Streamlining Government Investigationsstorage.googleapis.com/wzukusers/user-12916790/documents... · 2015-04-09 · STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY

STREAML INING GOVERNMENT INVEST IGAT IONS WITH THE CLEARWELL E -D ISCOVERY PLATFORM P A G E : 1

Streamlining Government Investigations With The Clearwell E-Discovery Platform

A Technology White Paper


Clearwell Whitepaper

Table of Contents:

The Data Analysis Challenge 3

The Solution: The Clearwell E-Discovery Platform® 4

The Clearwell E-Discovery Platform in Action 5

How the Clearwell E-Discovery Platform Works 11

Conclusion 12



The Data Analysis Challenge

Lawsuits. Regulations. Government investigations. All are a fact of life in today’s busi-ness environment. And all have created a data analysis challenge for government secu-rity and forensics professionals. The number of legal discovery requests, regulatory in-quiries, and government investigations is rapidly escalating. In addition, the deadlines required to “cull-down” and find relevant documents are increasingly aggressive and teams don’t have the luxury of adding resources to handle the greater demand.

Current tools only exacerbate the situation. Keyword search tools, for instance, return far too many false positive documents and fail to reveal context of critical email dis-cussions—requiring manual review of thousands of irrelevant documents and emails. Several different tools are commonly needed to complete each investigation, forcing government organizations into time-consuming, error-prone steps. All of these factors compromise accuracy and lengthen the data analysis process, leading to greater risk and a costly reliance on external vendor services.

With so much at stake, there is a critical need for a solution that can dramatically eliminate the time, cost, and complexity of data analysis in the investigative process.

Government organizations are overcoming the data analysis challenge with Clearwell. By automating and streamlining manual processes associated with analyzing thou-sands of documents and emails Clearwell provides much-needed relief for profession-als conducting government investigations.



The Solution: The Clearwell E-Discovery Platform

The Clearwell E-Discovery Platform (Clearwell) automates the complex, time-con-suming process of discovering, organizing, and analyzing large volumes of documents and emails in response to legal discovery requests, regulatory inquiries, and govern-ment investigations. The product dramatically reduces data analysis costs in two ways: first, by culling-down large datasets to a smaller, relevant datasets; and second, by delivering proven analysis and review capabilities that enable teams to rapidly find the most critical documents for each investigation. Unlike yesterday’s tools that simply collect, index, and provide keyword search, the Clearwell E-Discovery Platform:

1. Delivers forensically sound collection capabilities that enables IT, legal, and inves-tigative teams to easily identify and collect from all critical data sources;

2. Brings a new level of transparency to e-discovery search, enabling a more collab-orative and defensible process;

3. Tracks and graphically displays related emails, linked together in chronological order. These discussion threads allow investigators to quickly understand context, identify all participants, and determine who knew what, and when;

4. Organizes all documents into discovered topics and known user groups relevant to each investigation, thereby enabling rapid tracing of critical communication flows; and

5. Provides complete visibility and tracking of all ongoing investigations through dashboards and reports, thus allowing teams to optimize the investigative process.

The Clearwell E-Discovery Platform is an appliance that is up and running quickly. Since the product’s web-based interface is extremely intuitive and user-friendly, most investigative teams are productive immediately with minimal training. The solution seamlessly integrates with existing collection processes and allows users to consoli-date all processing, analysis, review, and production tools into one platform.



The Clearwell E-Discovery Platform in Action

The Clearwell E-Discovery Platform is already at work at hundreds of Fortune 1000 companies and government organizations. The following are just a few examples where Clearwell has delivered immediate value by significantly reducing the time and cost of government investigations:

• Large multi-agency task force investigations into Medicare/Medicaid fraud

• Office of Inspector General investigations into corporate fraud and procurement fraud

• Investigations into bank fraud after government receivership of failed financial institutions

• Suits brought against the Federal government regarding disputed royalty payments for oil, gas, and grazing leases

• Office of General Counsel class action lawsuits

• State and Federal governmental agencies investigating employee discrimination and harassment violations

The following use case demonstrates how Clearwell can reduce the time, cost, and complexity of conducting a government investigation. This particular investigation involved the analysis of email messages, attachments, and other collected files.

USE CASE: GOVERNMENT FRAUD INVESTIGATION

In this use case, a multi-agency task force used a search warrant to seize possession of computers, email servers, and networked shares in a place of business suspected of Medicare fraud. Their investigative process was to:

1. Quickly collect and preserve all electronically stored information (ESI) from the suspected place of business,

2. Efficiently review all emails and documents relevant to the investigation, and 3. Prepare for the taking of depositions from various persons of interest.

Prior to Clearwell, the task force used complex forensic solutions involving multiple tools and a high degree of training and experience. Because of the sheer complexity of the technology the agents generally resorted to reading massive amounts of docu-ments and pieced the case together via handwritten notes, white boards, and general intuition. With Clearwell all of that changed.



By employing Clearwell to automate their investigation process, the task force eliminated many of the older manual, time-consuming steps and reduced the effort involved in other steps. The end result: they reduced the analysis of ESI to one-tenth of the time and cost typically required. The task force’s new investigative process con-sists of the following 3 steps (which are described in detail in the next section):

1. ESI Collection & Pre-Processing: The task force collected hard drives, desktop files, emails, and documents from networked shares of the employees involved in the investigation and analyzed them with Clearwell prior to indexing the entire dataset. Specifically, the task force:

• Used the Clearwell On-Site Collector to collect suspect data to a secure preservation store

• Verified the integrity of the collected data to ensure it was forensically sound

• Ran completeness checks by date and by custodian (i.e. had they over-looked any relevant ESI or was a month/week/day of potentially relevant data missing?)

• Used date ranges to select the ESI for the first round of analysis and review

• Upon processing the much reduced set, automatically “De-NISTED” and eliminated duplicates across the entire set of ESI

2. Cull-Down and Early Case Assessment: After processing the agents discovered that the ESI had shrunk from over 900GB to slightly under 200GB. Next, the Spe-cial Agent in Charge (SAC) assigned an agent (who had subject matter knowledge of the case) the responsibility of performing an early case assessment. In a nutshell her job was to:

• Rapidly cull-down the large dataset of ESI into a much smaller, relevant sets by eliminating false positives and other irrelevant emails and documents

• Create a way to segment the ESI, either by subpoena, significant dates, or a com-bination thereof

• Gather key case facts to begin assessing the strength (or weakness) of the case

• Suggest a list of pertinent search terms/expressions that agents can use to guide their detailed review

3. Detailed Review: With Clearwell, members of the investigation team more ef-fectively performed detailed review and collaborated with other investigators in real-time. More specifically, the team members:

• Saved time by focusing their review on a much smaller set of relevant messages

• Enabled pinpoint investigation accuracy by further analyzing suspects’ conversa-tions over email

• Increased productivity by enabling efficient coordination and collaboration be-tween several reviewers via tagging and workflow features

COMPLETING THE INVESTIGATION STEP-BY-STEP

The following details the task force’s much improved investigative procedure using the Clearwell E-Discovery Platform.

ESI Collection & Pre-Processing The new investigative process using Clearwell began by pre-processing the collections in the directories where they were stored. Simply put, this meant indexing all meta-data associated with each document. This first step is a much quicker task than the



in-depth content analysis and indexing that occurs later during Processing. As a result the team pre-processed at speeds of approximately 100GB per hour. Thus the case administrator began pre-processing in the afternoon and by the next morning he was ready to sit down with the SAC to go over which categories of ESI (custodian, date range, file type) should or should not be fully processed for agent review.

Within the hour the administrator and SAC had determined their strategy and selected the first batch of documents for full Processing. Due to the pre-processing step, the da-taset had shrunk from 900GB to 200GB. Immediately the case administrator began the full Processing task. This takes only a couple clicks of the mouse to make happen. Soon the case documents are ready for further culling and early case assessment.

Cull-Down and Early Case AssessmentDuring Processing, duplicates are identified and the case is prepared for analysis. In this case, the de-duplication rate was approximately 40%. Thus when the agent began her work her case load had shrunk from 200GB to 120GB, a 40% reduction BEFORE she analyzes a single document.

In the Clearwell solution, projects define an “investigation workspace” that includes all ESI relevant to a particular investigation. Clearwell provides comprehensive role-based security that controls access to specific cases (as well as folders within the case), ensuring strict compliance with privacy policies. Projects also preserve the state of each investigation allowing investigators to stop and start investigations as time permits.

In some investigations, before the prosecuting team obtains access to the docu-ment collection, a “filter team” or “taint team” is assigned to conduct searches and review documents. These teams are responsible for ensuring that no privileged or out-of-scope documents (those outside the scope of the subpoena used to obtain the evidence) are introduced. Clearwell’s granular access controls enable the filter team to conduct their searches and review before moving non-privileged documents into folders for the prosecuting team. Access to specific folders can be controlled, so that prosecuting teams only have access to non-privileged documents under this workflow scenario.

Once project “Subpoena-00425” has been created for this investigation, the special agent’s first task is to cull-down the large set of email messages into a much smaller set for detailed review by other team members. Her first step is to eliminate what are considered to be “profoundly” non-relevant documents from case review.

Using Clearwell’s Auto-Filters, she selected all emails from domains that are of no interest to the investigation, such as those from on-line shopping sites (e.g., Ama-zon. com, other travel sites, sports sites, news feeds, and so on). She also eliminated documents belonging to senders or recipients that are of no immediate interest to the investigation. She tagged these documents as “non-responsive” and saves them in a folder. After an hour’s work she has eliminated another 30% from her review set. The case document size has now dropped from 120GB to 84GB.

After eliminating a significant amount of non-relevant emails and documents, her next task was to begin to gather case facts and create a list of keywords for her team to use in their review. The question is, how can she go about gathering facts quickly and how will she create such a list of keywords? What should those words be, exactly?



To assess the case and determine the top keywords, she perused a time line of suspected criminal activity which the team had prepared earlier for the search warrants. When any event of significance occurs, it generates “chat-ter” in corporate email systems. In Clearwell, that email chatter is captured as a Discussion Thread. Thus the first step in her analysis was to match Discussion Threads with event dates that were relevant to the case.

In this particular case, the first date of interest was September 30, 2006. She selects the Discussion Thread View and sorts all discussions by date. She quickly discovers that there are six lengthy threads that occur during that week. After she opens each Discussion Thread, she opens the Terms Analysis tab. The Term Analysis tab contained up to 20 noun and noun phrases that occurred most frequently during the discussion. These are the topics that people are talking about over email. These are the keywords that are being used by the persons of interest during their communications. At this point she clicks on the term and sees the paragraph containing that term from each email. Now she can determine if the term and its context are meaningful to the case. If it is then she adds it as a search term. During this process, she can also gather and record key facts of the case to help guide her team of reviewers.

After a short while she has collected several key facts and over a dozen search terms that are relevant to the case. She takes her entire list and pastes it into the Advanced Search page and runs all of the search terms at once using Clearwell’s Multiple Keyword Search feature. Within seconds all the documents containing keyword hits from all the search terms are returned for review. In this case, almost 5,000 documents were returned or about 5GB of the total. To determine the effectiveness of her search, she samples documents within the search result. Clearwell’s Relevance Rank feature enables her to see the most relevant results first, and pass judgment on the entire search result. Many of the results are relevant, and she quickly tags those documents as “potentially response” and moves them to a folder called “Subpoena 1”. By placing the documents in a folder she has made ac-cess restrictions possible. This means that some agents/attorneys on the task force may review that folder and some may not, based on the access control polices set for this case.

While sampling the search results, she discovered a particularly relevant document that revealed new information about the case. She wanted to understand the scope of the issue across the entire case, so she clicked the Find Similar link next to the docu-ment. Clearwell’s Find Similar feature provides a way to find documents with similar content to the item being viewed. The scope of Find Similar is controlled using a slider bar, and can be narrowed to focus on near-duplicates, or broadened to cast a wider net for loosely similar documents. She wants to find items with similar ideas, so she selects a lower threshold using the slider bar. The results include 21 items with similar content across the case. Each item returned by the search includes a list of relevant terms which provides visibility into why it was included as a similar item. These terms can also be used to generate additional keyword lists for further keyword searches.

Following the same methodology, she selects Discussion Threads and performs Term Analysis for other significant dates to create four other lists of terms/keywords. Using

Search Preview allows users to selectively include relevant variations or exclude false positive variations from their search query.

Discussion Threads dynamically link together all related messages into chronological threads that capture entire discussions, including all replies, carbon copies, blind carbon copies, and forwards.



the data from her “hit-lists” she was able to keep each review set to roughly 5,000 docs each. This was supplemented by selecting only relevant variants of wildcard searches using Clearwell’s Search Preview feature. Search Pre-view provides visibility into matching keyword variations prior to running a search. Users can selectively include relevant variations or exclude false positive variations from their search query, thereby adding relevant docu-ments and removing irrelevant documents from search results. For instance, given a search of LAW*, you would want to eliminate all documents contain-ing LAWNMOWER, LAWN, etc. from the search results.

Before finishing she creates a Search Report on each of her searches to create a record for each of her searches using the 5 search lists. Clearwell’s Search Reports creates a comprehensive report that documents all search

criteria and provides detailed analytics of the results for both the overall search and the individual queries within the search. The report tracks search terms that were included and excluded when using Search Preview providing a defensible audit trail of search refinement decisions. As a result, the SAC has total transparency into her searches and search refinement methodology.

So in just two days the agent has analyzed and reduced the case to 25GB. Now she is ready to turn over her results to her team of reviewers. At this point our agent has:

1. Created a list of search terms/keywords germane to the case (one per subpoena)

2. Segmented the case into smaller folders for review by other members of the task force

3. Collected and organized several critical case facts

4. Culled-down the size of the matter to 25GB prior to detailed review

Now, the other members of the task force will take the 25GB and perform a detailed review of the documents.

Detailed Review At this point the SAC has reduced the review set from 900GB down to 25GB within two days and gave case access to other agents on the task force. Each was assigned a folder to review based upon the subpoena that they are responsible for.

For reviewers, Clearwell provides an optimized review interface that maximizes screen real estate and minimizes mouse clicks to increase review throughput. Features such as dual monitor support, breadcrumb navigation, a related items panel and docu-ment thumbnail views allow reviewers to quickly navigate through document sets. Us-ing these review features the task force set out to perform a detailed review and to tag documents as “responsive”, “not responsive”, etc. Giving access to the review team was simple for the administrator. Because Clearwell authenticates user logins to accounts in Microsoft Active Directory®, the case administrator saved the time of creating and managing new user accounts. He only needed to assign roles to each of the agents. These roles have all been pre-defined in Clearwell, thus authorization to access the case took only a few minutes to set up.

Like the SAC earlier, an agent assigned to the case first performed a Discussion Thread analysis using key dates within the case to select conversations of interest. This gave him a general context of what was being discussed across the matter at the time of a special event. Clearwell also analyzes all of the attachments within the

Search Report creates a comprehensive report that documents all search criteria and provides detailed analytics of the results for both the overall search and the individual queries within the search.

STREAML INING GOVERNMENT INVEST IGAT IONS WITH THE CLEARWELL E -D ISCOVERY PLATFORM P A G E : 1 0


thread. With this type of attachment analysis, he can examine attachments with the editorials/explanations inherent in the email from originator/sender. This will also provide a context for any loose files that should be reviewed. Once an agent finds an attachment of interest, Clearwell can rapidly identify all suspects that have saved, sent or received that file (including early instances of the file using hash value comparison) across the matter with a touch of the button.

Since an attachment to an email is generally introduced with some explanation or highlighting by the originator, it is useful to find the email where a file is introduced. For this reason, Clearwell provides an “Originator” column in our Files view of the collection. This permits the investigator to see what comments were made when the document was introduced to others. Was there anything special about the file? What were people of interest saying about it? Furthermore, if the agent would like to see the chain of events, he has only to sort the email/documents by date and he will see the “evolution” of the file and its related Discussion Threads.

By easily traversing email discussions and analyzing attachments, the team discovered critical evidence proving both the guilt and innocence of the sev-eral suspects. Throughout this process the reviewers tag documents as either “Responsive” or “Not Responsive” depending on their importance to the case at hand. For example, one member of the team selected all emails of a Discus-sion Thread and tagged them as “Responsive” to the current investigation. With a single click, the member was able to tag 18 messages as responsive, saving the effort of tagging each and every message and, in the worst case scenario, misclassifying a key piece of evidence as “Non-Responsive”.

At the same time, the review team checked for near-duplicates using Find Similar. Many cases contain nearly identical items such as different drafts of the same document. Reviewing these near-duplicates together increases review throughput and accuracy. The reviewers opened Find Similar during review and moved the slider bar to a high similarity threshold, bringing back only items that are near duplicates of the document being viewed. Once these emails and documents were clearly tagged (along with annotated notes that articulated the logic that deemed the messages “Responsive”), other review-ers on the team were freed to focus on unreviewed emails and documents relevant to the investigation, thus reducing duplicative efforts. The team proceeded to review the remaining emails and documents until they were all reviewed and classified.

When it comes to deposition preparation Clearwell can save hundreds of hours. Using the Clearwell “participant picker” the agent can use a wildcard search select all emails (since a person can have more than just one email address—for instance a Yahoo email address and a corporate email address) of a person of interest. He can quickly select all documents sent by or re-ceived from that person of interest. He can also further refine his results by date. Once the documents are retrieved, he can see ALL of the interactions by this person of interest, no matter what email address was utilized, and can drill down on any documents/conversations of interest.

This procedure is useful not only for deposition preparation, but is equally valuable when comparing a deposition with the real facts of the matter.

Participant Picker consolidates all email addresses into a single identity, making it easier to discover and analyze case facts by suspect.

Find Similar enables reviewers to review and tag near-duplicates together, increas-ing review throughput and improving tagging accuracy.



Government Investigation CompleteWith Clearwell, the government agency successfully discovered evidence that proved both the guilt and innocence of several employees. In the past, this investigation would have taken the agency several weeks to complete. However, due to the rapid processing and powerful analysis features of the Clearwell E-Discovery Platform, the case was solved in less than one week. Overall, the government agency reduced the time and cost of this investigation by 90%.

How the Clearwell E-Discovery Platform Works

Installation of the Clearwell E-Discovery Platform is very simple and straight-forward. The product is delivered as a 2U rack mountable physical appliance or as a virtual machine image and is up and running quickly. The solution is flexible enough to be deployed as a mobile solution to collect data onsite. Once the standard network domain configuration parameters are set up (e.g., host name, IP address, etc.), the administrator simply configures Clearwell to access one or more document and email repositories for collection. Clearwell does not store any documents or emails, but rather crawls and indexes wherever they reside and can copy collected data to a se-cure preservation store. Within just a few hours allotted for Processing, investigation professionals can log into Clearwell and begin conducting searches, reviewing results sorted by relevance, using filters to cull-down datasets, viewing Discussion Threads, tagging email, and exporting or printing relevant email and documents into numerous formats. An easy-to-use, web-based interface, and administrative pages that display up-to-the-second status of system services make Clearwell painless to administer.


Conclusion

Government security & forensics professionals face tremendous pressure along several dimensions. The number of investigations continues to grow, as does the amount of documents requiring review and analysis. Deadlines are increasingly aggressive, rais-ing the urgency to rapidly and accurately determine who knew what, and when. Exist-ing search tools lack the functionality needed to conduct large scale investigations, leaving agencies no choice but to implement time-consuming, manual processes that waste precious time, resources, and money.

Clearwell delivers a true government-class solution that automates the document identification, collection, processing, de-duplication, analysis, and review process. The product dramatically lowers the cost of government investigations by culling-down a large dataset to a much smaller, relevant dataset; and delivering proven review and project management capabilities that enable teams to rapidly find the most criti-cal documents for each investigation. The product is easy to use, install, and main-tain—delivering a compelling ROI, often within a single investigation. Investigation teams at numerous Fortune 1000 companies and governmental organizations have all realized significant value and benefits using Clearwell. These benefits include:

• Easily collect data in a forensically sound manner

• Accelerate early case assessments from weeks to hours

• Cull-down data by up to 90%

• Increase review throughput and consistency

• Reduce movement of data across multiple, disparate tools

• Improve defensibility of the e-discovery and investigation process

© 2010 Clearwell Systems, Inc., Clearwell E-Discovery Platform is a trademark of Clearwell Systems, Inc. All rights reserved.

FOR MORE INFORMATION

For more information about Clearwell Systems Inc., or the Clearwell E-Discovery Platform, please contact us at:

Clearwell Systems441 Logue AvenueMountain View, CA 94043650.526.0600 tel650.526.0699 [email protected]

Documents

Streamlining Government Investigationsstorage.googleapis.com/wzukusers/user-12916790/documents... · 2015-04-09 · STREAMLINING GOVERNMENT INVESTIGATIONS WITH THE CLEARWELL E-DISCOVERY