Loading summary
Transcript97 lines
- [00:00]
A
Today we're going to talk about digital evidence and getting Digital evidence right with Tim Conlon. That's what we're calling this. And he's going to join any minute. For all I know, he's already joined and I'm in the wrong studio. Mobile phone, social media, cloud storage, email, they sit at the center of modern fact finding. But to their detriment and to that of clients, attorneys often misunderstand it or underuse the data as examples. Practitioners may not realize that client provided screenshots are often forensically weak or that text and social media can easily be forged or manipulated. That means lawyers and courts need to better understand authentication, preservation, and challenging electronic evidence. In this episode, I'm going to talk with Tim Conlon about how litigators can be more effective by gaining a deeper understanding of the space where evidence gathering and technology intersect. Through vivid case examples, including comparisons of computer and cloud backups, analysis of missing and altered files, and tracking email migrations from official to personal accounts, Tim is going to talk about how straightforward digital forensics techniques can expose concealment, manipulation, and institutional failures. He shares insights about how public exposure of digital trails changes the understanding of past misconduct. So, Tim Conlan is a partner at Darrow Everett, where he focuses on complex family court litigation and civil cases on behalf of children abused in the care of others, with particular emphasis on cases where electronic evidence and digital assets play a central role. Tim has handled matters in the forefront of litigation, from computer crime investigations in the 1980s to chairing and resolving Rhode Island's clergy abuse cases on behalf of dozens of victims. He's also a frequent lecturer on electronic evidence, trial technology, and advanced litigation issues. He's widely published on these subjects. He's author of Electronic Evidence for Family Law Attorneys, that's the American Bar association, and is currently completing an ABA book on cryptocurrency and digital assets, continuing his work at the intersection of technology and, and modern litigation. So with that, Tim will be joining me shortly. I hope you enjoy the interview. You know, first, I want to thank you for doing this today. It's a, it's an important topic to a lot of attorneys and companies and, and individuals as well. And so I appreciate your spending time on this. I, I have introduced you already. You've written quite a lot about this. You've got a new book coming out on cryptocurrency and digital assets, and so I'll make sure that people have access to how they can get that. You also wrote Electronic Evidence for Family Law Attorneys, Ben that was published by the ABA a few years ago. So we'll give those a plug and a link. But so I guess just to get started, we'll start with the big picture of digital evidence in everyday litigation. And you work a lot with family and tort and school abuse and broader civil cases. And how often does digital evidence like cell phone data, email, cloud accounts end up at the center of disputes?
- [03:30]
B
Well, I, I don't know about the center, but it is certainly prominent in virtually every case that I've been involved in of late. You know, whether it's because of an email or a text message between two spouses, or it's a text message from a coach who's trying to set up some rendezvous with a student. The bottom line is that since 90% of our communication, probably more than 90% of our communication flows through our cell phones, person to person communication is pretty much central to every case nowadays.
- [04:09]
A
Yeah, it's everywhere.
- [04:10]
B
And so it's unavoidable.
- [04:12]
A
It's unavoidable. Yeah, absolutely. So, so when people hear about ediscovery, they're picturing, you know, I do, I picture massive corporate email reviews and, you know, you talked about even it's in the news. I was struck when I heard about, you know, the Epstein files. You know, however many, 3 million, it's going to take forever. And that seems to be the biggest recent case that's been in headlines. But you say that there's a, there's a widespread misunderstanding of what digital evidence is. So what, what common ways do lawyers and courts get that wrong?
- [04:51]
B
Because the clients are, you know, basically consumers. Okay. Like yourself. Or myself, if you will, on a day to day basis. Okay. Taking off my lawyer hat, just living a life. Okay. They're not looking under the hood and they're not even thinking about, you know, digital forensics. They're just clicking a screenshot and sending it to their lawyer. Because I'm sending you that text he just sent me or, you know, well, yeah, I saved that text. Well, if you, you ask them what they mean by save that text, what they mean is they screenshot it. You know, it's like, well, did you delete it from the phone? And you can see the eyes glazing over, right? It's like, well, I never delete the text. Okay, well then it's probably still in the phone. But of course, you know, when you scroll up, you'll watch it spin a little bit as it loads, you know, because it's not putting it into RAM for the purposes of feeding it to the Screen, you know, all the way back for three years. But you could have text messages going back three years in your phone. You know, they're not thinking that way. Well, I don't know. The text isn't there. I'm not sure the text is there. Well, they haven't even looked for the text. And if they got it, they're still going to think that when they screenshot it, they're giving you the text. They're not. They're giving you an image of a screen. You know, I sent you that specific text. You know, fake text. Okay.
- [06:23]
A
Yeah.
- [06:24]
B
Right before we got on. And there's so many ways to play games with texts that when you're only looking at a digital image, a screenshot, you wouldn't be able to see that they're fake. Now, I spelled your last name incorrectly because often that kind of thing will give it away in the sense that somebody who's faking something won't necessarily be careful. There could be a spelling error involved. And so you may be betrayed by it or it. It may betray itself, if you will, because you're looking closely. But if they. If they're more careful, then it's much harder to see. You know, I think of a case that we were involved in a number of years ago, but the bottom line is that our client had a text conversation with a woman that he had a child in common with. Okay. And the woman had produced text conversation between herself and the client, and the client made what appeared to be incriminating statements in the text convo. Okay. But what was interesting was if you looked at the text conversation in his phone, right. And you compared it with the text conversation that she produced, there were pieces missing. Okay? So I'm texting you that you can't imagine what Joe got himself into. You're saying, what's up? I'm saying, well, let me tell you, this is what I got from him. Oh, I got so effed up last weekend, I crashed my, you know, Mercedes. Okay. Or whatever the hell it is, the admission. Okay, well, she takes out the, you know, Joe got in trouble, Right. She takes out the. Let me tell you what he got. I got from him. She just goes to, I effed up last weekend and crashed my Mercedes. Okay.
- [08:37]
A
Yeah.
- [08:37]
B
Or whatever it was that she wanted to attribute to him. And she does this throughout the convo. So all of the stuff that he's reporting to her that his buddy told him or texted him, he's telling her was texted to him by buddy. But the part about this is what he said next is all missing. Now, when you count the texts between. Because they're all timestamped by your phone, and that will show up in the image the date and time. But when you count the number of texts in his version of the convo, let's say there's 14 between this time and that time. You count the number, the text in her version of the convo, there's, let's say, seven, a much smaller number. Okay. You go back. Excuse me, to the provider with a subpoena for the text messages going back and forth. Now, you will hear all the time that you can't get the text messages from the providers, which. There's truth to that. But you can get logs of text activity. And so you could see that the number of messages that went back and forth between the two of them from his cell phone provider.
- [10:03]
A
Right.
- [10:03]
B
Was the same number as the number that we produced, that the number of text messages that went back and forth for her was missing. X number. I'm saying seven in this example, but we had a specific number that was missing. So you knew that she cooked the books. Which. That in and of itself is incredibly destructive on so many fronts. Right. At that point, her lawyer is just running and looking for cover. Right? Because, I mean, you, you've just got finished having your client say. Because of course, you bring them in for the deposition and you ask them questions, and I see you produce these texts and when did you get these and start a complete version of the conversation? And of course she says it is. Because what else is she going to say? You know, and then you, you, you go from there. Well, it's kind of funny because look at this one, you know, and look, he's got 14, you got seven. And you can watch the walls closing in, if you will. And then you've got the data from the phone company that is showing that 14 messages went, and she only has seven. I mean, once it becomes apparent that the woman is cooking the. Literally cooking the books. Yeah, but most attorneys. Let's start with the clients. Most clients figure that because they screenshot something, and most of them are not cooking the books, by the way. But the, the problem is that, that someone in my position who's not schooled in this can be taken advantage of, you know, and so now you're put in a, in a bad position. Not to mention it's. The screenshots are stupid and a pain in the butt anyway, but from a forensic point of view, they're literally useless.
- [11:51]
A
Yeah. Is there, is there any Other data that, that comes from the actual text chain, I assume there is versus just a shot of a screen.
- [12:00]
B
Well, let's start with if you were to text me a photo, right. And I get that image file, then that Apple an iPhone photo will tell you the latitude, longitude, which the image was taken. It'll tell you the date and time. It'll tell you, you know, a whole bunch of data around the creation of that photo. You ain't getting that out of a screenshot. Right. So if I've got a screenshot with the little itty bitty thumbnail on it, as opposed to the actual image that was transmitted, I lose what I mean, the term is metadata. So you lose metadata because. Excuse me, you lose the metadata because all that you have is the, you know, JPEG or whatever is created when you do the screenshot of the image, which is basically useless from a forensic point of view.
- [13:01]
A
And as you demonstrated to me before, before we spoke, you sent me a fake text. And so it sounds like, it looks like to me, like there's a little bit of an industry out there helping people create fakes.
- [13:16]
B
Absolutely. I mean, they'll, they'll have the usual disclaimers about this is not made to being done. You know, this is just for fun. You know what I mean? But, but, but there's some people who've got some pretty twisted ideas of fun and, and they're using those tools, you know. But literally, Ifak text.com, i think is the, the one that I used to make the example and they. Not a sponsor. Oh, I did literally was. I looked at the little blurb about some of the topics and I thought, you know, this will be a hoot. So I just googled fake. How do we, how do you fake a text? And it got me to this. The entire process took less than six minutes prior to me hopping on this call.
- [13:56]
A
And I didn't see it when you mentioned it to me. I looked at it and I thought, oh, he was joking because you said, you said the check is in the mail. I thought you were kidding.
- [14:04]
B
You said the check was in the mail and it better be.
- [14:06]
A
I said the check was in the mail.
- [14:07]
B
Right. And I said thanks.
- [14:09]
A
Yeah, right.
- [14:10]
B
You know, I'm looking forward to that check. But, but yeah, I, I fake promised. I faked you telling me that you were gonna, you know, send me a check. And, and I just as an example of trying to, you know, show how easy it is to create those foolishness and then misspelled your name as the sender just Because I figured it'd be fun so that you could see, you know.
- [14:33]
A
Yeah.
- [14:34]
B
How easy it is to do.
- [14:36]
A
I'll share. I'll share that with everybody. And everybody can go create their own fake text, basically. So we're not encouraging that, by the way.
- [14:42]
B
Referral fee from the ifatext.com I suppose. But that's honestly the last thing I want. I'm not trying to behavior. It's just important. Your average lawyer. Okay. Who's busy. Right. And has other things to do, then forensically evaluate the evidence that their client sends.
- [15:03]
A
Yeah.
- [15:04]
B
You know, is. Is in a. In a danger zone to a certain degree. Because, I mean, they get the stuff. They're not doing what would need to be done to. To cross examine it. Right. I mean, because. And I. Kudos to co counsel on this. She spent. Brenda Riola spent quite a bit of time digging through the text messages and saw that there was a delta or a difference between the text message version from our client, the text message version from the other side.
- [15:35]
A
Right.
- [15:35]
B
And. And she called that to my attention. And I was doing the Depot, and I'm like, well, I can. I can tell you how that's done. You know, I mean, the other thing. And this is different than what you saw with the Ifate text. If you go to your phone right now and you take our conversation, because we've had text message exchange between us, and delete one of the things in the conversation, when you pull the text messages from your phone, it'll be missing. Okay. So that's actually a bigger problem than the screenshot thing because here you could go and grab the stuff out of the phone. Okay. Download all the text messages, and that message would still be gone. Okay. A whole different issue about getting deleted files out of the phone. But all I'm getting at is that you got multiple levels at which stuff can be fudged. This gal was clever enough to figure out that if she just, you know, went and did the press down and then did more, she could select specific pieces of the combo and delete it and create a false reality.
- [16:50]
A
Yeah. It seems there's a. And I'm sure there are already ways to quickly compare what's fake with what's real. And I think it's. It's probably even more important these days when you have a president of a country allegedly saying something and it looks very real. It's like, you know, and people are sharing these things. And I, you know, is in tune to this as I am. I've been. I've been Caught. You know, I saw a picture of snowfall outside of Moscow and I thought, wow, they get a lot of snow and the snow is up to the top of a 10 foot building and Russians were snowboarding off the top of the building. And I sent it to my daughter who snowboards, she lives in Vermont, Said dad, that's AI. I'm like, no. Okay. And then I most recent stuff. What's that?
- [17:34]
B
I said, the AI piece of this is a whole other level of, you know, foolish, obviously foolishness, but. But the forgery and or alteration of valid things, you know, I mean, and if you think about it, you go back to the notion of filters, which, I mean, what was that? There was a lawyer who was got in trou appearing on a CAT filter. Yeah, yeah. That was all over the Internet in the middle of COVID when. When virtual hearings were going on. But all the filter is is real time form of digital manipulation. And the idea that people are using it to either get rid of wrinkles or maybe add some hair, whatever the heck they need to do. I mean that has now mushroomed into what you just described, which is basically creating an entire fake reality.
- [18:23]
A
Yeah. Okay, well we'll come to that too because you, because you're writing about this. So walk us through. You had told me about a case where you compared backups of a computer and a Google Drive and found thousands of missing files.
- [18:40]
B
Right.
- [18:40]
A
So what was that process like? Tell us about that experience.
- [18:45]
B
The crazy thing is, on one level it's relatively simple. Okay. Again, it's about asking questions that people don't ask. Okay. We had asked for. There was is a particular former teacher who was involved in what he would term, quote, naked fat testing or fat testing. He would call it fat testing. The media turned on to the fact that it was done with the kids naked.
- [19:16]
A
And this was to test their fat. Whatever percentage of body fat. Is that what it was?
- [19:21]
B
Okay. So not to take us too far afield, but the bottom line is that his official reason for doing what he was doing was to suggest that it was a body fat test analysis or a body fat analysis. Okay. His sworn testimony when this got to the trial stage was that he had had no training that would substantiate that what he was doing was actually part of a body fat test. And it involved getting inappropriately close to boys genitals.
- [20:00]
A
Right.
- [20:00]
B
Okay. And then the other difficulty for this gentleman is that he also created other interesting tests like puberty tests and flex tests that also involve putting them in interesting positions, shall we say. And then his hands where they didn't belong, clearly did not belong. But be this as it may, he got canned. We've got civil actions going on behalf of multiple victims of this stuff. Kids who, as 16 year old wannabe athletes or student athletes, let's say, okay, are being conned into getting naked in front of an old guy, or an old guy who's then putting his hands where they don't belong and dealing with all the fallout as this becomes obvious to the world that they were had and the embarrassment and shame, et cetera, et cetera. But be this as it may, we had requested the data from the drive in the computer that this guy was allowed to leave the building with when he was canned. Okay. Whole other problem in terms of, you know, data control around that. Right. But the bottom line is that we requested that that data, it being a Google Drive, there are snapshots of that drive on various dates. I want to be careful because certainly without having the documents in front of me, I'm not going to be able to be completely accurate about dates. Okay. What I can tell you is that we were clear ultimately that we wanted the backup, or the version, if you will, of the Google Drive that they got or that was created as soon as possible after the machine was recovered. Right. Because they ultimately got the machine back from him. And we wanted the Google Drive as it existed most recently, before he knew he had been caught. Okay. So they dragged him off a bus in February of, I don't recall which year, but let's just say for the sake of argument, 2020. They dragged him off a bus on a specific known date in February of, I'm going to say, 2021. You could work your way back through Google and find the preserved version of the file that was most close in time to the moment where he knew he was in trouble. Right. You could get the drive as it existed when it was returned. Okay. Because again, if you're a lawyer who's not schooled in how, what is a drive today? Okay. If you roll back to when I first got involved in computer forensics, a drive was a physical device that resided on a machine. It spun. Okay? Today they're all chips. But be this. It may. It used to be, it spun. It was a physical device and it had platters. Okay. And you backed it up to external sources so as to not have a problem if you. Somebody dropped the machine or it got lost. Okay? So that was in the old days. Well, today that's really not the way most computers are working. Right. You have a OneDrive. The OneDrive is echoing to a cloud. Okay, so and that cloud, depending upon the configuration of whomever it is that's running your system, okay, may, you may not even be able to write to the local machine other than that it echoes to the cloud. Right. Some machines you can, depends on what security has been allowed by the organization that issued the machine. But regardless, the IT people's access to back versions is controlled by the entity that controls the cloud, not by the nut who has the cam, the computer in his hand. So you can scrub a drive, but you can't stop Google, for example, from maintaining, to the extent it's a Google Drive controlled by a corporate entity, whatever it maintains with regards to the prior version. So running the prior version, the one from right before the guy got drugged off the bus against the one that was on the machine when it was returned, there was a delta of, I believe it was 11,000 some odd files that just didn't happen to be there, you know what I mean? And as anybody who is working in this area, you know, you don't need to be a rocket scientist to know that what's missing is, is usually the stuff that you're looking for. Right. You know, I, I, this goes 80, I'm going to say it was 87 where I was involved in a prosecution of a financial fraud case on behalf of the state of Rhode island, prosecuting somebody who was basically hiding il illegal mortgages that the agency that he was running was a quasi public state private entity that did low interest mortgages. That was supposed to be for first home, first time home buyers with moderate income. Okay. And the interest crisis at the time was what was perceived to be flattening the market. So the government comes up with this, you know, first time homebuyer thing. A public private entity, Rhode Island Housing and Mortgage Finance, it's run by a guy by the name of Ralph Parry. Ralph was politically connected. And the Providence Journal got a hold of the fact that there seemed to be a whole bunch of people who were politically connected who were getting RIMFAC mortgages. And it didn't make a lot of sense because they didn't seem to be of the income type or they weren't a first home, first time home buyer. But like, what's going on?
- [26:38]
A
Basically.
- [26:39]
B
So the AG went in with subpoenas for the financial records, including the digital records, and a woman by the name of Susan, who was an executive assistant to Ralph, was being instructed while they're coming in to delete the mortgages out of the System. Okay, but the, the two problems, okay, first problem. And sue was kind enough to make sure that everybody knew this at the AG's office. That, or the appropriate people knew it. That, that the. She knew that the system as a. It being a forensic, a financial management system from old school would log deletions. So there was a deletion log, and that deletion log was being updated every time she hit delete, which is timestamped. And it's timestamped during the point where the people are coming in to execute the warrant. Okay? So. And the beauty of it is, of course, Ralph is telling her to delete all the bad mortgages. Okay? So like let's. Hypothetically there's, you know, 2800 or 32,000, whatever the number of mortgages that Rimfolk had, the ones that are being deleted are all the ones that they shouldn't have made in the first place. Okay? So if you need to prove that Ralph knew what Ralph was doing, then all you had to do was look at the fact that they just happened to be deleting all the ones that implicated Ralph in doing. You know what I mean? So, so, you know, that kind of evidence is not just interesting because it shows the particular mortgages are going missing. It shows that somebody's actively involved in attempting cover their misconduct. Right.
- [28:33]
A
Yeah.
- [28:33]
B
And you know, again, the import of the fact that the woman cooked the. Cooked the books, if you will, as to the text messages really wasn't about whether our guy had done the stupid stuff that was in the text messages that she was trying to imply he did or didn't do weren't really the focus of the litigation. But the fact that she was choosing to manipulate data so as to create bad image of him really cooked her goose.
- [29:08]
A
Yeah, that would do it.
- [29:10]
B
And her lawyer obviously wants nothing to do with any of that. No, no lawyer wants to be in that position. You know, you touched on something, you know, when you said something about what traditionally had been the realm of digital evidence. And then that is. And you know what in part led to that book that you were asking me about or mentioning a minute ago. I mean, you come into digital evidence in the context of, you know, 25 or 26 or 20, you know, 2010 even, okay, 99% of that is discussed around large corporations, data processing departments. You know, then you get the mass email, you know, discovery stuff, the traditional big firm E discovery problems. Okay. That today is the tip of the iceberg in the sense that obviously Epstein is, is a large scale project. Okay, Right. But But I'm talking about, you know, garden variety divorces. I'm talking about a sexual abuse case involving misconduct by a coach in school. Things that don't scream E discovery. And yet the reality is that, you know, this guy was texting kids about setting up, you know, the little. Your AI just put a thought bubble with a thumbs up on my screen here because I did this. This guy was texting kids about setting up the fat tests. Okay, well, you know, those become quite useful. You know, he moved email very subtly. You could watch as he would start with an email from, you know, Tim conlon@darrow everett.or T. Conlanarrow everett.com to an email address that wasn't his school email. So it wouldn't even fly to the school server. And similarly, he'd. I don't know exactly how, I mean, I could talk to clients about it, but he'd weasel a private email address right from the kids. And then he'd get the. Over time, you could watch the communication go from the equivalent of T. Conlin to some personal email address that I have and away from your Tom Hagee at the school department. Basically, they were NKSD emails. Okay, so in North Kingstown School, if I recall correctly, North Kingstown School Department, nksd.net let's say, okay, so it would go from T Conlon@nksd.net to some personal email address. It would go from student Tom Hagee@ntsd.net okay, to some personal email that you had. And now all of a sudden that communication is being moved off of. Off of the school.
- [32:29]
A
Right? Yep. Gotcha. So to kind of step back or step up. I don't know which way I'm stepping, but. So let's talk about raising the literacy of digital evidence among attorneys. If you were doing a short course for litigators on digital evidence, what would you say are the core concepts they absolutely must understand? And then secondly, are courts keeping up with this?
- [33:00]
B
Well, look, okay, I'll take the second thing first, if you don't mind, just because to the extent that the lawyers are, it, it is certainly causing the courts to do so. Okay, but in terms of the first thing, I would say the concepts of quote, native files, okay? And metadata, okay? So for those who are not familiar with the term, metadata is basically data about data, okay? And metadata in the context of any computer file is material that is stored in the original file. And I'll get to what I mean by that in a minute. But the original computer file accessed by the program that is not necessarily seen by the user, okay? So just to use Microsoft Word as an example, okay? When you install Word, at some point in your preferences, you may well set up that you know your name is such and such, your organization is such and such, and you know your initials are tjc, okay? That data is being associated with every file that you create, along with when you created it, along with when you modified it, okay? And the reason that, for instance, when your computer crashes or you forget to save something, or you were prompted that there was something that wasn't saved, do you want to recover, right, Is that that stuff is accessible to the software that Microsoft runs to create these files in background and then can be scavenged, for lack of a better term, so as to reconstruct what it is that you are at. But flipping it around, if you open the Word doc, not with Word, but with forensic software, or for that matter, a text editor and just look at the file, you can see pieces of data that are stored just as you can with an I, a picture taken on an iPhone, okay? You can see data around where it was created, when it was created, when it was modified, and etc. Etc. We are, as lawyers, sometimes lazy or not thinking around the difference between getting the document, okay, which could be produced as a PDF of a Word document, right? And then bait stamped as a PDF versus getting the actual Word file. And there's information that you can glean from the Word file or from the email that you would not be able to glean from the raw file from a PDF, which is a picture, if you will, of the file. So understanding the difference between a PDF of a file versus quote, the native file and getting native files, where you have issues around the forensics of what is going on under the hood is a significant step that lawyers should be aware of, technically.
- [36:24]
A
How do you do that? You kind of said it quickly, I believe. But if I wanted to see the metadata behind a Word document or a
- [36:35]
B
PDF, maybe I don't want to say that I know all of this off the top of my head with a popcorn quiz in terms of what the most effective tool is. Okay. But you can definitely open most files with what on my. You know, I run Max, so TextEdit, okay, is I think the name of Max, Generic Text editor. Okay?
- [36:58]
A
Right.
- [36:59]
B
And it'll open a lot of stuff. Now you. How much you will be able to read is a different story, okay? Because a lot of it is, I don't say machine language, but it's encoded in such a way that it means nothing to the Naked eye as to most forms of commonly used files, image files, word documents. There are tools that will allow you to examine the metadata without altering the file. So there are forensic tools that are. Apart from just generically being able to open it up and peer into it, There are tools that will allow you to open the file without opening it. You're viewing the file so you're not altering. Altering it. And they've been specifically structured so as to, for example, read Word files and grab whatever metadata restored with the Word file or the. The PDF or the this or that. Each software package is storing different kinds of metadata. Right. The program, her, the programmer, or the company that wrote the program has the ability to build that in. You can go to a web page, view a source, and you'll see metadata that's there on the webpage that is not available to you. I mean, it's all available to you. Okay. But it's not visible. I'm looking at a webpage right now as I'm talking with you. It's showing me Riverside. It's showing me your studio. It's showing me timestamp.
- [38:43]
A
Right.
- [38:43]
B
It's showing me a bunch of stuff that is what you're seeing, only backwards slightly, and you've got some controls. Okay. But if I were to view Source, I would see a completely different thing, which is what the HTML editor is transferring into. You would always want to get the HTML code again. It's a great example. Okay. Get the HTML code on the websites of the entities you're suing. Okay.
- [39:10]
A
Yeah.
- [39:10]
B
Okay. Because, like, when I'm coming into a school system, you know, and. And I come into school systems, you know, hot, for lack of a better term. You know, we've gone on and we've downloaded, and there's a tool called Site Sucker. Again, that's a Mac thing. I'm sure there's wonderful things to do it on PCs, but I'm not plugging Site Sucker. Okay. But all I'm getting at is, what it'll do is I type I. What's the. The address of? You must have a website, right?
- [39:42]
A
Yeah, yeah. Litigation conferences.
- [39:43]
B
There you go. So I could point Site Sucker at that. Tell it to drill down 12 levels, and it just like points and clicks and it downloads each HTML file, It remaps it so that it'll run on a local drive. So I can basically mimic what would be out on the web, and then I can look to see what changes on your website between yesterday and today. Now, you may. Nothing might have changed other than, oh, I did an interview with Tim Conrad. Okay. But if you're a school department with a problem and a particular teacher, that teacher may get evaporated off that website pretty damn quick. Okay.
- [40:25]
A
Yeah. Or any company trying to make a change.
- [40:28]
B
Correct, Correct. So going out and grabbing. What is the current rev of the. When they don't know you're coming. Okay. And, and, and having a version of their website. And then there's. You've got the Wayback Machine. I don't know how many people are familiar with the Wayback Machine.
- [40:45]
A
Go ahead.
- [40:46]
B
Okay. The Internet Archive. Are you familiar with this or not? Okay, fine. So, but again, you're working in this area, so we're going to assume that some of the people listening to your podcast don't know what the hell I'm talking about.
- [40:58]
A
They won't.
- [40:58]
B
Okay. Right. So the Wayback Machine is a throw out to Sherman and Peabody. Some cartoon characters in Rocky and Bullwinkle. Back when I would actually had, you know, hair and was a little touch.
- [41:10]
A
Right.
- [41:11]
B
Yeah. No, that's where it comes from.
- [41:13]
A
Forgot about that.
- [41:14]
B
He forgot all about that part.
- [41:15]
A
Right, I remember that. I remember it vividly now.
- [41:18]
B
Yeah, now he's like, holy moly, guys. Right? He's got it. It's the way back, Mr. Sherman. In any event, we'll skip over that part. You can Google it. Okay. But in terms of the Internet Archive, which if you Google the Wayback Machine is where you're going to get rot. Not to Mr. Sherman and Peabody. But be this as it may, in terms of the Internet Archive, it's I believe, a not for profit that does nothing but scrub, store and archive and index snapshots of websites. Okay. I'm not certain how they choose who. And I certainly don't know what their frequency algorithm is all about. Okay. I do know that if you wish to arrange with them, I believe for some form of contribution, they will step it up in terms of a particular entity. But be this as it may, you can go to the Internet Archive tomorrow and look at Darrow, Everett and. Or any other entity that's out there on the. On the web. And then ask it when you got snapshots of that entity.
- [42:32]
A
Okay?
- [42:33]
B
Okay. And you can then download, okay, whatever snapshots it's got now, it is not necessarily complete. Okay. It's not like they will take every page off of, you know, the North Kingstown School Department's website. So you're stuck with what they happen to shoot on a.
- [43:02]
A
Right. Nor, nor will they do it minute by minute.
- [43:05]
B
No, no, no, that's correct. It may be that there's 10 shots that happened in a six month period in, in 2019, you know what I mean? Or two. And it'll show you graphically when it has those shots, but you can grab those, when you grab them, you grab original HTML. So if you open it with, with at least again, I'll go with Apple's Universe Safari. You got to put yourself into developer mode and then you can turn on the ability to see the source code as opposed to actually just get a functional. I mean it'll function, but. But if you view it as source code, then you can look at what they had for metadata.
- [43:50]
A
Yeah, there's a lot of, lot of data behind these websites. And I use, I have used it for what was. I do. I was working with another company and I was doing webinars for them and I needed to have to tell my people how to get to that webinar. I had to have a special ID for that webinar and the company was very slow in getting it for me. So I would just, I would just go on. You go on Chrome, you go view, as you said, you go down to developer and you can say view source and it shows you all the metadata. And then I figured out, oh, they bury the ID way down in line 3, 542 or something. So I, anyway, so I did learn to use it for that reason. But there is, you're right, it's just page after page after of data.
- [44:37]
B
Right. So the amount of stuff that's out there is astounding. Right. It's really more a question of shifting your mindset to from where you used to be, which is you're a consumer looking at stuff. And you know, I go to a website and what they show me is what I'm seeing versus someone who's looking under the hood. Right. Turning on the source, you know, looking at the source and seeing the code that's behind it, which is flat out there in the open. Okay. And, and pulling the data that they're not intending that you see. Yeah, right.
- [45:17]
A
Yeah. And this, and this other thing came up and I don't know if this is metadata or what it is, but I was trying to help a firm find language of an agreement in a court case. And I found the files where they discussed it, but they heavily redacted that specific language. So I took the PDF and I just copied the redaction and I pasted it into TextEdit and it revealed what was behind.
- [45:42]
B
Okay, so.
- [45:43]
A
And this just came up again in the news, big time.
- [45:49]
B
Okay. So we're all on the same page in terms of people listening to this. There are redaction tools that will obliterate the data that you were able to reveal. Okay. There are also people doing redactions that are not redactions. Okay. And, and so, yes, you know, if you put a black block over something, the thing that you put the black block on is there.
- [46:23]
A
Yeah.
- [46:24]
B
And that's not a redaction. Okay. But again, it's all about looking not at what the program just chooses to show you. Right. Because if you open the thing in a PDF viewer, you're going to see the black block that somebody put on top of the text. That's, you know, from a technical point of view, there's an image, there's some text, and somebody put the image over the text. So it's going to recreate it exactly like it's supposed to. The image will be over the text. Well, okay, great. But the text is still there. And if you, you copy and paste, you'll get the text. There's other ways of getting behind, you know, if somebody's foolish enough to do it that way.
- [47:05]
A
Well, this recently came out, and I don't know. I can't remember which case it was. It might have been the Epstein case, but there was significant redactions, as everybody knows. But somebody was able to uncover it by doing exactly what I did. I thought I discovered it, but maybe, you know, other journalists have been using it. But I do want to get to, you know, while we have time. Now, I misspoke earlier and said you're writing about artificial intelligence and data in digital. I meant to say what you're writing
- [47:31]
B
about to do that as well. So I think that.
- [47:34]
A
Have you.
- [47:34]
B
Yes.
- [47:35]
A
Okay.
- [47:35]
B
Well, we've wanted. But go ahead.
- [47:39]
A
Well, I just want to give you an opportunity because you've got a book coming out also on crypto. So you've handled litigation in these high conflict cases where digital forensics and crypto have come into play, including one in which you recovered quite a bit of money in hidden crypto. So tell us about that and what, what lessons that you might share with other attorneys about what you.
- [48:06]
B
Well, for one, it doesn't make sense to use, and I'll just use, you know, the Rhode island forms, if you will, as an example. But standard forms that are not looking for digital assets are just woefully incomplete is really what it comes down to, because whether it's a Venmo account, which most people wouldn't conceive of as crypto in the normal sense of the word. But it is certainly electronic currency, okay. That is moved money moves, you know, through it. Okay. Or it's, you know, Bitcoin or any of the other digital wallets that are out there. You know, it's become quite popular, number one. Number two, it's potentially quite lucrative. And it's also, on the one hand, incredibly transparent when you have access, but if you don't have access, is. Is easily covered. So the idea that you would just ignore digital currencies is certainly not a smart idea if you're a family law attorney. And then the question becomes, how do you divide it? How do you force its division? Which we were able to get a court to do. And I'll just drop a little suggestion here, okay. If you. Because normally the problem in my area, in the family law area around the digital currency is that you have one spouse who's like in like deeply embedded tech around the crypto market stuff, and you've got another spouse who's basically not interested or clueless, not because they're stupid or anything, but just it became a hobby for somebody. And the person it became a hobby for, okay. Is in this 24 7, the other spouse only knows that they put some money into crypto. Okay. So there's the disparity in information. And I will just using that case as an example reference, that the person who had control of it was not exactly forthcoming in terms of dividing the stuff. There would just seem to always be a problem getting it done. So the quick hint I'll throw out there is that we got an order entered that said that to the extent that the crypto wasn't in fact divided by such and such a date, the risk of loss. Didn't use the term risk of loss, but what it said is that the value as of that date he owed her period, and one half of okay. If the market went up, she got the up. If the market went down, not once you shifted the market risk unilaterally to the person in that instance was the guy, but to the guy who controlled the coin. He wanted that stuff divided as quickly as possible.
- [51:16]
A
Right, Gotcha.
- [51:17]
B
Because they were no longer in a position where he was effectively gambling with her money because he knew perfectly well that the court was going to divide it 50, 50. And if he left it in there, which he had the appetite around risk, evidently, and it went down, she got less money. If it went up, there was more. And he liked playing, so therefore he
- [51:42]
A
did well, how did you find that he had it? Was it a matter of you just asked and then got an order, or was there evidence suggesting that he had it?
- [51:50]
B
So I candidly will not be able to recall exactly how we found the first sniff of it. Okay. But I can tell you that you see transfers of funds out into the investments. Okay? And once you've got the fact that there are transfers out, you get court orders that the guy give you snapshots out of digital wallets. And ultimately, we brought basically a financial advisor who managed crypto funds for our client into a room with the guy and his lawyer. And we monitored the movements out of the crypto accounts in real time as they went from, you know, just making it up $100 in Bitcoin, you know, in this wallet, to $50 in Bitcoin in that wallet. So the client created their own wallets that all had, you know, values of zero with the same providers that the money was at. We moved the stuff, you know, and. And watched it in real time, ultimately, you know, but the key, frankly, in terms of getting it done was the order that basically shifted the risk of loss over to him, because at that point, he had no appetite for. Okay, you know, it was going to cost him if it went down, so he didn't want it to remain in his unilateral control. But honestly, I think it was probably six months of wrangling to get to the point where there was that order. Now, as it worked out, it had gone up during that period of time. Right. But. But had it gone down, it would have been a problem, and the client had the right to make control over over half of the stuff and no ability to do it because it was all held under his, you know, control.
- [53:50]
A
Yeah, yeah. So it sounds like to me, like there was a thread sticking out, and you guys pulled on it and pulled on it and pulled out it and got a court order kind of thing, so. That's right.
- [53:59]
B
Okay. Once you pry open a little bit, getting the rest of it, you know, I. Another case we had gotten then goes Back to like 2006 or some ridiculous, you know, from today's point of view, technology. But we'd gotten backups of either a BlackBerry or a Palm Pilot, some ancient device that was rumored to have existed in those days, you know, and we were able to pull Excel spreadsheets that the guy had stored on CD rom, backups of a PC, and we got emails back and forth with account holders. We got screenshots, okay. Or images of. Of. Of things that the guy Viewed out of the cache. Like somebody goes on to, you know, bankofamerica.com there's cache files on your computer that show what you were looking at. Okay, so between the Excel files, which documented in that instance 24 million. Okay. Versus. Because he had net worth, what he called the net worth statement on his computer in Excel. Right. With 24 million. We had his financial disclosure form with the court that disclosed, I believe it was eight and a half. So you don't need a. I'm not a mathematician, but yeah, absolutely. You know, it's not. So. So, you know, she winds up with 55% of. Of 24. It could have been 25, but 24 in change, let's say. Okay, but she winds up with 55% of 24 and change instead of 50% of what was originally disclosed or, you know, gotten without the benefit of the electronic discovery. And he picks up the tab for the computer forensics, he picks up the tab for us going in and doing what we did. So, you know, from her point of view, it's a win. And from his point of view, it's, you know. Well, she said she wasn't interested in that stuff. He just pulled that off by saying it was speculative, which it was, you know, but it was also generating a mass quantities of income, and he didn't bother to mention that. So he felt, because she said that she wasn't interested in these speculative things that might have calls associated with them. And, you know, and she got half of, you know, bumping on 10 mil. So, I mean, it wasn't like she. She was in a hurting position, but it clearly was not equitable.
- [56:44]
A
The Emerging Litigation Podcast is a production of Critical Legal Content, which owns the awesome brand HB Litigation. What we do is simple. We create content that's critical on legal topics for law firms and legal service providers. That kind of content can be blogs, papers, they can be podcasts, webinars. Once again, I'm Tom Hagee with Critical Legal Content and HP Litigation. If you like what you hear and you want to participate, give me a shout. My contact information is in the show Notes. Thanks for listening.