Overview: Using the Tools of the Digital Information Age

In Parts I and II of this article, we discussed the realm of digital forensic technology with regard to the Bankruptcy Code, Bankruptcy Rules and the Federal Rules of Civil Procedure. We noted that a debtor in the digital age is unlikely to maintain paper records. As one prominent commentator has observed: "There are no filing cabinets full of records that are easy to digest. Rather, there is a mass of computers, hard drives, software, CD-roms, etc., from which we have to try to figure out what happened to this debtor."³

Today, a formidable bankruptcy practitioner must be prepared to confront debtors and insiders on an equal-technological basis. Often, this is done with the assistance of a trained digital forensic accounting technologist. With digital discovery now coming of age, it is not surprising that ABI's Annual Spring Meeting includes a panel entitled "Electronic Digital Discovery‹Finding the 'Byte' in the Haystack."

The purpose of this final Part III is to demonstrate, using practical, concrete examples from real cases,⁴ how digital electronic data obtained in a digital forensic investigation can be used in conjunction with the hard copy documents to reveal an accurate picture of a debtor's financial affairs. It is our hope that if you have still not considered the use of digital electronic discovery in representing creditors, the examples set forth in this part will show you how vital and accessible digital discovery really is, and how it must be in your arsenal as you engage in bankruptcy litigation in the 21st century.

Example 1: The Case of the Self-dealing Insider

A chapter 7 business debtor's books showed that a large debt owed by a customer was never paid, and the customer subsequently went out of business. That might have been the end of the story, except that during a digital forensic investigation, a "deleted" electronic fax document was discovered. The fax showed that a key insider was in the process of buying the company that owed the large debt to the debtor. Moreover, the digital forensic investigation of the electronic books showed that the customer had made payments to the debtor that were applied to the benefit of the insider. The digital forensic examination showed that within one month following the payments, someone had "erased" those accounting entries from the books. Ultimately, the insider settled with the trustee for these actions.

How did the trustee and his digital forensic experts break open the case of the "Self-dealing Insider?" Almost all electronic accounting systems have "back doors" that allow for "fixing" and "tinkering" with the books. These back doors into the accounting system will not be found on the accounting system flow chart because they are hidden and provide invisible entry into the electronic books and records. Subsequent "erasures" of past accounting activity are possible using accounting system "back doors." Without the use of digital forensic accounting technology, forensic accountants and fraud examiners are often not able to discover the alterations and erasures made in the debtor's digital database for the books and records. Call it a digital accounting shuffle. The "deleted" fax mentioned a deposit made by the insider for the purchase of the customer's business. Evidently, the customer's payment was used as the deposit. The insider and accountant did what was right only up to a point. They charged the outstanding accounts receivable due from the insider account in the general ledger, but then, using the digital accounting shuffle, they fixed their "mistake" and reinstated the amount back to accounts receivable using this hidden and invisible "back door."

That was all in preparation of the next step in the transaction, because the next day the insider charged off the accounts receivable from this customer to bad debts. The dates of the electronic transactions and original entries were voided and made to appear as if they never took place. The debtor's accountant and computer consultant assisted the insider in creating this "back door" fix. The customer eventually went out of business, but not until after the insider had taken control of the company and emptied its accounts. Fortunately, a digital forensic examination uncovered all of this.

In the digital world, it is easy to hide financial information from auditors and examiners who use only "conventional" means to uncover it. Digital "back door" tools, alternative data streams, encryption and steganography all play their part assisting self-dealing insiders and their accomplices.⁵

Example 2: The Rejected Contracts and the "Lost" Digital Data

It can be easy for a debtor, including a debtor-in-possession (DIP), to "lose" potentially important data and information. This can be done with particular ease if the debtor has leased its computers and other digital devices, and then rejects the leases under §365 of the Bankruptcy Code. The computers and devices are returned to the lessor, and the drives and memory are wiped clean. This can include desktops, laptops, PDAs and other devices from the CEO, CFO, controller and other key personnel.

Bankruptcy practitioners must carefully scrutinize §365 motions to make sure that critical data will not vanish when computer leases are rejected. Too often, trustees and committee counsel do not realize that potentially significant data has been lost in this manner.⁶

Example 3: The Case of the Phony Invoices

For most people, any digital accounting information is easy to accept as the truth. After all, it looks so professional, and the professionals should know what they are doing, right?

In this case, the debtor's insiders created hundreds of fake customer invoices in order to fool lenders into providing large loans using the accounts receivable as collateral. The insiders then used a "back door" to the accounting program and "cancelled out" each of the fake invoices. Next, the insiders altered the digital books so that it appeared that the invoice was never created in the first place. In some cases, the insiders created bogus "credits" showing the same date as the fake invoices, thus offsetting the invoices, which were listing as "errors." Of course, the credits were created long after the fake invoices were made. As a result of these relatively easy steps, the invoices did not show up on the customers' accounts receivable records. Since the invoices and credits were all digital, it was not hard for the insiders to pull off the scam.

In this case, it took an aggressive trustee and a trained digital forensic accounting technologist to uncover the insider's fraud. First, the trustee got control of the debtor's computer hard drives. On first examination of the files, there were no invoices or anything out of the ordinary. Nevertheless, using digital forensic technology, the trustee was able to retrieve thousands of the fake invoices and uncover the fraud. Up until that point, the only thing the insiders had been considering was how much to take and when to file bankruptcy.

Example 4: The Case of the Second Set of Books

In this case, a digital forensic accounting investigation strongly suggested that a second set of books and records existed. You know, the "real" books and records. However, the initial investigation could only find one set of generic electronic accounting software, and the debtor's insiders swore it was the only software they used.

An extensive digital forensic examination of the debtor's hard disk drive showed that a QuickBooks program had been deleted from the hard drive. Why would QuickBooks have been deleted from the hard drive if the debtor never used it? The insiders insisted they did not know how it happened. Later, after reviewing every byte of the hard drive, the forensic technologist found something even more telling: A check had been issued to a computer store with the memo notation for the purchase of the QuickBooks software. In the face of this compelling information, and wanting to avoid more severe consequences, the insiders decided to cooperate with the trustee, and subsequently settled numerous disputes with the trustee resulting in a substantial settlement to the estate.

Example 5: The Debtor Who Changed the Hard Drive

Okay, sometimes digital fraud is easy to detect. In this case, the trustee made a demand for the debtor's computer. A few weeks later, the debtor's attorney turned over the computer.

A digital forensic examination determined that the computer hard drive was devoid of any data relating to the debtor's business. What was even more obvious was the fact that the hard disk drive found inside the debtor's computer was not the original hard disk drive. The debtor had replaced the original hard disk drive with a hard disk drive that was manufactured after the date the debtor filed for bankruptcy! The debtor even tried to move some useless "decoy" information from another disk drive onto the replaced hard drive, but the footprints from this effort were likewise very obvious.

Example 6: The Case of the Frightened Accountant

In this case, the electronic books and records were kept on the debtor's computer. However, the accountant kept the debtor's "real" books and records on the computer in his own office. After some investigation, the debtor's finances just did not add up. It was not that the accountant was suspected initially, rather it was that his myriad excuses and explanations did not resolve the problems with the estate. Increasingly, the trustee was forced to consider whether the accountant was a part of the problem, despite the accountant's repeated denials.

When the accountant realized that that the next step might be a full digital forensic examination of his computer, the accountant gave up. "What will it take to end this now?" he asked. The trustee obtained significant settlement in this case for the estate.

Conclusion

This series of articles has introduced bankruptcy practitioners to the reality of digital electronic data, and to suggest that it will no longer do to assume that all relevant data can be discovered in easy-to-understand hard copy. Financial data is now almost exclusively generated in digital form, and as we have shown, this opens a myriad of avenues for unscrupulous insiders to modify and manipulate data to their own ends. The conventional methods of forensic accounting are insufficient to meet this challenge. Digital data is the reality of the 21st Century, and practitioners who work for trustees and creditors must understand how to use digital forensic accounting expertise when dealing with potential debtor or insider fraud.

In this article series, we have introduced some of the key technical tools and terms, and have discussed the legal regimes that govern digital discovery. Of course, it is not expected that you will also be your client's digital forensic accounting technologist, no more than attorneys would hire themselves as the client's CPA or financial consultant. But bankruptcy practitioners today would do well to acquire a basic understanding of what digital forensic accounting is all about, and to know when to hire an expert as the need arises.

Footnotes

¹ Jack Seward is a consultant and has an association with a forensic accounting firm in New York City. He is a veteran of many years of forensic accounting and electronic data sleuthing. Return to article

² Daniel Austin is a lawyer in the Pittsburgh office of McGuireWoods LLP, where he specializes in bankruptcy law. Mr. Austin may be reached at [email protected]. Return to article

³ Furr, Robert C., "NAB Talk" (editor's column), Journal of the National Association of Bankruptcy Trustees, Summer 2003. Return to article

⁴ All names have been changed. Return to article

⁵ See Seward, Jack, "Digital Stealth Secrets and the [Sarbanes-Oxley] Act," LJN's Corporate Compliance & Regulatory Newsletter, Law Journal Newsletters, March 2004 (http://www.ljnonline.com). Return to article

⁶ Seward, J., "What You Need to Know About a Debtor's Leased Computers." LJN's Equipment Leasing Newsletter, Law Journal Newsletters, December 2003 (http://www.ljnonline.com). Return to article