Computer forensics combats fraud, complements litigation

By Randy Bonnecaze

The evidence is overwhelming. It indisputably links a former employee to a series of fraudulent financial transactions carried out while he was working at your construction company.

His crime cost you thousands of dollars, not to mention the trust of vendors you've worked with for years. And whom do you have to thank for this crook's capture? Why, the unassuming PC sitting on your desk.

If you think this sounds far-fetched, think again. Investigators can now search computers just like any other crime scene, uncovering small clues and even substantial proof. This new investigative form is called computer forensics and it can protect your construction business in a variety of useful ways.

Recognizing the reality. More than ever, today's companies - builders included - rely heavily on computers. In fact, businesses create nearly 93 percent of their documents electronically and almost 70 percent of this data is never printed, according to the book Designing a Document Strategy by Kevin Craine.

Along with raising electric bills, this reliance on technology creates numerous criminal opportunities. Hackers may target your systems to steal valuable data (such as lists of current bids, vendor or subcontractor pricing or even a particular job's pricing) or to commit "virtual vandalism." Identity thieves might also prey on your computers to filch money from your employees. Or less sophisticated crooks may just use a company PC to research the best way to commit their crimes.

In response, computer forensics works on the principle that electronic evidence remains long after whatever action put it there occurred. Truth is, any computer activity creates dozens of clues that when expertly analyzed may provide tremendous insights into an alleged crime's who, what, where, when and how.

Simply deleting files isn't enough and even reformatting a hard drive won't completely eliminate evidence. The most common uses for computer forensics include:

• Determining whether fraud, espionage, trade secret theft or other intellectual property violations have occurred
  
• Providing background in wrongful termination cases, civil lawsuits or criminal trials
  
• Proving or disproving sexual harassment allegations or the presence of a hostile workplace
  
• Supporting managers when suspending or otherwise disciplining employees
  
• Resolving contract disputes with owners, general contractors or subcontractors and vendors

For litigation purposes, digital evidence is increasingly gaining acceptance. Courts at many levels and in many jurisdictions have recognized computer forensics as a bona fide scientific method of discovering and proving facts.

Preparing your systems. While techniques for finding electronic evidence are improving, so are methods for hiding and eliminating it. That's why preparing your systems for a computer forensics investigator to quickly and cost-effectively gather data can make a big difference.

First, as privacy rights continue to pose problems in many jurisdictions, you need to develop an "acceptable use" policy. Although resources such as PCs, networks and Internet access are obviously company property - and therefore fair game for electronic monitoring and computer forensics discovery -

without an acceptable use policy, you could open yourself up to a civil case for violating an employee's privacy expectations.

Begin your policy by stating what is and isn't acceptable as well as laying out consequences for violations. Further mandate that your construction business retains the right to inspect and monitor all computer activity - in the past, present and future - without notice.

Also address data and communications ownership, particularly regarding business-related activities that occur outside your company. For example, if an employee connects to your network remotely, whether from home or a job site, your policy must extend ownership rights to whatever PC or laptop he or she uses to do so.

Along with a thorough acceptable use policy, you also need to configure a "forensics friendly" computer system. Many investigators have found that had companies set up their systems correctly they could have found more evidence or at least done so faster and less expensively. For instance, today's networks have extensive logging and auditing capabilities. But businesses generally don't configure these functions by default or they turn them off entirely because of large log files' storage requirements.

To avoid this critical mistake, ask an outside consultant to conduct a comprehensive systems review to verify that your company's logging and auditing capabilities are set correctly. And, as a safeguard against internal fraud, have the consultant regularly check these functions.

Responding to an event. Say your construction company experiences an event that calls for a computer forensics investigation, such as a potential theft of trade secrets (say a confidential client list or bid list). What should you do? First, secure and isolate the affected system - even taking it out of service, if possible.

Then, engage a computer forensics investigator immediately. For litigation and criminal investigation purposes, strict requirements and protocols exist for establishing a custody chain of potential evidence. In addition, the more time that passes between when an alleged act occurs and an investigation begins, the more proof that could disappear.

The investigator will work closely with you and your lawyer to determine the likelihood of finding evidence, where you may most likely find it, and how to best gather the proof while limiting the business impact of doing so. Furthermore, he or she will know techniques for discovering and analyzing data that the average IT consultant probably doesn't. And a qualified investigator will acquire evidence consistent with court requirements, ensuring that any data obtained will be legally admissible.

Knowing the potential. As you well know, the construction business is no stranger to fraud, employee dissension and other potentially contentious situations. Fortunately, computer forensics has the potential to significantly improve how hardworking contractors such as you can handle these issues.

And as investigative techniques, tools and legal boundaries expand, its significance will only increase.

Editor's Note: Randy J. Bonnecaze is a Certified Public Accountant (CPA) with Hannis T. Bourgeois LLP, Baton Rouge.