Grant v Marshall

Case •

[2003] FCA 1161

•

19 SEPTEMBER 2003

FEDERAL COURT OF AUSTRALIA

Grant v Marshall [2003] FCA 1161

INGEBORG LUISE GRANT v ROBIN MARSHALL & ORS

N1038 OF 2003

EMMETT J
19 SEPTEMBER 2003
SYDNEY


IN THE FEDERAL COURT OF AUSTRALIA

NEW SOUTH WALES DISTRICT REGISTRY

N1038 OF 2003

BETWEEN:

INGEBORG LUISE GRANT
APPLICANT

AND:

ROBIN MARSHALL
FIRST RESPONDENT

BMP TRAVEL & TOURISM GROUP PTY LTD
ACN 097 407 433
SECOND RESPONDENT

DIANE MARSHALL
THIRD RESPONDENT

COUNCIL OF THE CITY OF WILLOUGHBY
FOURTH RESPONDENT

COUNCIL OF THE MUNICIPALITY OF MOSMAN
FIFTH RESPONDENT

JUDGE:

EMMETT J

DATE OF ORDER:

19 SEPTEMBER 2003

WHERE MADE:

SYDNEY

By consent, upon noting the undertaking of the applicant to pay to the Fourth and Fifth Respondents their reasonable costs of complying with the following Orders, the Court makes the following Orders:

1.That, until further order, the Fourth Respondent, whether by itself, its servants, its agents or otherwise, refrain from deleting, moving, erasing, altering, concealing or tampering with any document or copy of document, whether electronic or otherwise, in its possession, custody or power, which:

(a)was made or dated in the period 14 October 2002 to date and refers or relates to the email address [email protected];

(b)was made or dated in the period 14 October 2002 to date and refers or relates to the identity of any person using a computer to send or receive email:

(i)via an account in the name of [email protected]; and

(ii)from any library in the Shorelink network on 29 July 2003;

(c)was made or dated in the period 4 August 2003 to date and which refers or relates to investigations undertaken by or on behalf of the Fourth Respondent, or any employee of any library in the Shorelink network of libraries:

(i)to ascertain the identity of a person using the email address [email protected] at any time; or

(ii)regarding the I.P. address 203.111.117.212.

2.That the Fourth Respondent produce to the Court at Queen Square Sydney on 26 September 2003 all documents or copies of documents, whether electronic or otherwise, in its possession, custody or power, which:

(a)were made or dated in the period 14 October 2002 to date and refer or relate to the email address [email protected];

(b)were made or dated in the period 14 October 2002 to date and refer or relate to the identity of any person using a computer to send or receive email:

(i)            via an account in the name of [email protected]; and

(ii)from any library in the Shorelink network on 29 July 2003;

(c)were made or dated in the period 4 August 2003 to date and which refer or relate to investigations undertaken by or on behalf of the Fourth Respondent, or any employee of any library in the Shorelink network of libraries:

(i)to ascertain the identity of a person using the email address [email protected] at any time; or

(ii)regarding the I.P. address 203.111.117.212.

3.That  until further order, the Fifth Respondent, whether by itself, its servants, its agents or otherwise, refrain from deleting, moving, erasing, altering, concealing or tampering with any document or copy of document, whether electronic or otherwise, in its possession, custody or power, which:

(a)was made or dated in the period 14 October 2002 to date and refers or relates to the email address [email protected];

(b)was made or dated in the period 14 October 2002 to date and refers or relates to the identity of any person using a computer to send or receive email:

(i)            via an account in the name of [email protected]; and

(ii)           from any library in the Shorelink network on 29 July 2003;

(c)was made or dated in the period 4 August 2003 to date and which refers or relates to investigations undertaken by or on behalf of the Fifth Respondent, or any employee of any library in the Shorelink network of libraries:

(i)to ascertain the identity of a person using the email address [email protected] at any time; or

(ii)           regarding the I.P. address 203.111.117.212.

4.That upon his giving an undertaking in the form attached to these Orders (Annexure B) the Fifth Respondent provide Peter Chapman with access to the hard drive, and all copies which have been made in the period 5 August 2003 to date of the hard drive, of the computer which is associated with IP address 203.111.117.212. for the purpose of enabling the process described in Annexure A to these Orders to be carried out.

5.That the Fifth Respondent produce to the Court at Queen Square Sydney on 26 September 2003 all documents or copies of documents, whether electronic or otherwise, in its possession, custody or power (other than the hard drive of the computer which is associated with IP address 203.111.117.212.), which:

(a)were made or dated in the period 14 October 2002 to date and refer or relate to the email address [email protected];

(b)were made or dated in the period 14 October 2002 to date and refer or relate to the identity of any person using a computer to send or receive email:

(i)          via an account in the name of [email protected]; and

(ii)         from any library in the Shorelink network on 29 July 2003;

(c)were made or dated in the period 4 August 2003 to date and which refer or relate to investigations undertaken by or on behalf of the Fifth Respondent, or any employee of any library in the Shorelink network of libraries:

(i) to ascertain the identity of a person using the email address [email protected] at any time; or

(ii)         regarding the I.P. address 203.111.117.212.

6.        The matter be stood over to 31 October 2003

Note:    Settlement and entry of orders is dealt with in Order 36 of the Federal Court Rules.

ANNEXURE A

THE FORENSIC IMAGE PROCESS

1.Proper acquisition of computer evidence requires the use of non-invasive advanced computer software specifically designed for the task. Such software recovers, searches, authenticates and documents relevant electronic evidence without compromising the integrity of the original evidence. PricewaterhouseCoopers currently use “EnCase” software, which is the industry standard.

2.The cornerstone of the computer forensics is the ‘forensic image’ process. Quite simply this is the process of making an exact copy of all data, including all Operating System files, application files, user files (including deleted files, data fragments etc.) located on the ‘target’ hard drive. The image retains the identical data structure as it appeared on the original hard disk.

3.        The forensic image process usually follows the following steps:

a)The ‘target’ computer is physically examined to identify its components;

b)The hard drive is removed from the ‘target’ computer and is connected to PricewaterhouseCoopers computer system;

c)The hard drive from the ‘target’ computer system is connected to and accessed via the hardware and software of the PricewaterhouseCoopers computer. The hardware used includes a write blocking device which prevents the alteration of data on the ‘target’ hard drive.

d)An image of the ‘target’ computer is written to the PricewaterhouseCoopers computer as a series of computer files (usually split into 640 megabyte parts so that the image files can be stored on CD). The taking of a forensic image of a standard computer takes between 40 and 90 minutes.

e)The settings of the ‘target’ computer (such as the accuracy of the date and time setting of the internal computer clock) are recorded.

f)The images files are secured on CDs and are verified to confirm their integrity.

4.The EnCase forensic image has an in-built audit trail with a sophisticated integrity validation process. It is possible using Encase software to directly analyse the forensic image, but it is also possible to use the forensic image to restore an exact copy of the computer to another computer and operate the system as a normal user.

5.Analysis of a forensic image is a technical process requiring skill and resources. The vast array of computer software in use requires the forensic examiner to employ a diverse range of techniques to access data in a myriad of formats. Additionally, it is possible that there has been an attempt to conceal evidence with deceptive file names, password protection or encryption. The forensic image allows the examiner to conduct this search in a properly controlled environment.

6.The image process is also enables the computer evidence can be evaluated in the ‘environment in which the evidence was created’. Operating System and Application Software files are preserved so that all steps that the user took to create the evidence can be duplicated by the computer forensics specialist and if necessary an independent examiner. This is vitally important in a case wherein sophisticated programs have been used, such as accounting software, electronic mail and Internet applications, or graphic design programs.

7.The adaptation of imaging to the investigation of computer data, together with the appropriate analysis software, now allows the forensic examiner access to data without fear of altering the original and with minimal disruption to the owner. A thorough search and complete identification of all evidence on a can take many hours per computer, depending on the volume, type and complexity of data stored, and the complexity of the search criteria. Without the forensic image process the analysis would be impractical and invasive.

Forensic Preview

8.It is possible to forensically preview the contents of a ‘target’ computer (that is, examine the hard drive in a write protected environment) prior to making a decision as to whether a forensic image is required. The preview is executed using a similar methodology as described above.  The preview allows the examiner to search the ‘target’ computer for relevant material so that he/she can be confident the computer is relevant to the orders or legislation under which the search is being carried out.

9.The forensic preview is not a substitute for full analysis. If relevant data is located the contents of the hard drive should still be preserved by a forensic image and fully analysed.

ANNEXURE B

CONFIDENTIALITY UNDERTAKING

I, Peter Chapman, of 201 Sussex Street Sydney in the State of New South Wales, Manager,

Dispute Analysis and Investigations, undertake to the Court in relation to data or information supplied to me on behalf of the Fifth Respondent pursuant to orders of the Court in the form contained in Annexure A for the purpose of carrying out the forensic process described in the Annexure to those orders (“the Confidential Material”), that subject to further or other order of the Court releasing me from these undertakings:   

1.The Confidential Material will not be disclosed by me either directly or indirectly other than:

(a)to the solicitors for the Applicants;

(b)for the purposes of Court proceedings (including, for the avoidance of doubt, in giving affidavit or oral evidence);

(c)as may be required by law;

(d)with the written consent of the Fifth Respondent or its solicitors.

2.In the event that the Confidential Material or any part of it is retained by me in my possession, custody or power I will ensure that it is not able to be accessed by any  other person other than:

(a)       the solicitors for the Applicant;
(b)       as may be required by law;
(c)       with the written consent of the Fifth Respondent or its solicitors.

Signed: ­­­­­­­­­­­­_____________________

Date:________________________


IN THE FEDERAL COURT OF AUSTRALIA

NEW SOUTH WALES DISTRICT REGISTRY

N1038 OF 2003

BETWEEN:

INGEBORG LUISE GRANT
APPLICANT

AND:

ROBIN MARSHALL
FIRST RESPONDENT

BMP TRAVEL & TOURISM GROUP PTY LTD
ACN 097 407 433
SECOND RESPONDENT

DIANE MARSHALL
THIRD RESPONDENT

COUNCIL OF THE CITY OF WILLOUGHBY
FOURTH RESPONDENT

COUNCIL OF THE MUNICIPALITY OF MOSMAN
FIFTH RESPONDENT

JUDGE:

EMMETT J

DATE:

19 SEPTEMBER 2003

PLACE:

SYDNEY

REASONS FOR JUDGMENT

  1. The applicant claims relief under O 15A of the Federal Court Rules.  Specifically, she claims relief against the fourth and fifth respondents, the Council of the City of Willoughby and the Council of the Municipality of Mosman respectively, pursuant to r 3.  That rule provides that where an applicant, having made reasonable inquiries, is unable to ascertain the description of a person sufficiently for the purpose of commencing a proceeding in the Court against that person (in the rule called ‘the person concerned’), and it appears that some person has or is likely to have knowledge of facts, or has or is likely to have or has had or is likely to have had possession of any document or thing, tending to assist in such ascertainment, the Court may make an order under r 3(2).  Rule 3(2) authorises the Court to order that the person, and in the case of a corporation, the corporation by an appropriate officer, make discovery to the applicant of all documents which are or have been in the person’s or the corporation’s possession, relating to the description of the person concerned.

  2. The applicant is the Senior Vice-President of the Art Gallery Society of New South Wales (‘the Society’) and has been a member of the Executive Committee since 1995.  The Society is the membership-based fundraising arm of the Art Gallery of New South Wales.  Among its fundraising and member services activities, the Society organises travel tours, through independent travel operators for its members.  On 9 May 2002, the travel subcommittee of the Society recommended to the Society that it appoint Fiorella Travel Pty Ltd as agent in respect of some of the Society’s tours and, on 23 September 2002, the Society entered into an agreement with that company in relation to overseas tours for members of the Society.  The applicant believes that on 14 October 2003 the then owner of that company sold the company or the company sold its business to BMP Travel & Tourism Group Pty Ltd. 

  3. On 29 July 2003, an email was forwarded to a number of people making allegations of corruption.  The email was purportedly signed on behalf of one ‘Robert Menin’.  The applicant knows of no person by that name.  The email makes allegations in relation to the sale of the business of Fiorella Travel Pty Ltd and its arrangements with the Society.  There is reasonable cause for belief that the applicant would have a cause of action under the Trade Practices Act 1974 (Cth) against the author of the emails. Instructions were given on behalf of the applicant for inquiries to be conducted in order to determine the source of the emails. Those inquiries have demonstrated that the emails were despatched from a computer in a library conducted by the fifth respondent. The computer in question provides facilities pursuant to arrangements made between the fifth respondent and the fourth respondent.

  4. I am satisfied from the material before me that it may be possible, by examination of the hard drive of the computer in question, to obtain information that could assist in identifying the author of the emails.  However, those inquiries and examinations may involve contravention of provisions of the Privacy and Personal Information Protection Act 1998 (Cth).  On the other hand, s 25 of that Act provides that a public sector agency, which would include the fourth and fifth respondents, is not required to comply with certain provisions of that Act if the agency is lawfully authorised or required not to comply.

  5. The applicant seeks orders that the fourth and fifth respondents refrain from deleting or erasing material that might assist in identifying the author of the emails.  She also seeks orders for the production to the Court of material that might assist in identifying the author.  She also asks that access to the hard drive of the computer be given to a computer forensic expert upon an appropriate undertaking being given.  An undertaking has been given by the applicant to pay to the fourth and fifth respondents their reasonable costs of complying with the orders sought. 

  6. The fourth and fifth respondents do not oppose the making of orders under O 15A r 3 so long as certain safeguards are adopted.  Those safeguards include an undertaking of confidentiality to the Court by any person who conducts any examination of the hard drive of the relevant computer and any material that might be produced in consequence.  The order for access to the hard drive requires an undertaking to the Court by the expert prior to access being given. 

  7. In the circumstances, I consider that it is appropriate to make the orders sought by the applicant. 

I certify that the preceding seven (7) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Emmett.

Associate:

Dated:             21 October 2003

Counsel for the Applicant: L McCallum
Solicitor for the Applicant: Baker & McKenzie
Solicitor for the Fourth and Fifth Respondents: Pike Pike & Fenwick
Date of Hearing: 19 September 2003
Date of Judgment: 19 September 2003
Actions
Download as PDF Download as Word Document
Cases Citing This Decision

0

Cases Cited

0

Statutory Material Cited

0