User:DKS Edinburgh/Draft Gates v Bando

Gates Rubber Company v Bando Chemical Industries, Ltd., et al.

Introduction

Gates Rubber Company v. Bando Chemical Industries, Ltd., et al. is a decision by the U.S. District Court for the District of Colorado from May 1, 1996. It is to be considered a landmark decision in terms of expert witness court testimony in questions of electronic evidence and forensics.

In a nutshell, the decision states that the authenticity of electronic evidence extracted from a computer hard disk is accepted by courts only, if the party adducing the evidence complied with the newest and safest standards for the acquisition of a given electronic evidence. Moreover, U.S. Magistrate Judge E. Schlatter explicitly commented on the factors he considered to be relevant in the process of wheighing the qualifications of digital forensics experts, when they present contrary opinions or conclusions to the court. Hence, Gates v Bando has set legal standards for examining computer evidence that have been cited by other courts since it was decided and remain relevant to this day.

The facts of the case

Gates Rubber Company and Bando Chemical Industries were both involved in the manufacture of industrial belts as direct competitors. Several of the other defendants aside from Bando were former employees of Gates, who had signed written non-competition agreements before they left the company. In 1989, Gates learned that persons associated with Bando used a computer program highly similar to one of its own, so that Gates suspected its former employees had stolen, copied and used it for Bando. Thus, Gates filed several actions on the grounds of unfair competition, misappropriation of trade secrets, infringement of copyright, and breach of contract.

During the court proceedings, Gates in 1992 learned that N., one of its former employees, deleted a software program called "Life in Hours" from his computer located in a facility of Brando. Furthermore(and actually decisive as regards the influence of digital forensics in court procedure), N. also "deleted" several word proceesing files on the same computer, testifying that he did not erase any materials relevant to the pending litigation. Consequently, Gates applied for expedited disclosure pursuant to the provisions of Fed.R.Civ.P 34, in order to examine whether ot not the defendant had maliciously deleted files in an attempt to destroy evidence. The court granted Gates a court order that allowed Gates to copy the hard drive of Newman's computer in order to obtain as much information as possible from the "deleted", but reconstructible files. Gates then assigned the technician V. to execute the copying of the hard drive, whereas he subsequently also appeared as Gate's expert witness in the court procedure.

In retrospect, the technical method V. applied to create a copy of the hard drive of N.'s computer as well as his formal professional qualification as a digital forensics expert (particularly in comparision to the expert witness summoned by the defendant) turned out to be the crucial aspects that were decisive for the outcome of Gates claims arising from Bando's alleged violation of discovery obligations through spoliation.

Acquisition of electronic evidence

In the course of his examination, V. copied a software-program onto the hard drive of N.'s computer (which contained the evidentiary electronic files), in order to create a "file-by-file" copy of the hard drive. This conduct induced the court to extensively comment on the forensic methods that must be applied to electronic evidence to allow it to be used as a piece of evidence in court procedure:

First, the court stated that - as a general rule - any digital forensic examiner shall be obliged to "utilize the method which would yield the most complete and accurate results" in order to comply with the legal prerequisites in regard to the admissibility of evidence in court procedure. As a result, several organizations started to continuously publish best practice literature for electronic evidence acquisition.However, it should be kept in mind that such a "best practise" prerequisite must be considered a dynamic procedural hurdle, as the technical requirements and possibilities in analyzing and copying digital data change with the underlying hard- and software, and consequently the technical procedures to be applied in order to create a legally permissible piece of electronic evidence may change in the future.

Second, the judge held that the "file-by-file" copying procedure applied by Gates' forensic examiner fails to fulfil the court's "best practice" requirement. Instead, it had been necessary for a forensic investigation de lege artis to copy the hard drive by means of creating an image (or: "mirror") copy:

"Gates retained V. as its technician to do the copying, and he attempted to do this through the use of a program called Norton's Unerase. Proper use of the program could yield information, or partial pictures, about files which were once present on the computer's hard drive, but were deleted.

Gates argued that V. did an adequate job of copying the Denver computer. W. (the defendant's expert witness, remark of author) persuaded me, however, that V. lost, or failed to capture, important information because of an inadequate effort. In using Norton's Unerase, V. unnecessarily copied this program onto the Denver computer first, and thereby overwrote 7 to 8 percent of the hard drive before commencing his efforts to copy the contents... Additionally, V. did not obtain the creation dates of certain of the files which overwrote deleted files. This information would have assisted in determining the deletion date of some files.

W. pointed out that V. should have done an "image backup" of the hard drive, which would have collected every piece of information on the hard drive, whether the information was allocated as a file or not. Instead, V. did a "file by file" backup, which copies only existing, nondeleted files on the hard drive. The technology for an image backup was available at the time of these events, though rarely used by anyone...

I find that the duty was on Gates, and not Bando, to utilize the best technology available."

The standards outlined above have become the general standards in computer forensic examination. According to these statements, electronic data, which is recovered from computer hard disk (or any other form of electronic storage unit for digital information) is permitted to be used in court procedures only, if the data is duplicated and verified in a forensically sound manner. The forensic examiner in Gates v Bando (V.) failed to create such a forensically sound duplication since the installation of the examiner's software could have overwritten existing files on the hard drive, this is the constitution of the evidence was altered even before the copy was made. Correct duplication, however, requires that any alteration of the data during the process of copying is reliably excluded., which is usually warranted by write-blocking of the original storage device. Correct verification means that the electronic evidence presented to the court must be provably identical to the one originally investigated, which usually is warranted by means of a "hash value", an algorithm that calculated a number based on the content of the respective piece of electronic evidence.

In the present, compliance with this "best practise" requirement can usually be achieved by using a proprietary imaging software, as this will admittedly preserve the evidential value of the electronic information recovered.

Qualification assessment of digital forensics expert witness testimony

Expert qualifications are considered by both lawyers and experts to be very important, and in the case of Gates v Bando, the court reaffirms that widely accepted belief. Judge Schlatter stated in this context:

"Bando's expert on matters associated with computer science was W., who holds a Ph.D. in computer science from Stanford. W.'s credentials, experience and knowledge were impressive, and I relied upon his opinions. Gates failed to obtain a similar expert in timely fashion. Gates did offer the testimony of V., the technician who was hired by Gates to copy the hard drive of the computer at Bando's Denver facility. His credentials, experience and knowledge were nowhere near those of W., and I placed much less weight on his testimony than on W.'s."

The court strongly relied on the experts' formal qualification, as it was obviously the most distinguishable criterion in this case. However, most cases in litigation are not that unambigious. Then, the factor of an expert's actual professional appearance - including but not limited to the ability to impart non-legal knowledge to the court, the thoroughness of the report and the traceability of the expert's inferences - will play a larger role. A major practical issue for judges outside the narrow scope of electronic evidence acquisition, however, remains in the lack of measurability of IT expertise, partly due to the absence of uniform formal professional qualification in this field.

Lessons from Gates v Bando for the future

The case surely highlights the necessity of selecting a given digital forensics expert carefully when it comes to civil litigation involving digital evidence issues, as such expert's opinion often turns out to be decisive for the outcome of a case. But the parties' due diligence in such cases even goes further: it is not only the selection of an expert witness in the litigation stage, but already in the pre-litigation phase attorneys and experts are obliged to ensure the correct acquisition of electronic evidence which is potentially relevant to their case. Moreover, they have to develop and apply an evidential reasoning that could both professionally withstand an opponent forensic expert's testimony and factually persuade the judge and/or the jury in the courtroom.

Apart from that, the course of the court procedure has (relatively early) illustrated the potential economic impact of E-disclosure issues on litigation: originally initiated as a secondary theatre of war in an IP litigation, these issues soon merged to a case of its own that finally achieved economically and temporally dimensions exeeding the original matter in dispute. Meanwhile, more than 90 % of all corporate information is stored electronically. Typically enough, digital forensics has become a big business with an estimated market value of 780 Mio. $ in 2011. Generally, the outcome of an increasing number of cases in all fields of law will depend on issues of digital evidence.

To the same extent which Gates v Bando illustrates the necessity for ligitation parties to carefully plan and execute a sophisticated strategy in terms of electronic evidence, however, it must be realized that it ultimately describes a recurrent practical problem: as IT and its relating tools and techniques will progress and the courts will (presumably) carry on to demand the application of the very best method available to warrant an electronic evidence's authentity, the absence of commonly court-accepted standards will emerge again and again. One potential solution for litigators to avoid the repeated occurence of this issue might lie in entering in entering into pre-trial agreements with their oppponent, in which they agreep upon certain conditions for the mutual recognition of their electronic documents' authenticy.