With the increasing importance of IP rights and the digitization of data, IP owners are advised to engage experts to perform forensic analyses of their intellectual properties. Espie Angelica A. de Leon discusses how clear instructions, unified standards and a multidisciplinary approach within an organization can pay benefits.

“Companies are likely to perform IP forensic analysis in at least two situations,” Sanil Khatri, local principal at Baker McKenzie Wong & Leow in Singapore, said. “First, where an organization suspects an employee or contractor of breaching appropriate use policies or IP fraud / theft. Second, where an organization requires evidence in support of search and seizure warrants.”

“IP forensic analysis is typically done where the contents or integrity of digital information is key to a case,” added Victor Tse, counsel at Bird & Bird in Hong Kong.

In this age of devices and the internet, the usage of computers and accessories, such as USB thumb drives and external hard drives is generally a major component of IP theft. In the exercise of computer forensics, electronic devices including mobile phones and tablets must be shut down, “guarded” and preserved for the ensuing investigation.

Examples of IP forensic evidence that may be gathered from the investigation include the soft copy of the material that was infringed, the software used to download the material, firewall logs and the user’s browsing history.

Evidence is collected using the various methodologies, from the application of keywords and forensic imaging of electronic devices and servers to data extraction, including already-deleted data and data carving for deleted email, among others.

Such evidence helps forensic experts tackle questions essential to the case or to their client’s end goal. Some of these questions are: Did the perpetrator copy the data? When and where did the perpetrator(s) use a USB flash drive? What vital information is contained in the email messages? Did the perpetrator use a cloud-based email or a file storage account? Did he transfer the files from one device to another using remote access?

Aside from litigation, IP forensic analysis is also undertaken for licensing, taxation and regulatory compliance, among others.

Who should perform IP forensic analysis?

“IP forensic analysis should be performed by an appropriately-qualified, independent expert. As the New Zealand Law Commission noted in 1991, ‘the first condition for the admissibility of expert opinion evidence is that the expert must be properly qualified to give evidence on the issue,’” said Blake Carey, senior associate at AJ Park in Wellington.

Yifan Yang, assistant attorney at CCPIT Patent & Trademark Law Office in Beijing, added that an appraiser, expert witness and technical investigation officer should perform IP forensic analysis. “Where the People’s Court considers that an appraisal is necessary for a specialized issue, it shall entrust a qualified appraiser to make the appraisal. The parties may also apply to the People’s Court for expert appraisal on specialized issues concerning the ascertainment of facts,” he explained.

In such a case, when the parties apply for appraisal, the qualified appraiser shall be determined by the parties through consultation. If the consultation fails, the court shall appoint a qualified appraiser.

“The parties may also apply to the court to notify a person with specialized knowledge or ‘expert witness’ to appear in court and give opinions on the expert appraisal made by the appraisers or the professional questions,” Yang said.

Meanwhile, technical investigation officers assist the judges in understanding and identifying professional and technical issues of a case. They also provide technical support in the trial process.

According to Michael Seifried, a partner and trademarks group leader at FB Rice in Melbourne, a skilled and experienced trademarks lawyer or attorney should be able to assist if the issue revolves trademarks.

It’s the same with patents. If the issue relates to patent drafting or validity, a skilled and experienced patent attorney should assist. If it’s in connection with the discovery of relevant documents, say, in an infringement context, a lawyer, instead of a patent or trademark attorney, could be involved.

If it’s about licensing or quantum of damages, then potentially, a forensic accountant with IP valuation experience should do the job. 

In the Philippines, several private IP investigation firms conduct IP forensic analysis. The National Bureau of Investigation also has a dedicated unit for digital forensic work.

“There is nothing from the rules on evidence or even the rules on IP litigation that would require any specific individual who should perform IP forensic analysis,” said Jonathan Perez, a partner at Bengzon Negre Untalan in Manila. “For as long as the forensic evidence gathered and the resulting analysis is competent and admissible under the rules, it would not matter who conducted the forensic analysis.”

Challenges: Negotiating the trail’s rough spots

The trail blazed by IP forensic analysis is definitely not a clear and easy one. The path is actually strewn with rough spots that are difficult to negotiate. Among these are admissibility and competence of the evidence gathered. According to Perez, these present the most glaring challenge where IP forensic analysis is concerned.

As Carey said: “While expert forensic analysis can carry much weight, it is rarely the full panacea. Forensic experts can be attacked by opposing counsel at all stages of the proceeding, including as part of pre-trial procedures.”

The rest of the challenges inherent in IP forensic analysis are associated with admissibility and competence of the evidence.

Citing an example, Perez said: “The use of private investigators is more convenient, but should the case reach trial, the admissibility of the evidence secured may be put into question and later affect the judgment issued, especially for criminal cases, which have a higher quantum of evidence. There is no parallel ‘presumption of regularity’ as when government agents conduct operations, which can be a hurdle in presenting admissible evidence to the court.”

Posing another challenge is preservation of evidence from digital forensics.

“Naturally, the evidence obtained must be preserved in a manner which maintains its credibility and integrity,” said Perez. “Was evidence gathered within the bounds of an enforcement action based on a valid search warrant? What was the procedure undertaken in extracting digital evidence? How was it saved or transferred to a file or a location? Was the evidence gathering properly documented? Was the chain of custody preserved? These are some of the questions which could affect admissibility,” he explained.

Perez related that in a good number of enforcement activities by their firm involving copyright infringement of software, they did not encounter major challenges as to evidence gathering and presenting such evidence in court.

“The lack of challenge from the respondents or the accused, or their counsels, is primarily because of clear finding of unauthorized reproduction of the software that were found either installed – and being used – or saved in specific locations or files in the computers that were examined during search warrant enforcement,” said Perez.

For Tse, a key challenge is to obtain the needed details of the file without inadvertently changing the file’s properties. 

“You have to know what you’re doing,” he stressed. “For example, it may be important to determine when and who made subsequent modifications to a file. This is often recorded in the file’s metadata. But if the file is accessed in a certain way, the metadata may change, thus destroying what you’re looking for in the first place.”

“A central theme in IP forensic analysis lies in the integrity of data in computer systems,” said Khatri. “Generally, when dealing with digital data, the authentication of digital evidence is usually inferred from circumstantial evidence and is based on extrinsic elements such as metadata, particularly if such data is stored on the cloud.”

He added: “However, Singapore has already struck a balance of accepting electronic evidence by enacting Section 116A of the Singapore Evidence Act 1893, which provides that there is a presumption in relation to accuracy of electronic records where the device or process used is one that if properly used, ordinarily produces or accurately communicates an electronic record used, unless there is sufficient evidence to raise doubts about this presumption.”

Khatri revealed their firm has to deal with companies that are not clear about the subject matter, locations and processes involved with regard to their digital information or sensitive data and the associated risks. He said this is especially so because IP forensic analysis is performed where time is of the essence.

To solve the problem, their firm often assists clients with preventative measures to make them understand their sensitive data, be aware of the relevant risks and take necessary steps to mitigate such risks.

He recommended that companies form a team composed of people from different units, such as IT, legal and human resources. The team’s objective is to develop a response plan for incidents of IP theft. He also advises organizations to adopt a risk-based approach and undertake periodic IP forensic analysis. This will be particularly useful if the organization digitally stores its valuable data including confidential information.

“It is also important to segment sensitive data, or data generally, on a need-to-know basis to reduce the risk of this data being stolen. Further, we have conducted IP audits and data audits to identify, analyze and resolve any potential issues,” Khatri added.

There is also the risk of deadlines stretching and costs blowing out.  

Carey said forensic analysis regularly requires the analyst to assess thousands of pages of detailed event logs, access logs and raw data, hence, the risk.

Another problem may arise when clear instructions are not provided to the forensic expert. Under this circumstance, the expert might accidentally comment on matters outside his expertise or give his analysis using technical jargon, which the judge and opposing counsel may not fully comprehend. “These circumstances may result in a court treating the forensic analysis as unreliable or inadmissible,” said Carey.

To address these rough spots, he noted that the acting firm should ensure the forensic expert is sent instructions that clearly set out the following: the relevant court rules and expectations for giving expert forensic analysis, precisely which matters require expert commentary and which matters do not, among other things.

“We occasionally have situations where forensic experts wander outside their areas of expertise and comment on irrelevant matters. The solution is to ensure the expert is provided with as clear a briefing as possible before it begins its analysis,” explained Carey. “The most effective evidence is concise, objective and clear in its analysis and conclusions. The expert must reach their own conclusions.”

He stressed the importance to remind clients that the judge, not the forensic expert, is the ultimate decision maker.

According to Bin Zhang, deputy director of the legal department at CCPIT Patent & Trademark Law Office in Beijing, there’s also the problem of authentication standards not being uniform. In particular, this may lead to a situation where it’s difficult to meet the needs of judicial practice. Plus, the qualification standard for appraisers might not be well under control, which may cause the risk of appraisal quality. Thus, he said it is advisable to establish a unified scientific identification standard and a common consensus in a certain industry.

Zhang explained: “The appraiser must have professional knowledge related to the appraisal project, should be a high-level expert with a higher professional and technical title and should have the ability to independently solve the appraisal problems within the scope of the discipline. At the same time, he must also master certain legal knowledge, have good professional ethics and a scientific attitude of seeking truth from facts as well as the moral character of not [harbouring] favouritism and have the ideological style and work style of respecting science. These are the preconditions to ensure an objective and just conclusion.”

With regard to Australia, Seifried said: “There are already quite detailed and complex rules for retaining experts in Australia, including under the Commonwealth Evidence Act and the Federal Court Rules. In order to assist the court, the evidence must clearly set out any assumptions made in preparing the evidence, and the evidence is often challenged on that basis. The Federal Court often ‘hot tubs’ experts – that is, it asks them all to agree on points in common and any point upon which they disagree so that matters in dispute can be more readily isolated.”

Smaller companies also have their own hurdle to face, he added. This relates to the prohibitive costs of retaining an expert and preparing expert evidence. Such dilemma often hits trademark or copyright clients.

“One recent challenge related to a trademark (non-use) matter in which a client faced a non-use removal application on the grounds that it could not have used its mark in a particular territory because it did not have an appropriate financial licence to do so,” shared Seifried. “Because of the nature of the client’s activities, it was not required to have such a licence. However, a document that was drafted as a letter of advice from the client’s lawyers was not admissible as evidence because it did not comply with the rules for expert evidence. Accordingly, the client had to consider whether to proceed with filing expert evidence in that regard and otherwise how to deal with that issue.”

Another challenge involves survey evidence in trademark and copyright cases.

Seifried revealed: “Survey evidence is generally not well-received in the forensic context, because the evidence relating to how the data was collected and assumptions made are either not well-expressed, or can be easily challenged.” He added courts will often put their own views above the survey evidence.

Growth and progress of IP forensic analysis

How progressive is IP forensic analysis in our interviewees’ jurisdictions?

“The notion of forensic analysis is very broad, so it is difficult to say with precision how well-developed or progressive it is in Australia and New Zealand. Although there are rules for filing evidence of this kind, there are still gaps in the ways data can be collected and filed in IP cases,” said Seifried. Some of these gaps relate to, as mentioned above, survey evidence as well as evidence of how similarities are perceived by the consuming public.

Carey specified, however, that forensic analysis and evidence is a regular feature of litigation in New Zealand and that the evidence is frequently adduced in disputes involving suspected misuse of company IP or confidential information by current or former employees.

“I gathered there is an upward trend in the demand for services related to digital forensics in the whole of Asia, but notable countries with highest demands are Japan, South Korea, India and China,” noted Perez.

On the other hand, the Philippines lags behind its Asian and even ASEAN neighbours in terms of cases where IP forensics analysis is used either as evidence or as means of arriving at a compromise agreement.

“My impression that the Philippines lags behind some other countries in Asia is more based on the limited number of professionals or entities providing the services,” he said. “We work with a couple of private IP investigation firms, which could conduct forensic investigation and analysis but on limited capacity.”

As for China, Zhang believes the trail of IP forensic analysis is on an upward trajectory, coinciding with the development of society.

“The market scale will be further expanded and the authentication standards will be more stringent, which will effectively promote the benign development of China’s forensic expertise industry in the future,” he said. “Meanwhile, benefiting from the progress of social science and technology, China’s judicial authentication industry is moving into a new period of technological development.”

According to Zhang, judicial authentication institutions and companies will continue to adopt more advanced technology to improve service quality and service efficiency. At the same time, the government will also introduce more support policies to provide more development opportunities for the judicial authentication industry.

Khatri also believes IP forensic analysis has been steadily progressing in the region, including in Singapore owing to the increased importance of IP rights.

“In particular, as data becomes increasingly commoditized in our digital landscape, we expect to see an increased role of forensic analysis in protecting IP rights,” he said.