Law and Computer Security E-Discovery Bahareh Rahmani CS - University of Tulsa

1. Law and Computer Security E-Discovery Bahareh Rahmani CS - University of Tulsa

2. DataClassification First Ground Definition EDRM IT Department Penalties

3. Electronic discovery • refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case. • E-Discovery can be: • carried out offline on a particular computer • done in a network • Court-ordered or government sanctioned hacking for the purpose of obtaining critical evidence • E-discovery is an evolving field that goes far beyond mere technology. It gives rise to multiple legal, constitutional, political, security and personal privacy issues, many of which have yet to be resolved.

4. Electronic discovery When a company is sued, the parties in the lawsuit ask for documents and other evidence from each other so they can fully explore the facts of the case prior to a trial. E-discovery is the process of exchanging documents and other information in electronic form. Lawyers define this as electronically stored information (ESI). It involves: 1- identifying, 2- locating, 3- retrieving, 4- handing over the requested information. Because the lion's share of corporate information is now stored electronically, e-discovery can be a complicated, time-consuming and expensive process.

5. Why digital data? electronically searched with ease, whereas paper documents must be scrutinized manually. difficult or impossible to completely destroy, particularly if it gets into a network. the data appears on multiple hard drives and because digital files, even if deleted, can be undeleted. the only reliable way to destroy a computer file is to physically destroy every hard drive where the file has been stored.

6. Data Classification A tool for categorization of data to enable/help organization to effectively answer following questions: 1- What data types are available? 2- Where are certain data located? 3- What access levels are implemented? 4- What protection level is implemented and does it adhere to compliance regulations?

7. Data Classification's steps • 1- Define what information you want to protect (specifically, not general data classification) • 2- Discover where it’s located (various tools/techniques, preferably automated, like DLP, rather than manual) • 3- Secure the data where it’s stored, and/or eliminate data where it shouldn’t be (access controls, encryption) • 4- Monitor data usage (various tools, including DLP, DAM, logs, SIEM) • 5- Protect the data from exfiltration (DLP, USB control, email security, web gateways, etc.)

8. Data types data of all types can serve as evidence: This can include: 1- text, images, calendar files, databases, spreadsheets, audio files, animation, Web sites and computer programs. 2- malware such as viruses, trojans and spyware can be secured and investigated. 3- Email can be an especially valuable source of evidence in civil or criminal litigation, because people are often less careful in these exchanges than in hard copy correspondence such as written memos and postal letters.

9. Computer(CYBER) forensics a specialized form of e-discovery in which: an investigation is carried out on the contents of the hard drive of a specific computer. physically isolating the computer, investigators make a digital copy of the hard drive. the original computer is locked in a secure facility to maintain its pristine condition. All investigation is done on the digital copy. http://searchfinancialsecurity.techtarget.com/definition/electronic-discovery

10. First ground of e-discovery 2003: securities giant UBS Warburg was sued by one of its salespersons in what seemed to be a fairly commonplace employment discrimination suit. The way the company handled its electronic information once the suit was filed landed it in deep trouble, however. 2004: a court found that UBS Warburg failed to save emails that might have been used as evidence against it and ordered the company to pay the employee $29.3 million. The landmark case, Zubulake v UBS Warburg, broke new ground for electronic data that must be produced during a lawsuit, a requirement known as electronic discovery, or e-discovery. Since then, the law and practice surrounding the legal obligations for handling e-discovery have continued to evolve.

11. State farm policy State Farm wanted control over and consistency within its e-discovery process. By keeping 25 years' worth of documents in production systems fronted by a master management system, the company greatly reduced the cost of responding to lawsuits. insurer of homes and automobiles keeps anything that might matter: emails, 100% of the email attachments of its claims officers, paper and electronic documents dating back 25 years, even the latest iterations of its human resources Web pages. The voluminous cache, meticulously imaged and coded, is stored centrally in an active system that is searched regularly as litigation arises.

12. Electronic Discovery Reference Model (EDRM) 1- Developed in 2005 by George Socha Jr., founder of St. Paul, Minn.-based Socha Consulting LLC, and Tom Gelbmann, managing director of Gelbmann & Associates in Roseville, Minnesota. 2- A framework that outlines standards for the recovery and discovery and of digital data. 3- Designed to serve as guidance for gathering and assimilating electronic data during the legal process, including criminal evidence discovery. 4- A conceptual standard for the e-discovery process.

13. EDRM steps 1. Information management: Implement data governance processes that alleviate risk and expenses in the event of an electronic discovery request. 2. Identification: Locate sources of information to determine exactly what the data is, and how it needs to be managed. 3. Preservation: Ensure potentially e-discovery-relevant ESI is properly stored using measures such as retention and deletion schedules. 4. Collection: Gather information for e-discovery use. 5. Processing: Reduce the volume the relevant ESI and convert it for review and analysis. 6. Review: Determine the data's e-discovery relevance. 7. Analysis: Evaluate the ESI for content and context, including key patterns and topics. 8. Production: Deliver the ESI to relevant parties. 9. Presentation: Display data findings at depositions, hearings, trials, etc.

14. IT department 1- Where, when, why and how the company stores and destroys data as well as how to retrieve it. 2- The IT team's role has to begin with information management, well before there's any hint of litigation. 3- Successful e-discovery that minimizes costs relies on an organization's information management strategy, namely its data retention/destruction policy and data management system. Experts advise that: 1- IT professionals familiarize themselves with the basics of e-discovery law and legal terms. 2- An organization's IT and legal departments collaborate on important policies and procedures for e-discovery, such as which formats data should be archived in or how long to store metadata.

15. Penalties • The UBS Warburg case set a precedent for identifying, preserving and producing emails and implementing litigation holds. Other high-profile cases have subsequently resulted in heavy sanctions for spoliation. • PricewaterhouseCoopers was penalized with a $345 million judgment for not preserving materials under a litigation hold. • Morgan Stanley was ordered to pay $1.45 billion following a ruling of e-discovery violations, although the ruling was later overturned. • Monetary damages aren't the only penalties for noncompliance. Failure to comply can also result in a company's own employees being barred from testifying or other evidence being excluded. Noncompliance can also lead to an "adverse influence" jury instruction that can cost a company the case.

16. Penalties Judges have held also companies in contempt for not fully complying with e-discovery rules. 1- A judge in Louisiana recently called Dell Inc.'s e-discovery conduct "unconscionable" after learning that the company's search efforts in an ongoing case did not include words such as camera. 2- Arthur Andersen was handed a criminal conviction for obstructing justice for shredding records just before being handed a subpoena from the U.S. Securities and Exchange Commission. Even though it was later reversed, the impact of this charge played a large part in forcing the company to shut down and ushered in the conditions for the Sarbanes-Oxley Act.