Allison Stanfield examines the consequences of the judgement in Porter v Australian Prudential Regulation Authority [2010], where the Federal Court of Australia gave the green light for a regulatory body to get access to files on a forensic image of a computer hard drive that was kept on the premises of an applicant’s solicitor.

In Porter v Australian Prudential Regulation Authority [2010] FCA 125, a forensic image of Ross Porter’s computer hard drive had been made by a judicial manager for the purposes of the judicial management of Austfam. Mr Porter was concerned that the hard drive contained information that was not relevant to the affairs of Austfam and possibly privileged material. Mr Porter’s solicitor, Fiona Shand, was summoned and it was agreed that a forensic image be made and that she would undertake to keep it in safekeeping.

APRA then issued notices seeking access to files on the forensic image, the first of such notices being held to be unreasonable. The second notice included a detailed specification of various categories of “books” which related to the affairs of Austfam.

In considering a number of issues about the notice raised by Mr Porter, it was contended that although Ms Shand had custody and control of the forensic image of the hard drive itself, she did not have custody of the files on the forensic image, because it was in a format which did not permit non-technical users to access it. Also, it was contended that because Ms Shand did not know anything about the affairs of Austfam, it was unreasonable to expect her to assess the relevance of material about which she was unaware.

The court dismissed the claim by the applicants, and granted APRA access to the files, notwithstanding the solicitor did not have the expertise to restore the files from the image nor had any knowledge of the company whose files were being sought.

Although the court held that service of a notice to show cause of an investigation of Austfam in August 2009 was incorrectly served upon the judicial manager rather than Austfam’s registered address, this did not null the existence of an investigation.

Given the existence of an investigation, it was under Austfam’s investigative powers to seek production of the documents. The court held that there had been no improper purpose by APRA nor was the notice unreasonable or that there was disregard for the burden on Ms Shand. Critically for the purposes of analysing this case from a data management perspective, the court further struck down arguments that Ms Shand could not access the files due to her lack of technical expertise, nor that she was an inappropriate person to review the material for relevance.

Section 55(1)(a) of the Insurance Act 1973 (Cth) gives APRA the power to serve notice on a person requiring production of “all or any of the books relating to the affairs of the body corporate that are in the custody or under the control of that person.”

Section 3 of the same Act defines “books” as including “any register or other record of information” and “any document”. Though it was not an issue between the parties in this case, it is an interesting observation to note the way in which it was accepted upon the definitions of “document” and “record” in the Acts Interpretation Act 1901 (Cth) s25, that each of the files located on the hard drive in Ms Shand’s possession was a “book” to which s55(1)(a) refers.

This serves as a reminder of how far the legal system has progressed in incorporating and defining electronic files for the purposes of litigation. This has been considered in cases such as Sony Music Entertainment (Australia) Ltd v University of Tasmania (2003) 198 ALR 367; [2003] FCA 532 and GT Corporation Pty Ltd v Amare Safety Pty Ltd [2007] VSC 123 and it is an important point to remember bearing in mind that a forensic image is created as a bit-for-bit copy of the hard drive of a computer which means that one forensic image can contain many thousands or millions of files.

Custody and control

What was however of contention between the parties was the argument by the applicants that although Shand had physical control and custody of the hard drive as a chattel sitting in a safe in her office, she did not have custody and control of the files on the basis that she lacked the computer skills and software to access them.
Justice Perram rejected this argument and said “It would be easy enough for her to ask technicians from the judicial manager’s office to show her how the data might be retrieved or, if they will not, what kind of expert she might speak with to the same end. There are any number of firms in this city offering technology services of this kind. Imaging of hard drives is a widespread phenomenon in modern insolvency and litigation practice.”

To Ms Shand’s defence, she had been told by technicians at the judicial manager’s office that it was impossible for her to access the files located on the drive and had further been dissuaded by an email from another staff member that recovering the files would be “expensive, complicated and not necessary if Ross [Porter] can print them off his live computer”.
Justice Perram held this not to be evidence of the fact that the files were inaccessible but rather that Ms Shand should first consider cheaper options. The court found it unnecessary therefore to examine the issue of whether custody and control of a storage medium such as a hard drive equates to custody and control of the files contained within that storage device.
In Sony Music Entertainment (Australia) Ltd v University of Tasmania, Justice Tamberlin of the Federal Court found that it was appropriate to order discovery of electronic storage devices notwithstanding they may contain a wide range of other information, with the implication that such a search for relevant documents would be conducted by a computer forensics expert who would make an undertaking as to non-disclosure and confidentiality and with the opportunity for the concerned party to see if they have any claims for privilege or confidentiality before discovery. Thus in this case, the argument raised by the applicants regarding Shand’s lack of knowledge as the factor excluding her from being appropriate for determining relevance, is a weak argument as it is not unusual for legal technology firms as well as lawyers to be the parties examining electronic storage devices for relevant files.

The issue of relevance

The applicants further opposed the notice on the ground that Fiona Shand was a person who was not well-informed enough about Austfam to review the material on the hard drive for relevance to matters ‘relating to the affairs of Austfam’.

Justice Perram rejected this argument on the premise that it was not necessarily unreasonable of APRA to serve notice upon Ms Shand as APRA was not necessarily aware of that lack of knowledge on Ms Shand’s part but more critically that “solicitors such as Ms Shand are frequently called on, in the process of discovery, to assess the relevance of client material without having any more expertise in the client’s affairs than that arising from the retainer… No doubt, as his [Mr Porter’s] solicitor, she may seek his assistance to the extent the matters are unclear.” This would appear to be the correct conclusion and is discussed further in the next section.

Implications for Data Managers

The effect of the decision is that a forensic image possesses no mystical characterisation over and above any other form of media. The court considers that there are adequate expert resources available to restore the image back to a format in which a lay user can review the material on a computer screen. This of course, assumes that the lay users will have a basic level of computer skills in which to review the material once it has been restored.

Further, the files, once restored from a forensic format, are then capable of being reviewed for relevance to a particular issue, whether this be pursuant to a regulatory notice, a discovery or any other request for information.

The judgement of the Federal Court removes the mystery surrounding computer files and treats them like any other document or “book” for the purposes of review. It now means that documents on a computer are no different to documents sitting in a cardboard box, and for any relevance review, each document must be reviewed accordingly.
It is foreseeable that this will be an issue that will return to the courtroom in the near future given the rising prevalence of the use of electronic data in the courtroom. One may argue that given the court’s distinction between the hard drive and the files in defining a “book” as a file not a storage device is a distinction that should be retained for the purposes of determining whether a person had “control” and/or “custody”.

This case establishes that with respect to the obligations of a person who has possession of a hard drive with a forensic image and is required to produce relevant files on the hard drive, the excuse of lack of technical knowledge is insufficient in a court room.

Allison Stanfield is a founder and CEO of e.law Australia, and has recently published her second book, “Computer Forensics, Electronic Discovery and Electronic Evidence”.