CFE Legal Frameworks & Regulatory Standards 4 — Questions and Answers
Question 1: Under the Electronic Communications Privacy Act (ECPA), a law enforcement agency seeking stored email content more than 180 days old must obtain:
- A subpoena
- A court order under 18 U.S.C. § 2703(d)
- A search warrant (Correct answer)
- Administrative summons only
Correct answer: A search warrant
After the Sixth Circuit's Warshak decision and subsequent DOJ policy, a search warrant supported by probable cause is required to obtain stored email content regardless of age.
Question 2: In a civil litigation context, what is the primary purpose of a litigation hold notice?
- To notify opposing counsel of evidence collection
- To suspend routine document destruction to preserve potentially relevant evidence (Correct answer)
- To compel witnesses to appear for deposition
- To freeze a party's financial assets
Correct answer: To suspend routine document destruction to preserve potentially relevant evidence
A litigation hold notice instructs custodians to suspend normal retention/destruction schedules and preserve documents potentially relevant to anticipated or pending litigation.
Question 3: The USA PATRIOT Act expanded which government authority to allow collection of 'tangible things' relevant to a terrorism investigation without a traditional warrant?
- Title III wiretap authority
- Section 215 business records authority (Correct answer)
- National Security Letter authority
- Pen register authority
Correct answer: Section 215 business records authority
Section 215 of the PATRIOT Act (amending FISA) allowed the FBI to obtain a FISA court order for any tangible things relevant to a terrorism or intelligence investigation.
Question 4: A forensic examiner discovers evidence of a crime unrelated to the original search warrant scope during a digital examination. Under the 'plain view' doctrine, seizure of that evidence is lawful if:
- The examiner had prior knowledge the evidence would be there
- The incriminating nature of the evidence is immediately apparent without further analysis (Correct answer)
- The warrant described the evidence with particularity
- The evidence was found in a system folder
Correct answer: The incriminating nature of the evidence is immediately apparent without further analysis
Plain view seizure requires that the item's incriminating nature be immediately apparent — the examiner cannot conduct additional analysis to determine whether something is evidence.
Question 5: Which regulatory framework requires financial institutions to file a Suspicious Activity Report (SAR) within 30 calendar days of detecting a suspicious transaction?
- Sarbanes-Oxley Act
- Bank Secrecy Act / FinCEN regulations (Correct answer)
- Gramm-Leach-Bliley Act
- Dodd-Frank Act
Correct answer: Bank Secrecy Act / FinCEN regulations
The Bank Secrecy Act, implemented through FinCEN regulations, requires covered financial institutions to file SARs within 30 days of identifying a suspicious transaction.
Question 6: Under Federal Rule of Civil Procedure 26(a)(2)(B), a retained expert witness must provide a written report that includes all of the following EXCEPT:
- A complete statement of all opinions to be expressed
- The compensation to be paid for the testimony
- A list of all other cases the expert has testified in during the past four years
- The identity of all co-workers who assisted in preparing the report (Correct answer)
Correct answer: The identity of all co-workers who assisted in preparing the report
FRCP 26(a)(2)(B) requires disclosure of opinions, basis and reasons, data considered, exhibits, qualifications, prior testimony, and compensation — but not identification of assisting staff.
Question 7: The General Data Protection Regulation (GDPR) requires organizations to report a personal data breach to the supervisory authority within:
- 24 hours of discovery
- 48 hours of discovery
- 72 hours of discovery (Correct answer)
- 7 days of discovery
Correct answer: 72 hours of discovery
GDPR Article 33 requires notification to the competent supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.
CFE Legal Frameworks & Regulatory Standards 4
Under the Electronic Communications Privacy Act (ECPA), a law enforcement agency seeking stored email content more than 180 days old must obtain: