Get The Jump On E-Forensics!

Saturday, January 1, 2005 - 01:00

Whitney Adams and Dr. Bruce V. Hartley
Cricket Technologies

Although electronic records have become an invaluable tool for business, these records have a hidden downside. When a lawsuit looms, electronic records become a treacherous, double-edged sword. Unless these records are properly handled, both plaintiffs and defendants can get into big, big trouble.

Consider, for instance, a huge legal battle that turned on the discovery of a single computer file. Cisco Systems was in court, fighting charges that it had stolen trade secrets from competitor Alcatel. Then, on June 21, 2002, Cisco was caught red-handed, stealing something else.

A computer forensic expert hired by Alcatel had uncovered a damning computer file amidst the voluminous back-up tapes of Cisco's computer network. The compressed file, named ALL.Z, contained over 2,000 source file codes and nearly 500,000 textual lines of source code - all of it Alcatel's copyrighted software, which the company used to run some of its sophisticated telephone products.

The ALL.Z file had been created by a former Alcatel employee. Ms. Behesti, on February 24, 1999 - the same day that she accepted an offer of employment from Cisco. She had emailed a copy of the file to her boyfriend, another Alcatel employee, who then sent the email to her at Cisco, where it was loaded onto the company's computer network.

Because Alcatel engaged in a thorough forensic analysis of its opponent's computer records, the case against Cisco was drastically altered, vital evidence was uncovered, which led to a new and powerful cause of action for copyright infringement. The case vividly demonstrates how important forensic analysis can be in a lawsuit.

However, the courtroom battle between Alcatel and Cisco also offers another lesson: It's not enough to conduct a thorough forensic analysis of electronic records. You need to do it early in the litigation and to do it fast. Alcatel neglected to do this, and it ultimately paid the price.

The court rejected Alcatel's attempt to add the copyright infringement claim to the lawsuit, because this new claim was made too late - eight months after the deadline for amending the pleadings. The court noted that for seven of these eight months. Alcatel had apparently done nothing to investigate the contents of the backup tapes. If Alcatel had investigated the tapes more diligently, the court implied, the copyright claim would have been added.

As it was, the court refused to hear the copyright claim, and it eventually threw out the rest of the charges against Cisco. So even though Alcatel had the computer file that proved Cisco's wrongdoing, Alcatel lost the case.

The issues raised by the Alcatel case are just the tip of the iceberg. Electronic records create a wide variety of difficulties for companies, no matter which side of a lawsuit they are on.

Plaintiffs run into problems because of the overwhelming amount of electronic data. It is not unusual for a party, as part of discovery, to have to retrieve and manage over four terabytes of information from the defendant's files. To wade through this huge amount of data, a plaintiff must turn to sophisticated software and search algorithms in order to have any hope of reducing its search for evidence to manageable proportions. The technical expertise to perform such forensic analysis isn't easy to come by, and it doesn't come cheap. Moreover, searching through the electronic data can take a long, long time.

Defendants face problems that are even worse - and these problems can start before any lawsuits are filed against them. If there is merely a reasonable probability that a company will be sued over a contract or some other legal matter, the company must suspend its normal electronic archiving and records retention policies, some courts say. All emails, instant messages, and other electronic records relating to the troublesome matter must be preserved. This requires concerted efforts from the company's IT staff, legal department, and the personnel directly involved in the contested matter, which costs the company money, time and manpower.

When a company is finally slapped with a lawsuit, its costs just keep rising. If the defendant hasn't already done this, the company must incur the costs needed to protect all of its electronic records relating to the disputed matter. When the plaintiff asks to see these relevant records, the defendant has the onerous task of collecting all the data (which are often scattered throughout the business, from employee laptops to network servers to backup tapes moldering in the corner of a dusty warehouse). Finding this data, collecting it, and putting it all in a usable form for plaintiff can easily cost millions of dollars. The plaintiff can sometimes be required to pay for some of these costs, but the courts have been unable to agree on a standard for when and how the costs should be divided among plaintiffs and defendants. In any event, the costs are usually pretty steep for both sides.

Heaven help the defendant who fails to properly preserve its electronic records and provide them in a timely fashion to a plaintiff because the courts can interpret any problems in this area as a deliberate attempt by the defendant to withhold important information. And the courts can punish such misbehavior harshly. For instance, a defendant might be forbidden to introduce certain evidence to defend itself in the lawsuit, or even worse, the jury might be allowed to infer that any missing evidence was detrimental to defendant's case - so the missing evidence in effect becomes converted into extremely powerful evidence against the defendant.

All these problems can be greatly mitigated by the proper use of outside forensic computer analysts. Such experts can help plaintiffs sift through the mountains of electronic data, locating computer records that can greatly strengthen a plaintiff's case, form the basis of new legal claims (as in the Cisco-Alcatel case), or vastly increase the amount of damages that the plaintiff can recover.

Defendants can profitably use outside forensic analysts to help craft appropriate policies and procedures to protect relevant electronic records from being accidentally destroyed. If some records are accidentally destroyed, a forensic analyst may be able to recover the data. And if the data can't be recovered, the analyst can testify in court that the company did its best to preserve the data. Such testimony from a third party may help convince a court that the loss of data was indeed accidental, and so prevent the court from imposing sanctions on the company.

A company defending itself in a lawsuit can also profitably use forensic analysis to uncover damaging computer records from the plaintiff's files, as well as to attack plaintiff's electronic evidence. In one recent case, for example, a lawsuit filed against a venture capital firm was thrown out after a computer expert found that the plaintiff had tampered with an email it was offering as evidence in the case.

Turning to an outside forensic analyst should never be construed as a slight on the company's IT staff. The IT personnel usually have more than enough work on their desktops without having to take on all the additional chores involved in finding, collecting and analyzing huge quantities of computer records. Moreover, forensic analysts bring with them long experience in the relevant issues, as well as resources that are unavailable to most IT departments.

Of course. forensic analysts don't provide a panacea for all the issues raised by electronic records. But as the Alcatel-Cisco case shows, these experts can play a major role in resolving a lawsuit. Just make sure they are brought into the case early.

Whitney Adams is General Counsel and Vice President of Business Development and Dr. Bruce V. Hartley is Chief Technology Officer of Cricket Technologies.