this month’s installment from Cybercontrols

In a recent lawsuit, Calyon, a French bank with locations in New York City, alleged that Mizuho Securities, a Japenese financal services company, convinced a group of debt traders to switch jobs and leave their positions. The complaint also named as defendants the traders whom Calyon claims resigned.

The plaintiff alleges that the traders subsequently used its confidential business information concerning debt securities for their benefit in conducting their new work responsibilities at Mizuho Securities.

Citing the Computer Fraud and Abuse Act, amongst numerous other causes of actions against the individual defendants, Calyon was successful in reaching an agreement with the Individual Defendants to preserve the hard drives of their personal computers and computer storage devices by creating forensic images of each device in its discovery stage.

Where the disputes over discovery started to arise was when Calyon asserted that their forensic expert should be permitted to inspect the entirety of the forensic images to determine the details of when and by what means the Individual Defendants misappropriated documents from Calyon on their personal computers, and the subsequent actions in copying or deleting same. The Individual Defendants objected to Calyons expert conducting the forensic examination citing invasion of the privacy rights of themselves and their non-party family members who had also used these same computers. The Individual Defendants offered as an alternative, that their forensic expert could perform an identical search and examination for all relevant, non-privileged electronic information (ESI) or, that a third-party expert be appointed by the court and who would confer with Calyon on the ESI it was seeking.

Calyons assertions that only its expertas opposed to the Individual Defendants expert or independent third-party expert would possess the requisite incentive to search exhaustively for evidence, and that only Calyons expert would be able to confer with Calyons counsel on an on-gong basis to refine such methods, was insufficient to convince the court. Despite the submission of Calyons experts declaration, which outlined a list of specific items of interest that would be searched for beyond routine word searches, the court concluded that the Defendants expert could perform the same inspection.

What complicated the Plaintiffs ability to conduct its own inspection of the Individual Defendants computers from the start was that these devices were their personal property, not their new employers computers. Personally owned computers always pose a challenge when it comes to forensic inspections. The storage of private information belonging to non-party family members on the computers became a major stumbling block for the Plaintiff.

In similar civil disputes, CyberControls forensic experts will often be searching for artifacts on evidence hard drives that help identify any external storage devices (i.e. USB flash drives) commonly used to copy and transfer large amounts of data from one computer to another. Other artifacts of interest in these situations would be any indication of a wiping utility software used on the subject computer to permanently erase specific data files and e-mails. Another common method of transmitting misappropriated IP is by using ones own Internet e-mail account (AOL, Hotmail etc.) over the employers Internet access and attaching documents to send to a third-party or ones self. These transmissions can only be recovered through vigorous forensic examinations of a hard drive.

Fortunately, Judge Freeman stipulated in her ruling that the Defendants forensic expert must consult fully and in good faith with Calyons expert in order to develop an appropriate search protocol. This stipulation by the court should provide Calyons expert with the ability to orchestrate a comprehensive search for all relevant ESI and artifacts on these evidence drives. Otherwise, Judge Freeman has provided Calyon with an opportunity to demonstrate that in the event that Defendants expert has failed to follow these instructions, Calyon may renew its application for direct access to the forensic images.

Conducting forensic computer examinations often requires an intensive collaboration between the expert and legal counsel to identify as many potential elements of electronic evidence that might exist on an opponents computer in order to sufficiently craft the most effective discovery plan possible. CyberControls expertise in computer forensics and investigative experience has proven to be an invaluable resource to hundreds of legal professionals across the country.

We welcome the opportunity to discuss any specific issues that you may be facing as a respondent or requesting party in a commercial litigation matter at 847-756-4890 or visit our cyber site at

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s