Gates Rubber Company v. Bando Chemical Industries, Ltd., et al

Gates Rubber Company v. Bando Chemical Industries, Ltd., et al.[1] is a decision by the U.S. district court for the District of Colorado from May 1, 1996. It is considered a landmark decision[2] in terms of expert witness court testimony in questions of electronic evidence[3] and digital forensics.

In a nutshell, the decision states that the authenticity[4] of electronic evidence is accepted by courts only if the party adducing the evidence complied with the newest technical standards of electronic evidence acquisition.[5] Moreover, U.S. magistrate judge Schlatter commented on the factors he considered relevant in the process of weighing the qualifications of digital forensics experts when those present contrary opinions or conclusions to the court. Hence, Gates v Bando has set legal standards for examining electronic evidence that have remained relevant to this day.[6]

The facts of the case

edit

Gates Rubber Company and Bando Chemical Industries were both involved in the manufacture of industrial belts as direct competitors. Several defendants aside from Bando were former employees of Gates, who had signed written non-competition agreements before they left the company. In 1989, Gates learned that the latter used a computer program highly similar to one of its own, so that Gates suspected its former employees had stolen, copied and used it for Bando. Accordingly, Gates filed several actions on the grounds of unfair competition, misappropriation of trade secrets, infringement of copyright, and breach of contract.[7]

During the court proceedings, in 1992 Gates learned that N., one of its former employees, deleted a computer program from his computer at Bando, which Gates claimed to be an unauthorized copy of a copyright-protected software of his own. Furthermore, (and actually decisive as regards the influence of digital forensics in trial), N. also "deleted" several word-processing files on the same computer, testifying that he did not erase any materials relevant to the pending litigation. Consequently, Gates applied for disclosure, in order to examine whether or not the defendant had maliciously deleted files in an attempt to destroy evidence. The court granted Gates a court order that allowed Gates to copy the hard drive of Newman's computer in order to obtain as much information as possible from the "deleted", but reconstructible files. Gates then assigned the technician V. to execute the copying of the hard drive, whereas he subsequently also appeared as Gate's expert witness in the court procedure.

In retrospect, the technical method V. applied to create a copy of the hard drive of N.'s computer as well as his formal professional qualification as a digital forensics expert (particularly in comparison to the expert witness summoned by the defendant) turned out to be the crucial aspects that were decisive for the outcome of Gates claims arising from Bando's alleged violation of disclosure obligations through spoliation.

Acquisition of electronic evidence

edit

In the course of his examination, V. copied a software onto the hard drive of N.'s computer (which contained the evidentiary electronic files), in order to create a file-by-file copy of the hard drive. This conduct induced the court to extensively comment on the forensic methods that must be applied to electronic evidence to allow it to be used as a piece of evidence in court procedure:

First, the court stated that - as a general rule - any digital forensic examiner shall be obliged to "utilize the method which would yield the most complete and accurate results"[8] in order to comply with the legal prerequisites in regard to the admissibility of evidence in court procedure. As a result, several organizations started to continuously publish best practice literature for electronic evidence acquisition.[9] However, it should be kept in mind that such a best practise prerequisite must be considered a dynamic procedural hurdle, as the technical requirements and possibilities in analyzing and copying digital data change with the underlying hard- and software, and consequently the technical procedures to be applied in order to create a legally permissible piece of electronic evidence may change in the future.

Second, the judge held that the file-by-file copying procedure applied by Gates' forensic examiner fails to fulfil the court's "best practice" requirement. Instead, it had been necessary for a forensic investigation de lege artis to copy the hard drive by means of creating an image (or: mirror) copy:

"Gates retained V. as its technician to do the copying, and he attempted to do this through the use of a program called Norton's Unerase. Proper use of the program could yield information, or partial pictures, about files which were once present on the computer's hard drive, but were deleted.

Gates argued that V. did an adequate job of copying the Denver computer. W. (the defendant's expert witness, remark of author) persuaded me, however, that V. lost, or failed to capture, important information because of an inadequate effort. In using Norton's Unerase, V. unnecessarily copied this program onto the Denver computer first, and thereby overwrote 7 to 8 percent of the hard drive before commencing his efforts to copy the contents... Additionally, V. did not obtain the creation dates of certain of the files which overwrote deleted files. This information would have assisted in determining the deletion date of some files.

W. pointed out that V. should have done an "image backup" of the hard drive, which would have collected every piece of information on the hard drive, whether the information was allocated as a file or not. Instead, V. did a "file by file" backup, which copies only existing, nondeleted files on the hard drive. The technology for an image backup was available at the time of these events, though rarely used by anyone...

I find that the duty was on Gates, and not Bando, to utilize the best technology available."[10]

The standards outlined above have become the general standards in computer forensic examination.[11] According to these statements, electronic data, which is recovered from computer hard disk (or any other form of electronic storage unit for digital information) is permitted to be used in court procedures only, if the data is duplicated and verified in a forensically sound manner. The forensic examiner in Gates v Bando (V.) failed to create such a forensically sound duplication since the installation of the examiner's software could have overwritten existing files on the hard drive, this is the constitution of the evidence was altered even before the copy was made. Correct duplication, however, requires that any alteration of the data during the process of copying is reliably excluded. This requires that:[12]

  1. The image is an exact, bit-by-bit duplicate of the original computer drive,
  2. The image is taken in such a way as to guarantee that the original was not changed,
  3. The image is examined in such a way as to guarantee that the image is not changed.

In practise, proper duplication is usually warranted by write-blocking of the original storage device.[13] Correct verification means that the electronic evidence presented to the court must be provably identical to the one originally investigated, which usually is warranted by means of a hash value, an algorithm that calculated a number based on the content of the respective piece of electronic evidence.[14] In the present, compliance with this "best practise" requirement can usually be achieved by using a proprietary software for imaging, as this will admittedly preserve the evidential value of the electronic information recovered.[15]

Assessment of evidential value in expert witness testimony of digital forensics experts

edit

Expert qualifications are considered by both lawyers and experts to be very important, and in the case of Gates v Bando, the court reaffirms that widely accepted belief.[16] Judge Schlatter stated in this context:

"Bando's expert on matters associated with computer science was W., who holds a Ph.D. in computer science from Stanford. W.'s credentials, experience and knowledge were impressive, and I relied upon his opinions. Gates failed to obtain a similar expert in timely fashion. Gates did offer the testimony of V., the technician who was hired by Gates to copy the hard drive of the computer at Bando's Denver facility. His credentials, experience and knowledge were nowhere near those of W., and I placed much less weight on his testimony than on W.'s."[17]

The court strongly relied on the experts' formal professional qualification, as it was obviously the most distinguishable criterion in this case. However, most cases in litigation are not that unambiguous. Then, the factor of an expert's actual professional appearance - including but not limited to the ability to impart non-legal knowledge to the court, the thoroughness of the report and the traceability of the expert's inferences - will play a larger role. Additionally, a major practical issue for judges dealing with issues of electronic evidence remains in the lack of measurability of IT expertise, partly due to the absence of uniform formal professional qualification[18] in this field.[19]

Lessons for the future

edit

The case of Gates v Bando surely highlights the necessity of selecting a given digital forensics expert carefully when it comes to civil litigation involving digital evidence issues, as such expert's opinion often turns out to be decisive for the outcome of a case. But the parties' due diligence in such cases even goes further: it is not only the selection of an expert witness in the litigation stage, but already in the pre-litigation phase attorneys and experts are obliged to ensure the correct acquisition of electronic evidence which is potentially relevant to their case. Moreover, they have to develop and apply an evidential reasoning that could both professionally withstand an opponent forensic expert's testimony and factually persuade the judge and/or the jury in the courtroom.

Apart from that, the course of the court procedure has (relatively early[20]) illustrated the potential economic impact of E-discovery issues on litigation: originally initiated as a secondary theatre of war in an IP litigation, these issues soon snowballed to a case of its own that finally achieved economically and temporally dimensions exceeding the original matter in dispute. Today, more than 90% of all corporate information is stored electronically.[21] Typically enough, digital forensics has become a big business with an estimated market value of 780 Mio. $ in 2011.[22] Generally speaking, the outcome of an increasing number of cases in all fields of law will depend on issues of digital evidence.[23]

To the same extent which Gates v Bando illustrates the necessity for litigation parties to carefully plan and execute a sophisticated strategy in terms of electronic evidence, however, it must be realized that it ultimately describes a recurrent practical problem: as IT and its relating tools and techniques will progress and the courts will (presumably) carry on to demand the application of the very best method available to warrant an electronic evidence's authentity, the absence of commonly court-accepted standards will emerge again and again. One potential solution for litigators to avoid the repeated occurrence of this issue might lie in entering into pre-trial agreements with their opponent, in which they agree upon certain conditions for the mutual recognition of their electronic documents' authenticity.[24]

See also

edit

Reliability of digital evidence in general:

  • United States v. Scholle, 553 F.2d 1109 (8th Cir. 1976)
  • United States v. Vela, 673 F.2d 86, 90 (5th Cir. 1982)
  • United States v. Bonallo, 858 F. 2D 1427 (1988)
  • John Paul Mitchell Sys. v. Quality King Distribs., Inc., 106 F. Supp. 2d 462, 472 (S.D.N.Y. 2000)
  • Schaghticoke Tribal Nation v. Kempthorne, 587 F. Supp. 2D 389, 397 (D.Conn. 2008)

Authentification of E-mails:

  • Kearley v. Mississippi, 843 So. 2D 66 (Miss. Ct. App. October 22, 2002)
  • Fenje v. Feld, 2003 LEXIS 24387 (N.D. Ill., December 8, 2003)
  • People v. Downin, 828 N.E. 2d 341 (Ill. App. Ct., April 29, 2005)
  • United States v. Safavian, 2006 U.S. Dist. LEXIS 32284 (D.D.C. May 23, 2006)
  • Scheuplein v. City of W. Covina, 2009 Cal. App. Unpub. LEXIS 7805 (Cal. Ct. App. Sept. 29, 2009)

Authentification of electronic document printouts:

  • United States v. Melenberg, 263 F.3d 1177 (10th Cir. 2001)
  • People v. Markowitz, 721 N.Y.S.2d 758 (Sup. Ct. February 9, 2001)
  • Bank v. Eurich, 831 N.E. 2d 909 (S.J.C Mass., August 3, 2005)
  • United States v. Lebowitz, 647 F. Supp.2d 1336 (N.D. Ga. 2009)

Authentification of website-content:

  • Perfect 10, Inc. v. Cybernet Ventures, 213 F. Supp. 2d 1146 (C.D. Cal. 2002)
  • Telewizja Polska USA, Inc, v. Echostar Satellite, 2004 WL 2367740 (N.D. Ill. Oct. 15, 2004)
  • Hutchens v. Hutchens-Collins, 2006 LEXIS 87187 (D. Ore. Nov. 30, 2006)
  • Lorraine v. Markel American Insurance Co., 241 F.R.D. 554 (D. Md. 2007)
  • Williams v. Long, 2008 WL 4848362 (D. Md., November 7, 2008).

References

edit
  1. ^ 167 F.R.D. 90 (D.C. Col. 1996), U.S. Dist. LEXIS 12423; a copy of the final opinion by U.S. Magistrate Judge O. E. Schlatter of May 1, 1996 is available as pdf. Document at Harvard Law (accessed 24.02.2015)
  2. ^ See Fred Chris Smith & Erin E. Kenneally in John J. Barbara (Ed.) Handbook of Digital and Multimedia Forensic Evidence (2008 Humana Press) p 105)
  3. ^ In most cases dealing with computer evidence, the term "electronic" may be more suitable than "digital". Although both are often used synonymously, their semantic content is different (for further details see Burkhard Schäfer & Stephen Mason in Stephen Mason et al. (eds.) The Characteristics of Electronic Evidence (Butterworth 2010), pp. 21–50).
  4. ^ This is just one of several criteria for evidence to be recognized as admissible in a legal proceeding. Namely the hearsay-rule often excludes even authentic electronic evidence's admissibility in trial. For further prerequisites particularly concerning electronic evidence see Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 554 (D. Md. 2007) and Jonathan D. Frieden & Leigh M. Murray "The admissibility of electronic evidence under the federal rules of evidence" (2011) Richmond Journal of Law and Technology Issue 2, 1 - 39
  5. ^ Acquisition is the process of actually collecting electronic data. For example, seizing a computer at a crime scene or taking custody of a computer in a civil suit is a part of the acquisition process as well as the copying of a computer's hard drive (see Larry E. Daniel & Lars E. Daniel in Maxwell & Spielmann (eds.) Digital Forensics for Legal Professionals (2012 Elsevier) p 12)
  6. ^ Fred Chris Smith & Rebecca Gurley Bace A Guide to Forensic Testimony: The Art and Practice of Presenting Testimony as an Expert Technical Witness (2002 Addison-Wesley Professional) p 262; in the similar case of Illinois Tool Works, Inc. v Metro Mark Products, Ltd. 43 F. Supp.2d 951 (N.D. Ill. 1999), both opposing digital forensics experts applied the best practice methods as describes in Gates v Bando.
  7. ^ The facts have been shortened and summarized to a large extent in terms of the aspects relevant for the fields of electronic evidence and expert testimony.
  8. ^ Gates Rubber Company v. Bando Chemical Industries, Ltd., et al. 167 F.R.D. 90 (D.C. Col. 1996) p 17
  9. ^ See e.g. for public authorities in the U.S: John Ashcroft, Deborah J. Daniels & Sarah V. Hart Forensic Examination of Digital Evidence: A Guide for Law Enforcement (2004 U.S. Department of Justice) accessed 26.02.2015; Paul Henry "Best practises in digital evidence collection" (September 12, 2009) accessed 26.02.2015 Archived March 6, 2015, at the Wayback Machine; Scientific Working Group on Digital Evidence SWGE Best Practises for Computer Forensics (SWGE 2014) accessed 26.02.2015[permanent dead link]; for crime investigators in the UK see: ACPO Good Practice Guide for Digital Evidence (ACPO 2012) accessed 26.02.2015[permanent dead link]
  10. ^ Gates Rubber Company v. Bando Chemical Industries, Ltd., et al. 167 F.R.D. 90 (D.C. Col. 1996) p 16 f.
  11. ^ Smith & Bace (n 4) p 7
  12. ^ see: Johnette Hassell & Susan Steen "Preserving and protecting computer evidence" (2005) Evidence Technology Magazine (accessed 25.02.2015) Archived 2016-03-04 at the Wayback Machine
  13. ^ see Larry E. Daniel & Lars E. Daniel in Maxwell & Spielmann (eds.) Digital Forensics for Legal Professionals (2012 Elsevier) p 29 (with further explanation)
  14. ^ Larry E. Daniel & Lars E. Daniel in Maxwell & Spielmann (eds.) Digital Forensics for Legal Professionals (2012 Elsevier) p 30
  15. ^ James Tetteh Ami-Narh & Patricia A.H. Williams "Digital forensics and the legal system: a dilemma of our times" (2008) in Proceedings of the 6th Australian Digital Forensics Conference (Edith Cowan University 2008) p 5 (accessed 04.03.2015)
  16. ^ Smith & Bace (n 4)
  17. ^ Gates Rubber Company v. Bando Chemical Industries, Ltd., et al. Loc cit p 15
  18. ^ Meanwhile, specific formal qualifications were introduced to certify a person's expertise in analyzing and creating reliable electronic evidence (e.g. the Certified Forensic Computer Examiner, the EnCase Certified Examiner, and the GIAC Certified Forensic Analyst). However, the variety of certificates available and the lack of their substantive conformity still make it hard for judges in practise to assess the actual expertise of a given expert witness as regards the broader field of IT
  19. ^ For further details on this issue see: John J. Barbara in John J. Barbara (ed.) Handbook of Digital and Multimedia Forensic Evidence (2008 Humana Press) p 25 ff.
  20. ^ For an insight to the economically overwhelming significance of e-discovery in present litigation cases see: William P. Barnette "Ghost in the machine: zubulake revisited and other emerging e-discovery issues under the amended federal rules" (2012) Richmond Journal of Law and Technology Issue 3 1- 123
  21. ^ William P. Barnette "Ghost in the machine: zubulake revisited and other emerging e-discovery issues under the amended federal rules" (2012) Richmond Journal of Law and Technology Issue 3
  22. ^ John Salmons The Basics of Digital Forensics (Elsevier 2012) p 4
  23. ^ See Paul W. Grimm "Authenticating digital evidence" (2014) 31 GP Solo Vol. 5 (accessed 26.02.2015)
  24. ^ See Zachary G. Newman & Anthony Ellis "The reliability, admissibility, and power of electronic evidence" (2010) Pretrial Practice & Discovery Issue 1, p 1
edit