Archives – April, 2017

Rising to the Challenge: Junior Attorneys Utilize Expert Witnesses in the Courtroom

 

Originally published in The New York Law Journal , an ALM Media publication, on March 31, 2017.

By: Michael Rader

Much ink has been spilled in recent years about the “vanishing jury trial” in America. With fewer jury trials and more at stake in many of the cases that are tried (for example, large patent infringement cases), opportunities for junior attorneys to participate meaningfully in trial advocacy have evaporated. Federal judges have increasingly expressed concern about who will be prepared to try the complex cases of the next generation.

Creating opportunities for young lawyers to take an active role in today’s trials is not, however, just a way of preparing the legal profession for the future. It is also an important strategy for serving clients in the present. Young lawyers often work more closely than senior lawyers with the witnesses who will testify at trial and are in a unique position to present those witnesses’ direct testimony. Eager to gain trial experience, young lawyers invariably bring an outstanding level of preparation to the task. Finally, advocacy by young lawyers can be refreshing—and most importantly, persuasive—to judges and juries.

Earlier this year, an organization called Chiefs in Intellectual Property (ChIPs) published a survey identifying 19 recent orders from federal judges across the country encouraging law firms to provide relatively inexperienced lawyers with opportunities for trial advocacy and oral argument.

For example, Judge Indira Talwani of the District of Massachusetts issued a standing order in 2015 directed expressly to “Courtroom Opportunities for Relatively Inexperienced Attorneys.” It provides: “Recognizing the importance of the development of future generations of practitioners through courtroom opportunities, the undersigned judge, as a matter of policy, strongly encourages the participation of relatively inexperienced attorneys in all court proceedings including but not limited to initial scheduling conferences, status conferences, hearings on discovery motions and dispositive motions, and examination of witnesses at trial.”

 

Similarly, a standing order concerning the conduct of jury trials, issued by Judge William Alsup in the Northern District of California in 2016, explains: “The Court strongly encourages lead counsel to permit young lawyers to examine witnesses at trial and to have an important role. It is the way one generation will teach the next to try cases and to maintain our district’s reputation for excellence in trial practice.”

Many of the standing orders directed to participation by junior lawyers include provisions requiring adequate preparation and supervision by more senior lawyers (which would surely be implicit in any event). Others include a variety of other special provisions. For example, a standing order issued in early 2017 by Magistrate Judge Christopher Burke in the District of Delaware indicates that the court will make an extra effort to grant oral argument—and will strongly consider allotting additional time for oral argument—when young lawyers are slated to argue.

A review of the standing orders compiled by ChIPs shows a strong trend of increasing judicial concern about this issue. While eight such orders were issued between 2005 and 2015, 10 were issued in 2016 alone. It is now a best practice, in addition to scrupulously following applicable local rules, for counsel to check whether a judge has a standing order concerning the participation of young attorneys.

As always, it is important to know the judge, who may have strong feelings about this issue even if he or she has not issued a standing order. For example, Judge Allison Burroughs of the District of Massachusetts makes it a practice to offer law firm associates an opportunity to argue a motion even after the lead attorneys have finished their presentation on that same motion. In January 2016, she wrote in the Boston Bar Journal that she hopes “litigants will see it as an opportunity to make their points one more time, rather than as a potential pitfall for the young and unwary.” Associates attending court hearings should make a special point of being well-prepared to take judges like Judge Burroughs up on such an offer.

While many of the judges who have issued standing orders like those discussed above have done so out of concern for the future of the trial bar, law firms and clients should appreciate that involving junior team members in trial work and oral argument has a more immediate impact: It benefits a client’s representation in multiple ways.

When it comes to examining a witness at trial, junior lawyers frequently have a distinct advantage over their more senior colleagues. It is very often the junior lawyer who spent significant time with the witness during the discovery process and in the weeks and months leading up to the trial. In the case of an expert witness, the junior lawyer probably played a key role in drafting the expert report. In the case of a fact witness, the junior lawyer probably worked with the witness to prepare a detailed outline of the direct examination. Direct examination is challenging, and it is critical that the examining attorney and the witness know each other well.

Knowing the witness is even more important for re-direct, which is impossible to script fully in advance. Successful re-direct requires knowing what the witness knows and what the witness will say when questioned on a topic. Cross-examination may cover unanticipated subjects, making it difficult to conduct re-direct without the rapport that comes from a lawyer and a witness having spent significant time together. With that in mind, clients should appreciate that the individual best positioned to present a witness’s direct testimony at trial may be the junior attorney who worked with that witness over the course of the case.

As numerous standing orders reinforce, it is crucial for senior counsel to ensure that junior attorneys are well-prepared for every task. The investment of time required to prepare a junior attorney to examine a witness or conduct an important argument can be substantial, but this type of hands-on mentoring is one of the most rewarding aspects of legal practice.

With few if any exceptions, junior lawyers avail themselves of mentoring and prepare extremely well when given such opportunities. In 2011, Judge Denise Casper of the District of Massachusetts observed that earlier standing orders from judges in her district “had the desired effect of having more well-prepared junior attorneys attend status conferences, argue motions to the Court, and, under appropriate supervision, examine witnesses at trial.” It is understandable that clients expect senior lawyers to argue important motions and present important witnesses, and senior lawyers certainly must earn their keep. However, clients should also keep an open mind and be prepared to discuss staffing decisions with senior lawyers, who may exercise their professional judgment to instead prepare a junior lawyer to undertake some of those same tasks.

Involving diverse talent in trial work and oral argument also helps hold the interest of the audience (whether judge or jury). In patent litigation, for example, most cases involve a claim construction hearing (known as a Markman hearing) that can last several hours or sometimes even multiple days. A single advocate, no matter how talented, may begin to bore the judge after many hours at the podium. A change of pace is almost always welcomed by judges and juries alike.

Conclusion

With age comes wisdom. It has been said that the wisest individual is one who learns from every person. Today, many judges—the most experienced trial experts in the legal profession—are recommending that junior lawyers be afforded substantive opportunities in court. Senior trial attorneys should take note and learn from those recommendations in implementing winning strategies for their clients.

 

Michael Rader, a litigation shareholder at Wolf Greenfield, heads the firm’s New York office.

Leave a Comment April 28, 2017

Using Computer Forensics Expert Witness to Investigate Employee Data Theft

By: Timothy M. Opsitnick, Joseph M. Anguilano and Trevor B. Tucker, JURINNOV, Cybersecurity Law & Strategy

This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. 

Over 25% of employees steal proprietary data when departing a company or organization. See, “Employee Departure Creates Gaping Security Hole, Says New Data,” Biscom. To that end, our experience shows that departing employees have a sense of ownership over the data that they copy. Intellectual property commonly stolen includes customer lists, secret formulas, source code, strategy documents and other trade secrets. The information is often used against the organization when the former employee goes to work for a competitor or decides to start a new company.

When suspicions of employee data theft arise, it is important to engage a computer forensics expert to perform a theft-of-IP analysis in order to preserve electronic data and uncover important evidence. Using specialized software, the expert can reveal digital footprints such as:

  • USB activity;
  • Files recently opened;
  • Cloud storage usage;
  • Files sent to personal email accounts; and
  • Recently printed documents.

The results of the analysis can provide the foundation for legal action such as a temporary restraining order, permanent injunction, subpoena of personal devices, or other litigation to prevent the misappropriation of company data.

When Employee Data Theft Is Suspected

Employee data theft occurs most frequently just prior to, or immediately after, an individual’s termination or resignation from an organization. Telltale signs that an investigation is warranted include unusual activity by the employee, such as:

  • Plugging a personal USB thumb drive or hard drive into a computer;
  • Coming into work at odd hours or establishing remote desktop connections during off-hours;
  • Transferring large amounts of data on the company network;
  • Visiting file sharing sites like Dropbox or Google Drive; or
  • Sending emails with attachments to personal accounts.

If there are concerns that a departing employee has stolen proprietary data, then it is important to take steps not to delete important electronic evidence located on his or her computer. If the computer is powered on, then leave it on, because important evidence may be stored on the computer’s random access memory and could be deleted if the computer is powered off. Also, ensure that the computer cannot be accessed remotely by disconnecting it from the network.

If the computer is already turned off, then place it in secure storage. Furthermore, confirm that the employee’s login credentials are disabled or have been changed, but do not let the IT staff reinstall the operating system or reassign the computer to another employee. Such actions could destroy or overwrite any evidence of wrongdoing. Finally, resist the temptation to “take a peek” at what is stored on the computer by turning it on and accessing files because this could alter the data, thereby making the investigation more complex.

If the suspected employee had a company-issued cell phone, place it in secure storage as well. Smartphones hold an abundance of useful information, such as text messages, emails, call logs, Internet activity and more. The simple act of resetting the phone, however, can permanently destroy this data.

IP Theft Investigations

Preserving and Analyzing Electronic Evidence

The first step in a theft of IP investigation is to forensically preserve the data on the employee’s device(s). The computer forensics expert will create chain of custody documentation, photograph the hardware, and verify the integrity of the preserved data, among other things. These steps ensure that the electronic evidence will be admissible in court.

Once the data is preserved, the next step in the investigation is to perform an analysis to identify software and artifacts that may be indicative of IP theft. These areas on a typical Windows installation include:

  • USB activity;
  • Files recently opened or deleted;
  • Cloud storage;
  • Personal email accounts;
  • Internet history report; and
  • Printed documents.

USB Activity Analysis

Many of today’s USB devices, such as thumb drives and external hard drives, have enough storage capacity to save an entire copy of a user’s hard drive. As such, they are one of the most common tools used to steal data. The good news is that using a USB device leaves behind a trail of digital evidence that can prove invaluable to an investigation.

Analyzing a user’s USB activity can reveal several key facts regarding what was connected to the computer and when. In most cases, forensic experts can determine the serial number and/or brand of the USB device, as well as the first and last time the device was connected to the computer. In some instances, they may also be able to verify each time a specific USB device was connected.

Often, the analysis will reveal that an external USB hard drive or flash drive was connected for the first time during an employee’s last week of employment. While most analyses reveal a new USB connection, it is also possible that a device used throughout the duration of the suspect’s employment was never returned. A device such as this would likely contain numerous documents and files that were related to the employee’s day-to-day activities and could contain value to a competitor. If it is a requirement that employees return company-owned USB drives at the end of their employment, forensic experts have the ability to verify whether or not that policy was upheld.

While confirming that a USB device was connected to a computer is significant, it is even more important to know what files were accessed and potentially transferred to the device. The Microsoft Windows operating system creates various artifacts when a user opens a file or folder. These artifacts indicate what was opened, when it was opened and from where it was opened. A classic red flag is if the employee was opening files during the last week of employment that were not related to the work being performing during that time.

Another consideration is the organization’s data access policy. If data access restrictions are not in place, then the employee may be able to access company files unrelated to current work that are stored on the network. The existence of these artifacts when combined with a USB activity timeline can indicate a high probability that data was copied off the system.

Last, the artifacts can also contain specific information about where the file existed. If a file was opened from a USB drive, the artifact will indicate this, providing factual evidence that the suspect is in possession of a USB drive that contains specific files. For example, combining a USB analysis and files recently opened analysis could show that on Oct. 7, 2016, at 7:22:08 a.m., a non-company-issued SanDisk thumb drive with serial number 851450 was plugged into the computer for the first time and a file titled “Client Contact List.xlsx” was opened.

Cloud Storage

If the analysis shows that certain files were accessed but no USB activity was detected, the next step in the investigation is to identify evidence that a cloud storage provider such as Dropbox, Google Drive or Microsoft OneDrive was accessed. The purpose of these applications is to share and sync data across multiple computers. For example, Dropbox may have been surreptitiously installed on the employee’s work computer as well as his or her home computer. Consequently, the simple act of syncing a company file to Dropbox will instantaneously also make that file available on the employee’s home computer.

The good news is that cloud storage applications often have corresponding log files and databases that record what files the user accesses and what activities are performed. These logs can signify files have been uploaded to the cloud in the past even if they have already been deleted from the shared folder. Some of these applications even save deleted data in a separate “hidden” folder on the computer itself that users typically are not aware of. As a result, a theft of IP analysis may show that Dropbox was installed on the user’s work computer and that early in the morning on Oct. 7, 2016, 50 files were deleted and the “hidden” folder reveals these were company files.

Personal Email Accounts

Some individuals may use their company email to send attachments to their personal email account such as Yahoo or Gmail. In these cases, forensic experts are able to perform a preservation of the employee’s work email to identify and document the evidence of misconduct.

Internet History Report

An Internet history report can be generated that shows, inter alia, recent Internet searches, websites and pages visited, cookies from websites, and Internet downloads that occurred. Such information is helpful in establishing what an individual thought was important or even their state of mind. For example, analysts have discovered that individuals have searched on how to delete data or copy data surreptitiously and that they reviewed websites that were in essence “how to manuals” to perform certain deleterious acts.

Paper Documents

Finally, individuals who are a little less aware of more modern techniques to copy data will simply print the documents they wish to take out the door. In these cases, forensic experts are able determine the last known print date of Microsoft Office documents.

Deliverables and Project Timeframe

The turnaround time for a theft of IP analysis performed by an analyst is typically one week. Deliverables provided will be easy to understand in the form of spreadsheets, HTML reports, and written reports containing the findings of the analysis. A forensic expert should also spend time with the client either over the phone or in person to discuss the reports in detail so that they know exactly what a report contains and the assumptions and opinions of the forensic expert. If necessary, an expert will also provide depositions or expert witness testimony regarding the authenticity of the evidence and their findings.

*****
Timothy M. Opsitnick is president, Joseph M. Anguilano is director of operations, and Trevor B. Tucker is a forensic analyst of JURINNOV, LLC. JURINNOV, LLC, a wholly-owned subsidiary of Technology Concepts & Design, Inc. (TCDI), a technology company that provides cybersecurity and e-discovery services.

The views expressed in the article are those of the authors and not necessarily the views of their clients or other attorneys in their firm.

Leave a Comment April 14, 2017

Ineligible Expert Insufficient to Justify Continuance, Court Rules

 

By: Ben Seal

Originally published in The Legal Intelligencer, an ALM media publication on April 3, 2017.

A legal malpractice plaintiff is not entitled to a continuance to seek an expert to testify despite learning shortly before a scheduled trial that his intended expert was ineligible, the Pennsylvania Superior Court has ruled.

A split three-judge panel issued a March 27 memorandum finding that Aldis Rutyna should have known that his medical expert had signed a consent judgment precluding him from testifying against the medical center involved in Rutyna’s underlying medical malpractice case. The trial court correctly dismissed the case with prejudice due to Rutyna’s inability to produce an expert witness, the appellate court determined in Rutyna v. Schweers.

Attorney William S. Schweers Jr. of Harrington, Schweers, Datillo & McClelland filed a medical malpractice complaint on Rutyna’s behalf against the University of Pittsburgh Medical Center in 2006 alleging negligence during back surgery. But Rutyna did not file a certificate of merit, leading to a judgment of non pros and the case being dismissed, Senior Judge Eugene Strassburger wrote for the 2-1 majority.

The following year, Rutyna and his wife filed a complaint against Schweers alleging breach of contract and vicarious liability for failure to file the certificate of merit. After a winding course of litigation that Judge Carl Solano described in his dissent as “convoluted,” a trial was set for June 2016, but the Rutynas requested a continuance just two weeks prior upon learning from Schweers about their expert’s inability to testify against UPMC.

 

Schweers filed a motion in limine seeking to preclude the expert, Dr. Mark Foster, from testifying because he was not qualified under the MCARE Act due to his failure to practice within the subspecialty at issue. Schweers also made an oral motion for nonsuit based on the Rutynas’ lack of a qualified medical expert. Both motions were granted, leading the Rutynas to appeal to the Superior Court.

On appeal, the Rutynas argued that Schweers waited too long to object to Foster’s qualifications, an argument Strassburger said was without merit because there is no requirement that an objection be made before voir dire.

“The trial court could not make a determination regarding Dr. Foster’s qualifications without conducting voir dire,” Strassburger said. “However, the trial court could not conduct voir dire under these circumstances because, as the Rutynas acknowledge, Dr. Foster would not testify.”

In reviewing Foster’s qualifications, Strassburger said that because he no longer practices as an orthopedic surgeon, he did not meet the standards set forth by the MCARE Act to testify as an expert against an orthopedic surgeon. Foster’s lack of qualifications factored into the court’s response to the Rutynas’ argument that their case should not have been dismissed because Foster’s inability to testify was caused by Schweers’ actions.

“Even if Dr. Foster were otherwise available, i.e., he had not signed an agreement not to testify, he would have been precluded anyway under MCARE,” Strassburger said.

He also rejected the Rutynas’ argument that they should have been given additional time to find a replacement expert, quoting the trial court’s ruling in the process.

“‘This case is over a decade old. … The only “surprise” that befell [the Rutynas] respecting the scheduled trial in this matter was that [Dr. Foster] had determined months in advance that he would not offer testimony against [UPMC],’” Strassburger said.

Finding no abuse of discretion by the trial court, he affirmed the order. In his dissent, Solano said the Rutynas should have been granted a continuance because there was no evidence they were negligent in not learning of Foster’s agreement sooner.

James R. Cooney of Pittsburgh represented the Rutynas. He said he thought it was “the type of case that cried out for a continuance, even though it’s been around for a while,” and noted his disappointment for his injured client.

Kenneth Schott III and James Schadel of Burns White in Pittsburgh represented Schweers. Schott did not return a call for comment.

Contact managing editor Zack Needles at zneedles@alm.com.

Leave a Comment April 7, 2017


Contact

Email: experts@ALM.com
Phone: 888-809-0133

Archives

Expert Witnesses

ALM Experts Blog

Admin