Cernam raises the bar for capturing and preserving online content as evidence

The CIO-level business angle on the latest tech

When I worked for a large corporation, every now and then my co-workers and I would get a notice from the legal department about a lawsuit the company was involved in. We'd be told that any documents and other business records we had generated or used were subject to scrutiny as evidence in the suit, and that we shouldn't delete or destroy any records. Everything had to be preserved for potential admission in court.

With business lawsuits being fairly common, the practice of e-discovery is standard operating procedure for digital evidence. And for data and other records that are generated and stored in-house on the corporate network, saving an unadulterated copy is not a problem. The IT department can relatively easily create and preserve copies of every electronic record and document within its domain.

Today, however, legal departments are facing a new challenge that is largely the result of the consumerization of IT: Electronic documents and data that are central to a lawsuit may not reside within the company's firewalls. Today it's very likely that critical evidence could be posted to a blog or a social media website; saved to a cloud based storage system; stored in a SaaS application; or otherwise reside on some transient medium that is outside the control of the company. In this case, it's difficult to capture the information in a way that satisfies legal requirements for the validity of evidence.

To continue reading, register here to become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

When I worked for a large corporation, every now and then my co-workers and I would get a notice from the legal department about a lawsuit the company was involved in. We'd be told that any documents and other business records we had generated or used were subject to scrutiny as evidence in the suit, and that we shouldn't delete or destroy any records. Everything had to be preserved for potential admission in court.

With business lawsuits being fairly common, the practice of e-discovery is standard operating procedure for digital evidence. And for data and other records that are generated and stored in-house on the corporate network, saving an unadulterated copy is not a problem. The IT department can relatively easily create and preserve copies of every electronic record and document within its domain.

Today, however, legal departments are facing a new challenge that is largely the result of the consumerization of IT: Electronic documents and data that are central to a lawsuit may not reside within the company's firewalls. Today it's very likely that critical evidence could be posted to a blog or a social media website; saved to a cloud based storage system; stored in a SaaS application; or otherwise reside on some transient medium that is outside the control of the company. In this case, it's difficult to capture the information in a way that satisfies legal requirements for the validity of evidence.

STUDY: IDC: IT hasn't grasped consumerization trend

For example, suppose an employee posted information about a pending corporate takeover on his Facebook account. The stock price of the target company suddenly plunges in value and a lawsuit follows. By the time the lawyers attempt to preserve a copy of the Facebook post -- the critical piece of evidence -- it has been removed. Even if the lawyers had captured a screen shot of the Facebook post, it may be defective in terms of evidence because the screen shot could have been faked or altered.

Now there is a new solution coming to market that addresses this specific problem of online content as digital evidence. Cernam is a firm that specializes in digital investigations with a focus on online evidence and investigations. Cernam's founder and managing director, Owen O'Connor, says "the use of online productivity tools has emerged as one of the biggest emerging sources of digital evidence and litigation type content. Online data is more fragile because it can be removed or changed. There is a need to bring forensic rigor to the capture and preservation of this content."

Cernam is raising the bar in the use of online content as evidence. Today what people are doing in collecting online evidence is primarily focused on screen shots, printouts and PDF captures. Whereas when you look at email, which is a very mature area in terms of digital evidence, no one would consider a screen shot of an email as acceptable as evidence. If that were acceptable, the entire industry around e-discovery and digital forensics would not exist today, and we would be exchanging screen shots as evidence.

Linda Musthaler is a principal analyst with Essential Solutions Corporation.