Streamlining Government Investigations

Transcription

1 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 1 Streamlining Government Investigations With The Clearwell E-Discovery Platform A Technology White Paper

2 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 2 Table of Contents: The Data Analysis Challenge 3 The Solution: The Clearwell E-Discovery Platform 4 The Clearwell E-Discovery Platform in Action 5 How the Clearwell E-Discovery Platform Works 11 Conclusion 12

3 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 3 The Data Analysis Challenge Lawsuits. Regulations. Government investigations. All are a fact of life in today s business environment. And all have created a data analysis challenge for government security and forensics professionals. The number of legal discovery requests, regulatory inquiries, and government investigations is rapidly escalating. In addition, the deadlines required to cull-down and find relevant documents are increasingly aggressive and teams don t have the luxury of adding resources to handle the greater demand. Current tools only exacerbate the situation. Keyword search tools, for instance, return far too many false positive documents and fail to reveal context of critical discussions requiring manual review of thousands of irrelevant documents and s. Several different tools are commonly needed to complete each investigation, forcing government organizations into time-consuming, error-prone steps. All of these factors compromise accuracy and lengthen the data analysis process, leading to greater risk and a costly reliance on external vendor services. With so much at stake, there is a critical need for a solution that can dramatically eliminate the time, cost, and complexity of data analysis in the investigative process. Government organizations are overcoming the data analysis challenge with Clearwell. By automating and streamlining manual processes associated with analyzing thousands of documents and s Clearwell provides much-needed relief for professionals conducting government investigations.

4 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 4 The Solution: The Clearwell E-Discovery Platform The Clearwell E-Discovery Platform (Clearwell) automates the complex, time-consuming process of discovering, organizing, and analyzing large volumes of documents and s in response to legal discovery requests, regulatory inquiries, and government investigations. The product dramatically reduces data analysis costs in two ways: first, by culling-down large datasets to a smaller, relevant datasets; and second, by delivering proven analysis and review capabilities that enable teams to rapidly find the most critical documents for each investigation. Unlike yesterday s tools that simply collect, index, and provide keyword search, the Clearwell E-Discovery Platform: 1. Delivers forensically sound collection capabilities that enables IT, legal, and investigative teams to easily identify and collect from all critical data sources; 2. Brings a new level of transparency to e-discovery search, enabling a more collaborative and defensible process; 3. Tracks and graphically displays related s, linked together in chronological order. These discussion threads allow investigators to quickly understand context, identify all participants, and determine who knew what, and when; 4. Organizes all documents into discovered topics and known user groups relevant to each investigation, thereby enabling rapid tracing of critical communication flows; and 5. Provides complete visibility and tracking of all ongoing investigations through dashboards and reports, thus allowing teams to optimize the investigative process. The Clearwell E-Discovery Platform is an appliance that is up and running quickly. Since the product s web-based interface is extremely intuitive and user-friendly, most investigative teams are productive immediately with minimal training. The solution seamlessly integrates with existing collection processes and allows users to consolidate all processing, analysis, review, and production tools into one platform.

5 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 5 The Clearwell E-Discovery Platform in Action The Clearwell E-Discovery Platform is already at work at hundreds of Fortune 1000 companies and government organizations. The following are just a few examples where Clearwell has delivered immediate value by significantly reducing the time and cost of government investigations: Large multi-agency task force investigations into Medicare/Medicaid fraud Office of Inspector General investigations into corporate fraud and procurement fraud Investigations into bank fraud after government receivership of failed financial institutions Suits brought against the Federal government regarding disputed royalty payments for oil, gas, and grazing leases Office of General Counsel class action lawsuits State and Federal governmental agencies investigating employee discrimination and harassment violations The following use case demonstrates how Clearwell can reduce the time, cost, and complexity of conducting a government investigation. This particular investigation involved the analysis of messages, attachments, and other collected files. USE CASE: GOVERNMENT FRAUD INVESTIGATION In this use case, a multi-agency task force used a search warrant to seize possession of computers, servers, and networked shares in a place of business suspected of Medicare fraud. Their investigative process was to: 1. Quickly collect and preserve all electronically stored information (ESI) from the suspected place of business, 2. Efficiently review all s and documents relevant to the investigation, and 3. Prepare for the taking of depositions from various persons of interest. Prior to Clearwell, the task force used complex forensic solutions involving multiple tools and a high degree of training and experience. Because of the sheer complexity of the technology the agents generally resorted to reading massive amounts of documents and pieced the case together via handwritten notes, white boards, and general intuition. With Clearwell all of that changed.

6 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 6 By employing Clearwell to automate their investigation process, the task force eliminated many of the older manual, time-consuming steps and reduced the effort involved in other steps. The end result: they reduced the analysis of ESI to one-tenth of the time and cost typically required. The task force s new investigative process consists of the following 3 steps (which are described in detail in the next section): 1. ESI Collection & Pre-Processing: The task force collected hard drives, desktop files, s, and documents from networked shares of the employees involved in the investigation and analyzed them with Clearwell prior to indexing the entire dataset. Specifically, the task force: Used the Clearwell On-Site Collector to collect suspect data to a secure preservation store Verified the integrity of the collected data to ensure it was forensically sound Ran completeness checks by date and by custodian (i.e. had they over-looked any relevant ESI or was a month/week/day of potentially relevant data missing?) Used date ranges to select the ESI for the first round of analysis and review Upon processing the much reduced set, automatically De-NISTED and eliminated duplicates across the entire set of ESI 2. Cull-Down and Early Case Assessment: After processing the agents discovered that the ESI had shrunk from over 900GB to slightly under 200GB. Next, the Special Agent in Charge (SAC) assigned an agent (who had subject matter knowledge of the case) the responsibility of performing an early case assessment. In a nutshell her job was to: Rapidly cull-down the large dataset of ESI into a much smaller, relevant sets by eliminating false positives and other irrelevant s and documents Create a way to segment the ESI, either by subpoena, significant dates, or a combination thereof Gather key case facts to begin assessing the strength (or weakness) of the case Suggest a list of pertinent search terms/expressions that agents can use to guide their detailed review 3. Detailed Review: With Clearwell, members of the investigation team more effectively performed detailed review and collaborated with other investigators in real-time. More specifically, the team members: Saved time by focusing their review on a much smaller set of relevant messages Enabled pinpoint investigation accuracy by further analyzing suspects conversations over Increased productivity by enabling efficient coordination and collaboration between several reviewers via tagging and workflow features COMPLETING THE INVESTIGATION STEP-BY-STEP The following details the task force s much improved investigative procedure using the Clearwell E-Discovery Platform. ESI Collection & Pre-Processing The new investigative process using Clearwell began by pre-processing the collections in the directories where they were stored. Simply put, this meant indexing all metadata associated with each document. This first step is a much quicker task than the

7 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 7 in-depth content analysis and indexing that occurs later during Processing. As a result the team pre-processed at speeds of approximately 100GB per hour. Thus the case administrator began pre-processing in the afternoon and by the next morning he was ready to sit down with the SAC to go over which categories of ESI (custodian, date range, file type) should or should not be fully processed for agent review. Within the hour the administrator and SAC had determined their strategy and selected the first batch of documents for full Processing. Due to the pre-processing step, the dataset had shrunk from 900GB to 200GB. Immediately the case administrator began the full Processing task. This takes only a couple clicks of the mouse to make happen. Soon the case documents are ready for further culling and early case assessment. Cull-Down and Early Case Assessment During Processing, duplicates are identified and the case is prepared for analysis. In this case, the de-duplication rate was approximately 40%. Thus when the agent began her work her case load had shrunk from 200GB to 120GB, a 40% reduction BEFORE she analyzes a single document. In the Clearwell solution, projects define an investigation workspace that includes all ESI relevant to a particular investigation. Clearwell provides comprehensive rolebased security that controls access to specific cases (as well as folders within the case), ensuring strict compliance with privacy policies. Projects also preserve the state of each investigation allowing investigators to stop and start investigations as time permits. In some investigations, before the prosecuting team obtains access to the document collection, a filter team or taint team is assigned to conduct searches and review documents. These teams are responsible for ensuring that no privileged or out-of-scope documents (those outside the scope of the subpoena used to obtain the evidence) are introduced. Clearwell s granular access controls enable the filter team to conduct their searches and review before moving non-privileged documents into folders for the prosecuting team. Access to specific folders can be controlled, so that prosecuting teams only have access to non-privileged documents under this workflow scenario. Once project Subpoena has been created for this investigation, the special agent s first task is to cull-down the large set of messages into a much smaller set for detailed review by other team members. Her first step is to eliminate what are considered to be profoundly non-relevant documents from case review. Using Clearwell s Auto-Filters, she selected all s from domains that are of no interest to the investigation, such as those from on-line shopping sites (e.g., Amazon. com, other travel sites, sports sites, news feeds, and so on). She also eliminated documents belonging to senders or recipients that are of no immediate interest to the investigation. She tagged these documents as non-responsive and saves them in a folder. After an hour s work she has eliminated another 30% from her review set. The case document size has now dropped from 120GB to 84GB. After eliminating a significant amount of non-relevant s and documents, her next task was to begin to gather case facts and create a list of keywords for her team to use in their review. The question is, how can she go about gathering facts quickly and how will she create such a list of keywords? What should those words be, exactly?

8 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 8 To assess the case and determine the top keywords, she perused a time line of suspected criminal activity which the team had prepared earlier for the search warrants. When any event of significance occurs, it generates chatter in corporate systems. In Clearwell, that chatter is captured as a Discussion Thread. Thus the first step in her analysis was to match Discussion Threads with event dates that were relevant to the case. Discussion Threads dynamically link together all related messages into chronological threads that capture entire discussions, including all replies, carbon copies, blind carbon copies, and forwards. Search Preview allows users to selectively include relevant variations or exclude false positive variations from their search query. In this particular case, the first date of interest was September 30, She selects the Discussion Thread View and sorts all discussions by date. She quickly discovers that there are six lengthy threads that occur during that week. After she opens each Discussion Thread, she opens the Terms Analysis tab. The Term Analysis tab contained up to 20 noun and noun phrases that occurred most frequently during the discussion. These are the topics that people are talking about over . These are the keywords that are being used by the persons of interest during their communications. At this point she clicks on the term and sees the paragraph containing that term from each . Now she can determine if the term and its context are meaningful to the case. If it is then she adds it as a search term. During this process, she can also gather and record key facts of the case to help guide her team of reviewers. After a short while she has collected several key facts and over a dozen search terms that are relevant to the case. She takes her entire list and pastes it into the Advanced Search page and runs all of the search terms at once using Clearwell s Multiple Keyword Search feature. Within seconds all the documents containing keyword hits from all the search terms are returned for review. In this case, almost 5,000 documents were returned or about 5GB of the total. To determine the effectiveness of her search, she samples documents within the search result. Clearwell s Relevance Rank feature enables her to see the most relevant results first, and pass judgment on the entire search result. Many of the results are relevant, and she quickly tags those documents as potentially response and moves them to a folder called Subpoena 1. By placing the documents in a folder she has made access restrictions possible. This means that some agents/attorneys on the task force may review that folder and some may not, based on the access control polices set for this case. While sampling the search results, she discovered a particularly relevant document that revealed new information about the case. She wanted to understand the scope of the issue across the entire case, so she clicked the Find Similar link next to the document. Clearwell s Find Similar feature provides a way to find documents with similar content to the item being viewed. The scope of Find Similar is controlled using a slider bar, and can be narrowed to focus on near-duplicates, or broadened to cast a wider net for loosely similar documents. She wants to find items with similar ideas, so she selects a lower threshold using the slider bar. The results include 21 items with similar content across the case. Each item returned by the search includes a list of relevant terms which provides visibility into why it was included as a similar item. These terms can also be used to generate additional keyword lists for further keyword searches. Following the same methodology, she selects Discussion Threads and performs Term Analysis for other significant dates to create four other lists of terms/keywords. Using

9 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 9 the data from her hit-lists she was able to keep each review set to roughly 5,000 docs each. This was supplemented by selecting only relevant variants of wildcard searches using Clearwell s Search Preview feature. Search Preview provides visibility into matching keyword variations prior to running a search. Users can selectively include relevant variations or exclude false positive variations from their search query, thereby adding relevant documents and removing irrelevant documents from search results. For instance, given a search of LAW*, you would want to eliminate all documents containing LAWNMOWER, LAWN, etc. from the search results. Search Report creates a comprehensive report that documents all search criteria and provides detailed analytics of the results for both the overall search and the individual queries within the search. Before finishing she creates a Search Report on each of her searches to create a record for each of her searches using the 5 search lists. Clearwell s Search Reports creates a comprehensive report that documents all search criteria and provides detailed analytics of the results for both the overall search and the individual queries within the search. The report tracks search terms that were included and excluded when using Search Preview providing a defensible audit trail of search refinement decisions. As a result, the SAC has total transparency into her searches and search refinement methodology. So in just two days the agent has analyzed and reduced the case to 25GB. Now she is ready to turn over her results to her team of reviewers. At this point our agent has: 1. Created a list of search terms/keywords germane to the case (one per subpoena) 2. Segmented the case into smaller folders for review by other members of the task force 3. Collected and organized several critical case facts 4. Culled-down the size of the matter to 25GB prior to detailed review Now, the other members of the task force will take the 25GB and perform a detailed review of the documents. Detailed Review At this point the SAC has reduced the review set from 900GB down to 25GB within two days and gave case access to other agents on the task force. Each was assigned a folder to review based upon the subpoena that they are responsible for. For reviewers, Clearwell provides an optimized review interface that maximizes screen real estate and minimizes mouse clicks to increase review throughput. Features such as dual monitor support, breadcrumb navigation, a related items panel and document thumbnail views allow reviewers to quickly navigate through document sets. Using these review features the task force set out to perform a detailed review and to tag documents as responsive, not responsive, etc. Giving access to the review team was simple for the administrator. Because Clearwell authenticates user logins to accounts in Microsoft Active Directory, the case administrator saved the time of creating and managing new user accounts. He only needed to assign roles to each of the agents. These roles have all been pre-defined in Clearwell, thus authorization to access the case took only a few minutes to set up. Like the SAC earlier, an agent assigned to the case first performed a Discussion Thread analysis using key dates within the case to select conversations of interest. This gave him a general context of what was being discussed across the matter at the time of a special event. Clearwell also analyzes all of the attachments within the

10 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 10 thread. With this type of attachment analysis, he can examine attachments with the editorials/explanations inherent in the from originator/sender. This will also provide a context for any loose files that should be reviewed. Once an agent finds an attachment of interest, Clearwell can rapidly identify all suspects that have saved, sent or received that file (including early instances of the file using hash value comparison) across the matter with a touch of the button. Since an attachment to an is generally introduced with some explanation or highlighting by the originator, it is useful to find the where a file is introduced. For this reason, Clearwell provides an Originator column in our Files view of the collection. This permits the investigator to see what comments were made when the document was introduced to others. Was there anything special about the file? What were people of interest saying about it? Furthermore, if the agent would like to see the chain of events, he has only to sort the /documents by date and he will see the evolution of the file and its related Discussion Threads. By easily traversing discussions and analyzing attachments, the team discovered critical evidence proving both the guilt and innocence of the several suspects. Throughout this process the reviewers tag documents as either Responsive or Not Responsive depending on their importance to the case at hand. For example, one member of the team selected all s of a Discussion Thread and tagged them as Responsive to the current investigation. With a single click, the member was able to tag 18 messages as responsive, saving the effort of tagging each and every message and, in the worst case scenario, misclassifying a key piece of evidence as Non-Responsive. Find Similar enables reviewers to review and tag near-duplicates together, increasing review throughput and improving tagging accuracy. At the same time, the review team checked for near-duplicates using Find Similar. Many cases contain nearly identical items such as different drafts of the same document. Reviewing these near-duplicates together increases review throughput and accuracy. The reviewers opened Find Similar during review and moved the slider bar to a high similarity threshold, bringing back only items that are near duplicates of the document being viewed. Once these s and documents were clearly tagged (along with annotated notes that articulated the logic that deemed the messages Responsive ), other reviewers on the team were freed to focus on unreviewed s and documents relevant to the investigation, thus reducing duplicative efforts. The team proceeded to review the remaining s and documents until they were all reviewed and classified. When it comes to deposition preparation Clearwell can save hundreds of hours. Using the Clearwell participant picker the agent can use a wildcard search select all s (since a person can have more than just one address for instance a Yahoo address and a corporate address) of a person of interest. He can quickly select all documents sent by or received from that person of interest. He can also further refine his results by date. Once the documents are retrieved, he can see ALL of the interactions by this person of interest, no matter what address was utilized, and can drill down on any documents/conversations of interest. Participant Picker consolidates all addresses into a single identity, making it easier to discover and analyze case facts by suspect. This procedure is useful not only for deposition preparation, but is equally valuable when comparing a deposition with the real facts of the matter.

11 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 11 Government Investigation Complete With Clearwell, the government agency successfully discovered evidence that proved both the guilt and innocence of several employees. In the past, this investigation would have taken the agency several weeks to complete. However, due to the rapid processing and powerful analysis features of the Clearwell E-Discovery Platform, the case was solved in less than one week. Overall, the government agency reduced the time and cost of this investigation by 90%. How the Clearwell E-Discovery Platform Works Installation of the Clearwell E-Discovery Platform is very simple and straight-forward. The product is delivered as a 2U rack mountable physical appliance or as a virtual machine image and is up and running quickly. The solution is flexible enough to be deployed as a mobile solution to collect data onsite. Once the standard network domain configuration parameters are set up (e.g., host name, IP address, etc.), the administrator simply configures Clearwell to access one or more document and repositories for collection. Clearwell does not store any documents or s, but rather crawls and indexes wherever they reside and can copy collected data to a secure preservation store. Within just a few hours allotted for Processing, investigation professionals can log into Clearwell and begin conducting searches, reviewing results sorted by relevance, using filters to cull-down datasets, viewing Discussion Threads, tagging , and exporting or printing relevant and documents into numerous formats. An easy-to-use, web-based interface, and administrative pages that display up-to-the-second status of system services make Clearwell painless to administer.

12 STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY PLATFORM PAGE : 12 Conclusion Government security & forensics professionals face tremendous pressure along several dimensions. The number of investigations continues to grow, as does the amount of documents requiring review and analysis. Deadlines are increasingly aggressive, raising the urgency to rapidly and accurately determine who knew what, and when. Existing search tools lack the functionality needed to conduct large scale investigations, leaving agencies no choice but to implement time-consuming, manual processes that waste precious time, resources, and money. Clearwell delivers a true government-class solution that automates the document identification, collection, processing, de-duplication, analysis, and review process. The product dramatically lowers the cost of government investigations by cullingdown a large dataset to a much smaller, relevant dataset; and delivering proven review and project management capabilities that enable teams to rapidly find the most critical documents for each investigation. The product is easy to use, install, and maintain delivering a compelling ROI, often within a single investigation. Investigation teams at numerous Fortune 1000 companies and governmental organizations have all realized significant value and benefits using Clearwell. These benefits include: Easily collect data in a forensically sound manner Accelerate early case assessments from weeks to hours Cull-down data by up to 90% Increase review throughput and consistency Reduce movement of data across multiple, disparate tools Improve defensibility of the e-discovery and investigation process FOR MORE INFORMATION For more information about Clearwell Systems Inc., or the Clearwell E-Discovery Platform, please contact us at: Clearwell Systems 441 Logue Avenue Mountain View, CA tel fax info@clearwellsystems.com 2010 Clearwell Systems, Inc., Clearwell E-Discovery Platform is a trademark of Clearwell Systems, Inc. All rights reserved.