Speakers

J Justin Tolman 00:11

Welcome to this episode of FTK over the air the first one of 2023. So we are here. Yeah, we just came back from the holidays, the break for us. And so we're back into our schedule of releasing episodes. And Lynn, you're here you're healthy this year, how was your holiday?

L Lynne Roossien 00:35

I spent Christmas was great. I spent New Year's Eve, sitting in my chair and not doing anything that could compromise my safety. Because if you recall, a year ago, on New Year's Eve, I fell through the ceiling, cracked my spine had emergency spinal fusion just for fun. So this year, I was not taking any chances. And I sat very still all day long, and didn't do anything. Anything dangerous. And I made it through so that's a win. Well, we're How are your holidays

J Justin Tolman 01:04

are good. I, I didn't fear falling through the ceiling. But you know, just took it easy. And I think it was just the perfect amount of time. Because I think as it got towards the end, I was like okay, like I need to get back in start doing something. Because it was just starting to

L Lynne Roossien 01:25

get a little stir crazy. Just kind of sitting around at the at the end of it. Right. Yeah,

J Justin Tolman 01:28

it was my life was starting to degrade. And I think. Yeah, so. But yeah, so we're back. With an episode, we're back to work. So we've got YouTube stuff. We've got the podcast. And we've got a lot of cool stuff scheduled for 2023. This year, I think, with the software and with forensics in general. We can't talk about that yet. But it's gonna be a

L Lynne Roossien 01:54

secret, but it's a big fun secret that we can't wait to reveal very soon. Yeah,

J Justin Tolman 01:59

so we've we've got a lot of good stuff. But today we're going to talk with Jason Fisher, and Lynn who is Jason Fisher.

L Lynne Roossien 02:12

Jason Fisher is one of the nicest people I think we've ever had. Like, there's the nicest, coolest guy. I want to be friends with him and he just lives so far away, so it's probably never gonna happen. Jason Fisher, he is the Director of Information Technology at the federal Defender's Office in New York Federal Defenders of New York. I'll give you a little bit of his bio he earned a bachelor's degree in history from the University of Florida. Go Florida love it. He got a master's degree in poli sci from Florida Atlantic University, FAU also amazing school. He made it out of Florida live after all those party schools. So man good on him. He's and he's so intelligent and so clever. Yeah, he's great. So he's been working in the field of ediscovery, and digital forensics for over 10 years. The Federal Defenders of New York has actually it's as we know, they're a nonprofit organization. As of right now, he said, they're nonprofit, they're actually not government employees. They're just a nonprofit organization. They defend clients in the southern and eastern districts of New York. So when we think about the public defender's, right, like, what do we all think about? Oh, we watch, you know, Law and Order Special Victims Unit, and we watch all these legal procedural shows on television. And, you know, Olivia Benson and detectives, and, you know, they're dealing with attorneys, and you think a lot of those people, you know, that they that they criminally apprehend on those TV shows, might get a Federal Public Defender because, you know, they just stabbed somebody and they're probably not don't have an attorney on speed dial, maybe they should. But so we think about it, it's such a glamorized way. I mean, even on TV, you know, there's the sort of make it known that, like, the federal defenders are like, Hey, this is my job, you know, I'm assigned to try to defend this person, you know, based on whatever they'll admit to me, I do the best I can to, you know, to negotiate, you know, the best fair sentence or deal for them that that everyone seems to want to agree on. But you know, it's still television. And you know, everything just gets wrapped up nice and neatly with a bow on it after 60 minutes. And real life is not like that at all. And so I think you know, the big takeaway after you listen to this conversation with Jason is yeah, it's hectic, man. You know, there's so many so many cases going on simultaneously. They they don't always have all the resources that they need because they're not a big gigantic huge, you know, law firm or corporate in house legal department that has big money clients, right? They they are a nonprofit organization and and affiliated with the government, but not necessarily government employees themselves. So they're in they're in kind of a funny spot where they really have to make do with with what they have and they and they certainly do a lot with it. but they have he actually so it his office that he works for what were some of the big cases that his office was involved in recently. There's some big ones.

J Justin Tolman 05:09

Yeah. So he worked on the Cesar sayoc Mail bomb campaign.

L Lynne Roossien 05:15

And oh, that was just in what 2019? That was only a couple years ago.

J Justin Tolman 05:19

Yeah, it all it all runs together. And then you got the COVID mixed in there. So but yeah, within,

L Lynne Roossien 05:25

you can't you cannot mail bombs to political figures now, because you don't like them. We learned that from

J Justin Tolman 05:31

him across the line somewhere around there. The Joshua Sheltie vault, seven CIA WikiLeaks stuff he worked in in relation to that. So he's not a stranger to high profile cases, say folio Osipov, ISIS inspired attack, he also was associated with that. And so a lot of big things going through there. And of course, the south eastern, southern and eastern side of New York is the big side of New York. So a lot of stuff is hosted there. In fact, I wonder if he'll be working the FTX big fraud case, I think he's going to be worked out of the New York area there, the Manhattan area, so who knows, we'll have to get back with him and see if we can get details on the crypto fraud going on as well.

L Lynne Roossien 06:28

We're gonna have to start a group checks with Jason. That's yeah.

J Justin Tolman 06:33

to adjudicate and then call up, Jason. But yeah, I learned actually a lot of stuff talking to him in this episode, because I've actually worked with an A training capacity, the federal defenders, since I came on with access data years ago. And there were things about how they function and the types of cases they work. And some of the problems and, and solutions they do that I didn't know about, even you know, I've run probably eight or nine week long events and classes with the federal defenders over the last few years, talked with a lot of them. And this was really educational for me just on how they operate. And as you mentioned, like some of the TV shows most of the TV shows like CSI, or law and order, they focus on the prosecution side. Because that's where a lot of the problem solving is right. And maybe a lot of the narrative, but we don't often see what happens on the other side. And so it was it was good to sit down with Jason and, and talk about what he does and how he does it and how things happen. And it was it was really cool. So

L Lynne Roossien 07:40

yep, and I think the key is, you have this is doesn't even matter who we're interviewing and who we're talking to. But the problem number one problem always is, we have so much data, we don't even know how we're going to get through it. Right? It doesn't matter if you're a corporation, public sector, you know, law enforcement, like whatever, whoever you are, whatever you're working on everyone's common challenge is I have so much data, and I don't, I don't have enough human beings and or even sometimes technology to be able to crank through all that data fast enough, so I can find what I'm looking for. So yeah, Jason kind of shares a lot of his, his, his workflow secrets on you know, I'm, I'm receiving some phones from some criminals. And I don't even know what I'm getting. I'm not sure until they just show up and hand them to me. And I don't know if that phone, you know, has half a terabyte on it or multiple terabytes on it. Like I don't, I just don't know what I'm walking into. And so I have to use the tools in my toolkit to be able to get as much as I can off that phone. And again, do you get everything off the phone? Do you just look for certain things and get a filtered collection off the phone? Like you share some good, some good wisdom with us on you know, how do you get through that as quickly as you can to meet deadlines? And, you know, to hit your objectives for your side of the case? Yeah, you've got a lot to do.

J Justin Tolman 09:05

Yeah. Whether you're whether you're working for law enforcement on the prosecution side, or defenders on the defense side, of course, there's no shortage of work. No shortage of cases, no shortage of work and no shortage of data. So yep.

L Lynne Roossien 09:23

It was really cool. So but he's doing it all he's doing it all with with with a smile and that clever little wink in his eyes, so make sure you watch us on YouTube. If you're only listening to audio. You guys are missing out. You know, we do this on video. If you go on YouTube, and you go to zero media, and we have an entire podcast series. We have what this is 19 episodes now we've got almost 20 episodes. Most half of those are on video. So yeah, totally adds a little bit more to the conversation where you can see and hear our guests and and hear their story and watch Some tell it so yeah, he does everything. He's pretty. He's cool as a cucumber man. It was really fun to talk to Jason. And yeah, if you if you're a bit an audio only listener, thank you for that. Totally give it give the video a shot, you might find that you like that even more. Perfect. Either way. We're glad you're here.

J Justin Tolman 10:17

Absolutely. Well, thanks, Lynne. And let's jump over and have a chat with Jason. Okay, we're back with Jason Fisher, who is the Director of Information Technology with the federal defenders out of New York. Hopefully we've all heard of that state. And, Jason, welcome. Thanks for jumping in. How are you doing today?

J Jason Fisher 10:49

I'm doing great. Thanks for having me.

J Justin Tolman 10:52

And, Jason, here's I want to give a little bit of background first off, you and I met at Tech know, we had some cool conversations. Hopefully you got a pair of socks or something. Well, you came by the booth.

L Jason Fisher 11:03

The contigo water bottle. Oh, yeah. Give us Yeah, cool, cool score.

J Justin Tolman 11:12

But as we talked about, like, it's interesting, because my one of my very first, if not the first time I taught on the road FTK. And forensics in general, was at a federal defenders conference in Denver, way back in 2014, or something way back. And so when we ran into you at Tech knows, like, oh, man, this is like, this is cool. I don't we don't see very many federal defenders at these things. So Jason, tell us a little bit about how kind of your story how you got into this kind of role that you're in and what motivates you?

J Jason Fisher 11:50

Well, thank you. Um, yeah, it was good to meet you there too. Glad to catch up with everyone. It's my second techno as it was. So it was good to be back. I got into this industry in 2010, I moved up to New York and Florida after getting a bachelor's degree in history and a master's in political science. I worked for a vendor, right as I moved into the city got a job that just basically dealt with all the lifeblood of what law firms deal with right paper, printing, copying, scanning, hosting material, digitizing material. So I got to go run around in New York for a few years, picking up all the boxes, and hard drives from all the big law firms in the city and going through the freight elevators and bringing things down, gotten to learn that side of it, how we've handled the material and relativity, how we ingest and deal with all the different hosted platforms and just how to, you know, make money off this side of, of e-discovery. So that was a really cool time, it was a fun experience. And then I from there worked my way to a law firm to see how they did their work. And it was an interesting experience there as well being on the other side of how that gets sent out to vendors and how we get to play around with all the different tools because vendors would come in and say use recommend or using, you know, ringtail or easy review. I haven't touched any of these in like seven or eight years since leaving law firms because of the federal defenders. We don't have a lot of money for these. We're nonprofit government agency to a degree. We're non government, but a nonprofit. And we we take cases from the courts, for clients or who cannot afford attorneys. So I moved over from the vendor to this job, because I just saw the opening, I thought it was a really cool place to just grow and try new things. And I liked the mission. I thought this was really needed and important. And someone should be checking the work and making sure this is all done properly. And so it was just it was a good transition over there in 2015. And I've been there since.

J Justin Tolman 13:45

Oh, so that's that's really I didn't realize so you guys are kind of you you work for the government but are not government.

J Jason Fisher 13:55

Yeah, exactly. We're not government employees, at least this this version of the federal defenders. The third letters in New York specifically, there are other versions of federal offenders in each state. Each one has their own guidelines, issuances, just depending on how they have to are actually unworking for the federal government work community. Sorry, CTO, I forget what it is. Forgive me, I forget specifically what it is Community Defender organization. There we go. Like I said, I tend to ramble a little bit. So we get to operate a little differently. We cover the Southern District of New York in the Eastern District. So again, we're a little different that we're a hybrid of two different districts. And we cover four offices specifically. So it's a wide range from White Plains to Manhattan, to Brooklyn to where I'm at today working in the central Islip office. So yeah, we have just a lot of ground to cover.

J Justin Tolman 14:44

Yeah, and no shortage of work when you have that much geography

J Jason Fisher 14:50

and a lot of hype and a lot of high profile ones too. So it makes it just always something comes up and you know, from the just a tabloid story that's probably going to be ours. That's probably Yeah,

J Justin Tolman 15:00

yeah, you can you can look forward to, to work in that.

J Jason Fisher 15:04

So what are gives away? What probably would be my client sooner or later? And it's sort of fascinating to see like, oh, yeah, I can see this happening soon.

L Lynne Roossien 15:12

Like the great the great Oracle for your job. Yeah.

J Justin Tolman 15:15

When you're like, Oh, it'll be interesting to look through their stuff. That was always yes,

J Jason Fisher 15:19

I get this coming all the time. We're in the yes, it's quite a we have Joe. There's a lot of gallows humor and jokes just about the entire, like scope of what we deal with in mitigation. And just from where the discovery is, and, you know, you get it from and other law enforcement has that same field as well, of what the case is they because we see the same thing they see. Yes, there's a lot of Silicon Valley and is to this absurdity.

J Justin Tolman 15:45

Oh, yeah. So speaking of, well, less of Silicon Valley, but more about the things you said right before that. What's kind of like, obviously, every day is different. That's actually one of the reasons why I loved forensics. Is it even if you're working the same type of case? It was different every time but what in general? Like? Is the your roles day to day like, how do you approach each investigation or each case or whatever,

J Jason Fisher 16:12

a lot of it. So each case is different right off the bat, my day to day in my in my case, work is sort of different. I have a hybrid role as I'm the director of it, which means I also do printers, setup, new computers onboarding, deal with management type miss things that have to have for new employees, all the fixing of the swipe doesn't work for the door on top of casework. So, it can vary from day to day, right. So but on a typical cases, a lot of it's just like, I'm brought discovery on cases, and I'm asked to help and assist, we have somewhat of a good way of just ingesting that stuff coming in. And if only I need to really see it, does it come to me? Or if there's questions. So a lot of it, of course, the Celebrate based any forensic images come my way, just for the data size itself, and the tools that would be needed in the licenses. So that stuff just comes my way. Anything these go through axiom or FTK would just of course, come my way. So it just it really varies on what data set is and what the priority is and what you're looking for. And you know this again, I got a request today for five terabyte drive. And it's just Can that be split up? No, of course not. Because it's all one as it should be. So you need a five terabyte drive to probably give me a forensic image that I either need to copy somewhere hosts somewhere, then process somewhere. And this is all time, this is all just days, equal weeks, and then to give you some information, and without ever speaking to the client on most of these, so I'm I'm less sort of in the dark on a lot of where I'm going and what I'm looking for, which isn't to say I can't find information, right. There's the indictment. There's the complaint. There's affidavits I can scour for that. But oftentimes, it's difficult to communicate with client me directly. And I think one of your discussions was earlier with me it was at you know, how do you get them to trust you or give you information? I you know, I It's a whole nother level of like, do they trust the attorneys and not lie to them? I don't know. And I'm just going with what they tell us? Yeah, yeah, go on.

J Justin Tolman 18:04

No, that's, um, it's so interesting, because it's always the same problem, no matter where you're at, where they're like, Hey, we've got this five terabyte drive, but they have no idea what that means. So they're just like, hey, can you do this? And you're like, five terabytes is a massive amount of data and stuff to deal with? And so like you said, it shipped this time.

J Jason Fisher 18:24

What are you looking for there? Every in on the the reverse side, right. Government is often constrained by search warrants, date, dates, a big issue time, what they're looking for, as a small subset of material. I'm minds very much open ended. We can mitigation stuff before, after the key events, we need to look at everything. And so you're left checking off every conceivable bog knowing this is going to take forever, but just you know, let me see every artifact there is because I don't know what I'm looking for. Versus if you only want the video, this will go a lot faster. If I only want the video.

L Lynne Roossien 18:56

If you don't know what you're looking for. What do you have a routine of where you start? You know, do you have a Do you have? Do you have a repertoire of like, okay, well, I always start with email, or I always start with photos or always start with video or like, do you ever give a so

J Jason Fisher 19:11

in this, in this setup, I wouldn't hypothesis I would use using celebrate or something in which I've already got a process report to look through, I'm not going to deal with having to process the data, and then look at it. So yeah, based on what I always do, I can always go to images timeline, database is a key one, what databases were polled. If this is, you know, always key to me. I think I'm not going to speak ill of the other side too badly. But like, I think they skip over the databases. And I think they just don't look at the stuff. You know, they're happy with what celebrate has given them in the Analyze train like this is good enough. I've got these text messages, but there's also this wealth of information that is there or not there. And you can make some good inferences based on what you don't see in the databases. So I've often found they skip over those in key cases. And I think it's interesting that they didn't point those out or find them considering it's right there. I'm also left with on a lot of celebrate stuff, phone stuff, specifically, I hate to go back to it, but this is just the half forensic world we're in is just phone stuff. And I'm left with oftentimes just really getting reports, you know, oftentimes they don't get the full extraction unless we, you know, make a point to get that some agencies, some departments will give that routinely, but others don't. So I'm just left with what you've checked off to be significant. I'm not saying it's not the full report, but I have no way to know that I don't have the real data. So I'm just left to make my calls based on Well, this is what's in the DSM, this is what's here is what's here. And just help analyze it for the for the attorneys make sense of, you know, the information and what would be a user controlled, you know, instance, or just that just showed up because it's in the cache. You know, Google reverse image says that pictures of gun is actually just from the Washington Post, like, I don't think this is important.

J Justin Tolman 20:54

It's not. You know, that's interesting that you say that, because we, and I say we, and I mean, like, I don't feel like I'm that old timer in the forensic world. But I do think there's a movement a thing, and I think it's been forced, based on case loads versus time available, but it's very pushed button, we're kind of moving to a very push button. So like you said, Hey, I push the button on the tool, it's going to spit out what it spits out. And I'm going to go with that. But like you said, there is so much information in the databases that may or may not be there, or I like what you said, where it's like, hey, the lack of stuff can can infer information as well. And so it's really interesting that we are kind of moving that way. And I wonder it's gonna, it'll probably last as long until some high profile cases lost due to something I mean, like high profile to where it causes a culture shift on the on the kind of the prosecution or law enforcement side or whatever you want to call it. So I see that was

J Jason Fisher 22:02

a recent on this sort of collect everything push that was going on for a long time. I think there's been an acknowledgement by the other side by the DOJ and they're in their prosecution offices, like let's not go out, grab everything at every site, we don't have the space to store it, I'll turn it over discovery. And properly do it all its target this because they're just grabbed. And not to say that this was wrong, but it's turning into so much data. Now. I've seen a half terabyte Android recently as a extraction like, come on. It's just so much I sat fly to do a ccm case yesterday in the Eastern District. And I you know, asked them to schedule it earlier in the day specifically because there was I knew was five phones and I had no idea size and I feeling that I at least see one or 200 Gig extractions. And just to sit there opening each one would eat up and you know, just the time involved in opening all five is an hour so can I please like start sooner open them all up so that I don't sit there waiting on a progress bar for the half a day. Progress Bar waiting.

J Justin Tolman 23:05

That's the secret of forensics man, that's all work is is watching that progress bar moved from one side of the screen to the other for the trace window.

J Jason Fisher 23:12

Is it moving? Yes. It's moving. Okay, sitting here. Yeah. Yeah.

Lynne Roossien 23:17

So then what is your feeling, though? Because right, which I mean, even for us, at our company, and everywhere, you know, there's always a hot buzzword every year for technology. And it's automation, automation, automation. Let's automate everything. Have you guys dipped your toe in that water yet of like, Man, I do have a crapload of data? How the heck am I going to do this as a human being? Like, have you gotten really constrained by

J Jason Fisher 23:39

the resource issue is that it's just the cost and money in our offices, you know, we our budget comes from Congress. So we use it effectively for you know, for hiring for resources for technology upgrades as needed. But to give the money to a vendor for some AI or some specific high tech, you know, I'd love to bring in like, say nuix to do something, some processing in house, because I do get a wealth of stuff in the forms of PST, S and M boxes and all this I have low level e-discovery tools that can do some of this, but I'm limited at maybe half a million documents before I need to start a second case because it can't handle any more. You know, I'd love to actually do some really good stuff. But these the licenses are so cost prohibitive. And we're not a money making enterprise. So this can't just can't be spent that way. I have friends that are still at law firms, other vendors and I talked to him and it's quite funny because they just have the resources to do stuff. No, can't do that. Can't do that.

J Justin Tolman 24:35

Yeah, it's a little harder to pass your cuz I know. I'm like, like Lynn said, former forensics, we talked about it. And next Tara was e-discovery. So this has really broadened my view of the e-dscovery side. And it's just like any cost that a lot of these big law firms and legal agencies have they just pass to their client like hey, if you don't want us to do this, well, it's going to cost you this. When you work public sector or With the public sector, there's no client, you can I mean, you pass your comments to the students base in, you know, life in prison, like, what's he's gonna be like, What? What do you what do you mean that I'm going to pay? What? No you can't, you know, so it's,

J Jason Fisher 25:13

there's no one to pay the cost to this is how the system is set up, you know, suddenly everyone gets their defense we're gonna go through the system, everyone gets there, you know the right word is I'm gonna check their work I'm gonna get that's how I've always looked at it right? It's just a weird thing. Like, I can only do so much of what they oftentimes just turn over or tell us so I'm really friendly not to say like we're not on a fair footing. But in the same, do the CCM cases I can't do the same work they can do in their lab, I'm somewhat handcuffed in that I'm on their turf, their system, their computer, no admin rights, no internet and barely a license. I can't do much research like they're in their lab, we, you know, as a dual, dual monitors, triple monitors, what are every tool they can imagine most of you know all the high profile suites of of licenses to just be at the data and constantly work with it. I'm here for three hours, I can come back if I want. But like, it's hard to really it's a it's a fair footing. It's not it's just okay. And then you get into classified cases which are worked out of a skiff, which are just another total unfair footing and that this is the system we're all going to play by it. But it's hard to do this job doing a skiff work, you know, just our lack of understanding of what you can ask for and what they turn over that comes up with with the attorneys just don't know what they should be asking for or looking at, and what's available. So I don't know how to make the system better. It's just sort of its usual gripes, again, back to the CCMS. Re, all I had was a you fed reports I did, I'm sure they had the extractions, but I didn't have the time to load up and bring my own analyzer and sit and load up and just review the raw data sets and load them one by one, to then really analyze that data in the same way they would. I mean, if that mattered in this case, right? It always comes down to like, was it the first picture and the thing that you were looking for? Why would you look any more than that you found the picture, right, and waste your time move on to the next case, which I can see funny voice or just being in their labs and seeing all their toys and seeing their chart, all the charging stations set up with all the phones and their airplane modes, everything's sitting ready to go just really cool stuff. I understand how they have their system, and it works pretty well. But it's just so difficult to not be able to validate some of this.

J Justin Tolman 27:25

It's interesting, because I think one of the, the cool things because it's a problem for you is a lot of these forensic companies are started or at least propped up by former law enforcement individuals. And so they they target the vast majority of their marketing, they're angled towards their their buddies, right? This is where I came from, this is where I'm going. How has that been like? So when I when you talk about like, hey, the attorneys don't even know what they can ask for in that. How has it been? Not from the like budget approval, but just finding training that you can go to that's going to help you in your in your gig and your job.

J Jason Fisher 28:11

I think that's been that's been, I think that's really positive, I wouldn't say anything negative on that side, the vendor has been more than willing to work that's at their heart, their sales companies. So any new accounts, you know, new revenue, so they've been really helpful, I think, have not had any issues with any of them. As far as teaching me the software teaching my you know, the other analysts, the software, even volunteering to, you know, the other user summits and setting that up and going to those. I've, you know, when I've done the Celebrate trainings, it's been an interesting mix for the early classes, because 90% of them would be law enforcement. So you'd get the Raise your hand if you work with the defense, and I'd raise my hand and you'd get the stairs and whatnot from people like you do with defense. Why are you here, but I think there's just nothing, nothing negative, from least from the tank trainers or teachers, they were all really helpful. And I think not to just disparage any of those cops, but I know that they the local offers a lot of them, especially for the CCO CCB going through the motions for the test, and I get it, I would say there's no reason to like do it. If you're not going to Casa, you know, during the advanced classes, you don't need to know about SQL like databases, that intuitively it's fine. But I enjoyed, you know, doing that class and just taking notes and learning and picking the brains instructors trying to learn as much as about graykey Because that's, you know, one of the ones that won't work with us. But seeing how that works, because we do see that the back end of those abstractions just never good advice.

J Justin Tolman 29:32

Yeah. Well, that's that's good to hear, though, because like I said back in, I think it was 2014 or something like that. When I went out to Denver and was working with federal defenders. At least way back then. They mentioned how hard it was to get training and I know a lot of like the message boards and stuff. You have to be law enforcement and like there's discord channel now and you have to be law enforcement. And so there there is kind of this gated community that kind of hold spec some of that information,

J Jason Fisher 30:01

I won't say that you're wrong. And then I didn't come into the federal financial 2015. So yes, that may be how things were looked at and felt for a little while. I recall going to techno and listening to this individual speak at length about Tor and some other stuff and a bunch of companies like Palantir. But he started as his talk, but raise your hand if you work with the defense. Just a couple of people did just just you know, me and my team won't work with you. Okay, so now I want to pay attention more. Okay. Yeah. Wow, that's

J Justin Tolman 30:29

that's not a good that's not a good way to intro anything. Like, who's from New York? Yeah, you're out? Oh, yeah.

J Jason Fisher 30:36

Yep. That was it. I didn't raise it. I was like, Where was this going? But then I started taking even more notes because it was a fascinating talk on record a future Palantir like Hyperion Gray, a bunch of companies, which in 2016, I'd never heard of are very few are in the news, but now much more in the news with what they're up to. And their profiles have gotten bigger. Love to do some of the stuff with those companies and see what they're up to. But that's not my line of work. Yeah,

J Justin Tolman 31:03

it's that's more hobby based.

J Jason Fisher 31:05

At some point, just interesting anecdote. I remember working on some case, and I, we were getting these giant Facebook page reports, but there are PDF in me 80,000 page PDF, PDFs, and his Facebook, which originally probably an HTML, but they dumped them as PDFs is, like, how are you dealing with this? Maybe 500 megabyte but 80,000 page PDF that was unsearchable. And the remark from their analysts was oh, we just use Palantir. I was like, Well, I mean, obviously, I would, too. That sounds awesome. I don't have that tool. That cost a lot of money.

J Justin Tolman 31:39

Yeah, that's always the always the trick. I just wish we we were dealing with Facebook weren't returns and stuff like that. And I hated the PDF format, because you'd have these like chat messages or one searchable. Yeah, you can't search them. For them. You can't like, hey, I want to filter based on LinkedIn. Well, it's a PDF, there's no filtering, there's no like, it was you're

J Jason Fisher 32:05

getting the search index crashes after halfway through it just it doesn't work. HTML is only slightly better. But it's like, Why can't Why is this not a database? Why is this not an Excel that's I understand that pictures and it gets, but like, you could get me something that would be sortable and dateable. And you don't, it's the same for Instagram. And it's just so bad because they're the same company. I could rant about the would like the A to Z subpoena return that I see all the time, from like a big case when it's just you open it up. And it's Oh, man, it starts at Amazon. And it goes all the way down to like Verizon, and it's just 100 companies, all their returns from subpoena and search warrants. And it's just a mix of Excel PDF, you know, we're just, uh, so you know what, embark, but the Google returns, I had a case recently with 440 videos inside 400 zip files. It was from YouTube. It was, I think 500 gigs or something. He was just so. So Matt Johnson, whoa, that does not matter. Because what is this? How is this? How is this useful? If anybody thinks, yeah.

L Lynne Roossien 33:11

My question is, then, okay, so we know that there's your sort of hamstring by, you know, lack of budget, and, you know, you don't have all the pretty shiny toys that everyone else has. So my like, the part that I always am fascinated by, and anyone, I guess who works for public defenders, whether you're an attorney, whether you're it, there's something inside of you, that's like, I would do this work anyway. Yeah, I don't have all the fancy toys, but like something about it, like makes you come in every day. You know, you you have this whole geographical range you're supposed to cover right? It's not like you just have this little area like you have so many challenges. But is it just love the forensics? Is it love of helping people like what what is your why your reason why, right? Because you have so many challenges. So how do you how do you keep going, it's a

J Jason Fisher 33:57

really good office, I love all the people that we work with, I do love doing all the work we do, like get to go and sit and trials sit part of the court. And that's one thing we talked about as I for a long time before we started having paralegals do a little bit more of this, I would do the trial director of PowerPoint presentation through the trial. So I'd say that, you know, the counsel table through the whole trial and, you know, show exhibits through the entire trial and sit there through that. So I get to see that end of it. It's just a fascinating worldview of just the whole, it's the legal system. I like being a part of the people, we work for co2, but the cases are just fascinating. Trying to hunt for this stuff, look for things, just the challenges with every single different piece of material and just seeing it out all works. I have my background being in history and politics. This sort of fits in in the nexus of, you know, the Southern District history of just the legal profession there and what you have the cases we work on in cases we do. Just a fascinating like World of just the last stuff from the last six, eight years of the Trump era and whatnot and the case is generated out of the quarter. Just across the street from me and seeing all the craziness and being a part of it all in some way in some of the cases we represented, so yeah, it's been a really cool job. And I don't know that I'd leave it anytime soon. So.

L Lynne Roossien 35:12

So this is a question for both of you. Do you guys? Well, just I know you're not doing this work now. But did you? Do you still get the butterflies of like, Oh, I found something. I'm looking through all this data. I'm doing my forensic review. Like, ah, I found something right. Is that still exciting for you? Jason?

J Jason Fisher 35:30

Yeah, I'd say yeah, I do enjoy that. It's always been cool to find things and just notice and discover, yes, I'm wanting to jump up from my desk when I found something interesting. That I didn't think to see and go tell somebody is like, you don't believe what the this was in there. And this is, this was the password, what do you know, just, you know, usually, unfortunately, a lot of it is is not helpful, because of the nature of our cases. A lot of it is just like, alright, at least we know, the bad fact versus not knowing the bad fact. And so that's sort of Yeah, it's like, Darn it.

L Lynne Roossien 35:59

That was gonna be my next question is like, what do you do? What do you do when you find it? Are you are you a vocal exclaim? Or are you like, cool man found it noted? Or are you like, Oh, my God, you know, everyone always has a different reaction to how they, you know, find exciting versus

J Jason Fisher 36:11

there's something on my desk, and then run out to tell one of my colleagues, as soon as like, you'll never believe how he had this, you know, this case was this. And, of course, in this layer, and this layer, they did that. And it's sort of like reading ISIS chain and a little bit when you see how the, the someone asked for help on there. When someone law enforcement, I need help, and then through the Eureka steps that people offering support, and they come up with, Okay, here's how I solved it. It's like, Oh, that's pretty interesting how he did it, because that's, he had no passwords at all, they still manage to do it. Like, that's really cool.

J Justin Tolman 36:41

Most people in forensics, regardless of their industry is kind of like I either went to school, just for computers, and then I got into it, or if you come through the law enforcement, they knew how to check their email. And so they're just like, hey, you're in it now. And, and you kind of came through it where like, you don't have computer based degrees, you went into this legal environment and kind of snaked your way across this huge landscape. And in here you are, what how did that kind of shape your view of it as you go through an investigation? Because you have this holistic view of the justice system?

J Jason Fisher 37:17

It's that's a really good question. So there's oftentimes I have conversations with people that work in still in law firms, and they can't wrap their heads around not getting a load file and Bates number produced a stuffer. And I'm like, no, no, no, no, you don't understand. They just dump everything at me not to say that this is wrong. But this is just the system we live with. I make it like when I said the subpoena return search warrants. I'm right. It's like that may be Bates numbered material that may not be that may have file names that are original. That may not there is no cross reference. I don't know if I got everything. I don't know if they get it. Like in civil discovery. It's a fascinating like, each side must produce according to specs, it's all laid out. It's all mutual. And if the one side is withholding, there's fights on all fronts. And it's very, instead, we're, we just assume we've gotten everything. They're not without it. And so it's not, it's a very interesting, and there's the lack of more clear cut organization, that they oftentimes do give indexes. And so there is some cross reference. But in terms of like the breakdown of what every single file is, that's not the case. I don't get a preference for reference for every file name matching what that should be. Like I said, is it Bates number, is it not? And so I often I can look at it from like that perspective of, here's how I know the other side of the world, this would be acceptable, here's what they're giving to us now. And here's like, I can make sense of which you know, how they've done, what they've done, why they've done what they've done. You know why I didn't get tiffs because, well, here's why they didn't do this because it was like, in some cases, sec related finance related, you know, coming from banks, it's all going to be produced discovery with concordance load files, well, if it comes from Amazon, it's not going to be that they're just gonna dump you some excels and PDFs that's just how they produce and so it's under you know, my ability to I think understand all of the the lifecycle how it can go back and forth from a vendor back to the Department of Justice and it's back out to us Yeah, has made it just a little bit just seeing that e-discovery to the legal side not even talking the forensic side I had some case recently where they produced to me I don't understand it I got what basically is an extract to do one image but in Bates number tiff they withheld all the all the stuff that can't be tiful produce native excels but gave me an entire like C drive in tiff like why what was it useful man? I couldn't give me the EO one Why would you even process this? What were you doing? And so like yeah, just being able to explain it to the team. Why? What are we looking at? Why is none of these terrible? Well, here's why this is stupid. But this is what they did. They paid money for this.

J Justin Tolman 39:57

Yeah, I think it's so it's It's so interesting to have that, that perspective from both sides because the eDiscovery and forensics are kind of related and they both deal with data, but they are kind of worlds apart in the in the way, like to like you kind of describe the front forensics is the Wild West compared to e-discovery. Because everything is like, Okay, you will give us this and you will give us this and it will be in this format, it will be numbered like this. Bla bla bla bla bla, are we in agreement? Yes, shake hands, whatever. Forensics is like, here's your email one JSON piece out. Yep. Just like,

J Jason Fisher 40:32

whose one is this? Who's the profile? I have no idea. Like, we've says so and so Van Gogh. But like, that's not the clients name. Who is this? They've know it? You know? Okay, just running blank search terms.

J Justin Tolman 40:46

Yeah, yeah.

L Lynne Roossien 40:47

But is it your job to be able to remember Justin, we always talked about like placing the suspect behind the keyboard and verifying that this is their machine, and it was them. And they were the one that took the picture. And they were the one that sent that? Like, do you spend a lot of time having to just prove that before you even get into the evidence to make sure you're like, to your point, like, am I even looking at the guy's computer that they

J Justin Tolman 41:08

a lot of what I saw, oftentimes, it's you get into space where I get the data set, and I could, I'd be wanting to look at information into it only to discover a little bit into the case or talking to Attorney a statements already been made, which so it sort of doesn't really matter what I find on this machine where I've got to deal with the fact that they've made statements to the police that probably implicate them in some way. So whatever I do here doesn't matter. So that's often the case and a lot, you know, it's gonna spoil it in a sense, but that's often the case in a lot of it is that people do speak to when they're when they're, what's the word I'm looking for? Under questioning, they do talk, they don't ask for lawyers. So in that process, they do give up information, which tends to make a lot of what I do in the discovery process not matter. So again, back to verifying what I'm saying that's accurate, that's the radio one. That's it verifies the MB five hash. Doesn't matter whose This is now, is this gonna go in a drawer? Okay. So yeah, it's it's really a case by case you know, we putting them behind the phone is, I think we do on phones a lot more, right. These days? I definitely do. So it's oftentimes like is that the right Apple cloud is that the phone number that matches the CDR, and then that's the call detail record. And that's, you know, likely their device, there's, there's their picture, it just sort of all mapped out. Computers are leaner, like I agree with you, it's harder, but usernames, things like that profiles will just tend to ring out logins. So easy to figure out depending on not getting like 20 or 60 hard drives. We had some case which thankfully I don't have to look at. Guy was extradited from Romania or colonial Colombia, he's Romanian hackers something or another. They asked for 20 or so terabytes of drives I ended up looking at all the EO ones I pulled all the text files as I was just wanted to see this. He was 60 devices have a range of of USBs externals, internals, whatever you name it, but all 60 eo ones. Thankfully, it's all like in Romanian, so nothing I can really do to help that. And, and so I just laughed at like, what am I? Is anyone gonna look at this? And very likely not. So there's Yeah, thankfully, I could just let those be paperweights.

L Lynne Roossien 43:24

Just you have so many devices, but like, how many devices do you own total?

J Justin Tolman 43:30

It'd be like that. If they hit my house it bankrupt a small Police Department.

L Lynne Roossien 43:35

I don't know. Maybe I shouldn't have asked you that question. And you shouldn't have admitted that? I don't know. But it's too late. Now.

J Justin Tolman 43:40

That's my defense is security through obscurity.

L Lynne Roossien 43:44

No, nothing is made

J Jason Fisher 43:46

sure. This is stupid. I read this in some book, hacker book, but it was funny, I laughed at it. And I could see just the mind numbing work that would be done on the other side was just every flash drive, just buy 100 flash drives, encrypt them all with TrueCrypt put a ridiculous password that you never remember on every one of them and just leave them and just have it you know, like, you'll be there for the eternity. We will see them on the other side. And like we know there's nothing in these but we have to do this.

J Justin Tolman 44:13

We have to do it. I know we would talk about that stuff in the office all the time just have like random encrypted stuff hidden around your house like but you got to put them you got to put the jump drives like in between the mattress and stuff so that like it looks like you were trying to hide it.

L Lynne Roossien 44:27

Right looks real juicy, juicy evidence.

J Jason Fisher 44:30

Jay hit Eastman's house a couple of months ago, they brought the USB sniffing I want to say it's he's been I may be wrong. But the USB sniffing dog anecdote I remember was the dog's name was browser, which I thought was great. It's just really funny.

J Justin Tolman 44:43

I met my first browser browser, USB sniffing dog at the AIPAC conference in Seattle. And I was thinking, man, we've all got this stuff laying around. You must be going crazy, but Yeah, it's kind of interesting. Dogs are very malleable creatures. And it's just like, hey, we're going to teach how to sniff out computer chips and stuff. And so that's pretty cool. But, but yeah, we've talked about that. But yeah, I have a I have a lot of storage drives around. Fortunately, I don't do anything illegal to try to keep them out of my house. So,

L Lynne Roossien 45:19

but not yet. You haven't? Not yet. There hasn't been put on the up and up.

J Justin Tolman 45:24

No, not a big enough motivation yet to do anything illegal, so I wouldn't last long in prison. So

L Lynne Roossien 45:33

Jason, what is the I always like, you know, most people, right lay people. I'm a lay person, I did not work in forensics, I just work at a forensics company. But you know, so we're like, oh, how much of this is really like what you see on TV? Right? I watch all these procedural crime shows on CBS. And you know, I know what you know, I feel like I know what's going on in the real world. But I guess my question is to it and I asked everybody and like since you actually work, like in the trenches, right, not in like the not even in the pretty part, right? But you work in the trenches? What is the most similar part of what you do that is a lot probably like a TV show and what is so completely fabricated? In most TV shows when we talk about forensic investigation, and even even just the public defender's Is there are there like myths and and facts that you

J Jason Fisher 46:23

wouldn't think the CSI one is always the images the video and images clean this up? You know, I've got this black and white video footage from a camera of him walk of them walking down the street, and then just you just have to catch the light. Right? Can you make this better? And not really, there are tools there are some things that I've seen recently that are really cool, but I don't have them and I don't own them. So no, there's not much I can do here. So that's our

L Lynne Roossien 46:47

zoom in on this license plate and magically make it clear it's it's 10

J Jason Fisher 46:51

kilobytes of data there's nothing for me to CSI up there's not enough depth there to write what's the most like TV in the front this one is interesting. I don't I don't think I've got a comparison because it does such a poor job of just displaying what's possible and the times involved like show me a show or the guy is watching a progress bar for like a long time did I like that's accurate? That's really the time that goes are holding the phone up and down and doing all the Android mechanics and to get an Android to route and just yeah because that's in no it's not just plugging now the the break the password this took forever there was a backlog of phones that's not how this works. Can't just jump the line that Greg key has been humming for seven months you know, like it's just they don't understand that I think in the legal world was always blown my mind was on the federal side. It was always that I bring up the the closing arguments in cases which I think is always fascinating, like state court Law and Order is always state court. So it's opening and closing the closing is done by both sides and that's a wrap in federal charges blows people's minds I think it's the fascinating thing is the government goes first for closing the defense go second and then the government gets up again for rebuttal. And that's the end of the case and I don't think people ever who'd ever sit in federal court because there's no cameras no video you don't see trial unless you're part of one. Like oh, wait get to go again. I thought there was so I think the people don't know that I was thought was a fascinating fact. And I didn't know that till I did this either. Just really? Okay. But why? Okay, I even told the reason I still don't agree with it because it doesn't apply. Like defense attorney did such a good job. Can we just end there?

L Lynne Roossien 48:36

I just have this one thing I could just clear everything up if I could just okay.

J Jason Fisher 48:40

Good job. There's song and dance was really good. And they get to go up as Everything you said was wrong. That's not nice.

J Justin Tolman 48:50

Yeah, I think every if TV was accurate, every thing would start with him walking in. And what are you doing? I'm looking for the yellow tip cable for the Celebrate the to frickin swap the Samsung. That was it. Back in the day. Everybody was always looking for that yellow tip. And you'd always find some agent out in the main area charging their phone with it. You're like, No, you can't take my cables. But yeah. Jason, thanks for joining us any as far as closing arguments, do you have any anything you want? This is

L Lynne Roossien 49:26

your chance. We're gonna let you have the last word.

J Jason Fisher 49:29

This is why I'm not an attorney, amongst many reasons why I'm not an attorney. I'm not doing that. I'm not on a soapbox. This is as close to dotcom so thank you both for having me. It's been a fun talk.

J Justin Tolman 49:39

No thanks, Jason, for jumping on and shedding a bit more light on the federal defenders and your workflow. It's been great. Thank you.

L Lynne Roossien 49:46

And I think everyone will agree that thank you for everything that you do with what you have. It's really admirable and we're really proud that we know you.

J Jason Fisher 49:56

Thanks Lynne, bye Justin.