27 Jan Sometimes investigations don’t work as expected

It’s fashionable on web sites to describe successes. Sometimes other case outcomes are more memorable, however. Here are some of our experiences in a Redmond cyber intrusion, a Tacoma murder and a few other cases.

Last year we were retained in a pro bono case by a Redmond nonprofit organization. Their web site had been attacked. Our analysis discovered a targeted attack that it came through the dark web. Attackers were masking their location with the onion router, TOR. By analyzing logs we were able to determine their real location. Just when the case got interesting, the management decided that their staff limitations would not allow continuing the investigation…. darn.

The whole family was concerned. Things were getting worse fast. We had been retained to inspect their Tacoma house for eavesdropping devices. Two days before we were to do the inspection the situation exploded; our client was murdered. Everybody involved in a situation like this keeps thinking, Could she still be alive if I would have…

A Seattle criminal defense lawyer retained us to evaluate some images and separately to provide an opinion on DNA evidence in a vehicular homicide case. These investigations were significant to the case and depended on our expertise. Three of us worked on the investigation and two of us testified about the evidence. We presented opinions on the facts allowing the court to throw out some bad evidence and evaluate other evidence. The jury voted to convict. Our opinions reflect facts; attorneys represent clients; the court decides.

A big regional medical operation came within a few minutes of wiring $100K to an online fraudster. We produced and analyzed forensic images of headquarters computers. We investigated the phishing email which started the the problem. A former employee became the likely fraudulent wire transfer suspect. Our client decided not to investigate further because an executive really liked the suspect. Sometimes feelings override evidence. This sort of fraudulent wire transfer is becoming more popular, see the FBI suggestions for preventing it at https://www.fbi.gov/news/stories/2015/august/business-e-mail-compromise/business-e-mail-compromise