FORENSIC IT FORENSIC IT FOR


What is the extent of IP infringement and what is the overall loss to business?


IP infringement, much of which is criminal, falls into two broad categories. Te first is digital IP, which relates to electronic formats that are protected by copyright. Te second is physical IP, which refers to counterfeiting of brand name products—anything from pharmaceuticals to electrical goods.


At the end of 2009, the Organisation for Economic Cooperation and Development reported that the global scale of counterfeiting and piracy of tangible goods had reached a value of $250 billion. Its study estimated that digital IP infringement would add another several hundred million dollars to that figure.


What kinds of IP issues are appropriate for investigation by computer forensics?


Tere are many IP issues that may require the application of computer forensics. Someone may have stolen some form of technology. Tere may have been a theſt of business plans or customer lists. Or it may be that someone is pirating some form of media such as music, films or soſtware.


What actually happens in a computer forensics investigation?


A computer forensic inquiry will generally fall into two parts. Te first is the imaging of any suspect computer’s hard drive. In many cases, where a large company is involved, it may involve the imaging of a server, which is a much bigger job. Te point of the imaging is to preserve the hard drive in an evidential manner. A copy of the first image will be used for the rest of the investigation.


Te second step will involve a careful interrogation of the image. Tat usually means conducting a search of the image using keywords supplied by the client. Te point is that the image will include not only saved documents and files, but most probably deleted documents as well—or at least fragments of deleted documents. It is during the search, which may take many hours, that evidence is produced.


What kind of evidence is likely to be produced by computer forensics?


INTELLECTUAL PROPERTY Graham Robinson, managing director of Farncombe International, tells WIPR how and when companies should use computer forensics to address intellectual property theft.


Properly examined, the image will reveal the equivalent of fingerprints of wrongful activity. Usually the incriminating information will include dates of document creation, the dates of any alterations and the dates of any deletions. It is also likely to produce a trail of communications between the infringing parties.


Can you give us an example?


In one case, our forensic consultants were called in when a team of securities traders had been lured from one company to another. By a careful analysis of link files, event logs and metadata, and by recovering unallocated emails and fragments of documents, the technicians were able to show that the leavers had used web-based email accounts to circumvent the company’s email system to discuss their plans and had stolen market-sensitive information.


Is it appropriate for a business to use internal IT people for a forensic inquiry?


Most probably not. If a business happens to have a qualified forensic technician on its staff, then it’s okay. Otherwise, you are asking for trouble. If the work isn’t carried out to specific standards, the evidence will be open to challenge. In fact, when it comes to computer forensic work, we usually work closely with our sister organisation, Bishop International, because of its long history of working with computer forensic experts.


What is the most important advice for someone considering a computer forensics investigation?


First of all, if you suspect a computer may have been used for some IP infringement, don’t do anything with it. If it’s on, leave it on. If it’s off, leave it off. Call the experts. Any use of the computer will inevitably change some aspect of its configuration and that may, in turn, affect its quality as evidence.


Is it only big brand owners that need to be concerned about IP infringement and therefore consider the expense of computer forensics?


Definitely not. One of our clients is a provincial law firm that acts for a major sports organisation.


40 World Intellectual Property Review March/April 2011 www.worldipreview.com


Graham Robinson gained his law degree from the University of East Anglia and then qualified in 1997 as a solicitor specialising in intellectual property litigation at the London law firm Nabarro Nathanson. He subsequently practised law at Olswang as a litigator in the firm’s intellectual property group. Aſter working for two other investigations companies, Robinson joined Farncombe International in December 1999 and became managing director in September 2003. Farncombe is the largest dedicated IP investigations company in Europe and is part of the Bishop Group.


Te law firm suspected that one of its secretaries had been accessing information about certain sports contracts so that she could gossip about them with her friends. A computer forensics investigation proved that the suspicions were true. If it had continued, the leaking of sensitive contract negotiations could have severely damaged the reputation of the firm.


Does the use of computer forensics apply only to the theft of internal IP?


Not at all. Sometimes employees will use their company’s computer systems to sell counterfeit or pirated goods. Te UK Intellectual Property Office survey in 2009 reported that 25 percent of its respondents said they had investigated the sale of IP-infringing goods in the workplace, including the use of company resources to create and publicise the sales.


Has computer forensic work demonstrated links between IP infringement and organised crime?


Absolutely. Soſtware piracy in particular is highly profitable. As one expert said, when a kilo of fake CDs fetches 50 percent more than a kilo of cannabis, no one should be surprised that organised crime is involved.


Graham Robinson is managing director of Farncombe International. He can be contacted at: info@farncombeinternational.com


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52  |  Page 53  |  Page 54  |  Page 55  |  Page 56  |  Page 57  |  Page 58  |  Page 59  |  Page 60  |  Page 61  |  Page 62  |  Page 63  |  Page 64  |  Page 65  |  Page 66  |  Page 67  |  Page 68  |  Page 69  |  Page 70  |  Page 71  |  Page 72  |  Page 73  |  Page 74  |  Page 75  |  Page 76