Pro Digital Forensic Consulting: confidentiality

Showing posts with label confidentiality. Show all posts

Saturday, August 29, 2015

How Digital Forensics Can Help: Intellectual Property Theft Cases

August 29, 2015

How Digital Forensics Can Help: Intellectual Property Theft Cases

In the second of our series of “How Digital Forensics Can Help” articles, we’ll focus on an area that is most applicable to corporations – Theft of intellectual property. Intellectual Property (IP) is defined as:

The legal rights that arise from intellectual activity in the industrial, scientific, literary and artistic fields. This includes works of art, inventions, designs, trade secrets, words, phrases and symbols.

Pro Digital is not just a cool digital forensic firm, it’s also a company that was built from the ground up. Like many companies, we have proprietary and confidential information that we would not welcome our competitors to have. Most corporations fall into this category. Think about your company or companies you know. There are things that make them different and unique and many times, there’s some blood, sweat and tears (not to mention money) that has been invested over a significant period of time to help separate those companies from others who may claim to offer the same products or services. This is why intellectual property is so important – It is information that can potentially break a company if provided to competitors.

When Should Digital Forensics Be Used in IP Theft Cases?

In keeping with the best practices of the digital forensic methodology, whenever the slightest potential of an IP theft incident has occurred, a digital forensic consultant should be called immediately. Many times, these cases end up in some formal legal proceeding. Also quite often, the custodian of the digital evidence is also a party to that legal action, a circumstance in which an argument could be made that there is a conflict of interest. Even if that argument isn’t made, it’s best to call in a digital forensic consultant as soon as possible after the theft is detected to ensure they get a look at the evidence in the purest form possible.

Some cases may require notification of law enforcement, but this can also go both ways. In many state courts (including Virginia), theft of proprietary information can be handled both civilly and/or criminally. That means there are remedies in the state law for both types of legal actions. The decision of whether or not to pursue criminal charges against the suspected thief of the intellectual property is something that should be carefully considered and counseled upon with your attorney(s). If the decision is still “up in the air”, make sure you choose a digital forensic consultant who is knowledgeable about proper evidence handling and has testified in court as an expert witness (hint: one such consultant writes this blog).

What Types of Evidence Can Be Useful in IP Theft Cases?

Consider this brief case **example from a recent Pro Digital client: Acme company provides specialty technical analysis services to corporations and governmental clients. Acme has been in business for about 10 years and has developed a decent client base through their sales and marketing department over that time. For the majority of the 10 years, Bob Bouey has been Acme’s Sales Manager, but Bob has been slacking for quite some time and has even been counseled and disciplined for his failure to acquire new customers. Finally, Bob is fired, but he’s not dumb and saw the writing on the wall. A few days before he was fired, he transferred the entire Acme customer database to a thumb drive and took that information with him to a competitor, who now has acquired several of Acme’s (former) clients. Acme’s President finds out about this and files suit.

In this case, we were called by Acme to conduct a digital forensic exam on Bob’s former work computer to see if there was any digital evidence that Bob stole the customer database. There most certainly was! We were able to ascertain the date and time of the file transfer, the size of the file, the device onto which the database was transferred and even specific items such as the volume label of the USB thumb drive Bob put the database onto: BOBS FILES. The FBI calls that a clue.

Cases like these are probably more common than most companies are aware of. And this is just one example. In the age where company perks include mobile devices, computers and other cool electronic gadgets which all store high volumes of data, it’s important to also bear in mind that these devices only help to facilitate the potential theft of information… and they all contain digital evidence when that happens.

Digital Forensics in IP Theft Case Tips

So now that you know what types of evidence are potentially accessible in your IP theft case, what should you do to help ensure the most benefit your case? Here’s some tips about how to maximize effectiveness in IP theft cases:

· If a problem employee is identified, start your documentation EARLY

· Identify what digital items are most vital to the operation of your business and keep an open mind about how that may be exploited

· If an intellectual property theft is suspected…

o Secure and lock-down any and all equipment used by the suspected thief immediately

o Make sure remote access is shut off, including any back doors

o Call a Digital Forensic Consultant and schedule a meeting as soon as feasible

o If criminal charges will be sought, notify law enforcement as soon as feasible

o Be aware that you may be without the computer or mobile devices used by the suspected thief for the duration of the examination and litigation

Digital devices are ubiquitous in our work and personal lives. Tech has interwoven itself into everything we do for better productivity, entertainment and communication. Because of this, it’s also best practices when an employee or associate is thought to be unhappy at work to assume that some sensitive and/or proprietary information will be absconded at some point before their access is cut off. By keeping this in the back of your head, you already start to increase your effectiveness in response to any suspected IP theft and set the stage for a better outcome in partnership with your Digital Forensic Consultant.

**For confidentiality, the names of the company and former employee were changed in this example**

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

About the Author:

Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia. In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history. A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.

Email: ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: @ProDigital4n6

Thursday, July 16, 2015

Auditing Social Media Contacts

July 16, 2015

Auditing Your Social Media

Quick note: I’ve done some light research and seen where there are a few articles onlie about how companies should audit their social media for market effectiveness. This article is not about that. This article is about why YOU should audit your personal & professional social media contacts & connections on a regular basis.

While Pro Digital is primarily a digital forensic consulting company, a great deal of my early professional experience in criminal investigations involved online undercover investigations. Yes, I’d create the persona of a young girl online and conduct sting operations a-la “To Catch a Predator”, only with many more measures put in place to ensure proper evidence handling and successful prosecution of these cases. Because of my repeated creation of online undercover social media accounts and daily contact with others online conducting these types of investigations, I thought it might be useful to spread a little wisdom with regard to overall social media usage.

Social media has become an intimate part of most of our lives. While it’s true my octogenarian father has not embraced Facebook, my slightly younger mother-in-law has. But Facebook is just the beginning! There’s a pretty decent likelihood that you found this article on one of several social media outlets attributed to Pro Digital Consulting – Twitter, Linked In, Google+, Facebook Pages, etc. all create a universe for us to connect with other people, either personally or professionally, and network in a way our parents never even imagined. But with this ability comes added responsibility. While some other social media experts may disagree with me, I’ll offer a few tips from what I’ve seen over the years catching bad guys and conducting investigations online.

Separate or Post with Discretion

Years ago, I created a personal Facebook page under a pseudonym. I did this because I was involved in gang and narcotic investigations and to insulate my family from potential threats from those I was investigating. This pseudonym became (and still is) my account and one of the ways I connect with friends and relatives I may not see regularly, but still wish to remain in contact with. Because of this, however I’m forced to abide by the same advice I give teenagers about social media: only contact those whom you know personally and those who you could call with relative ease. Regardless, I still make a conscious effort to separate my personal and professional social networking. Pro Digital has a Twitter page and I have a separate Twitter page. This helps not only separate valued professional contacts from personal ones, but also serves to avoid alienating potential business associates. It’s important and prudent to make the decision to separate your personal and professional social media OR post with extreme discretion if they are to be combined as part of your overall online persona. This becomes a little more difficult when we connect with co-workers (or even bosses) on our personal social media pages.

Linked In is a somewhat different animal. Because Linked In is a professional social networking site and digital forensics is a fairly small community, I will choose to connect with other digital forensic and investigative professionals that I have not (yet) met in person. However, taking into account the normal traffic across list serves and browsing of blog articles published in the profession, it’s fairly easy to vet contacts as real or legitimate versus not. Even still, I audit all of my social media accounts regularly and I suggest you do too.

Why Audit?

It seems to be an unfortunate side-effect to the world of social media that it’s the 21^st Century version of the popularity contest. How many contacts can you amass in your social media world? The winner has the most. Facebook doesn’t expressly reward this, but interestingly enough, Linked In does! I routinely see potential contacts on Linked In that boast 500+ or 1000+ contacts. While that may be a measure of some sort of accomplishment, the sheer number of connection requests I get from people who fall into these categories suggests they’ll just connect with whomever for no apparent reason other than to connect with them. That’s a bad idea.

Another side-effect to ubiquitous social media usage is that potential employers, clients, opposing parties in legal disputes, etc. can look at your profile(s) and see your activity, your accomplishments and with whom you associate. Let’s face it, every profession has clowns. I define a clown as a talker, not a doer. Someone who makes a career out of doing as little as possible and talking about the little bit they do as much as possible. Another sub-set of clown are the incompetents. Think about your profession – You know people who fit these categories and your peers also know the same people who fit these categories, so why would you want to be associated with them, even if it’s just online?

Yet another reason to audit your contacts is things change. People change. That co-worker you went to multiple happy hours and worked on two major projects with at your previous company just got convicted of defrauding the same company… Do you still want to be connected or associated with him professionally? Probably not. The reality is that sometimes good people turn bad and sometimes good people let bad things carry them away through any number of motivations, so it really benefits YOU to stay abreast of who you’re connected with and what they’re up to. Like it or not, we’re all judged by our friends & acquaintances. Birds of a feather… well, you know.

When to Audit?

There’s no “best practice” for how often to audit your social media contacts. I would suggest at the very least to do it once a year, but it also depends on the volume of your social media usage. If you’re a 500+ or 1000+ connector on Linked In, you may need to audit more frequently. If, like me, you’re more cautious and discriminating about who you connect with, you may need to do it less frequently. Just don’t let it get away from you. Speaking as one who has seen respected friends, co-workers, clergy and professional contacts get caught up in situations that reflect horribly on themselves and badly on those with whom they associate, it really is an important piece to maintaining professional integrity.

What Now?

Auditing your social media is like cleaning out your filing cabinet. It sits over there in the corner, you use it when you need to and don’t pay attention to it when you’re not looking at it, but it’s still very important to maintaining your professional reputation. So use these suggestions and log-on to your Linked In, Facebook, Twitter, etc. and take a look at who you’re connected with. If you find yourself saying “yikes” or simply “who the hell is that?”, maybe it’s time to make the decision to disconnect.

Trust me, they won’t be the wiser and you’ll be better off for it!