As a computer forensic specialist, my consulting practice revolves around digital evidence, forensic investigation training and electronically stored information (ESI). The objective of my work is to help bring meaning to digital evidence by bridging the gap between technology and law. Judges know that they don’t have to go back to school to acclimatize themselves about digital evidence. That is not their work. Theirs is to listen to the evidence or submissions by each party presented in a layman’s understandable manner. They reach a conclusion based on the presented facts. It is on this basis that Judges believe electronic discovery should not be as difficult or expensive as some lawyers would like to make them believe.
One of my retired Judge friends once said: “The Judge is happy when lawyers are knowledgeable about the facts of the case. Complications in any case arise where counsel doesn’t know what s/he is doing or how the evidence was obtained. All practicing lawyers should know how to identify, acquire, analyze, preserve and present evidence – digital or otherwise. Where counsel doesn’t know, he or she must enlist the support of an expert who knows.” Digital evidence is a constant reality today. Lawyers must master digital evidence just like accountants must stay abreast with the recent developments in accounting.
Dilemma 1: An incompetent lawyer.
It is very frustrating to deal with a lawyer who is incompetent about the issues at hand. They don’t know the relevant law, the precedence and the best practice. As you know, cases are won or lost based on the lawyer’s understanding of the basics, and the initial steps taken when a matter is brought to the chambers. A good case might be lost because the lawyer is damn incompetent or completely negligent!
Case study 1.
In July 2012, a lawyer who had attended one of my presentations called for advice about his client who had been summoned to attend a disciplinary hearing (DH). His client had been working for a financial institution in their IT department. A fraudster had used his username and password to post a transaction of about Ugx. 80m to a fraudulent account that had just been opened in the bank. The money had been withdrawn at the counter by an unknown person the following morning. On identifying the staff’s username as having been involved in the fraud, the Head of Security reported the matter to Police and had the suspect’s statement taken, and a police file opened. The financial institution also put the staff half pay suspension. After a month, the suspect (my lawyer friend’s client) received a letter to appear before the financial institution’s disciplinary hearing. As required by law, he was allowed to appear before the DH with any two people of his choice. Because this was an IT fraud, that is how the lawyer got me into the picture.
The good thing with justice is that it focuses on facts. There are no ‘draft facts or final facts.’ Whatever you present, if it is factual and relevant to the case, it is final. You can only keep adding more factual information to water tight your case through connecting the dots.
My advice to the lawyer was: “Go with your client to the DH. Don’t let your client say anything, as Police already took his statement, so the matter is already criminal and they want evidence. Just ask for the financial institution’s investigator to give you a complete forensic investigation report which they are basing on to suspect your client. Also ask for one week to understand the report. Keep all your discussion within that request.”
Things were smooth at the DH for the lawyer. As expected, the financial institution had not done a forensic investigation. They had done an audit. A forensic investigation provides analysis of who did what, where, when and how. Depending on the quality of the investigation, it can also help connect the dots by stating the motive or the ‘why’ of the incident.
After a week, he brought the audit report for our analysis. Again, the lawyer did not know what to do. I briefed him about the critical areas of a forensic investigation and the weaknesses of an audit report. First, an audit is subjective. Different auditors may provide different results because the tools used are not standardized. Auditors rely on materiality and therefore do lots of sampling. In forensic investigation, everything is material. You need to get a full picture of a given case to be able to make an informed judgment. Auditors use tools that often lead to spoliation of the ‘smoking gun’ evidence. Their approaches and tools involve tempering with the original evidence which can be challenged at trial. The list is long. We evaluated item by item in the auditors report and found lots of holes. The investigator had not done proper first responder procedures with the computers involved in the fraud. The chain of custody was lacking. So were other critical investigation musts. We drafted a letter requesting for clarification to the financial institution’s lawyer and HR and advised them to reinstate the staff in the meantime as they were making a huge mistake based on hearsay. The financial institution did not respond. They instead reinstated the client of my lawyer in his position and forgot all about the case.
The above is a classical case of an incompetent lawyer. How could the financial institution’s attorney proceed with a case with a poorly done investigation? How can today’s lawyer fail to create a case file and review each and every piece of evidence and its importance to the case? When a company lawyer fails to advise accurately on matters of procedure, who should incur the resulting costs for the loss or withdrawal of a bad case? Great lawyers give an accurate first opinion because they see through the wall. Such hindsight comes like a spark and is a result of experience and general awareness. You must be informed and competent.
The lawyer’s duties are to supervise the client’s identification, collection and preservation of all evidence – electronic or manual. Electronically stored information (ESI) has broadened in terms of forms and systems. Unfortunately, lawyers have not kept pace. This lack of knowledge about ESI brings a dilemma to Judges who rely upon lawyers to ensure the integrity of the discovery process. How can you defend what you don’t understand?
The failure of lawyers to understand e-discovery is a huge cost to the justice system, their clients and everyone who rely on their work. Digital information is on the rise and you either change or look for another profession.
To be continued in the next issue.
Mustapha B. Mugisa, CFE, CHFI is a Forensic and Anti-fraud Expert.
