Mattias is a founding partner of Swiss FTS Ltd, and leads the IT forensics practice in Switzerland. He has been working in IT forensics and e-discovery since 2008 and holds a master’s degree (MSc) in computer science. Mattias has been a part of and managed Swiss and international e-discovery projects, helping companies deal effectively with their most challenging situations: data theft, fraud and corruption. He has worked on these issues for major financial institutions in Switzerland and across Europe.
WHAT ATTRACTED YOU TO A CAREER IN DIGITAL FORENSICS AND E-DISCOVERY?
Every case in digital forensics is unique. There is no blueprint because you’re often on the trail of suspicious or even unethical behaviour. Thus, there is often a “MacGyver” approach to solving problems – we must improvise robust solutions “in the field”, urgently and with many different players who are often not acting in alignment.
And these solutions must be perfect – there is no room for error. We must document every move we make and follow strict rules for handling evidence in a way that can stand up in court.
The combination of exacting standards and high time pressure under conditions of uncertainty makes every day an exciting workday.
WHAT QUALITIES MAKE FOR AN EFFECTIVE DIGITAL FORENSICS EXPERT?
Digital forensics projects are highly complex and multi-dimensional, not only on the technical level, but also the human level.
We are often talking with different teams, sometimes on opposing sides of a problem, sometimes across continents and languages. There are teams of lawyers, technical people and business managers on each side – and sometimes they don’t even agree with each other when they’re on the same side!
In keeping with our Swiss heritage, our firm is dedicated to absolute neutrality. We are here to discover the facts, not take sides.
This commitment to neutrality and truth in the middle of what often seems like chaos, requires a great deal of translation. For example, US and Swiss lawyers, IT professionals and business managers not only speak different languages, they think in completely different ways. Thus, I have to be a translator of ideas and concepts, not just of language.
I take pride in always integrating both a solid grasp of the technical aspects of the problem, with a deep care for the human communication, and interaction that will lead to the solution.
HOW HAS THE MARKET CHANGED SINCE YOU FIRST STARTED PRACTISING?
Data volumes in e-discovery cases have risen exponentially. Since everything is digital now, more and more things get tracked, logged and recorded, all with increasingly detailed metadata.
The rise of assisting technology, such as analytics, technology-assisted review, clustering, linguistic approaches, machine learning, personally identifiable information (PII) identification and AI, can help, but makes field orders of magnitude more complex.
There are many off-the-shelf tools out there, but they often don’t combine well. At Swiss FTS, we pride ourselves in coming up with custom solutions, which combine already existing software packages with our own proprietary technology to integrate them and fill in the gaps.
HOW DO YOU SEE THE USE OF ARTIFICIAL INTELLIGENCE IN E-DISCOVERY DEVELOPING OVER THE NEXT FIVE YEARS?
Without AI, investigators need to read through each document and make a judgement call as to whether it’s relevant. Often, these judgements are based on complex mixtures of variables, which depend on context and knowledge of other aspects of the case. There’s a certain “intuition” involved.
The complex judgement calls can’t be broken down into formulas that traditional algorithms could determine.
While AI is not there yet, it’s likely that, within the next five years, it will get to a point where it can make basic or even complex “judgement calls” based on context.
For example, if you’re looking for PII, current algorithms can search for simple, directly identifiable information such as names, emails and mobile numbers. However, there’s a host of information that could be identifiable – such as certain time-stamped financial transactions – with a few simple inferences that any human could make. Currently, our best algorithms cannot make these inferences, and thus will almost certainly miss some PII, often with disastrous effects.
AI will be able to recreate the types of inferences humans make about what is identifiable, and do this on the scale of hundreds of millions of documents within hours or even minutes, rather than within half a year as with humans.
HOW DOES SWISS FTS DISTINGUISH ITSELF FROM COMPETITORS?
Our number one value is transparency with our clients. Corporate investigations can be an opaque field, with a requirement for highly technical and customised solutions, often performed under tense or hostile conditions, with many cross-cutting actors, and on short notice. We communicate with clients in a way that allows them to understand our rationale for everything we suggest.
We stick to the facts, and we are willing to lose business rather than participate in massaging the data or constructing false narratives. Whenever we are on the case, all parties are confident that the role we are playing is to provide the facts, not to support any particular agenda.
We are also committed to integrity in pricing. We attempt to estimate the work as accurately as possible, so as not to add on costs later once we have the client.
WHAT HAS BEEN THE MOST INTERESTING CASE YOU HAVE BEEN A PART OF?
A charitable incorporated organisation called once in the vacation week between Christmas and New Year, in a panic, saying that his company is basically “deleting itself”. Meaning, 300 servers had already self-deleted, for totally unclear reasons. So, our vacation ended and we went to work figuring out what the problem was.
It turned out a recently fired employee had planted a timed script to instruct the servers to wipe themselves, as revenge. We pinpointed the bad actor and determined (via log entries) that he had travelled to another country. We were able to stop the script, restore the data and write up a forensic report that allowed the Swiss authorities to extradite the perpetrator back to Switzerland and face justice. While I would have preferred the quiet time of the vacation, this case was definitely more interesting!