evidence |

Counteracting Increased Illegitimate Whistle-Blowing

Posted on November 20, 2012 by Lina Maini

Increasingly, employers (estimated at a 300+% spike since approximately a decade ago according to the IRS) are falling prey to employee whistle-blowers that can leave a company or firm bankrupt beyond recovery. Granted, in any civilized society there should always be a strong mechanism in place for reporting illegal and or dangerous business practices to the proper authorities. The drastic rise in whistle-blower initiated claims however includes a disproportionately high number of simply disgruntled former employees using this tipping method in retaliation for both real and imagined offenses.

And government agencies are aggressively encouraging whistle-blowing as a means of backdooring in federal corporate oversight.

By way of example, the Dodd-Frank Wall Street Reform and Consumer Protection Act offers a whistle-blower provision that encourages giving tips to the Securities and Exchange Commission. The final rule permits them to go first to the SEC rather than their own firms, thus putting their firms at risk of falling under SEC scrutiny.

Under the provision, a whistle-blower who provides “original information” to the SEC in a case that results in $1 million+ sanctions, could be awarded up to 30% of the penalties levied. An SEC’s Office of the Whistleblower spokesperson stated that while he has no data to indicate whether the number of whistle-blower tips have increased since its rule implementing the act went into effect Aug. 12, there has been a “significant increase in the number of quality tips.” The SEC expects to will receive upwards of 25,000 new tips annually. Companies argued unsuccessfully for a requirement that employees first go to their own companies with any whistle-blower complaints before the go to the SEC. Employers feel that this bounty program will undermine their own internal compliance policies and will have a drastically reduced ability to monitor the every day mechanisms that keep companies in business. Companies can justifiably presume there will be more whistle-blowing claims, especially by disgruntled former employees and whether the claims are eventually proven false, the resultant legal defense costs will skyrocket for these companies.

Our advice is for companies to foster a workplace environment wherein employee complaints are non-judgmentally received and reviewed by supervisors and to ensure that employees recognize their rights in reporting issues via a well-crafted employee handbook. When the steps to reporting unpleasant workplace situations are clearly outlined (and recorded), employees feel empowered that their legitimate complaints are being taken seriously. There will always be a group of retaliatory malcontents in any company, but combatting this malice with a pro-active employee reporting policy will leave the onus of the legitimacy of questionable claims on the troublemakers and cause their separation from a content corporate workstaff.

One course of action that we recommend, and it may appear partial, but it is my job to know this, is to conduct background checks on potential new hires who will be handling financial, employee and client information. (I’ll cover the related mandatory Red Flagg employee and client data security rules of the new FCRA laws in a future article.)

Our Operatives: Street smart; info savvy.

As always, stay safe.

Filed under: background checks, Employment Regulations, evidence, whistle-blowng | Tagged: employee, Employment, Government Accountability Project, irs, penalty, reward, sec, Whistleblower, workplace | 2 Comments »

Electronic Crime Scene Investigations; Evidence Collection. II/II

Posted on July 24, 2012 by Lina Maini

In Part I of our two-part Electronic Crime Scene Investigations series, we covered recognizing and securing an electronic crime scene. In this post, we delve into the actual investigation itself.

First and foremost, now that you have isolated all persons with access from the crime scene, please ensure that they provide your investigator (whether it is an inside manager or a hired professional detective), with a release similar to the below. (Please check with your local law enforcement on particular jurisdictional guidelines.)

CONSENT TO SEARCH ELECTRONIC MEDIA
I, __________________, hereby authorize __________________, who has identified himself / herself as a law enforcement officer, and any other person(s), including but not limited to a computer forensic examiner, he / she may designate to assist him / her, to remove, take possession of and / or conduct a complete search of the following: computer systems, electronic data storage devices, computer data
storage diskettes, DVDs, or any other electronic equipment capable of storing, retrieving, processing and / or accessing data.
The aforementioned equipment will be subject to data duplication / imaging and a forensic analysis for any data pertinent to the incident / criminal investigation.
I give this consent to search freely and voluntarily without fear, threat, coercion or promises of any kind and with full knowledge of my constitutional right to refuse to give my consent for the removal and / or search of the aforementioned equipment /data, which I hereby waive. I am also aware that if I wish to exercise this right of refusal at any time during the seizure and or search of the equipment / data, it will be respected.

This consent to search is given by me this ________ day of, __________________
20__________, at ____________ am / pm.

Location items taken from: ____________________________________________
Consenter Signature: ________________________________________________
Witness Signature: _________________________________________________
Witness Signature: _________________________________________________

Evidence Collection
Handling digital evidence correctly is essential to preserving the integrity of the physical device as well as the information or data it contains. Turning off the power to a computer or other electronic device may cause the information or data stored on it to be damaged or lost.
If you are not trained in handling digital evidence —
• Do not attempt to explore the contents of a computer or other electronic device or to
recover information from it.
• Do not alter the state of a computer or other electronic device.
• Do not press any keys or click the mouse.
• If the computer or device is off, leave it off.
• Do not move a computer or other electronic device that is powered on.
• Do not accept offers of help or technical assistance from unauthorized persons.
• DO request technical assistance from personnel with advanced equipment and training in digital evidence collection. See http://www.ecpi-us.org/Technicalresources.html for a list of available resources.

Assess the Situation

Before seizing digital evidence, make sure you have the legal authority to do so. Improper access to information or data stored on electronic devices may violate provisions of federal laws.

After securing the scene and identifying the computer’s power status, follow the steps listed below for the situation most like your own. (If the final suggestion in each situation is “Proceed to if Computer Is On” or “Proceed to if Computer Is Off.”, those two sections are posted on the bottom on this article.)

Situation 1: Monitor is on. Program, application, work product, picture, e-mail or Internet site is displayed.

1. Photograph screen and record information displayed.
2. Proceed to “If the Computer Is ON”

Situation 2: Monitor is on. Screen saver or picture is visible.
1. Move mouse slightly without depressing buttons or rotating wheel if present.
2. Note any onscreen activity that causes a change in the display.
3. Photograph screen and record information displayed.
4. Proceed to “If the Computer Is ON”

Situation 3: Monitor is on. Display is blank.
1. Move mouse slightly without depressing buttons or rotating wheel if present.
2. Display changes to login screen, work product, or other visible display.
3. Note change in display.
4. Photograph screen and record information displayed.
5. Proceed to “If the Computer Is ON”

Situation 4a: Monitor is off. Display is blank.
1. If monitor’s power switch is in off position, turn monitor on.
2. Display changes to a login screen, work product or other visible display.
3. Note change in the display.
4. Photograph screen and record information displayed.
5. Proceed to “If the Computer Is ON”

Situation 4b: Monitor is off. Display is blank.
1. If monitor’s power switch is in off position, turn monitor on.
2. Display does not change. Screen remains blank.
3. Note that the display does not change.
4. Photograph blank screen.
5. Proceed to “If the Computer Is OFF”.

Situation 5: Monitor is on. Display is blank.
1. Move mouse slightly without depressing any buttons or rotating the wheel if present.
2. If display does not change, confirm that power is supplied to the monitor.
3. If display remains blank, check computer case for active lights and listen for fans spinning or other indications computer is on.
4. If computer case gives no indication that it is powered on, proceed to “If the Computer Is OFF”.

================================

If the Computer Is OFF
For desktop, tower and minicomputers follow these steps:
1. Document, photograph, and sketch all wires, cables, and devices connected to the computer.
2. Uniquely label and photograph the power supply cord and all cables, wires or USB drives attached to the computer and the connection each of these occupies on the computer.
3. Remove and secure the power supply cord from the back of the computer and from the wall outlet, power strip or battery backup device.
4. Disconnect and secure all cables, wires and USB drives from the computer and document the device or equipment connected at the opposite end.
5. Place tape over the floppy disk slot if present. Ensure that the CD or DVD drive trays are retracted into place and tape across the drive tray to prevent it from opening.
6. Place tape over the power switch.
7. Record the make, model, serial numbers and any user-applied markings or identifiers.
8. Record or log computer and all cords, cables, wires, devices and components according to agency procedures.
9. Carefully package all evidence collected to prevent damage or alteration during transportation and storage.

For laptop computers follow these steps:
1. Document, photograph and sketch all wires, cables and devices connected to the laptop.
2. Uniquely label and photograph all wires, cables and devices connected to the laptop and the connection each occupies.
3. Remove and secure the power supply and all batteries from the laptop computer.
4. Disconnect and secure all cables, wires, and USB drives from the laptop and document the equipment or device connected at the opposite end.
5. Place tape over the floppy disk slot if present. Ensure that the CD or DVD drive trays are retracted into place and tape across the drive tray to prevent it from opening.
6. Place tape over the power switch.
7. Record the make, model, serial numbers and any user-applied markings or identifiers.
8. Record or log the laptop computer and all cords, cables, wires, devices and components according to agency procedures.
9. Carefully package all evidence collected to prevent damage or alteration during transportation and storage.

If the Computer Is ON
Removing the power supply is generally the safest option. If evidence of a crime is visible on the computer display, however, request assistance from personnel with experience in volatile data capture and preservation (see http://www.ecpi-us.org/Technicalresources.html).

Immediate disconnection of power is recommended when —
• Information or activity on screen indicates that information or data is being deleted or overwritten.
• A destructive process appears to be in progress on the computer’s data storage device(s).
• The system is powered on in a typical Microsoft Windows® environment. Pulling the power supply cord from the back of the computer will preserve information about the last user account logged in, login time, most recently used documents, most
recently used commands, and other valuable information.

Immediate disconnection of power is NOT recommended when —
• Information or data of apparent evidentiary value is in plain view onscreen. Seek assistance from personnel with advanced training in digital evidence collection.
• Indications exist that any of the following are active or in use: Chat room(s), text documents, remote data storage, Instant Messaging (IM), child pornography, contraband, financial documents, data encryption and obvious illegal activities.
• The device is a mobile or smart phone. Leave mobile and smart phones in the power state in which they were found.

Improper shutdown of mainframe computers, servers or a group of networked computers may result in the loss of data, loss of evidence and potential civil liability. Secure the scene and request assistance from personnel with advanced training in digital evidence collection of large or complex computer systems (see http://www.ecpi-us.org/Technicalresources.html).

(We suggest you print Parts I and II of this series into a manual format.)

Our Operatives: A step ahead.

As always, stay safe.

How To: Computer Crime Scene Investigations, I/II (beaconbulletin.com)
Retrieving Digital Evidence: Methods, Techniques and Issues (articles.forensicfocus.com)

Filed under: Computer Security, crime, cyber crime, cyber investigations, data, equipment, evidence, investigation, security | Tagged: Computer crime, Digital forensics, dvd, Electronic Crime Scene Investigation, Hardware, laptop, Optical disc drive, Power cord, usb, USB flash drive | Leave a Comment »

Seeing Doubles; Evidence in Dram Shop Cases Revised

Posted on September 18, 2011 by Lina Maini

Decision of the week: Nokes, et al v. HMS Host USA et al, wherein the Missouri Court of Appeals reversed a summary judgment for the bar, concluding that evidence as to the bar patron’s level of intoxication,

taken together with the drink receipts, the police report, and the expert testimony that such a level of intoxication would produce outward manifestations of intoxication was sufficient

to warrant its decision.

In NY and most other states, the dram shop law’s requirement is that a bar knowingly serve a visibly intoxicated person and that may be established through direct and circumstantial evidence.

Nokes, et al…, Background

The patron consumed four Maker’s Mark doubles, each containing 3.5 ounces of alcohol, at the Bud Stadium Club in the Kansas City International Airport before boarding a flight to Dallas. The bar receipt noted the four drinks were purchased between 4:32 and 6:22 pm. No one at the bar recalled seeing the patron. Said patron also admitted to having one cocktail on the plane.

After arriving in Dallas, he got behind the wheel of a vehicle and shortly thereafter, was involved in an automobile collision that killed two passengers in the vehicle he hit and injured the other vehicle’s driver. The responding police officer noticed the his slurred speech , his eyes were red, bloodshot and red eyes and that he reeked of alcohol. The bar patron failed a field sobriety test and a blood test taken about four hours after he left the Stadium Club yielded a .169 BAC.

The families of the decedents sued the owner of the Stadium Club and several other defendants asserting liability pursuant to Missouri’s dram shop law.

Because no one working in the bar remembered the patron, the bar sought summary judgment on the grounds that there was no evidence that it knowingly served a visibly intoxicated person. The trial court granted the motion for summary judgment and the plaintiffs appealed.

Missouri’s Dram Shop Law

Missouri’s dram shop statute, Section 537.053(2), has three elements.

“The claim must be brought (1) ‘by or on behalf of any person who has suffered personal injury or death . . .’ against a (2) ‘person licensed to sell intoxicating liquor by the drink for consumption on the premises . . .’ and demonstrated by clear and convincing evidence that the person (3) ‘knowingly served intoxicating liquor to a visibly intoxicated person . . .’”

The issue in the case before the Court involved the third element. The bar’s position was that because no one at the bar observed/recalled the patron intoxicated, the evidence was insufficient to establish that the patron was a visibly intoxicated person.

The Court disagreed, stating that establishing visible intoxication did not require observation. Instead, the definition of visible intoxication was defined as inebriated to the extent that physical function and coordination were significantly impaired.

While relevant, a person’s BAC , in and of itself, didn’t establish a prima facie case. However, the families also presented the responding police officer’s testimony, the drink receipts and the expert testimony of toxicologists (including that of the bar’s toxicologist who conceded that the patron’s alcohol intake during the time period in which he was served would have rendered the patron intoxicated). That evidence, the Court concluded, was sufficient to create an issue of material fact as to whether the bar knowingly served alcohol to a visibly intoxicated person.

The trial court’s judgment was affirmed in part, reversed in part and remanded.

The Future of Dram Shop Case Evidence

In dram shop cases, our operatives have focused heavily on including statements from identified witnesses in our investigations.

We’ve experienced a shift towards non-cooperation among witnesses in the past few years but, for evidence collection purposes, this change appears to be heavily moderated by the defendant’s use of credit/debit cards to purchase alcoholic beverages. Also, people are publicly announcing their presence at drinking establishments (via 4Square, Twitter, smart phone gps apps…). Leave alone the number of public drinking pics and vids posted everywhere online, (i.e., YouTube, FaceBook, Flickr…).

The bottom line is, don’t drink and drive but if you do, understand the signficant consequences.

BNI Operatives: A step ahead.

As always, stay safe.

How do you handle a guest who has had too much to drink and wants to purchase more (wiki.answers.com)

Filed under: bars, breath test, dram shop, drasm shop, drunk driving, evidence, expert witness, investigation, police accident report, witness statement, witnesses | Tagged: 4Square, bar, Circumstantial evidence, Dram shop, drunk driving, facebook, flickr, Missouri Court of Appeals, Nokes, Public intoxication, Summary judgment, twitter, youtube | 1 Comment »

Familial DNA An Inadvertent Informant?

Posted on September 6, 2009 by Lina Maini

We hope you are enjoying this unofficial last weekend of the summer!

Back on topic, we’ve been monitoring the development of a relatively new investigation tool in law enforcement and litigation closely; that of prosecutors, the FBI and other investigative/authorized agencies using the DNA samplings of relatives to locate potential criminals/defendants.

In the majority of familial DNA usage cases, the jurisdictional agency will run a suspect’s genetic material through the FBI’s 6 million+ DNA samples database. States are scrambling to legislate procedure for this investigative tool. The ABA cites California as having already set up familial DNA usage protocol.

In unusual cases, (see: NPR reports of matching familial DNA in capturing the BTK (Bind, Torture and Kill) murderer) normal, routine medical samples (in the BTK killer case, his daughter’s pap smear test) are being subpoenaed for testing within the FBI’s DNA database.

Furthering compounding the issue are potential situations of identical DNA, such as has occurred in the German case involving identical twins, ultimately released without being charged, as it could not be determined which brother had perpetrated a massive jewelry heist.

Strap in tight. It’s going to be a bumpy road, folks.

BNI Operatives: Street smart; Web Savvy.

Our wishes for a healthy, sane and relaxing Labor Day!

As always, be safe.

TIP OF THE WEEK FOR OUR SUBSCRIBED READERS: How to confirm the death status of a subject, without his/her SSN.

Filed under: crime, dna testing, evidence, fbi, forensic, invasion of privacy, privacy | Tagged: aba, BTK, BTK Killer, california, criminals, database, defendant, DNA, dna testing, familial DNA, family, fbi, identical twins, investigation, jewlery, law enforcement, legal, murder, murderer, prosecutor, states, testing, theft, thief | 1 Comment »

Hiring An Expert Witness Re: Whistling At Work

Posted on September 8, 2008 by Lina Maini

Okay so we got a bit carried away with this week’s title, but I’ll prove my point below: that you can find an expert witness on any topic, and then we’ll get into the reality of the necessity of expert witnesses.

The judge’s decision: Posted On: March 31, 2007 by Jim Robinson, Esq.
Gang Expert Allowed to Testify in Illegal Immigration Trial

As reported in Pennsylvania’s Times Leader, U.S. District Judge James Munley allowed gang expert witness Jared Lewis to testify as an expert witness at a Pennsylvania trial regarding the Illegal Immigration Relief Act. Lewis testified that the gang named “MS-13″ had a presence in Hazleton, Pennsylvania, and was one of the most dangerous gangs in the world.

Lewis was allowed to testify even though he had minimal law enforcement experience, did not include any published authoritative works in his resume, and his expert report did not include any information based on gang statistics specific to the area. The court found that his area of expertise is not an area about which many authoritative books have been written.

This week’s Bulletin covers the topic of Expert Witnesses; definition; why it is better to hire one sooner than later and selecting expert witnesses. Following the Bulletin text is the video pertaining to the above article on Mr. Robertson’s excellent and concisely named blog: Expert Witness Blog.

Definition: From Wikipedia:

An expert witness is a witness, who by virtue of education, training, skill, or experience, is believed to have knowledge in a particular subject beyond that of the average person, sufficient that others may officially (and legally) rely upon the witness’s specialized (scientific, technical or other) opinion about an evidence or fact issue within the scope of their expertise, referred to as the expert opinion, as an assistance to the fact-finder.

History of Expert Witnesses: The earliest known use of an expert witness in English law came in 1782, when a court that was hearing litigation relating to the silting-up of Wells harbour in Norfolk accepted evidence from a leading civil engineer, John Smeaton. This decision by the court to accept Smeaton’s evidence is widely cited as the root of modern rules on expert evidence.

Why it’s better to hire an expert witness sooner rather than later:

1. The cost of finding out later that your client has a much weaker case than originally assessed will be far greater than the expert’s fee.

2. As much as one or one’s staff can conduct comprehensive research, an expert will have the real life experience of not only the subject matter, but unenvisioned or rebuttal scenarios and that can translate to a substantial difference in case settlement amount.

3. A well-qualified and respected expert lends significant credence to a trial case.

4. With expert discloser and pleading rules…its best to know your theories early.

Selecting an expert witness:

1. Ask colleagues who’ve experienced similar cases,

2. Review the expert’s testimony in a similar case.

3. Ask for recommendations from the expert witness. He or she should not have any issue providing you with references. Then follow through. Interview the references. Professional courtesy is usually extended and professionals speak the same language, so an assessment can quickly and accurately be made.

4. Some organization (ATLA??) should start a opt-in expert witness rated directory.

Note: The above recommendations should apply to both nontestifying and testifying witnesses.

And now the gang expert video (which proves you can find an expert on anything):

Good luck and successful results,

As always, stay safe,

Lina

BNI Operatives: Street smart; Web savvy.

Filed under: case, evidence, expert witness, opinion, testimony, trial | Leave a Comment »

Categories

Pages

Archives

Counteracting Increased Illegitimate Whistle-Blowing

Electronic Crime Scene Investigations; Evidence Collection. II/II

Seeing Doubles; Evidence in Dram Shop Cases Revised

Missouri’s Dram Shop Law

Familial DNA An Inadvertent Informant?

Hiring An Expert Witness Re: Whistling At Work

Who. What.

Recent Comments

Recent Posts

Follow “”

May 2013
M	T	W	T	F	S	S
« Apr
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31

Categories

Pages

Archives

Counteracting Increased Illegitimate Whistle-Blowing

Share this:

Like this:

Electronic Crime Scene Investigations; Evidence Collection. II/II

Related articles

Share this:

Like this:

Seeing Doubles; Evidence in Dram Shop Cases Revised

Missouri’s Dram Shop Law

Related articles

Share this:

Like this:

Familial DNA An Inadvertent Informant?

Share this:

Like this:

Hiring An Expert Witness Re: Whistling At Work

Share this:

Like this:

French Maids Make Photo Sharing Simple

Share this:

Like this:

Who. What.

Recent Comments

Recent Posts

Follow “”