Legal proceedings require sharing data and evidence to prove which party is at fault or acted negligently. Proper evidence depends on the validity and authentication of original data. Key data may be obtained from a system in part or in whole and the collection, handling, transfer and analysis of that data requires that it be free from potential spoliation issues and concerns. With the exponential increase of relevant digital evidence in modern litigation, it is imperative to understand how and when spoliation issues may be of real concern.
What is spoliation of evidence?
Spoliation of evidence is the intentional or negligent alteration, hiding, withholding or destruction of pieces of evidence relevant to a trial by a party connected to the case. Manipulation or destruction can occur before or after filing or data preservation notices or at any other point. Any relevant parties – including targets, custodians, attorneys, analysts and/or investigators – can cause spoliation. It is not uncommon for custodians to engage in improper data collection efforts during self-collections that significantly impact the validity of evidence. Spoliation often afflicts metadata, a key piece of information embedded within data files that helps determine specific timestamps, ownership, file access history and more. Many times, when spoliation occurs, original data is permanently and negatively impacted; this can have significant impacts on an investigation and, ultimately, the entirety of a case.
Knowing what to do when crucial evidence is destroyed
Federal statutes criminalize the purposeful alteration or destruction of evidence to influence a trial. Preservation notices are crucial to alerting all parties of their obligation to properly maintain and protect applicable data. Failing to properly protect or preserve data can result in penalties such as imprisonment or the payment of legal fees to the injured/opposing party. It is critical that thought be given to where data may be stored and any secondary or tertiary locations where data may be duplicated, shared or referenced. Often, time is of the essence because of varying retention periods, security controls, backup schedules and automated deletions. Any action, even data hiding , can be considered spoliation and puts parties at risk of penalties from the court.
Fixing the problem
If spoliation concerns are raised by either a party or the court, the court will employ multiple controls to attempt to minimize, manage and avoid additional issues. These controls can be enacted at any point in litigation in response to evidence or the suspicion of lost or missing data, gaps in data, or evidence of deletions or inconsistencies in data. The court may not have the ability to reverse spoliation, but the court does have options to determine the best response to possible spoliation concerns. A court’s response is based on:
- The damage the spoliation causes to the case
- The degree of bad faith (level of negligence or intentional spoilage)
- The extent of loss the damage may cause
- The time of the spoliation (before or after the filing of the lawsuit)
- Relevance of the evidence in the case or defense
Spoliation is always a concern with electronic data and can vary in likelihood based on several factors. Potential spoliation issues can occur from:
- Self- or custodian-led collections
- Non-forensic image formats (e.g., copying data)
- Non-compression of data (e.g., leaving files loose in folders)
- Transferring data electronically
- Creating backup copies
- Failing to limit user access to systems
- Failing to prevent retention policies from occurring
- Repurposing or destroying relevant devices
Conclusion
Failing to recognize where potential spoliation issues can arise may have a significant and direct impact on increased litigation costs, loss of evidence, sanctions and more. Preventing issues to arise by leveraging forensic collection techniques and experts to conduct evidence collection is the best way to avert spoliation evidence. Correction actions can be taken to mitigate spoliation issues if caught early enough, with time being a crucial aspect of well a corrective action can be implemented.