Law Times

PAGE 12 FOCUS Deloitte's lab fights white-collar crime Analytic and forensic technology facility cutting edge BY GRETCHEN DRUMMIE Law Times I n a typical crime scene scenario, you wouldn't open the door, see a body, step in the pool of blood, rip the knife out of the victim's chest and say, "Yup, it was definitely a knife that killed him," stick it back in there, and then call in the forensic experts. It's the same with digital evi- dence in white-collar crime. A company shouldn't, for example, suspect corporate fraud and then get Phil the in-house tech guy to snoop around an employee's com- puter — it's akin to yanking the knife; he's likely breaching proto- cols and ruining the potential case, no matter how well-intentioned. Indeed, call in the experts at the first whiff of trouble, and in Can- ada that's the Deloitte analytic and forensic technology facility, one of the largest in North America and the most advanced in this country. In fact, David Stewart, partner at Deloitte & Touche LLP and na- tional leader of the firm's analytic and forensic technology practice, says, "we're specialists in investiga- tions in computer forensics, find- ing information and asset tracing." The lab, tucked away in a downtown Toronto office tower in the belly of the financial district, doesn't look like the kind of place that could take down some of the sneakiest white-collar perpetrators. There's no one doing DNA analysis or inspecting the innards of insects for clues here. But, what DNA is to the CSI-types, digital evidence is to the 30 experts working in this lab. "The authenticity of our digital evidence we prove with a digital fingerprint and it's even better than sive version. It's the same standard, whether it be criminal or civil. So, I guess we may not have the cloak and dagger criminal-activity stories, but we're doing a lot of work that eventually may fall into that [criminal] arena if the clients launch the complaint. We're not the victim; the company would be the victim." David Stewart and Corey Fotheringham are specialists in investiga- tions in computer forensics, finding information and asset tracing. a human fingerprint," says Corey Fotheringham, senior manager and a former OPP detective with the electronic crime section. "When it comes to electronic evidence, it is fact-finding and it's expert work. If we take this digital image of the computer system and give it to another qualified expert, they will have the exact same findings be- cause it is a science." Within the 8,200-square-foot lab are 17 rack towers; 45 high-pow- ered computers; four high-powered servers; and one blade server. With 250 terabytes of secure online data storage capability they can analyze 6,250 laptops at once, and, with capability to analyze all the data on-site, the client data never leaves Canada; therefore it doesn't become subject to foreign legislation. There is also a secure network environment; 24/7 security cam- eras; monitored access; fire-sup- DD LT RXQTB-05 Frntr ad 5/23/08 3:16 PM Page 1 pression equipment; a data vault; 21 tons of air conditioning equip- ment; field kits; and readily deploy- able teams enabling forensic imag- ing of systems in a client's office. Stewart adds there are processes around the movement of data within the lab so there is no incor- rect co-mingling of cases. But what are they doing? "We are gatherers of fact," says Stewart. "A lot of the time we are hired is to provide clarity to a concern or an allegation." They look at the situ- ation from an independent view and say based on what they see, whether there is a problem or not. It is then up the client how to pro- ceed; whether it is prosecuted as a criminal offence or pursued civilly is the client's decision, he says. "The way we attack a computer forensic investigation would be no different than the criminal law en- forcement area, as in the civil, be- cause you handle data to the same high standard," says Stewart. "We don't have two standards, a lite version and a more comprehen- And they never know what could happen; sometimes what looks like a civil matter becomes criminal. In one case, Stewart was investigating an inventory short- age in the pharmacy department of a hospital which was considered a financial probe, but it turned into a criminal charge of trafficking in narcotics. It involved $32,000 worth of OxyContin missing on the balance sheet, that had an esti- mated street value of $750,000. "That's how things will turn into criminal," says Fothering- ham. "He went in and started looking at the inventory, and there was a shortage and it led to all kinds of different places." The Deloitte team, which glob- ally includes former FBI, CIA, and other law enforcement, has no jurisdictional issues given their worldwide network. They also work closely with lawyers. Fotheringham says they look at Office Furniture that will leave your clients and employees with a positive lasting impression. C everything from BlackBerrys to e- mails to text messages, online bank- ing statements, password protected files, encrypted files, things that were deleted that you think don't exist anymore; even a printed doc- ument, whether it resides in your computer system or not, there'll be a copy of it on the system. In fact, the team brought down one perpetrator who ordered mon- ey wired to certain accounts via a fax from a document created on a home computer and printed on a work computer from a memory stick. Stewart says the individual wrongly thought they were "clever because they didn't type the in- struction on their system." He adds that nine times out of 10, when they confront people with the results of their investigations, "we've had successful confessions." He says while he has testified in criminal court, people often plead guilty before that point. "If you've gathered the fact and it is what it is, sometimes it's hard to defend," says Stewart. "[If] I find the money in your bank account and the bank tells me I can see the statements, then what are you going to argue?" "It is hard evidence," notes Fotheringham, adding that they also look at other activity such as the timing of office pass cards, accessibilty to a computer, user- name passwords. "You put all the pieces together," and put the right person behind the right keyboard at the critical time. "E-mails are always the flavour of the month in the big cases be- cause somebody has said something maybe they shouldn't have said or saw something they didn't think was so important at the time," says Stewart. "We go through entire corporate e-mail systems." Stewart says that often courts process and don't understand what is the digital environment. "It's not bits of paper where you can quickly see," he says. "So we're helping educate the lawyers and the judges on understanding the realities of the technology and how that may be used or come into court as evidence." Fotheringham says 10 years ago computers were looked at for porn or fraud. "Nowadays they look at the computer in almost every crim- inal offence. That's what we're find- ing, almost anything, electronic data is actually searched," he says. Stewart says it's a good idea for criminal lawyers to get on the digital bandwagon. "If there is a crime, and there's a potential for digital information to shed light on the allegation or the com- plaint, then there's a good likeli- hood that there's information been captured, [so] you're going to have to understand what you could do with that. How could that help you . . . It's like DNA: is it on the scene, and, if it is, how did it get there? It's no different. If there's an e-mail or there's some trail, is it your [client's], and, if it is, how did it get there?" He adds that if there's digital evidence in a case, defence law- yers "have to understand what could be done with that . . . It could actually help them support some of their positions." "I think that the criminal law- yers should be aware that this is out there," adds Fotheringham. LT Seat Sale Chevron Multi-Tilter Chair An achievement in ergonomic seating. Finger touch lever controls for pneumatic height adjustment, seat and back adjustments. Solid support and comfort. 26876-02 High Back Reg. $349. . . . . . . .sale $299. 26874-02 Low Back Reg. $329. . . . . . . .sale $289. for the month of June 2008 only. (taxes and delivery not included) yourONE source supplier for dyedurham.ca • Phone: 1-888-393-3874 • Fax: 1-800-263-2772 OFFICE & FURNITURE PRODUCTS Office & Furniture Products • Corporate Promotional Products Printing & Graphic Services • Law Office Essentials Corporate Supplies • Search & Registration Services www.lawtimesnews.com U The courts are 'bubbling' Continued from page 11 PREFERRED SUPPLIER E were withdrawn. It's almost as if they're calling my bluff; that I won't file a Charter application with a factum and case law . . . I just don't think it helps any of us." Neuberger isn't sure what's behind the practice but speculates, "it could be because trial times are more distant in the future now, and they're [the Crown] trying to come up with more creative ways to battle 11(b) applica- tions, and there may be more of a hard line in certain cases. I'm not sure." Neuberger says statistics say that in many areas crime is down, but "I think there's a tremendous amount of business coming through the courts and it's a difficult thing to deal with. You need more judges, you need more Crown attorneys, you need resources for the police. Those are all real issues. It's busy, very busy. You go to any jurisdiction, it's bubbling." And all that business means tremendous strain. "When you combine lots of work, lots of work downloaded to the Ontario Court of Justice, with unrealistic time estimates, and not a determining of what really is a day, that just creates more continua- tions and greater delay in my opinion," says Neuberger. LT JUNE 2, 2008 / LAW TIMES a D Y I n E 9 p N d & 9 n C D m a R 1 H a A n M S a 8 W e ' r e y C i o a

• Cover