Category Archives: Science

The Exchange: Cyber Security

TGCIHot on the heels of Today's General Counsel and Institute's eDiscovery-based, "The Exchange" comes something new:  "The Exchange: Cyber Security.  This is not a 'tour'; it's only held in two locations.  Thankfully for me, one is – once again - at The Bar Association of San Francisco, April 27-28, 2015.

Any guesses where the second one will be held?  Hmmm….where is this kind of thing prevalent?

Washington, D.C., of course!  That conference isn't until November 2015 – you have time.

I attended most of day one of The Exchange yesterday and it's as robust as ever.  Still a great choice if you want to get the big-picture view from every corner of our profession. 

Registration is open, but be warned; it's almost completely full and the rules are different this time.  You may use the same free code to register if you're my corporate readers only:

TGCICOMP

Sorry law firms – you still have to pay.  Also, this is a vendor-sponsored event, so no outside vendors allowed.  

P.S.  I'd like to give a shout-out to my good friend from TGCI, Neil Signore, who has graciously provided complimentary admissions.

e-Evidence Insights: Mars Needs Moms; But Science Needs Humans

TWINS_320

"It's an inexact science."  We've heard that phrase often.  But, how often have we heard it in reference to DNA?  Usually, we hear it more in terms of how it identifies a particular suspect with astronomically-high odds, such as, 'one-in-a-million'.  In other words, it must be him because mathematically, it couldn't possibly be anyone else.

Consider the very bad luck of our suspect in today's story:

 

  • A murder was committed.
  • The suspect's DNA was found on tape used to gag the victim.
  • Based on this evidence, he was promptly arrested.

Now, factor in the very good luck of our suspect in today's story:

  • He had an alibi.
  • He was able to prove it beyond all doubt (i.e, it wasn't his mother claiming that he'd been with her the entire time – he was in a hospital).

In fact, he was nowhere near the scene at the time of the murder; nor was he ever at the scene.  Yet, he spent five months in jail before he was eventually exonerated.

This appears to be a bizarre case of transference.

Furthermore, DNA is not necessarily like snowflakes; sometimes, two samples are identical (at least within the range that law-enforcement would feel comfortable arresting and prosecuting a suspect).

The moral of this story?  We rely on science; but sometimes, science must also rely on us.

ReInventLaw Silicon Valley: GoldenState & the Three Bears

RILSC 2013
What the hell was that???

I’m speaking of the all-day ‘experiment’ (that’s what I’m calling it), ReInventLaw Silicon Valley 2013 conference this past Friday.  Is that a criticism?  Not at all.  This was the kickoff event of a collaborative effort; law students, professors, technologists, investors, inventors, attorneys and everything in-between, all convening in one place (The Computer History Museum in Mountain View, California, to be exact) to talk about the future direction of law practice.  Approximately 40 speakers in all.  You read that right; 40 speakers in a single day (enough to make an LPMT Chairman cry).

And what did we see?  Good talks, bad talks, decent talks, shameless sales pitches, moderately-shameful sales pitches.  Terrible speakers with outstanding messages, outstanding speakers with terrible messages & mediocre speakers with mediocre messages.  Speakers who went on too long, speakers who didn’t go on long enough and speakers who were juuuust right (yes, this was the LPMT-equivalent of the Three Bears…).

And of course, live streaming Tweets hosted on a PC with an IP-address conflict (DHCP, my friends; old school!).  There were funny tweets about there only being five ties in the room (I happened to be one of them).  My response was to create the hash tag, #thesmartesttiesintheroom.

In other words, I had a great time!  It’s very easy to criticize something like this, I suppose, but the organizers were able to land many hard-to-attain speakers while simultaneously coaxing approximately 350 people (by my rough count of how many actually showed up vs. the 500 tickets that were distributed) to convene in one location for a healthy exchange of ideas.

I gotta go…my porridge is getting cold…

Solid State, Spoliation, Stochastics, Shrodinger’s Cat & Wyatt Erp

MP900401975Last year, I was presenting at the Calbar Solo Summit and the issue of gleaning evidence from solid state drives (aka SSDs) came up.  From a technological standpoint, SSDs are highly efficient; from a forensics standpoint, they can be a nightmare.

The problem one faces with being queried about this issue is that it results in a very common answer I have to give when faced with a one-hour presentation and little time to explain; it depends.  Of course, on this blog, I’m not time-constrained.  Furthermore, I don’t re-invent the wheel when others have so elegantly explained the issue.

But, for a basic overview, let’s break down the data recording patterns into three possibilities:

  1. Random data is written to an open area.  When data is marked for deletion, it is not deleted immediately, but in the future, when a need arises to utilize that space.
  2. New data is written to an area containing existing data that is marked for deletion, thereby overwriting that data.
  3. Data marked for deletion is actually erased, then other data is written to the same area at a future time.

If you asked most people what happens when they record something on magnetic tape, most believe that there’s simply one ‘head’ that records onto the tape while simultaneously recording over anything that already exists on the tape.  Not so.

This is where “ERP”, comes in.  It’s just a simple mnemonic that stands for “Erase”, “Record” and “Playback”.  There are actually three separate heads, in that order, so when the tape passes over them, the first head erases any data, then the second head records new data.  In playback mode, obviously, the other two heads are bypassed and the playback head is used.

The reason I mention it is that most people also believe that deleting data on a drive is instantaneous, when normally, as illustrated from the examples above, it is not.  However, SSDs are closest to that process through an operation called ‘self-corrosion’.  Very soon after data is marked for deletion, that data may be gone; and I mean, really gone and unrecoverable.

Add that to the long list of challenges faced by data forensic investigators.

eDiscovery California: Upcoming Panel: eDiscovery and Legal Technology in Practice Conference – San Francisco

00443095
I'm going to be on a roundtable panel at the Thomson Reuters 'eDiscovery and Legal Technology in Practice' Conference 2012 in San Francisco.  It's an all-day event, taking place on December 5th.  It's a terrific agenda; here's the scoop on my specific panel:

12:00pm – 1:10pm

Under Fire: Defending and Challenging a Motion against Technology-Assisted Review – A mock Meet and Confer (26f) hearing.

Panelists:

Nicole Armenio – Kroll Ontrack Solution Architect
Perry Segal – eDiscovery Attorney and Management Consultant, Charon Law
Hon. Socrates Peter Manourkian – Judge of the Superior Court, County of Santa Clara

It's entirely possible that by 1:00pm, the attendees will all be thinking about lunch…

I Never Promised You a (Dusty)Rose Garden…

Artificial-Sweeteners
…but I did promise to try to post more often.  Isn't it a shame when work gets in the way of a good blog post?  Having not posted anything this week, I wanted to let you know about two subjects I'm working on for you right now:

  1. Due to all of the controversy over Google's privacy policy, I'm writing an instructive article about alternate software products you may use to sync email, contacts and calendar on all of your devices; including desktops, laptops, tablets and smartphones.  And here's the best part – you can do it free (for power users who want more robust features, I'll also include some pay options).  I don't know about you, but being able to create emails, calendar appointments and/or modify contacts – then having the device automatically propagate the data to all of my other devices simultaneously – is one of life's greatest time-savers!  Here's another bonus, that should appeal to many of you – you'll have a database that lives on your own device, not just via access in the cloud.  Yes, there will be pictures, in fact, I've been playing with an excellent app that creates terrific images from a non-rooted Android smartphone.  Stay tuned…
  2. I'm also working on a comparison of scientific analyses in California courts versus other jurisdictions.  I'd seen a few good articles floating around about using the Daubert analysis to support the implementation of predictive coding.  Well, that's not going to help in the Golden State, where we follow the Kelly-Frye standard (aka the 'Kelly' standard).  I'd had a lot of exposure to this during my days at the Los Angeles County District Attorney's Office.  Ask me, sometime, about how my boss and I successfully used a "Sweet'N Low" packet to impeach the defense's scientific evidence in a criminal case, once.  I suppose today, we would have called it the Splenda Gambit…

I won't post until I have the time to do the quality job you expect, so look for them a little ways down the road.  In the meantime, enjoy your weekend!

Don’t Do the (Cyber)Crime if you Can’t Do the Time

MP900316414
The ABA Journal Tech Report has a comprehensive examination of cyberwarfare from their May 2012 issue.  It examines the perceived attorneys' role, Constitutional limitations and international law issues.  There are contributions from a host of experts, including some very polarizing figures, like John Yoo.

Hey, you know there can be no valuable debate unless you hear out assenting and dissenting views, right?

Be warned; this is not a light read, by any means…

Case Got Your Tongue? Court Cases Aren’t Horse Races

MH900228831I understand we live in a ‘first-to-press’ world, and I further understand that – most of the time – it’s important to get a story out as soon as possible.  But, that doesn’t mix too well with judicial decisions.  In my view, you should treat them like a fine meal.

Allow some time to digest them.

So, this is why I didn’t jump on the predictive coding decision by Judge Peck in Monique Da Silva Moore, et al., v. Publicis Groupe & MSL Group, Civ. No. 11-1279 (ALC)(AJP) (S.D.N.Y. February 24, 2012).  The odds were, it would be contested and it is being contested; in rather strong language, I might add.  A lot of that language is being directed at the alleged misconduct of Judge Peck, himself, among others.  I’ve seen Judge Peck speak.  Water off a duck’s back, I suspect.

As some of my colleagues would say, “That’s litigation.”