The Case for In-House eDiscovery | Heathcare Info Security (Upasana Gupta)

In mid-2011, Canada’s Scotia Bank set up an internal eDiscovery team of three full-time professionals to tackle litigation issues for the institution in 50 countries.

The goal: to preserve, collect, review, manage and produce any electronic evidence relevant to a court case. For Greg Thompson, vice president of enterprise security services at Scotia Bank, Canada’s third-largest institution, eDiscovery has become a top concern because of the rising litigation caseload. Failure to comply with an eDiscovery request could result in fines or other penalties.

 

The main reasons for establishing an internal eDiscovery team, versus outsourcing it: huge cost savings, increased control of data and a better understanding of the litigation process.

“Satisfying a court order is heavy lifting,” Thompson says. “The cost and risks of outsourcing this service with regards to the number of litigations we are dealing with has skyrocketed. If you send your data to an external party for investigations, you can expect to pay somewhere around $2,000 per day compared to internal expertise, where we spend around $800 per day.”

Scotia Bank’s choice is increasingly common among private and public sector organizations worldwide. The expansion of litigations, electronically stored information and the risk of sending data to third parties are pushing these organizations to develop their own eDiscovery capabilities.

“eDiscovery is becoming a big deal,” says David Matthews, deputy chief information security officer for the City of Seattle in the U.S., and author of a forthcoming book called “Electronically Stored Information: The Complete Guide to Management, Understanding, Acquisition, Storage, Search, and Retrieval.” “Every bit of infrastructure and activity generates electronic data, so organizations and individuals are expected to understand by law where their electronic evidence is and how it’s accessed and produced in court.”

via The Case for In-House eDiscovery.

Court Sanctions Defendants for Elaborate Spoliation, Declines to Sanction Misled Counsel Unaware of “What was Going on Behind the Scenes” : Electronic Discovery Law

United Cent. Bank v. Kanan Fashions, Inc., No. 10 CV 331, 2011 WL 4396912 (N.D. Ill. Mar. 31, 2011); United Cent. Bank v. Kanan Fashions, Inc., No. 10 C 331, 2011 WL 4396856 (N.D. Ill. Sept. 21, 2011)

In this case, the magistrate judge recommended sanctions against defendants for their bad faith spoliation of a relevant server where the evidence strongly suggested that defendants arranged for the sale of the server to company in Dubai, which resulted in the unavailability of its admittedly relevant contents.  The magistrate judge declined to sanction defendants’ attorneys, however, where the evidence indicated that they made efforts to ensure preservation but were misled by their clients and unaware “of what was going on behind the scenes.”

Plaintiff alleged that defendants were in default on several loans and sought damages accordingly.  In the course of discovery, defense counsel repeatedly informed defendants of their obligation to preserve relevant information.  Despite their obligation to preserve and their assurances to counsel that all appropriate efforts were being undertaken, defendants took steps to ensure the unavailability of a relevant server which was maintained in one of defendants’ warehouses.  The details of defendants’ efforts are numerous and complex.  Summarizing broadly, when defendants experienced significant financial problems and defaulted on both the lease of the at-issue server and the loan related to the warehouse in which it was stored, Defendant Shah (who controlled the four corporate defendants) entered into an agreement for a “friendly foreclosure” on the warehouse and for the foreclosing bank to purchase the server’s lease (which was owned by a different bank and also in default) and to resell the server to Shah.  This agreement was reached after plaintiff’s complaint had been filed and after defendants had been informed of their duty to preserve.  Despite this, the arrangements for the bank’s purchase of the lease and resale of the server to Shah were not revealed to defense counsel.  Rather, defendants’ attorneys were assured that preservation was ongoing and repeated these assurances to the court and to the plaintiff, without correction or clarification from defendants.  When counsel eventually learned that the server had been left at the warehouse following defendants’ eviction and was in the possession of the bank, defendants assured counsel that access would not be a problem; such assurances continued for several months.

via Court Sanctions Defendants for Elaborate Spoliation, Declines to Sanction Misled Counsel Unaware of “What was Going on Behind the Scenes” : Electronic Discovery Law.

FCPA Roundup: Swiss Bank Accounts, Ferraris and “Foreign Officials” – Law Blog – WSJ

here’s more FCPA news swirling around this week than you can shake a deferred prosecution agreement at.

For starters, on Wednesday the Justice Department announced another resolution in the Bonny Island case that has ensnared KBR in its Nigerian operations. JGC Corp. has agreed to pay $218.8 million for participating in a decade-long scheme to bribe Nigerian government officials.

JGC, a Japanese engineering and construction company, and KBR are two of four companies that were part of a joint venture awarded more than $6 billion contracts for a LNG plant on Bonny Island. Our Corruption Currents blog has more on the case, plus links to the criminal information and deferred prosecution agreement.

DOJ filed a deferred prosecution agreement and a criminal information today against JGC in federal court in Texas, charging the company with one count of conspiracy and one count of aiding and abetting violations of the FCPA.

The case doesn’t involve a Ferrari (more on that later; meanwhile check out the coolest Ferrari ever here) but it does include multi-million dollar wire transfers, Swiss bank accounts and “cultural meetings” where bribes were discussed.

Now for the Ferrari. The National Law Journal has this story today about opening statements in one of the many FCPA trials slated for this year, the case against California company Lindsey Manufacturing Co.

The government says two of the company’s senior executives paid more than $5 million in bribes to officials at Mexico’s electricity provider in exchange for contracts. The bribes included a $300,000 red Ferrari and a $1.8 million yacht.

via FCPA Roundup: Swiss Bank Accounts, Ferraris and “Foreign Officials” – Law Blog – WSJ.

Wikileaks Episode Should be Wake-Up Call for Companies | Governance Center Blog

If you are a director on a U.S. public company, you probably had a queasy feeling in your stomach when you heard about Wikileaks’ potential next target: corporate America.

Let’s face it. If there were to be a data dump of corporate e-mails, documents and other secret information that was the size of the classified U.S. government cables released by the rogue Wikileaks Web site last year, the ramifications for that particular company could be severe. And that’s not so much because the information being leaked was confidential or top secret. It’s how the information is portrayed by the leaker and how key stakeholders and the markets react to that portrayal.

The information itself could be as minor as some embarrassing e-mails or as major as documents that could be discoverable in criminal or civil litigation. But since most IT teams, CIOs, CEOs and directors can’t predict what information might be leaked by an organization like Wikileaks or a whistleblower, for that matter, preparing for such a breach of data security becomes an exercise in crisis risk management.

The type of risks at play here run the gamut from strategic and operational risks to business model and financial reporting risks, especially if you are talking about the release of documents that might intimate a fraud has been perpetrated.

In the case of Bank of America, which happens to be the alleged target of Wikileaks [Read Forbes blog post here], the possibility that such a leak may occur in the near future has cost the bank considerable money. It has been reported by the New York Times that Bank of America hired the consulting firm Booz Allen Hamilton to conduct an internal investigation. The bank is looking for a needle in a haystack as employees in the finance, technology, legal and communications departments try to determine what, if any, computers or hard drives are missing or have been compromised. All this because the director of Wikileaks, Julian Assange, said in an interview last year that a major bank would be the next big target of his non-profit organization.

While such a threat couldn’t have been contemplated only 10 years ago, the digitization of our world has made it possible. That doesn’t mean that all leaks of classified or secret information are bad (i.e. the Pentagon Papers during the Vietnam War, WorldCom whistleblower Cynthia Cooper’s testimony). But  the potential downside from such a release of corporate information definitely should keep the C-suite and directors up at night.

via Wikileaks Episode Should be Wake-Up Call for Companies | Governance Center Blog.

Hacked laptops lead banks to warn of data breaches – Computerworld

Recent data breaches at two banks underscore what’s becoming a gnarly problem for companies that handle sensitive information: When does a hacked PC become a data breach?

Sovereign Bank noticed its problem on Oct. 15, when staffers discovered a computer on their network connecting to an unusual IP address. After investigating, they found a keylogger program on a company laptop. Sovereign isn’t releasing many details on the incident, but in December it notified 50 customers nationwide that their data may have been compromised.

Over at Pentagon Federal Credit Union, a bank used by nearly 1 million U.S. service members, a hacked laptop led to a bigger problem. On Dec. 12, the company found that someone had hacked a laptop on its network and used it to access a company database that contained credit card numbers, addresses, Social Security numbers and other sensitive information. A PenFed spokeswoman wouldn’t say how many customers were affected, but the company is re-issuing 514 credit cards in New Hampshire alone.

Both incidents underscore how easily a hacked laptop can be used to gain access to sensitive information, an issue that’s becoming more of a problem for corporate IT as criminals continue to hit workers with malicious e-mail and links to drive-by-download websites — the two most popular hacking techniques to get malicious software installed on a computer. Criminals set up drive-by-download websites to install malicious software on victims’ computers. Typically they leverage known computer flaws to silently install their malicious software.

via Hacked laptops lead banks to warn of data breaches – Computerworld.

Hacked laptops lead banks to warn of data breaches – Computerworld

Recent data breaches at two banks underscore what’s becoming a gnarly problem for companies that handle sensitive information: When does a hacked PC become a data breach?

Sovereign Bank noticed its problem on Oct. 15, when staffers discovered a computer on their network connecting to an unusual IP address. After investigating, they found a keylogger program on a company laptop. Sovereign isn’t releasing many details on the incident, but in December it notified 50 customers nationwide that their data may have been compromised.

Over at Pentagon Federal Credit Union, a bank used by nearly 1 million U.S. service members, a hacked laptop led to a bigger problem. On Dec. 12, the company found that someone had hacked a laptop on its network and used it to access a company database that contained credit card numbers, addresses, Social Security numbers and other sensitive information. A PenFed spokeswoman wouldn’t say how many customers were affected, but the company is re-issuing 514 credit cards in New Hampshire alone.

Both incidents underscore how easily a hacked laptop can be used to gain access to sensitive information, an issue that’s becoming more of a problem for corporate IT as criminals continue to hit workers with malicious e-mail and links to drive-by-download websites — the two most popular hacking techniques to get malicious software installed on a computer. Criminals set up drive-by-download websites to install malicious software on victims’ computers. Typically they leverage known computer flaws to silently install their malicious software.

via Hacked laptops lead banks to warn of data breaches – Computerworld.

Corruption Currents: Trends To Look For In 2011 – Corruption Currents – WSJ

The anti-corruption world crackled with activity in 2010, with the U.S. (again) setting Foreign Corrupt Practices Act enforcement records, the Group of 20 turning its gaze toward the United Nations Convention against Corruption and the World Bank amping up its fraud and corruption investigations unit, to name a few major developments.

Zuma Press

But now it’s time to peer into the future, to what promises to be another groundbreaking year on several anti-corruption fronts. We’ve listed below 10 trends we expect to see in 2011. But don’t take our word for it — please, write us with your own forecasts.

More anti-corruption enforcement by foreign nations: The anti-graft group Transparency International found that seven parties to the OECD anti-bribery convention actively enforced it in 2010, up from four in 2009. The U.K. Bribery Act, which takes effect in April, has the potential to reach corruption anywhere on the globe, and U.K. investigators are eager to grab some of the market share from their counterparts in the U.S. Nigeria, meanwhile, has capitalized on U.S. anti-bribery cases, opening its own probes into Halliburton Co., Panalpina Group and others. Earlier this week, authorities in Malaysia and Honduras announced investigations that piggyback on the U.S. probe of French telecommunications company Alcatel-Lucent SA, which agreed to pay $137 million to resolve bribery allegations. And the U.S. now routinely includes language in settlement agreements requiring companies to cooperate with foreign authorities and multilateral development banks.

via Corruption Currents: Trends To Look For In 2011 – Corruption Currents – WSJ.

Foreign Shareholders Increasingly Told to Stay Out of U.S. Courts – Law Blog – WSJ

Increasingly, federal courts are rolling up the welcome mat when it comes to securities suits by foreign investors.

That’s the theme of this WSJ article today that looks at the impact of the Supreme Court’s recent ruling in Morrison v. National Australia Bank.  The ruling concluded that Australian investors who purchased shares of an Australian bank should not be able to bring a securities fraud suit in U.S. court.

That holding has been a boon to multinational companies, as courts have interpreted Morrison to bar fraud claims by any investor — either from the U.S. or overseas — who purchased stock on a foreign exchange. Courts have dismissed  claims against Credit Suisse Group, Alston SA, and others in light of Morrison.

The ruling could also save millions of dollars for the likes of BP, which faces securities suits over the Gulf oil spill, and Toyota, which faces securities claims arising from its handling of sudden acceleration claims. Some of the plaintiffs in each case purchased their stock overseas, so they could be out of luck.

via Foreign Shareholders Increasingly Told to Stay Out of U.S. Courts – Law Blog – WSJ.

Should U.S. Firms Build Local Practices in Hong Kong? | American Lawyer

The Agricultural Bank of Chinas initial public offering, expected to become the worlds largest, debuted Friday, landing squarely in the middle of a debate over whether leading Wall Street law firms should build local practice capability in Hong Kong.The IPO on the Hong Kong and Shanghai exchanges would seem an obvious rallying cry for those arguing that top American capital markets firms will miss out on deals without their own Hong Kong lawyers — except that the lead lawyers on the AgBank deal are from New Yorks Davis Polk & Wardwell, which only practices U.S. law.

via Should U.S. Firms Build Local Practices in Hong Kong?.

SEC Comment Watch: BofA’s Accounting Exam

The specter of TARP and troublesome economic times are still haunting Bank of America. In a recently released SEC staff comment letter, several items within the financial institution’s annual financial statements for 2008 were questioned by the SEC.

The staff was particularly keen on seeing an explanation regarding computation of the carrying value of the company’s reporting units. Of particular interest were the impairment tests to goodwill. The staff requested details of the testing, as no impairment to goodwill was recorded. Bank of America’s initial response to this comment was still inadequate for the SEC, as they followed up asking for additional details concerning the bank’s goodwill impairment testing.

Another area of SEC concern was the valuation of the TARP securities. The staff had requested additional information concerning the value of the preferred stock and warrants issued to the Treasury Department. Bank of America’s response spurred even more comments from the staff, probing deeper into the methodology of the company’s fair value determination.

via SEC Comment Watch: BofA’s Accounting Exam.