ComputerForensicsDigest.com

The conspiracy, securities fraud, and wire fraud trial of former Bear Sterns fund manager Matthew Tannin offers an object lesson for computer forensic specialists and electronic investigators on the fragility of cloud data. At issue, the Wall Street Journal reports, is whether the government can introduce evidence that Tannin deleted his Google mail account in March 2008, rendering the information unrecoverable for trial eighteen months later.

Government prosecutors argue that Tannin's erasure of his Gmail account occurred "during the pendency of the criminal investigation" into the handling of the BS fund, and that Tannin's email account had been subpoenaed in a separate civil case brought by the Securities and Exchange Commission.

One of Tannin's lawyers, Susan Brune, wrote to the U.S. District Court to object to any mention of the fact that Tannin deleted his personal email account.

"There is no requirement in law or in common sense," Brune wrote, "that dictates that a person under a subpoena must keep his personal email account at a third-party email provider open in perpetuity. That Google has apparently stopped maintaining the emails that were available on its server for a lengthy period of time after the collapse of the funds is not evidence of any impropriety and is simply not relevant to any issue in trial."

In response to a separate subpoena from investigators in the Tannin case, Google said that it was unable to retrieve any of the data from Tannin's Gmail account due to the passage of time since it was deleted. Google's privacy policy states that messages in deleted accounts may remain on its active servers for up to 60 days, and on backup servers indefinitely. In this case, however, the messages apparently got flushed.

Brune argues that it would unnecessarily prejudicial for the jury to be told about the deletion, particularly since Tannin's own computers were imaged by the government. However, whether those images contain complete copies of correspondence sent through his Gmail account remains to be seen.

An equally valid question is whether federal investigators in the Tannin case moved quickly enough to subpoena information from cloud data sources such as Google. Brune argues, for instance, that it took government agents roughly 21 months to send a subpoena to Google, thereby making the likelihood of data recovery remote.

The Court is likely to rule on whether the deletion of Tannin's Gmail account can be mentioned at trial prior to the start of jury selection on October 13.