Connecticut Employment Lawyer & Attorney : Daniel Schwartz : Stamford, Hartford New Haven, CT

Every so often, it's nice to hear from people who know what their talking about. Today, we've got part of this blog's "Five Questions" feature. 

I posed five questions for Frank Rudewicz, Managing Director of UHY Advisors FLVS, Inc.  UHY provides forensic litigation and valuation services which are particularly useful for things like electronic discovery, trade secrets and case investigation. 

I've worked with Frank for a number of years and those in Connecticut may know Frank from his prior company, Decision Strategies.  Frank spent 14 years with the Hartford Police Department and FBI and has built an impressive resume in the field of trade secrets and investigations.  He also received his J.D. from University of Connecticut.  Thus, his experience both as a police officer and as a lawyer provides a good foundation for the services he and his company offers.

I asked him recently to provide readers of this blog some additional insights into the area of forensic litigation.

1. Intellectual Property Theft seems to be a "hot" issue. If an employer suspects a current employee is stealing data, when should they contact an outside forensic expert?

When one has a reasonable anticipation that intellectual property ("IP") is being compromised, one should begin a dialogue with a data security/forensic expert. This dialogue may touch on topics such as:

• determining whether one's suspicions are justified,
• whether the suspected IP compromise is internal or potentially an external threat masked as an internal compromise (i.e., an external party who obtain an employee's user name and password),
• methods to audit, monitor, and document the suspicious activity,
• develop a timeline documenting the suspicious activity,
• investigate method of intrusion, if applicable,
• define triggering events to begin data preservation.

2. From a technical perspective, what are some steps that an employer should take around the time it is terminating an employee to preserve data?

• Physically secure all computing equipment (including mobile messaging/cellular device) and digital media (USB flash drives, external hard drives, etc.) of terminated employee before termination
• Secure terminated employee's network home directory and other network file shares that the terminated employee had access
• Disable terminated employee's network user account, verify terminated employee is logged out of any online systems, and notify any third party application/database/website provider to revoke terminated employee's access.
• Reset the terminated employee's access code to voicemail system; consider reviewing/preserving any voicemail messages before system purges the same; configure auto forwarding of new calls either to HR or administrative mailbox.
• Before re-provisioning any computer equipment that belonged to the terminated employee, consider performing a forensic image of the equipment and wiping the equipment before re-provisioning
• If terminated employee has administrative access to any corporate computing systems, change all administrator passwords immediately.

3. Is there a common item that employers overlook in trying to capture data when an employee leaves?

Blackberry messages, instant messaging, voice mail captures.  [Employers should consider conducting]  a software inventory and Web browsing history of the terminated employee's computer to highlight other areas of interest. For example, are there FTP sites that the terminated employee visited, which may indicate potential risk that the employer's data was compromised.

If the terminated employee is savvy, file extensions may have been renamed to hide relevant information. Absent a file signature analysis, these files may be overlooked.

4. What is the hot item in forensic litigation consulting?

Data Landscape Modeling

5. What types of questions should a company or lawfirm ask when considering hiring a forensic firm like yourselves?

• Are they licensed?
• Do they have written policies and procedures to ensure "forensically sound" evidence?
• How do they charge?
• Does your staff carry current industry digital forensic certifications such as EnCE?
• Do you use full time staff to perform forensic analysis or do you use contractors (use of contractors may break chain of custody)?

Watch for more Q&A in the upcoming weeks.

• Email This
• Print
• Comments
• Trackbacks

You're an employer in Connecticut. You've just been sued.   Besides contacting a lawyer (and you ARE contacting a lawyer, right?), what else are you doing about the new case? 

A new case in Connecticut suggests that preserving electronic data should be a top priority.  Why? Because under new court rules, failure to do so could lead to sanctions or inferences that a party destroyed evidence that would've been harmful to its case.  Indeed, the case suggests, in fact, that the duty to preserve evidence may arise even before the lawsuit is filed. 

In, Doe v. Norwalk Community College, 2007 WL 2066497 (D. Conn., July 2007), the court granted a motion for sanctions against a party who had failed to preserve electronic evidence.

Under the new safe harbor provision of Federal Rule of Civil Procedure 37(f), data management must be maintained through a routine system; moreover, the company must take some affirmative action (such as a letter to key potential witnesses and IT consultants within the company) to prevent that everyday system from destroying or altering information once the party becomes aware of the case.

In this case, the party (Norwalk Community College) did not do so.  It did not preserve the hard drives of key witnesses. Indeed, and even more damaging, those hard drives had been cleaned of data.  Indeed, the expert for the other side -- who inspected the  computers, concluded that there were inconsistencies in the PST or Outlook e-mail files. 

Because the company did not suspend the routine document destruction policy and "put a litigation hold in place," the court rejected any safe harbor arguments under Rule 37(f). Instead, the court granted the plaintiff request for sanctions and imposed an adverse inference jury instruction regarding the destroyed evidence (along with attorneys fees, costs and expert fees).

So, does this mean that an employer can wait to be sued before preserving evidence?  This decision clearly says no.  It found that the obligation to preserve evidence arises even before the lawsuit is filed.  Following other precedent, the court held that the duty to preserve electronic data arises at the time when litigation is "reasonably anticipated". 

While some employers and companies prefer to handle pre-litigation matters by themselves, the case serves a reminder that little actions (or inactions) at the start of a case can have much larger consequences down the road.  Issuing litigation holds and suspending routine document retention policies upon notice of a complaint may be one way to avoid these larger consequences down the road.

(Hat tip: Delaware Corporate and Commercial Litigation Blog)

• Email This
• Print
• Comments (1)
• Trackbacks (1)