±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 5
Overall: 26215
Visitors: 72

±Forensics Europe Expo


±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Legal privilege

Discussion of legislation relating to computer forensics.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Legal privilege

Post Posted: Mon Dec 03, 2012 11:15 am

Just chatted with an LE buddy of mine (I'm not LE) about a case where the CPS have directed that some devices are to be examined by an "independent" non-LE analyst due to there being files that are subject to legal (solicitor-client) privilege. It's not an enquiry that I've fielded before.

Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire? I guess I could produce keyword search logs that show particular directories/files are excluded from my searches. What if there are live/deleted files that could be classified as legal privilege outside of any named directories/files?

Who establishes whether the defence are playing with a straight bat? For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.

The enquiry started with a request for me to acquire an image minus the items of legal privilege for viewing by LE.

Thanks in anticipation.  

Fab4
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 11:48 am

Sometimes its easiest to get an independant barrister to sit in on the examination to ensure legal privilege isnt violated. But overall you've got the idea, the law is slanted in the favour of the defendant to a disturbing degree.

Do people abuse legal privilege? Of course they do. Some lawyers are bent as hell.  

Xennith
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 12:09 pm

- Fab4
For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.


This isn't my area of expertise, but though I'd chime in with a question.

Says who? Folders do not have "content". Whether something is legal privilege or not should be determined by a third party (you, from the way I read it) based on the contents. If there are a thousand legal privilege files in that directory, and one image of child sexual exploitation, should it really be beyond law enforcement discovery simply because it resides near protected material?  

twjolson
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 1:19 pm

- twjolson
- Fab4
For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.


This isn't my area of expertise, but though I'd chime in with a question.

Says who? Folders do not have "content". Whether something is legal privilege or not should be determined by a third party (you, from the way I read it) based on the contents. If there are a thousand legal privilege files in that directory, and one image of child sexual exploitation, should it really be beyond law enforcement discovery simply because it resides near protected material?


Individual docs are designated privileged. Those docs are kept together in a folder. So yes, anything in that folder is privileged (subject to limits and challenges).

Also, whilst a challenge to privilege will be determined by a third party, generally your own legal counsel is competent to designate docs for privilege prior to or during discovery (at least in the US and compatible common law systems).

I am not a lawyer, this is not legal advice.
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6 

Patrick4n6
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 1:31 pm

As already mentioned, the court usually appoints an independent lawyer to verify that material claimed by the defendant/ respondent as privileged is indeed subject to privilege. Although seemingly simple at first, the law of privilege is a rather involved area. You'd be better off asking your legal team for advice on this rather than your fellow geeks. Wink

- Xennith
But overall you've got the idea, the law is slanted in the favour of the defendant to a disturbing degree.


Probably something to do with that pesky presumed innocence thing.

- Xennith
Do people abuse legal privilege? Of course they do. Some lawyers are bent as hell.


Most aren't though. Some UK prosecution are "bent as hell" too, though most aren't.
_________________
Forensic Control
twitter.com/ForensicControl 

Jonathan
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 1:50 pm

- Fab4
Just chatted with an LE buddy of mine (I'm not LE) about a case where the CPS have directed that some devices are to be examined by an "independent" non-LE analyst due to there being files that are subject to legal (solicitor-client) privilege. It's not an enquiry that I've fielded before.

Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire? I guess I could produce keyword search logs that show particular directories/files are excluded from my searches. What if there are live/deleted files that could be classified as legal privilege outside of any named directories/files?

Who establishes whether the defence are playing with a straight bat? For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.

The enquiry started with a request for me to acquire an image minus the items of legal privilege for viewing by LE.

Thanks in anticipation.


Fab4

Specify exactly the examination tool/s (and procedures) you intend to use and demonstrate in advance that the tool allows (take nothing for granted) selection and choice for extraction and havesting of particular data? Make sure all parties agree to its use.

Confirm with the pros whether a video of the examination is also required?

Make sure your contemporaneous notes are complete and without omission of any actions you conducted e.g. you don't want the video showing something you haven't written in your notes.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 2:02 pm

I should probably have qualified that the legal counsel of the party claiming privilege can designate in my earlier comment.

When I was working LE in Australia, I worked a case where the computer was seized from a solicitor's office. I conducted the entire examination with that solicitor's solicitor sitting next to me, and he agreed on what wasn't privileged and could be produced, and if there was any disagreement, we could have taken it to the judge. In the end however, we didn't have any disagreements, and we produced a combination of full documents and redacted documents for trial.
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6 

Patrick4n6
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next