requirements," advises Mr. Overly. "Businesses must...preserve electronic evidence when they have notice of a pending claim. Hughes Aircraft paid $20,000 in actual damages and $60,000 in punitive damages last year because it overwrote a backup tape." Spoliation of evidence may be hard to avoid, particularly at large corporations, says Mr. Overly. "By the time the outside attorneys tell the in-house counsel, who must tell the [computer staff], information on a backup tape may have been overwritten in the normal course of business." The nature of electronic records complicates development of policies. If need be, evidence can easily disappear. If it is destroyed, however, it can still leave a trace. "I can obliterate a day's worth of work in a fraction of a second, or by upgrading to a new computer, I can preserve it for decades," says Andrew Johnson-Laird, a software forensics specialist in Portland, Ore. In one case, he proved that e-mail messages apparently coming from his client's business had been faked. "The beauty of computer evidence is that it speaks very loudly to those who are willing to listen," says Mr. Johnson- Laird, who has lectured to judges about the authenticity and reliability of electronic "audit trails." Who Ya Gonna Call? Software forensic technologists generally appear early in litigation. They begin by making a copy of the computer hard drives to be searched. The originals are sealed and filed in escrow. It is the mirror images that are scoured by keywords or dates. Kroll Associates' Mr. Paroff says he can search for 256 terms simultaneously. With proper software, the actual search may require only a few minutes. The creativity involves knowing where and how to look, says Mr. Johnson-Laird. "The tyranny of computer-based evidence is that it looks like a nice, tidy metal package, inside of which is an electronic garbage dump....Has anyone ever told anyone the right way to file documents on a computer?" he asks. The answer is usually no, and the result is a mass of information he calls "the defecating-elephant syndrome." Mr. Goldberg believes the emergence of forensic technologists may bring some order to the chaos. "The day will come when a matter first comes in, when lawyers will say, 'Have my FT have lunch with your FT.' " Forensic technologists will also be responsibile for filing, storing and preserving documents, he adds. Unless you can cut through the digital fog, litigation will be "hopeless," he says. "The boring data base person--the future belongs to them. I can't find my socks in the morning." * * *  This article is reprinted with permission from the March 9, 1998 edition of The National Law Journal. © 1998 NLP IP Company.   || About This Site || Articles || E-Filing Projects in the U.S. || || Lawyers in the Movies || Links || My Background || Humor || Home || E-mail wendytech@gmail.com