Context-Aware Technology Goes to Court

Cataphora sifts employees' digital communications on and off the job for signs of conspiracy to cover up company wrongdoingor to initiate a scam

Residents of Virginia, Florida, and Louisiana knew something was amiss when their new homes began smelling of rotten eggs. They grew alarmed when family members started developing respiratory and other health problems. After an investigation, the U.S. Consumer Product Safety Commission found a correlation between homes built with drywall made in China and higher levels of a gas that can cause a range of problems, including shortness of breath.

Consumers have brought class action lawsuits against manufacturers and importers of drywall from China. As they investigate, attorneys representing consumers will need to answer a key question: Did companies and their employees know the potential hazards of the materials they sold?

Cataphora, a software company founded in 2002 and based in Redwood City, Calif., is helping one group of plaintiffs search for the answer. Cataphora's software can track employee behavior that might indicate some form of wrongdoing. It's able to detect such patterns as e-mails unexpectedly written in a foreign language or unusual amounts of time spent on phone calls or offline communication.

In court cases involving corporations, lawyers for plaintiffs often struggle to determine which employees knew that fraud or some other illegal activity was happening. Reconstructing the context surrounding the event can be painstaking as investigators wade through thousands or even millions of e-mail messages. The task has become even more challenging in recent years as new forms of communication—instant messaging, text messages, or social media postings—have become more pervasive. That means it's less likely for investigators to find a single "smoking gun" e-mail message or memo.

Context helped Cioffi and Tannin

Cataphora's software overcomes this challenge by correlating and analyzing different types of communications to try to create context. "In the time we've been in business, the average size of e-mail text has shrunk about 50%," says Elizabeth Charnock, CEO of Cataphora, a maker of software that helps organizations understand complex employee behavior patterns by analyzing electronic communications.

Using software to track the larger context around employee relationships can be used to incriminate—or acquit—defendants. Bear Stearns hedge-fund managers Ralph Cioffi and Matthew Tannin were found not guilty of fraud and conspiracy on November 10. The government had tried to prove that e-mails they sent to each other indicated a much bleaker picture of their funds than the messages they were giving investors, who ultimately lost $1.6 billion. Charnock says jurors looked beyond the text of the e-mails and into the broader context of their communications. In that context the e-mails sounded more confused than conspiratorial, the defense successfully argued.

Cataphora's software also can analyze interrelationships on social networks to find close social ties between employees and to look at a company's so-called shadow social networks. These are the hard-to-detect, yet tightly bound groups that form among people with similar interests and backgrounds. "The org chart doesn't necessarily reflect the way people are working," says Carol Rozwell, vice-president and distinguished analyst at research firm Gartner (IT).

While most shadow social networks aren't nefarious, they can sometimes be instrumental in helping employees perpetrate fraud. Shadow social networks can be especially useful to wrongdoers in companies that have stringent fraud-prevention mechanisms, such as requiring multiple signatures for large transactions. In those cases, it often takes groups of people to skirt controls, Charnock says. Cataphora has encountered shadow social networks comprised of fraternity brothers, avid collectors of Nazi memorabilia, and people from the same region of a European country, who all spoke the same regional dialect.

Missing: glances, whispers, winks

Social network analysis can be helpful in determining which groups of employees might have had interactions across the company. In the book Coolhunting, authors Peter Andreas Gloor and Scott Cooper recount their efforts in a research project to look at e-mail messages between late Enron CEO Kenneth Lay and colleagues. The authors were trying to establish whether Lay could have been correct in claiming that he knew nothing of the wrongdoing at the company. Gloor and Cooper learned that Lay had been in contact with dozens of people who were connected to employees who were ultimately convicted in the Enron case. Although no proof of direct contact could be established, the authors say it is "highly unlikely that he did not know of their wrongdoing." When the authors examined the discussions, they found conversations about "highly suspicious topics." Lay was later convicted of fraud and conspiracy but the conviction was vacated after his death.

Examining electronic communications isn't foolproof. It can't capture the whole context of employee interaction. "We don't communicate the same way online as we do in person," says Karen Sobel Lojeski, a professor of technology and society at Stony Brook University and author of the book Leading the Virtual Workforce. In a harassment or discrimination case, for example, electronic communications wouldn't capture certain looks or whispers, she says.

Still, scanning digital employee communications can flag interactions that might be suspicious, such as staffers communicating in a foreign language in e-mails. "Every single time we've seen someone change language with a person they don't normally do it with it's been fraud or attempted fraud, or somebody is having an affair or talking about a drug problem," says Charnock, adding that many companies don't set up electronic compliance and monitoring systems to track more than one language.

Next, Cataphora plans to add real-time capabilities so that companies can identify problems faster. "The benefit of being real-time is that you're catching things that look suspicious before it goes on for weeks or months or years," says Charnock.

Before it's here, it's on the Bloomberg Terminal.