Changing Federal Rules to Reduce Discovery Costs

http://www.corpcounsel.com/id=1202640349441?kw=Changing%20Federal%20Rules%20to%20Reduce%20Discovery%20Costs&et=editorial&bu=Corporate%20Counsel&cn=20140128&src=EMC-Email&pt=Afternoon%20Update

Digital Evidence Became Smoking Gun In A-Rod Investigation

Los Angeles, California  (January 14, 2013 ) - Coded text messages and documents detailing an elaborate doping scheme were reportedly recovered that ultimately became the crucial evidence needed by Major League Baseball in the case against the Yankees Alex Rodriguez.

“Merely testifying that a paper document is authentic just isn’t enough anymore”, says Digital Forensic Examiner Mark McLaughlin of Computer Forensics International. “That’s why we’re brought into all types of cases where digital evidence may be found”, he added.

Today, nearly all the world’s information was initially created from a digital device. Plus it’s widely understood that by using Word or Photoshop, you can easily make anything look authentic. So unless you’ve verified the source, the authenticity of printouts as evidence are always questionable. That’s why Digital Forensic Examiners establish a verifiable chain of custody to prove what you’re looking at, is an exact representation of the original.

Examiners like McLaughlin, routinely use cutting edge software tools like EnCase and Lantern when analyzing computers and cellphones on civil and criminal cases. They start by making an exact forensic copy of the entire device – which includes active and deleted data.

Then just the copy is searched, either visually or by using keywords for relevant hits. And those searches can produce tens of thousands of hits that all must be manually reviewed. “That may seem daunting, but considering the alternative, it’s a walk in the park”, adds McLaughlin.

Over the last 17 years, McLaughlin has handled over 500 cases and examined over 2,000 digital items. He testifies in court as an expert and even trains attorneys on how to enhance their cases through digital evidence. McLaughlin says, “I really enjoy the sleuthing part of what we do. Because when we find that smokin’ gun, it’s pretty much game over”.

# # #

Agent: Soldier's laptop had sensitive files

Agent: Soldier's laptop had sensitive files

By Joe Gould, Army Times

FORT MEADE, Md. -- Computer forensics investigators testified Monday that the computer of a soldier accused of sharing military secrets contained thousands of sensitive files and logs of conversations between himself and a former hacker who turned him in.

 

Investigators said they found evidence Army Pfc. Bradley Manning downloaded thousands diplomatic cables, Guantanamo assessment documents, video from a controversial 2007 airstrike in Baghdad and military records of a 2009 U.S. airstrike in Gerani, Afghanistan, in which dozens of civilians were found dead.

As the evidentiary hearing for Manning entered its fourth day, the government had called 13 witnesses and was expected to ask eight more to testify before the defense presents its case. Expected to last several more days, the hearing will help determine whether Manning should be court-martialed on 22 charges, including aiding the enemy. If convicted at court-martial, Manning could face life in prison.

Manning, 24, of Crescent, Okla., is accused of giving the secrets-sharing website WikiLeaks a trove of government material while working as an intelligence analyst in Iraq in 2009 and 2010, including Iraq and Afghanistan war logs, and State Department cables.

On the stand Monday, digital-crimes investigator David Shaver said he recovered more than 100,000 State Department cables and other sensitive information on a secure computer that Manning used.

The cables were contained in a deleted .csv file, ordered by a message record number that indicated the embassy where they originated.

"It seemed like someone wanted to make sure they got all of them," said Shaver, who is special agent with the Computer Crime Investigative Unit of Army Criminal Investigation Command.

In open session, prosecutors and defense attorneys sparred over the potentially damaging evidence. Under cross examination, Shaver said to defense attorney Capt. Paul Bouchard that some of the cables did match those published by WikiLeaks. The damaged file could only be opened with special tools, which could explain why those documents weren't published.

Based on an examination of Manning's computer, Shaver said he recreated Manning's searches, which led to downloads of detainee assessments that have been published by WikiLeaks.

On Manning's personal laptop, a MacBook Pro, CCIU investigator Mark Johnson said he found chat logs between Manning and hacker Adrian Lamo.

On Sunday, Shaver said in court that "it stood out" that on one of Manning's laptops, Firefox's homepage was set to Intelink, considered the main search engine for the U.S. intelligence community's secure networks, and that it was set not to record its browsing history.

From the time Manning arrived in Iraq in October 2009 to May 2010 when he was arrested, Manning had conducted many intelligence searches using key words including "WikiLeaks," "Julian Assange" (WikiLeaks' founder), "Iceland" and "retention of interrogation videos," Shaver said. The last term corresponds with a solicitation from WikiLeaks.

Investigators concluded that hundreds of documents, image and video files that had been downloaded through Manning's computer profile that were connected to a controversial U.S. airstrike in May 2009 at Gerani village. Shaver said files included documents about burn victims and aerial reconnaissance video.

Shaver said he found two versions of a 2007 video, called "Collateral Murder" by WikiLeaks: The "released version from WikiLeaks and another version that seemed to the source for it." WikiLeaks used the gunsight video from Apache helicopters involved in a series of air-to-ground attacks in 2007 in which 11 people died, including two employees of the Reuters news service.

Defense attorneys have focused on supervisors' failure to pull Manning's security clearance in spite of his erratic and sometimes violent behavior, as well as broader security lapses in the facility on Forward Operating Base Hammer where Manning worked. Fifteen people, including the noncommissioned officer in charge of the facility, have been disciplined in the case.

Contributing: The Associated Press

http://www.usatoday.com/news/military/story/2011-12-19/manning-wikileaks-hearing/52074010/1?csp=34news

Making It! Featured Entrepreneur Mark McLaughlin of Computer Forensics International

Documents Show 'A Culture' of Illegal Phone-Hacking At The News of The World

Reprint from The Hollywood Reporter - 10:13 AM PDT 11/1/2011 by Mimi Turner        

http://www.hollywoodreporter.com/news/james-murdoch-phone-hacking-scandal-news-corp-255869?utm_source=SilverpopMailing&utm_medium=email&utm_campaign==?utf-8?B?TWFpbGluZyBEb2N1bWVudHMgU2hvdyAnQSBDdWx0dXJlJyBvZiBJbGxlZ2FsIFBob25lLUhhY2tpbmcgQXQgVGhlIE5ld3Mgb2YgVGhlIFdvcmxkKDExLzAxLzIwMTEgMDE6Mjg6MjAgUE0p?=&utm_content=

 

 

Bloomberg/Getty Images

 

A 2008 legal opinion from Michael Silverleaf QC will put further pressure on James Murdoch to explain whether he was part of a cover-up.

LONDON - Pressure is mounting on James Murdoch to explain his knowledge of phone-hacking allegations after the Parliamentary Culture Media and Sport Committee Tuesday published a cache of devastating documents showing that phone-hacking was known about by senior executives at News International as early as 2008, almost three years before the publisher admitted that the problem was systemic.

A legal opinion dated June 2008 prepared for News International lawyer by Queen's Counsel Michael Silverleaf, said that there was "overwhelming evidence" that senior journalists were involved in what amounted to "a culture" of illegal phone-hacking at the newspaper.

The lawyer also said that News of The World investigator Glenn Mulcaire appeared to have been hired purely "to engage in illegal gathering."

Silverleaf was hired as an external senior barrister in 2008 to advise News International on the legal case being brought against it by Gordon Taylor, head of the Professional Footballers' Association.

James Murdoch later approved a payment of almost $3 million to keep the case out of court.
The damning legal opinion tells News International's legal team that the chance of winning the case is "slim to non-existent" because of the amount of "truly damaging" information that Taylor's legal team had obtained after getting a court order to access the documents in a previous legal case against Glenn Mulcaire, who was jailed for four months in relation to hacking the phones of members of the Royal family.

"In addition there is substantial surrounding material about the extent of NGN journalists' attempts to obtain access to information illegally in relation to other individuals." The Silverleaf legal Opinion went on.

"In the light of these facts there is a powerful case that there is (or was) a culture of illegal information access used at News Group Newspaper in order to produce stories for publication.
The Silverleaf memo was sent to Tom Crone, the News of The World's internal lawyer.

"Not only does this mean that NGN is virtually certain to be held liable to Mr Taylor, to have this paraded at a public trial would, I imagine, be extremely damaging to NGN's public reputation. If the trial proceeds there would seem to be little doubt that Mr Taylor's case will be advanced on the basis that Mr Mulcaire was specifically employed by NGN to engage in illegal gathering."
These new documents could prove immensely damaging to James Murdoch's claim that he had not been aware of the suggestion that phone-hacking had gone beyond one reporter when he authorised the near $3 million payment.

Murdoch will face tough questions on what he knew about the payment when he is recalled on November 10, given the extent to which the information about illegal behaviour was known internally.
But it is still unclear the extent to which James Murdoch, then chief executive of News International was fully informed.

In a handwritten memo of a conversation between former News of The World editor Colin Myler and an advisor to Silverleaf, Julian Pike of Farrar's Solicitors, about five reporters under investigation, Pike appears to quote Myler in a handwritten scrawl: "Les no longer here - James wld say get rid of them - cut out cancer."

The most likely interpretation of the - note could be that Myler had told Pike that James Murdoch would not have entertained keeping the reporters on, however senior.

James Murdoch is due to give evidence again to the House of Commons Parliamentary Committee on November 10

Interview by the Making-It TV series

http://www.facebook.com/video/video.php?v=1190547372953

Jackson Death Trial Showcases iPhone Forensic Capabilities

Los Angeles, California  (October 5, 2011) - “iPhone users would be stunned to learn the amount of recoverable data we can get”, says Mark McLaughlin of Los Angeles based Computer Forensics International. “When you hit delete it doesn’t necessarily mean that message, text or picture is gone forever. You’re just telling the iPhone, don’t show it to me anymore and it flags that deleted data so it can be overwritten. So depending on the activity after the deletion, we may be able to bring it back like it was never deleted.”

DEA Computer Forensics Examiner Stephen Marx testified today in the Michael Jackson Death Trial that he found emails the defendant Dr. Conrad Murray had sent hours before Michael Jackson died on June 25, 2009. Not only did Marx recover critical timeline emails, he also discovered digital medical charts thought to be non-existent. But the key piece of evidence was a damaging audio recording of an impaired Michael Jackson reportedly made by Murray.

Computer forensic examiners like McLaughlin, routinely use very sophisticated software tools, such as EnCase, on civil and criminal cases. They start by first making a copy of the iPhone’s entire memory – which includes active and deleted data. This exact copy doesn’t disturb the original data which makes the examination forensically sound and admissible in court. Then the copy can be searched either visually or by using keywords. The recovered data is ultimately put into known iPhone categories and displayed.

McLaughlin says, “our SmartPhone forensic capabilities have improved exponentially. But it stands to reason because they’re just pocket computers, and we’ve been searching them successfully for nearly 20 years now. So I guess people need to realize that if it’s there, we’re usually going to find it”.

# # #