I am sure that there is a corollary “law” similar to Moore’s law (the number of transistors that can be placed inexpensively on an integrated circuit doubles approximately every two years) regarding the increase in new crimes that rapidly follow advances in new technology. Each time there is advancement in computer technology, it seems that there is an equal increase in the need for forensic analysis as people use computer skills in attempts to cover up their crimes. Electronic data has created an entirely new method of falsifying evidence which has required a corresponding increase in investigative methods.
An increase in the importance of forensic document analysis has occurred both within government agencies (think FBI) and EDiscovery consultants, on the cutting edge of technology in order to keep up with the increasing demand during litigation. The courts are realizing that this expertise is required in order to fairly evaluate the evidence that is part of today’s litigation.
Since this is an emerging area of expertise, there has been some confusion about where and how to present individuals as experts for the purposes of testifying. A recent ruling in the US District Court for the Southern District of Florida, Coquina Investments v. Rothestein and TD Bank, 2011 U.S. Dist. LEXIS 120267 (S.D. Fla. Oct. 18, 2011, helps to define the reliability of a digital forensic expert’s report. This is a civil case that included allegations of electronic forgery. There were several Daubert motions filed that sought to exclude the testimony of various traditional types of experts that covered areas of financial damages and generally accepted accounting practices. Additionally, the plaintiff sought to exclude what they claimed was a new type of expert when the defendant’s expert submitted an opinion that certain electronic documents were in fact e-forgeries.
The plaintiffs main argument was that the opinion of the defendants’ metadata expert was unreliable and should be excluded because the expert had only reviewed a sample subset of the total data. The Court reviewed the expert’s accompanying methodology and report and ruled that the expert had “employed a sound metadata analysis” and would be able to offer testimony about the emails identified as forgeries. The Court further concluded that the fact that only a sample was examined would only impact the weight of the evidence presented but did not impact the reliability of the experts conclusion about the forgeries.
I believe that this ruling creates an important precedent in metadata analysis while employing a commonsense approach to today’s exponential growth in data. Since EDiscovery productions often number in the hundreds of thousands if not millions of pages of documents, there needs to be a practical scientific method of analyzing the documents and the related metadata. It is impractical to think that each and every document needs to be examined before certain conclusions can be drawn about the document population. The use of sampling is a long accepted scientific practice that must be employed in litigation given the ever increasing size of document populations. This ruling goes a long way towards making sampling an accepted practice and offering forensic metadata expertise as a valid reporting mechanism.
Comments