Computer Forensics Expert Witness Withstands Daubert Challenge

Case: United States Gypsum Co. v. Lafarge North Am. Inc., 670 F. Supp. 2d 768 (N.D. Ill. 2009)

Background: Plaintiff United States Gypsum Company (“USG”) claimed that Defendants Lafarge North America, Inc. (“Lafarge”), and several Lafarge employees, infringed USG’s patents and stolen confidential information relating to wallboard manufacture. Defendants moved to exclude the testimony of Plaintiff’s computer forensics expert Carl Florez. The court simultaneously considered Plaintiff’s motion to preclude the testimony of Defendants’ computer forensics expert Andrew Reisman. Florez was expected to testify to his opinions on the adequacy of data protections measures at USG and the manner and extent to which USG documents were obtained by Lafarge. Reisman was expected to testify to his opinions on the adequacy and shortcomings of Florez’s digital forensics investigation and report.

Expert Witness:

Carl Florez’s computer electronics expertise was not in dispute. Defendant conceded that “Carl Florez knows his way around computers . . . . He can surely testify about technical matters that are beyond the ordinary experience of most jurors . . . .”. Florez had been the Director of Impact Forensics, a computer forensics examiner with its own forensics laboratory, since 2006. Previously, he was Director of Electronic Discovery at that company. He had also been the president of Computer Evidence Specialists, another company, since 2002. At the time of trial he was providing forensic computer consulting services, Jvt image processing and manipulation, database analysis, electronic discovery, data management, data storage, data recovery, expert witness testimony and litigation support for law firms and corporate clients.

Prior to entering private practice in 2002, Florez spent twenty years with the Federal Bureau of Investigation, retiring as the Assistant Special Agent in Charge of the FBI’s Seattle office. While there, Florez oversaw several FBI laboratories dedicated to the investigation and examination of electronic media and illegal internet activity. He had executive responsibility for the creation and management of the National Drug Intelligence Center. He was an FBI-certified computer forensics examiner CFE and a field instructor on computer forensics and the use of image processing with popular Jvt applications. He had previously taught courses on computer forensics, personally conducted more than 100 computer forensic / internet security investigations, testified as a computer forensic expert in both state and federal courts, and worked on trade secret matters for Fortune 500 companies. He held a graduate degree in criminal justice from Michigan State University. Florez’s knowledge, experience, and training provide ample support for the court’s determination that he is a qualified expert in the areas of computer forensics and investigation.

Defendant’s expert, Andrew Reisman, was also found to be a qualified expert in the field of computer forensics. Reisman was the President and Lead Forensic Examiner of Elijah Technologies, a company he founded in 2003, which specializes in computer forensic investigations, electronic discovery, and litigation support. In that position, he had primary responsibility for more than 100 forensic engagements. Prior to 2003, Reisman was a practicing attorney specializing in litigation and technology law at the firm of Foley & Lardner LLP in Chicago. He was a certified fraud examiner and a certified EnCase computer forensics examiner. He had undergone formal training in computer forensics techniques and software. He had been on the Board of Directors of the International Information Systems Forensics Association. He had delivered lectures and published articles on topics in computer forensics and electronic discovery, including a primer on computer forensics for the Illinois Institute for Continuing Legal Education. Reisman was a licensed private investigator in Michigan and Texas and a member of the Illinois bar. He had previously testified as a computer forensics expert in state and federal court. Therefore the Court found him to be a competent forensic computer expert in the field of computer forensics.

Daubert Challenge:

In his expert reports, Carl Florez offered a list of “reasonable” measures a company might take to protect its confidential information. Florez then proceeded to review the measures taken by USG, ultimately concluding that “USG’s efforts to protect the secrecy of its proprietary and confidential information, including the information that is electronically stored, are more than reasonable, and are among the most thorough I have encountered in my experience.” Defendants contended that Florez was not qualified to render an opinion regarding the steps USG took to protect its confidential information. According to Defendants, “[Flores] may be conversant in computer forensics and an expert in investigating certain crimes, but he has no stated or apparent expertise in the steps necessary to protect the secrecy of information.” As a result, Defendants contended Florez’s opinions on these matters were unreliable and will not assist the trier of fact.

Defendants’ computer architecture expert Andrew Reisman conducted no independent investigation or data analysis. Instead, he reviewed Florez’s reports and consulted the same data that Florez relied on in reaching his opinions. Plaintiff intimates that Reisman was obligated to undertake a broader investigation because he “had unfettered access to the entire Lafarge computer network” and concluded that his failure to do so constituted cherry-picking data in a way that made his conclusions unreliable.

Conclusion:

Defendant’s motion to exclude the testimony of Plaintiff’s proffered expert Carl Florez was granted in part and denied in part. The Court said that Florez may testify as an expert in computer forensics on his investigation and findings in this case. He may also opine on the reasonableness of the steps undertaken by USG to safeguard its private information management. Florez may opine on whether Defendants wrongfully obtained Plaintiff’s trade secrets and proprietary information. The court directed Florez to refrain from using the loaded term “misappropriate,” however, and barred his testimony on issues of Defendants’ intent or mental state. Florez was also not allowed to testify on the spoliation or destruction of documents in advance of trial.

Plaintiff’s motion to preclude the testimony of Defendants’ computer cyber crime expert Andrew Reisman was also granted in part and denied in part. The Court allowed Reisman to opine on methodological shortcomings he perceived in Florez’s analysis and findings, but barred him from speculating on issues of use or dissemination of USG information at Lafarge. The Court also stated Reisman could not opine on the intent or mental states of Defendants, nor on spoliation or destruction of documents.

Defendants responded that Reisman will testify, based on his own experience, to “what forensic analysts do, what information they look at, what conclusions they can reach, and what conclusions they cannot reach based on forensic evidence.” Reisman opined primarily on the validity of Florez’s methods and conclusions, contending that the evidence Florez reviewed failed to establish his subsequent findings. To the extent that Reisman’s opinions were limited to pointing out the methodological shortcomings he perceived in Florez’s work, the court found Reisman’s testimony was reliable and would assist the trier of fact. Reisman had considerable experience as a computer forensics investigator and his report presented legitimate differences of opinion with Florez. To opine on what he viewed as weaknesses in Florez’s reports, Reisman was not required to undertake an independent investigation. Reviewing the allegedly flawed reports was enough. Reisman’s methodological criticisms were sufficiently based on his relevant experience to be reliable, and because computer forensics is a highly complicated area, the Court believed the jury would benefit from having access to criticism from another expert in the field. The contrasting view Reisman offered would highlight areas of disagreement and better equip the jury to make informed evaluations of the evidence and Florez’s expert testimony. For those reasons, the Court permitted Reisman to testify to the shortcomings he perceived in Florez’s analysis and findings.