IT Group Creates a Video Timeline of Employee Misconduct to Present to a Jury

As technical experts, our advice and recommendations are requested across a plethora of legal matters. In this particular instance, corporate fraud was the question and IT Group the answer; tasked with creating a video to help explain how a high-tech crime took place.

A quantitative analyst employed by a hedge fund that develops codes/strategies used to trade the markets pleaded guilty to theft of its intellectual property (IP). In addition to a prison sentence, a Serious Crime Prevention Order (SCPO) required the guilty party to reveal the location of any computer that contains the stolen IP and to remove it. The order was not complied with and the trial proceeded.

To assist the prosecution, IT Group was asked to create a video to help illustrate how anybody (never mind a highly qualified, intelligent individual) was able both to gain access to and copy the securely held, compiled, obfuscated, code.

The facts presented to us at the time of instruction were:

  1. The Accused had remote access to his work computer;
  2. Commercially available software was used to decompile the code; and
  3. Other specialist software was used to decrypt it.

Also, by forensically analysing internet history and email correspondence, IT Group discovered that the Accused was also interested in purchasing ABBYY FineReader.

ABBYY FineReader is a piece of optical character recognition (OCR) software that allows the conversion of images into text. Using Abbyy FineReader, I could take a picture of a page in my favourite book (Catcher in the Rye, for those wondering),  upload it onto a PC running the ABBYY FineReader application and use the software to read the text in the photo. This can then be used; copied, pasted and edited at my own leisure. It works for screenshots on a computer too, well, in fact, any image that has legible text. It’s incredibly simple; I tried it below on J.D Salinger’s finest work with the free trial:

Step 1: Amateur photo of book page

Catcher in the Rye JD Salinger (2)

Step 2: Run the photo through the software


“If you really want to hear about it, the first thing you’ll probably want to know is where I was born, and what my lousy childhood was like, and how my parents were occupied and all before they had me, and all that David Copperfield kind of crap, but I don’t feel like going into it, if you want to know the truth. In the first place, that stuff bores me, and in the second place, my parents would have about two hemorrhages apiece if I told anything pretty personal about them.”


Step 3: Copy and paste the text to be used at own leisure

Admittedly not much use in this example, but when used on thousands of lines of complex software code worth millions of pounds – its advantages become readily apparent. But how does one obtain the code to run through this OCR process?

Another video was made detailing the remote access protocol by another party (also assisting the prosecution). In essence, at the end of this procedure, the user (in this case, the Accused) will have a ‘window’ into the desired machine from their local machine.

It is only a window too, changes can be made to the remote PC, but they remain on the remote PC i.e. you could not simply download data/files to their local machine.

Photographs!

I’ve already demonstrated you can run amateur photos taken with a mobile phone through OCR software such as ABBYY FineReader, but taking many mobile phone pictures of a PC screen containing code is likely to be cumbersome and inefficient so is unlikely to be the approach taken…also we know from historic Google search data that the Accused had searched for both manual and automatic ‘screenshot’ software (Lightscreen and Auto Screen to be precise).

Once we had identified all the pieces of software involved, we set to task and began creating our video to assist both the prosecution and the jury. We elected to use Camtasia video editing software to record our on-screen actions recreating the likely steps taken by the Accused to steal sensitive intellectual property.

These were:

Remote Access to work PC from local machine

Open sensitive code on work PC

Screenshot the code through various means (Lightscreen, Auto Screen & camera photo)

Save the images locally

Run the images through ABBYY FineReader

Demonstrate the code can now be manipulated locally

While the video was playing, the steps were narrated by IT Group expert Jason Coyne demonstrating the simplicity of the technique. This video was presented at trial, by Jason Coyne and received positive feedback from the prosecution counsel. In this situation, a video was the perfect tool for providing clear explanations of the techniques used and ultimately was a key aspect of the jury returning a guilty verdict and securing a conviction.