Notifications
Clear all

Legal privilege  

  RSS
Fab4
 Fab4
(@fab4)
Active Member

Just chatted with an LE buddy of mine (I'm not LE) about a case where the CPS have directed that some devices are to be examined by an "independent" non-LE analyst due to there being files that are subject to legal (solicitor-client) privilege. It's not an enquiry that I've fielded before.

Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire? I guess I could produce keyword search logs that show particular directories/files are excluded from my searches. What if there are live/deleted files that could be classified as legal privilege outside of any named directories/files?

Who establishes whether the defence are playing with a straight bat? For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.

The enquiry started with a request for me to acquire an image minus the items of legal privilege for viewing by LE.

Thanks in anticipation.

Quote
Posted : 03/12/2012 9:15 pm
Xennith
(@xennith)
Active Member

Sometimes its easiest to get an independant barrister to sit in on the examination to ensure legal privilege isnt violated. But overall you've got the idea, the law is slanted in the favour of the defendant to a disturbing degree.

Do people abuse legal privilege? Of course they do. Some lawyers are bent as hell.

ReplyQuote
Posted : 03/12/2012 9:48 pm
twjolson
(@twjolson)
Active Member

For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.

This isn't my area of expertise, but though I'd chime in with a question.

Says who? Folders do not have "content". Whether something is legal privilege or not should be determined by a third party (you, from the way I read it) based on the contents. If there are a thousand legal privilege files in that directory, and one image of child sexual exploitation, should it really be beyond law enforcement discovery simply because it resides near protected material?

ReplyQuote
Posted : 03/12/2012 10:09 pm
Patrick4n6
(@patrick4n6)
Senior Member

For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.

This isn't my area of expertise, but though I'd chime in with a question.

Says who? Folders do not have "content". Whether something is legal privilege or not should be determined by a third party (you, from the way I read it) based on the contents. If there are a thousand legal privilege files in that directory, and one image of child sexual exploitation, should it really be beyond law enforcement discovery simply because it resides near protected material?

Individual docs are designated privileged. Those docs are kept together in a folder. So yes, anything in that folder is privileged (subject to limits and challenges).

Also, whilst a challenge to privilege will be determined by a third party, generally your own legal counsel is competent to designate docs for privilege prior to or during discovery (at least in the US and compatible common law systems).

I am not a lawyer, this is not legal advice.

ReplyQuote
Posted : 03/12/2012 11:19 pm
Jonathan
(@jonathan)
Senior Member

As already mentioned, the court usually appoints an independent lawyer to verify that material claimed by the defendant/ respondent as privileged is indeed subject to privilege. Although seemingly simple at first, the law of privilege is a rather involved area. You'd be better off asking your legal team for advice on this rather than your fellow geeks. wink

But overall you've got the idea, the law is slanted in the favour of the defendant to a disturbing degree.

Probably something to do with that pesky presumed innocence thing.

Do people abuse legal privilege? Of course they do. Some lawyers are bent as hell.

Most aren't though. Some UK prosecution are "bent as hell" too, though most aren't.

ReplyQuote
Posted : 03/12/2012 11:31 pm
trewmte
(@trewmte)
Community Legend

Just chatted with an LE buddy of mine (I'm not LE) about a case where the CPS have directed that some devices are to be examined by an "independent" non-LE analyst due to there being files that are subject to legal (solicitor-client) privilege. It's not an enquiry that I've fielded before.

Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire? I guess I could produce keyword search logs that show particular directories/files are excluded from my searches. What if there are live/deleted files that could be classified as legal privilege outside of any named directories/files?

Who establishes whether the defence are playing with a straight bat? For example, "the directory 'My Solicitor Correspondence" is entirely subject to legal privilege, but in reality it's where the suspect maintains all records relating to the alleged crime.

The enquiry started with a request for me to acquire an image minus the items of legal privilege for viewing by LE.

Thanks in anticipation.

Fab4

Specify exactly the examination tool/s (and procedures) you intend to use and demonstrate in advance that the tool allows (take nothing for granted) selection and choice for extraction and havesting of particular data? Make sure all parties agree to its use.

Confirm with the pros whether a video of the examination is also required?

Make sure your contemporaneous notes are complete and without omission of any actions you conducted e.g. you don't want the video showing something you haven't written in your notes.

ReplyQuote
Posted : 03/12/2012 11:50 pm
Patrick4n6
(@patrick4n6)
Senior Member

I should probably have qualified that the legal counsel of the party claiming privilege can designate in my earlier comment.

When I was working LE in Australia, I worked a case where the computer was seized from a solicitor's office. I conducted the entire examination with that solicitor's solicitor sitting next to me, and he agreed on what wasn't privileged and could be produced, and if there was any disagreement, we could have taken it to the judge. In the end however, we didn't have any disagreements, and we produced a combination of full documents and redacted documents for trial.

ReplyQuote
Posted : 04/12/2012 12:02 am
PaulSanderson
(@paulsanderson)
Senior Member

Why would you want a video of the examination - I have done quite a few of these cases and involved in a lot more and that has never been a requirement. What you do is not at issue, its what you produce at the end of the case. It just over complicate the matter and adds nothing at the end.

Typically, or rather almost invariably when lawyers are involved, they will want to look at every document that the other side wants and the respondent will claim privilege on things that aren't and the supervising solicitor will review and make a decision.

ReplyQuote
Posted : 04/12/2012 1:05 am
trewmte
(@trewmte)
Community Legend

Why would you want a video of the examination - I have done quite a few of these cases and involved in a lot more and that has never been a requirement. What you do is not at issue, its what you produce at the end of the case. It just over complicate the matter and adds nothing at the end.

A video over complicates nothing, merely adds support to the work undertaken. As I read fab4's question the work undertaken for the examination is in issue to prove no reproduction from a particular folder during the examination. Better to be safe, than overly self-confident.

What you aren't doing is illustrating for fab4 examination techniques, from the experience you say you have, that shares the benefit of your experience as to what could be done for examining this mobile/smart phone for evidence.

the respondent

I thought the prosecution in criminal proceedings were asking for the evidence?

ReplyQuote
Posted : 04/12/2012 1:55 am
Fab4
 Fab4
(@fab4)
Active Member

Thanks guys. All varied and useful responses.

I conclude that several considerations currently need to be undertaken by the CPS (in agreement with the suspect's representatives);

designation of privilege docs prior to/during examination,

allocation of an independent barrister/lawyer to advise on privilege during the examination and/or to review the acquired image to advise on privilege and/or to review the examination outputs (including stated sources of evidential data) to ensure that privilege has been fully observed in the report submitted to the Court,

escalation of disagreements re privilege to the Court.

I also note the (slightly contested) discussion about videoing the examination.

Probably something to do with that pesky presumed innocence thing.

Brilliant.

Thanks again. Any further opinions extremely welcome.

ReplyQuote
Posted : 04/12/2012 4:54 am
PaulSanderson
(@paulsanderson)
Senior Member

I was being constructive greg - some people/companies over complicate things - IMHO videoing is not required for the reasons I stated. What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.

ReplyQuote
Posted : 04/12/2012 2:31 pm
Fab4
 Fab4
(@fab4)
Active Member

What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.

Having thought about it overnight, this is the conclusion I came to and discussed with LE first thing this morning. If the lawyers decide to engage an independent peer to whatever degree before/during/after the examination, that is their call. For me, the gig is the same (on the data classified as not privileged) in relation to process, tools, notes and output.

Thanks again to all.

ReplyQuote
Posted : 04/12/2012 9:14 pm
trewmte
(@trewmte)
Community Legend

….CPS have directed that some devices are to be examined…………Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire?

"If there is a large volume of ESI, you should discuss the best method for it to be searched, collected, filtered and reviewed with your lawyer."
http//www.out-law.com/en/topics/dispute-resolution-and-litigation/disclosure-electronic-disclosure-and-document-review/disclosure-and-privilege/

I was being constructive greg - some people/companies over complicate things - IMHO videoing is not required for the reasons I stated. What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.

I'm not suggesting paul you're not being constructive and let me make it clear I didn't think that about or of you when I raised my observations. People differ in the way an examination can be conducted. I accept we all approach matters differently.

I realise now that I should have used 'e.g.' in my last post when I mentioned smartphone because I didn't know the devices fab4 would be faced with. The smartphone anology was used merely to represent where lawyers may have material stored e.g. on Blackberry devices.

"A typical smart phone contains a 2 GB removable memory card, which can contain the equivalent of 40 banker’s boxes of paper, or 100,000 pages."
A Litigation Neccesity Electronically Stored Information (ESI) Review Tools

I would welcome though if anyone can provide by reference to a weblink or a rule that states you mustn't video or it is seen as not required during a device examination where ESI privilege documents maybe present.

What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.

Having thought about it overnight, this is the conclusion I came to and discussed with LE first thing this morning. If the lawyers decide to engage an independent peer to whatever degree before/during/after the examination, that is their call. For me, the gig is the same (on the data classified as not privileged) in relation to process, tools, notes and output.

Thanks again to all.

fab4 this is your case and you are doing the work and will know the devices. My observations are just that and are not intended to hold you back. As you state you will run with what is best for you and in the case. Good luck with whatever you proceed to do.

ReplyQuote
Posted : 05/12/2012 3:00 am
Share: