E-Evidence Acquisition Strategy, Essay Example

Introduction

When computer forensics investigators perform the discovery of digital data and documentation, this process is known as e-discovery. The process of paper discovery led to the term e-discovery as investigators transitioned from primarily collecting evidence in paper form to a computer or electronic form. Courts may issue orders for evidence from these sources to be disclosed. If the corporation does not comply, this action is seen as hiding evidence and possibly obstructing justice.

Rule 26 Versus EU Directive 95/46/EC

Currently, the problem that exists for investigators occurs when the rules governing discovery are different between foreign countries, such as with the European Union (EU) member states. Investigators are presented with different rules governing the collection of private data, including its preservation and transport. The Federal Rules of Civil Procedure, Rule 26—Duty to Disclose; General Provisions Governing Discovery—in the United States does not apply for searches of electronic evidence in the EU. When investigators cross EU boundaries to perform e-discovery with other EU investigators, local laws governing the discovery process must be followed for evidence to be considered admissible and for privacy to be protected for the EU citizen.

Cooperation between the two investigative units can resolve any misunderstandings in this area. Unfortunately, foreign privacy laws act as clear roadblocks to the U.S. e-discovery process. EU privacy laws are found within the EU Directive 95/46/EC, which was effected by the European Parliament in 1995. In many instances, the EU Directive provides its citizens complete protection from investigation. The protection provided by the EU Directive is clearly different from that provided by the Federal Rules of Civil Procedure, Rule 26, which dictates that all parties must allow complete access to any data or information that may be pertinent to the case, including private data.

Specifically, the EU Directive affects the ability of the investigator to pull and analyze forensics data with a forensics tool. Unlike the American e-discovery process, which uses the evidence to establish a case against and guilt of the party, the actual review, processing, and transference of the discovered private data cannot happen without the clear connection between the evidence and the individual’s defense. The main question that exists between the United States and the EU is, “Are the EU discovery rules enacted to ensure that investigators from the United States are blocked from performing e-discovery specifically on private data?”

There are many EU investigations conducted in Switzerland, the U.K., and France that are blocked through what is called a blocking statute, which restricts the extent to which U.S. investigators can gain access to critical electronic evidence necessary for the prosecution of an EU citizen (Waterman, 2009). Even crimes being conducted across international boundaries can be protected through the use of blocking statutes in EU member states. U.S. and EU investigators simply coordinate their efforts to ensure that they all understand the limitations of the blocking statute. Unless the evidence is clearly related to the defense of the legal claim, the evidence cannot be transported.

Bypassing Language Barriers

Another challenge of e-discovery across international boundaries is language barriers. Investigators work to bypass this barrier by investigating suspects with specialized forensics tools. Systems that are being developed in the United States for e-discovery across international boundaries are those that may track all the data transactions that occur between IP addresses. Data transactions between the source IP address and the destination IP address will be monitored and analyzed for criminal activity. Therefore, investigators can monitor and analyze criminal data transactions without ever having to perform a complete e-discovery imaging of the computer and storage of the electronic evidence. Once this technology identifies the illegal or suspicious data transfer between IP addresses, it may be able to store this data without holding any of the private data. By not collecting the private data, U.S. investigators avoid violating EU privacy directives (Waterman, 2009).

There are various grounds for both EU and U.S. authorities to carry the collection of computer forensic evidence, or to engage into what is considered as the e-discovery process. Defendants in criminal concerns and the litigants in civil cases may be focus in investigation by either the EU or the United States. EU member states need the U.S. investigator to work with EU computer crimes sections to carry out the investigation. The e-discovery measures and the EU Directive preside over the investigation and defend the rights of the EU citizen. Coordination meetings between U.S. and EU investigators can determine the disparity between the two electronic-evidence compilation strategies.

Detailed knowledge of the EU Directive and its conduct of privacy are necessary before the United States may be engaged in the e-discovery—if the investigator is permitteded to contribute at all. Once inside an international e-discovery analysis, U.S. investigators must understand that U.S. laws may not be relevant. For instance, the criminal and civil law measures relating to how investigators look for for evidence may not apply. The influence of the U.S. Computer Fraud and Abuse Act does not apply to the procedures used to acquire digital evidence in fraud investigations. Civil privacy laws, such as HIPAA, GLB, FERPA, and ECPA are not relevant to EU citizens. The Wiretap Act and Pen Register Trap and Trace laws also are not relevant at all to an investigation being carried out against an EU citizen. Any concerned party of the U.S. Electronic Communications Privacy Act has no power at all in the EU. Consequently, although the U.S. investigator may have enormous acquaintance of the U.S. civil and criminal laws, it will not help during an EU investigation (Hunter, 2011).

Search and Seizure of Evidence

There are numerous laws that both U.S. and EU investigators must be familiar with to preside over their investigative actions during e-discovery in the EU. Criminal and law measures concerning the search of evidence include the EU Data Protection Directive, Data Retention Law, and the Information Systems Attacks Decisions (Bromson et al, 2007).

The basic ideas of searching the file system, engaging in volatile data recovery, and probing data layers and the hard drive will then be familiar to both investigators. Each subject, however, is exceptional to the EU investigator. Therefore, it must be handled in a different way within a legal sense.

The prearranged measures that are followed in that each case is different in the EU from those in the United States. For example, in the United States, complete bit-stream imaging procedure may be only the targeted image of the hard drive to guarantee that private data is not overlooked. In the incidence of copyright violation, the entire bit-stream copy made by a U.S. investigator would represent copyright infringement under British law.

One of the crucial mistakes made by U.S. investigators happens when they permit the Federal Rules of Civil Procedure (FRCP) to violate the EU Directive or do not recognize the structure of discovery. The structure of discovery is diverse between the United States and the EU because the EU has stern potential of privacy in the workplace and the United States do not have. The FRCP offers broad discovery of all data in the bit stream, including private data, but the EU may not permit this broad relocation of data (Bromson et al, 2007).

The EU Data Protection Directive guarantees that U.S. investigators only employ proficient forensics apparatus to process private data required for the defense of the EU individual. The U.S. investigator must guarantee data protection notices to the EU law enforcement authority about why the personal information is being used. The data collection must comprise safety procedures employed to safeguard the data, and the moment this data has been used effectively in the investigation, it will be discarded.

References

Bromson, D. L, Isenberg, J. D., Rajoo, S. K. & Reissner, H. J. (2007, August 23). Data privacy in the E.U. and how it impacts firms in the U.S. Retrieved October 31, 2009, from the International Legal Technology Association Web site:

Hunter, S. (20011). E-Discovery: What Increased Data Protection Means for the Global  Economy. Retrieved November 17, 2011 from http://ediscovery.quarles.com/

Waterman, K. (2009, June 18). The cross-border ediscovery challenge & the possible accountable systems solution. Retrieved November 3, 2009, from the K.KrasnowWaterman.com Website: http://www.kkrasnowwaterman.com/professional/tabid/3075/bid/9651/The-Cross-Border-eDiscovery-Challenge-The-Possible-Accountable-Systems-Solution.aspx