A significant shift that I noticed at last month's InsideCounsel SuperConference was the increase in topics on technology and its effects on GCs. For years, GCs have primarily focused on the law and protection of an organization from a legal standpoint, but now a GC also has to be somewhat of an expert on an organization's networks and technology–whether we like it or not. GCs need to have some understanding of network security, how to protect your organization's networks and what to do if network violations occur. The area of computer forensics can be an important component of this protection, and it is important for GCs to be aware of its many aspects.

An area previously reserved for IT professionals, this column addresses key facets of computer forensics, including what computer forensics is, why it is important to a GC and reasons for engaging an experienced computer forensics examiner when appropriate.

What is computer forensics?

Computer forensics is the discipline of combining elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications and storage devices in a way that is admissible as evidence in court. A thorough computer forensic investigation can uncover hidden data or files that may not be viewable in a directory listing of the hard drive. Also computer forensics often can recover evidence in files that were accidentally or intentionally destroyed.

Because it is a relatively new discipline, there is little consistency or standardization with respect to computer forensics across IT, legal professions or the courts. As we've all seen, the number of corporate investigations continues to rise, creating more awareness of computer forensics and the wide range of computer crimes and misuses, including illegal internet activity, trade secret theft, fraud, sexual harassment, embezzlement and destruction of intellectual property. Awareness of the legal and technical facets of computer forensics helps to attain crucial information if your network is compromised and helps to prosecute a case if an intruder is caught.

What GCs need to know about computer forensics

Protecting company data is critical to organizations. Recent legislation such as HIPPA and SOX make it possible to hold organizations both civilly and criminally liable if customer or employee data is not properly protected. GCs should make IT professionals aware of how technical actions can be affected by existing laws, including legal ramifications for using security monitoring tools and having proper authorization before monitoring and collecting information related to a computer intrusion. Violations during computer forensics investigations could constitute a federal felony punishable by a fine and/or imprisonment. If computer evidence is collected, it must be collected in a way that is legally protected and admissible in court. You risk destroying vital evidence or risk having forensic evidence ruled inadmissible if computer forensics is handled improperly. Should an intrusion lead to a court case, an organization with computer forensics capability will be at a distinct advantage. Knowing key areas of computer forensics helps GCs protect company data, which in turn protects the company as a whole.

The value of an experienced computer forensics examiner.

A knowledgeable computer forensics professional can ensure that a subject computer or network system is carefully handled so evidence is not destroyed, damaged or compromised by the procedures used in the investigation. They also ensure that a computer virus is not brought in by a subject computer or device during the analysis process and maintain and establish chain of custody. Experienced examiners will also make sure that if business operations are affected that it is only for a limited amount of time.

Computer forensics experts use technology and techniques to conduct powerful searches of data for collection and presentation in a legally acceptable format. Keyword searches and password decryption can be performed to locate a “smoking gun” or vital information that can be used as evidence in a case. Experienced examiners can also provide expert testimony on computer forensics, including activity on individual computers and complex network systems. They can perform data recovery services and analyze hard drives for various types of user activity, including Web sites visited, files downloaded and the types and length of time that external/removable devices were attached to a PC. Working with an experienced computer forensics professional provides benefits on both a technical and legal level. Importantly, it also ensures protection against viruses during an investigation, limits business operational downtime, protects client-attorney information and even offers expert testimony if necessary.

GCs are now required to protect their organization's networks and work with IT professionals to ensure network security. Understanding what computer forensics is, why it is important to a GC and when to use a computer forensics professional are areas in which GCs now need to be informed in order to provide the utmost legal protection to their organization.

———-

A significant shift that I noticed at last month's InsideCounsel SuperConference was the increase in topics on technology and its effects on GCs. For years, GCs have primarily focused on the law and protection of an organization from a legal standpoint, but now a GC also has to be somewhat of an expert on an organization's networks and technology–whether we like it or not. GCs need to have some understanding of network security, how to protect your organization's networks and what to do if network violations occur. The area of computer forensics can be an important component of this protection, and it is important for GCs to be aware of its many aspects.

An area previously reserved for IT professionals, this column addresses key facets of computer forensics, including what computer forensics is, why it is important to a GC and reasons for engaging an experienced computer forensics examiner when appropriate.

What is computer forensics?

Computer forensics is the discipline of combining elements of law and computer science to collect and analyze data from computer systems, networks, wireless communications and storage devices in a way that is admissible as evidence in court. A thorough computer forensic investigation can uncover hidden data or files that may not be viewable in a directory listing of the hard drive. Also computer forensics often can recover evidence in files that were accidentally or intentionally destroyed.

Because it is a relatively new discipline, there is little consistency or standardization with respect to computer forensics across IT, legal professions or the courts. As we've all seen, the number of corporate investigations continues to rise, creating more awareness of computer forensics and the wide range of computer crimes and misuses, including illegal internet activity, trade secret theft, fraud, sexual harassment, embezzlement and destruction of intellectual property. Awareness of the legal and technical facets of computer forensics helps to attain crucial information if your network is compromised and helps to prosecute a case if an intruder is caught.

What GCs need to know about computer forensics

Protecting company data is critical to organizations. Recent legislation such as HIPPA and SOX make it possible to hold organizations both civilly and criminally liable if customer or employee data is not properly protected. GCs should make IT professionals aware of how technical actions can be affected by existing laws, including legal ramifications for using security monitoring tools and having proper authorization before monitoring and collecting information related to a computer intrusion. Violations during computer forensics investigations could constitute a federal felony punishable by a fine and/or imprisonment. If computer evidence is collected, it must be collected in a way that is legally protected and admissible in court. You risk destroying vital evidence or risk having forensic evidence ruled inadmissible if computer forensics is handled improperly. Should an intrusion lead to a court case, an organization with computer forensics capability will be at a distinct advantage. Knowing key areas of computer forensics helps GCs protect company data, which in turn protects the company as a whole.

The value of an experienced computer forensics examiner.

A knowledgeable computer forensics professional can ensure that a subject computer or network system is carefully handled so evidence is not destroyed, damaged or compromised by the procedures used in the investigation. They also ensure that a computer virus is not brought in by a subject computer or device during the analysis process and maintain and establish chain of custody. Experienced examiners will also make sure that if business operations are affected that it is only for a limited amount of time.

Computer forensics experts use technology and techniques to conduct powerful searches of data for collection and presentation in a legally acceptable format. Keyword searches and password decryption can be performed to locate a “smoking gun” or vital information that can be used as evidence in a case. Experienced examiners can also provide expert testimony on computer forensics, including activity on individual computers and complex network systems. They can perform data recovery services and analyze hard drives for various types of user activity, including Web sites visited, files downloaded and the types and length of time that external/removable devices were attached to a PC. Working with an experienced computer forensics professional provides benefits on both a technical and legal level. Importantly, it also ensures protection against viruses during an investigation, limits business operational downtime, protects client-attorney information and even offers expert testimony if necessary.

GCs are now required to protect their organization's networks and work with IT professionals to ensure network security. Understanding what computer forensics is, why it is important to a GC and when to use a computer forensics professional are areas in which GCs now need to be informed in order to provide the utmost legal protection to their organization.

———-