Robert DeCicco is a managing director with Alvarez & Marsal’s disputes and investigations practice. He specialises in providing services related to digital forensics incident response, forensic examinations, cybersecurity and electronic discovery for a variety of high-profile and confidential clients. He is a court accepted expert for a host of technology-related disciplines both domestically and abroad. Mr DeCicco has performed hands-on examinations and analysis through the full life cycle of electronic evidence from extremely complex, disparate and sensitive technology environments throughout the world.

What do you enjoy most about working in digital forensics?

The dynamics of digital forensics is what keeps work interesting. There is an ever-changing landscape of devices which store electronic information and communication platforms we use in day-to-day business and personal life that go in and out of fashion. We are constantly working with new tools and techniques in an effort to keep up with the new technologies. As a result, nothing ever becomes completely routine. Always needing to learn and adapt makes for a fulfilling career.

What are the initial key steps when handling an incident response from a client?

The first step when handling a response is to get an understanding of what has already happened and what the client or outside counsel has already done. We always have a plan for any contingency and have seen almost every scenario at least once before. It is important to remain calm and rely on training and experience and to trust in the process. Once a baseline of steps is taken and is coupled with the facts, we look to leverage as much as possible of previously taken measures and to shore up any short falls which may have inadvertently happened. From there, the next steps all involve understanding the universe of users impacted and what digital assets have been impacted, and then operating within that universe.

How do you prepare when testifying as an expert?

Personally, I like to make sure I understand the timeline of how long I have to prepare and then compare that to what information I need to refresh or have top of my mind for any direct examination. Going through reports, deposition testimony or any other details and drilling with counsel has always been helpful for me. Knowing what I ‘did’ inside and out and cold will usually serve better than saying ‘I have to get back to you’ too many times on the record in cross-examination.

What are the main challenges of working in a practice area that is increasingly global in scope?

The main challenges, without taking covid-19 into consideration, have traditionally been how data is handled from a privacy perspective from region to region. The nuances change often and our access to data from corporate and individual citizens of varied nations changes right along side of legislation. Fortunately, I can rely on and leverage the experience of my colleagues who operate in every major market across the globe. Our clients are multinational and understand their respective landscapes and they expect the same from us.

How have you seen companies’ approaches to cybersecurity issues and data breaches evolve over the past few years?

Companies have learned to involve outside counsel as soon as possible, as compared to previous times when we found ourselves advising a corporate client to do so. In instances where the law firm introduces us to an event, the case teams are considerably more sophisticated in the approaches to getting their client back to productivity and what issues to look for. The translation of technology to law is much smoother now than it was previously.

How has your firm adapted to the challenges caused by covid-19?

Overall, our firm continued to leverage all our core values and we pride ourselves on our agility and adaptability to change despite being a large international firm. Using one of our core values – integrity – as a baseline for how the firm would approach the change in work structure was key. We did not allow the changes in the past year to compromise our quality of work or the integrity of our work product. For the forensic technology services practice overall our shift due to covid-19 was relatively frictionless. We have been dealing with data collection scenarios on short timelines from often physically remote locations and conducting analysis remotely for years, so our change was more of shifting gears from remote collection and analysis being an exception to being a majority. And we have continued to take away lessons that make us more productive and cohesive as a team.

Looking back over your career, what has been your proudest achievement?

Looking back at the colleagues and peers I have worked with in various consultancies and across various levels of organisations around the world and seeing how they have grown over time professionally, personally and in their respective expertise has been one of my proudest achievements. I’d like to think I contributed in some way as either a colleague or teammate, a lesson learned during our interaction that helped them move forward and develop in their careers.