The Future of Legal Tech in FCPA Enforcement

Happy to be here. Thank you.

Thank you.

Well, thanks very much. Appreciate the opportunity to speak with you guys and your listeners, and I have been working in the investigations white collar world for over twenty years. I started my career at the Department of Justice as an honors attorney in the Criminal Division Fraud Section and spent a decade there doing a variety of white collar investigations from multibillion dollar accounting frauds with four month trials to congressional corruption cases, pursuing both lobbyists and elected officials to some of the largest international corruption cases at the time as part of the Foreign Corrupt Practices Act unit within the fraud section.

So I been about a decade there. Had a really amazing experience, really had a great opportunity to serve the public, understand kind of the legal and international business world. And then then I shifted to Paul Hastings where I'd been for over a decade as well. I'm a investigations white collar defense partner focusing broadly on international criminal enforcement, focusing mostly on international corruption or foreign corrupt practices act cases, FCPA cases.

Although I'm increasingly connected to a variety of other regulatory and criminal offenses linked to those, whether it is trade controls or sanctions, whether it is a variety of other international issues.

My specialty is dealing with crises with big cases that put the company at risk and kind of walking them through the most significant legal, factual, and business issues for them to deal with. And I've been blessed or cursed depending on how you look at it with handling some big cases as well as some smaller cases which are really, really important to the people that are in the middle of it. I love what I do. I am constantly learning about new things, being faced with new challenges in a changing enforcement environment, changing regulatory environment. And I get an opportunity to work with great professionals at BDO and elsewhere to do some of the great work that we all do together.

Well, Nat and I have worked together. I think we've known other for over ten years by now. Mhmm. And we really had fun working together. I am a principal here at BDO. I'm based in New York with a focus on cross border forensic work. And so that calls in the FCPA part of it, which is a lot focused on cross border transactions and business activities.

I spent half my life by now in Asia. I started out as an auditor. I was based in Singapore, grew up there, and got exposed to some of the issues in that region, especially in China and India and others, as an auditor. And when I made the switch to forensics over twenty years ago, it's natural for me to continue focusing on that. And so at BDO, I also lead the Asia Forensics Desk. And like Ned, I've been working on many FCPA cases and some of them do not originate as FCPA cases and in others they actually turn into something else or something bigger that came out of FCPA allegations.

In addition to some of the anti corruption work, I've increasingly spent time in export controls and sanctions work as well. So anything that has to do with international supply chain fraud, that's one of our focus areas here.

I'd note that my particular area of interest, one of the things that brought me to the FCPA was Asia. So I lived in Asia as a child growing up, and then I lived in China shortly after college and thought I would have nothing to do with Asia again, did other business consulting before coming back to law school and then eventually spent a significant amount of time for DOJ building relationships in Asia, including as the point person on corruption for DOJ to China, having met with the Chinese government, Chinese prosecutors to try to build cooperation between the US and China, given some of the overlapping interests and at times competing interests. But I do think that one of the fascinating things that draw people to this profession is the impact of the international business environment, the fascinating cultural shifts that can occur, and really unique fact patterns that can make for good stories, dinner party or a bar, depending on the stories you're willing to tell.

Part of the reason that the FCPA is relevant is it impacts economic growth because you're giving away your profit margin to a government decision maker. You are not investing in service. You are not investing in the best products that's out there. It distorts the economic environment, but fundamentally it is a breakdown in the rule of law. And if you are willing to break the law to gain an additional sale, the US government has made very clear that this is also a risk on the national security side, that all of a sudden this money may be floating in different directions. This may be threatening national security of the United States and around the world.

I've been doing FCPA work for a very long time. I'm curious of your perspective of, you know, the shifting enforcement over the years. You know, it's been on the books, as you've said, for a very, very long time, but it seems like it's only been since, you know, maybe your career got started that it's really been hot. You know, it's really been a focus of the DOJ and the SEC. Could you take a minute and just kind of describe, you know, what the current enforcement looks like and how that has shifted from previous years?

I think the current enforcement is at some of the highest levels that it has ever ever been. And I think DOJ and SEC are threatening more, especially with the growth of global enforcement partners and new incentive structures, creating a whistleblower bounty program, encouraging a variety of other ways to get information to the enforcement agencies that is useful for law enforcement. But I would say that the growth has been pretty dramatic. I started at DOJ in two thousand and three and the enforcement wave really took off a few years after that.

I think my first enforcement FCPA case was two thousand and five in some of this, and I dabbled in some other things along the way, but it has grown from a DOJ enforcement piece from a handful less than five FCPA focused attorneys to more than thirty just in the DC fraud section FCPA unit and they have well over thirty partner AUSAs in offices around the U. S. And that doesn't even count the global partners which when I was there I was an important part of my job traveling the world to meet with the UK, to meet with the French authorities, to meet with Russia, to meet with Brazil, to meet with Sweden, to try to build partnerships, some of which were successful, some of which were not.

But the current global enforcement is very much not US only, but increasingly multi jurisdictional, and that leads to a variety of legal issues, technological issues in terms of what is legal or allowed to export, to retain, to image in a variety of different countries around the world, and it significantly increases the enforcement risk for companies who are out there who may never thought that they would face this, and is also one where it is not simply a US issue, but really a global risk for companies that are out there.

So I was a part of it when I was part of the US government when I was at the DOJ, and it is a collection of different economies, around the world, over forty different of the major developed economies around the world. And the working group on bribery actually was established in the late nineties to essentially internationalize the FCPA. So the FCPA had been enforced primarily against US companies, and so the working group on bribery has collected a variety of different countries around the world, the UK, France, Germany, the Netherlands, Japan, Brazil, a variety of the countries that are there to enact legislation that is equivalent to the SCPA to essentially set out that it is illegal not just in the United States for US companies to bribe, but it's going to be illegal for a Russian company to bribe or a Korean company to bribe, to level the playing field, as it were.

And so the role of the OECD and the working group on bribery when I was one of the U. S. Delegates to that is to essentially evaluate the legislation and the enforcement of these different laws around the world, whether it is Peru, whether it is Switzerland, whether it is Italy to say, are you doing enough to enforce your laws against your own companies that are violating international bribery laws? And if you're not, hey, you know what, the U.S. May step in and do that type of thing. There were law enforcement meetings that shared intelligence and there was evidence or leads that were shared, which have led to some of the largest cases that have been brought by the U. S. and others. It is a multinational or multi economic group that is there to essentially ensure that there is a level playing field, and U. S. Companies are not the only ones that are subject to the international corruption laws.

I would say it changed pretty dramatically. When I first started working on FCPA cases, it was basically US only. I was involved in, I think, three joint cases with the UK that were resolved early on, but late in my tenure at DOJ, and it has now grown dramatically where if you look at either the DOJ or the SEC's who they thank and that's always the critical piece who they thank in their press releases inside tip that's what matters you're going to see that they are thanking everybody from Singapore to Brazil to the Cayman Islands to the Isle of Man to Switzerland to UK to the Netherlands and those are partners that some of which would not have been involved years ago.

South Africa, Australia, you've got the Philippines, you've got a variety of different countries that have taken on different roles, some of which are enforcing their own laws and some of which are just now cooperating and providing evidence and information to the US enforcement authorities or to the main enforcers that are out there, which is going to be Brazil, UK, France, Netherlands, Switzerland.

You know, the very fact that what we're in multiple jurisdictions, working in different locales and experiencing different cultures, business practices that the company needs to look into. I think that on its own presents several challenges, the resources.

Right? And one of the things that I think continues to be a challenge today from way back when is building a team or putting together a team that has all of these strengths and skills and qualifications to help the company move forward with their monitoring, with their investigations, with their testings and audits. And, you know, it's not just about knowing the local culture and business practice. It's also understanding how to navigate the local environment and have a very, very good, strong understanding of what the US regulators and other regulators expect of the company.

And that might also include some awareness of the different various international laws that might affect the company. My first exposures to export controls and anti money laundering came from an FCPA case that I was working on, and that's many years ago. And then you bring along all these other factors like international tax laws, transfer pricing, minimum export prices, all these other laws and regulations that come together to create that environment that a company operates in, it is very challenging. So that would be one of the challenges that I see.

I mean, unfortunately, you go back to the history lesson of just binders and boxes. Right? So when I first started doing FCPA cases, right, there were binders and boxes of hard copy documents. Right?

And some of them were printed out emails and it started with nobody knew which time zone it was in. Right? So, like, that got very confusing when you're building chronologies. Right?

Those are simple fixes that now can be very easily fixed on a technological level. But I think the fundamental challenge on all of this is the volume of data is just dramatically increased exponentially.

So long ago, you would have email and occasionally some of my cases even had pager data and stuff like that if you go back really, really long on some of this stuff. But that was it, and it was really limited in terms of what's there. We did not have these mobile devices in our hands, which means that the volume of communications is immense.

And so being able to understand how to image data, not only on laptops, on servers, on shared drives, on cloud drives, all over the world through a variety of different data privacy regulations, cybersecurity issues that are there, but then be able to cut the data in a way that is useful, in a way that is cost efficient for companies that are paying a huge amount to host the data, but also to have people review the data. And that is a critical piece, But it is just there's way too much data that's out there, and I have cases with huge numbers of terabytes of data. And comparing this to the size of the Library of Congress and all the data in Library of Congress is it's multiple times the entire library of congress. And if that's the case, how on earth can we look at it and identify that needle in the haystack when people are sometimes using coded language, using messaging apps, oftentimes in my cases in multiple languages.

Right? So you have to have a remarkably talented tech team and an analysis team that can understand what the data is, where it's stored, and how to fit it all together, especially as often happens when things are deleted in a way that sometimes can drive us directly to what is most important, at least in their minds. And you need a talented tech team to be able to look at that and fundamentally find that needle in those ten terabytes of data that you've collected along the way.

I don't find ephemeral messaging, the disappearing apps, as critically important as just messaging apps, which are often on mobile devices that are sometimes owned not by the company, but by individuals.

If somebody is using a disappearing app, they're not going to be found most of the time. They are smart enough to be covering their tracks. So if they're using encrypted, highly encrypted, or disappearing apps, we're not going to be able to find what actually happened. Frankly, I think that that's a bigger risk for companies if they have people who are designed to do that.

But ultimately, the messaging apps is where we are running across both legal and technological issues. We're not necessarily doing ones where it's signal or where it's where it's actually disappearing. What you're doing is this is on their personal phone, but they use it for business purposes. It's a business record, and they're talking about contracts, and they're talking about normal business.

Then if DOJ or SEC has a problem, and I can't answer and say what happened because I don't have the normal business communications and we're going to get hit for that. So I think it's a messaging app issue less than an ephemeral messaging app issue. But I do think that what has shifted with the rise of messaging apps and especially the lack of good internet, not good internet access, but good telephonic cell phone access, but good wi fi access around the world is that we've shifted to messaging apps and so there has not yet been a institutionalization.

Everything else that's out there where there's an enterprise version, I know there are some attempts at it, which has been readily adopted by the corporate and business world and as long as that is there there's going to be a gap between how employees communicate, what companies retain, and what the enforcement agencies are expecting.

I think it very much depends upon the situation that you are facing, the volume of data that you have, and what your goal is.

Where I think we have a harder time using this AI or predictive technology is when there is an issue and you are trying to identify what are the most relevant documents. And what I've seen most effective is using it to obviously build chronologies, identify the key people, identify the communication patterns, who's communicating to who, right, when that pattern changes, and frankly tying it to deletion analysis, I think has been kind of fun too. There are certain aspects of this which can be very useful, but it is making sure that you have a technological team that knows enough of how to do this in a way that you are credible before the enforcement agencies or credible before the board when I'm explaining and saying that yes, I will vouch that I don't believe there's anything there, or this is the manner in which we've determined that these three people need to be disciplined and these seven people do not.

I couldn't agree with that more on the importance of sifting through that massive amount of data to get to the information that we need to help clients and organizations.

And one of the things that continue to be a big focus for us or a big tool for us is having advanced analytics to run those searches and analyze the data and correlate across multiple factors of importance in an investigation. And that's again going to multiple systems, gathering that data very efficiently, and processing it with input from the key stakeholders.

I want to emphasize too that when we get to a result of looking at a much smaller set of data than the entire population, that's a result of an iterated process with taking interviews or conducting interviews, conducting document reviews, and feeding the information gathered from all these work streams into the same work stream that drives the data processing and analytics. So I think that's one of the most important things. We see that as an opportunity and also a challenge, right, because we want to make sure that there are no blind spots creating a disconnect between the data and other elements of the fact gathering.

So that and I've seen too that data scientists and analysts working a lot more closer with the accountants and the lawyers that are on the same investigative team. As it relates to AI, I do want to kind of highlight a few things. I think AI is it has been kind of, as you pointed out, Jared, used by us and others in the field to conduct investigations, to identify red flags and transactions that are worth a second look. When we do this across borders, taking into account different languages, different references, it could add a certain level of challenge.

We need to be a step ahead of them or at least be in step with them to figure out those as soon as possible and then as efficiently as possible.

What's very challenging as our listeners know who have dealt with predictive coding, technology system review, and also Nat and Pei Li, I'm certain that you know us. When we talk about that, first of all, that is a form of artificial intelligence, to be clear. So that is definitely when we talk about AI today, we forget about the fact that all these structure analytics, conceptual searching, name normalization, etcetera.

I think one of the things that your listeners should be aware of is that DOJ has cautioned companies on the use of AI and that they want to be very confident that companies who use it in their data analytics in identification or for on compliance issues or more broadly that it is not being misused. And I think that that is why it is critical to make sure you have a good technological partner who knows all of those words that you mentioned, which I don't know, but also can think about it broadly. And this is why it's a team, can think about it broadly from both the technological, the legal, the forensic aspects that are there because it's a combination of different things that are going to be critical.

Generative AI, again, I was a history of religion major in undergrad, so I may not be the most technologically savvy on this, but I know some. It's based on what it's trained on. And if it is trained on the universe of my teenagers talking, that's gonna be very different than if it's trained on the universe of corporate executives talking. It's very different than if it's trained on the universe of pharma sales reps in China.

And so as we think about what is the AI use, what it is in terms of the linguistic side, whether we're looking at the financials and the transaction testing and identification of outliers there. You need to be thinking about the old term is the seed set. Right? But fundamentally, what are you basing that on?

I think that ultimately we need to be thinking about what is this going to be used for? And that, from my perspective as an enforcement lawyer, that's the way we're going to be able to convince the US government or agencies around the world that the use of AI is appropriate and we are not intentionally or unintentionally misleading them with our results.

So from my perspective, and I'm a forensic accountant, so I can speak to the legal aspects of it. But my role in many of these are fact finding, and I do want to have the evidence. I want to be able to trace the flow of assets, the transaction, the exchange of assets.

And at the end of the day, it goes back to what can I present to the client that says, yes, this happened or did not happen, or whether we have enough support to say that a certain activity has occurred?

In many of the investigations that I've done, the biggest challenge is the omission of data or information.

And when it's not there, you couldn't really say it's there. A lot of it can be circumstantial but that is also helpful for the company to present to the government or for the lawyers to say okay this is what we have and this is what we do not have. Now how do we make sense out of all of this? So that's the biggest challenge for me, making sure that everything is backed up by facts and backed up by documents.

So how we get there, I think AI might be helpful, but again, I think the legality of it has to be assessed by people by lawyers like Nat and others.

I think a lot of it is I mean, I think there's a number of both law firms and others that are trying to figure out how best to do this and how to use in particular datasets or investigative issues that they have internally and how to create their own generative AI aspects so that we can cut thousands of hours off of investigations and reviews or help identify how best to enhance compliance program. Right? To add to that, these are the ways that I don't think that there's that link yet that is there, but I think everybody is excited about the opportunity because of the challenges with data, the challenges with rising costs in general, and how to be most efficient to help companies solve their biggest problems, in a way that they aren't spending more money on this when in a time of conflicting budgets, we'll just put it that way.

I'm happy to start on this one. I do think DOJ has recently said made some statements that they've received over a hundred tips on this issue. I was at DOJ when SEC launched their whistleblower program and the bounty program there, and it has in the SCPA area as well as others and it has led to very significant awards, right? Hundreds of millions of dollars, if not billions of dollars, when you put it all together to various different individuals and their attorneys.

I do think DOJ is seeking some way for them to get more information that is not put through a filter of companies, and this is one way to provide those incentives. The challenge is separating the wheat from the chaff, what is legitimate, what is not. I think DOJ is going to be very focused on getting new information, not just for FCPA, but for a variety of these white collar enforcement issues. And there's a lot of money floating around.

And so that leads to both plaintiff's lawyers and individuals which are both seeking opportunities, but also competitors willing to or trying to throw their competitors under the bus, right? There's nothing like a FCPA allegation that comes in, which is without justification that you suddenly spend a huge amount of time and energy on and can justification that you suddenly spend a huge amount of time and energy on and can impact stock price. So I think that DOJ needs to be cautious in how they vet these in the same way that the SEC has generally been cautious in terms of vetting these before approaching their companies or making things public.

I do think that it is already having an impact as things come in and as companies are aware of these issues, updating their whistleblower hotline policies, ensuring that there are quick turnaround times in terms of responding to these issues, looking at the data analytics of how long it takes, where it goes, all of these things. It's a renewed emphasis on a topic which has languished, I think for a little bit, but is increasingly important in a disconnected age, especially as more and more people are outside of the office. And there's not the same personal loyalty that was critical, I think, in long term employment and belief in the future of the company.

Thanks, Daniel. So, yes, I will be on a panel at the ACI FCPA conference in Washington, DC. That's going to be in December fourth to fifth. I'm going to be on a panel with Stephanie Acousti, who's the Global Head of Integrity Investigations at ABB, and Angela Main, who's the Senior VP, Global Chief Compliance Officer and Associate GC at Zimmer Biomet. So we will be doing a deeper dive on China, covering some of the challenges of operating in China and discussing the evolving FCPE compliance programs in response to the latest trends as well as considerations for managing third parties and navigating China's laws and balancing those requirements against expectations from the US regulators.

And I'd just like to jump in and say that it's a fantastic conference and I will be there and it is an amazing opportunity to learn from distinguished speakers. Pei Li and her fellow panelists will, I'm sure, provide a fantastic insight into this, and I encourage everyone to both go to the conference and attend.

It will be at this website, and we could probably put that in the registration for this podcast as well at american conference dot com slash fcpa dash dc.

Thank you. It's been a pleasure. Thank you.

Thank you, guys.