Posts Tagged ‘e-discovery’

Simplifying the webmail collection process

Thursday, January 13th, 2011

A recent ComputerWorld article discussed the security problems posed by webmail within organizations. In short, because webmail comes across HTTP rather than SMTP protocols, the organization does not protect against data leakage as it does from its own email system.

The reasons for this are many. In 2008, ComputerWorld ran an article that discussed ways webmail could breach even organizations with strong security. As always, the human factor can be a challenge. Well-meaning employees may use webmail to segregate business from personal email, when they are required not to conduct personal business on company accounts; employees may also use webmail to bypass overly complicated email security procedures.

At that point, even if employees’ personal webmail accounts aren’t being archived per the law, their email may become discoverable in the event of litigation. How to document the emails’ content?

In an October 2009 article for EDEN: The Electronic Data Extraction Network, Jonathan Yeh discussed various ways in which webmail could be captured for archival purposes. Among them:

  • Download the email locally using an email client with a POP or IMAP protocol. It can then be searched just like other digital evidence.
  • If these protocols cannot be used, screenshots, web page capture, or even printing.
  • Obtain data via browser artifacts.

Each of these methods is, however, complicated. Yeh goes into these issues in some detail, ending with the need to document each step of the collection process. While true that the courts accept expert testimony together with downloaded or screenshot data, there is still nothing about these collection methods to prove that the content was not manipulated in any way.

In addition, the procedures Yeh describes, along with some of the issues that the investigator must take into account, are time-consuming. Under such conditions, the margin for human error is greater, and as Yeh concludes, “The reliability of evidence can often only be gauged by the reliability of the methods used to collect it, and proper documentation can be the difference between admissibility and inadmissibility in court.”

Simplifying the “screenshots and web page captures” process, and in doing so addressing the reliability issue that Yeh brings up, is WebCase. That it is currently the only tool to do so should not be lost on e-discovery experts or other investigators.

Want more information? Schedule your free demo today!

Legal Issues with Online Investigations: Some background

Friday, January 15th, 2010

As Executive Director and Senior Counsel of the National Law Center for Children and Families, Richard Whidden is most familiar with laws and precedents related to child pornography—but stresses that investigators of other crimes can take away important information, too. “Much of the case law on electronic evidence comes from child porn cases because those are what prosecutors take on,” Whidden says.

During his webinar, “Legal Issues with Online Investigation,” on Thursday, January 21, Whidden will be discussing a sampling of cases from 2009 that had to do with Internet and computer forensics. One of the primary cases, however, has to do not with child pornography but instead with steroids.

Specifically, U.S. v. Comprehensive Drug Testing, Inc. describes forensic procedures relative to search and seizure of electronically stored evidence. Although it applies to the 9th Circuit Court of Appeals’ jurisdiction, it’s likely that other courts will look to the decision when dealing with their own issues of electronic evidence.

The case also illustrates how the process of e-discovery has evolved over the past 10 years. Typically this is difficult to discuss. As Whidden says, “You could have entire symposiums on how the law has changed over the last 10 years, before you even break out the crystal ball on how it will change over the next 10.”

Notably, law changes according to the technology. “We’ve gone from pornographic images of children, to streaming video of abuse taking place,” says Whidden. “Modes of transmission change. Cell phone technology is much more prevalent now, and will continue to evolve.”

Whidden will cover other legal issues, such as the definition of “possession” of child pornography, procedures related to computer related evidence, search and seizure issues, and the difference between state and federal prosecutions. He will not discuss civil cases, only criminal cases because of the higher burden of proof.

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.