Breach & ransomware litigation
What happened, what was reasonable, what the standard of care looked like at the time, and whether the response met it.
02 / Litigation
Retained by counsel for breach litigation, data-handling disputes, digital evidence questions, and IT-related commercial matters. Reports, depositions, and trial testimony. Thirty years of operational IT and cybersecurity work, translated into testimony a jury can follow.
Case types
What happened, what was reasonable, what the standard of care looked like at the time, and whether the response met it.
Storage, access, retention, sharing, and the gap between written policy and operational reality.
Reviewing other experts' work, methodology challenges, chain-of-custody, and what the artifacts actually do (and don't) show.
MSP/vendor performance claims, system delivery and acceptance, software project failure, and the technical underpinnings of contract claims.
Insider misuse, departing-employee data movement, trade-secret matters, and what the systems actually recorded.
Whether the loss falls inside or outside cyber-policy language, and the technical facts that resolve it either way.
Deliverables
Initial conflict check and scope conversation. Document review and independent analysis. A written expert report that says what it found and why, in language a non-technical fact-finder can follow. Deposition. Trial testimony where required. Plain-English explanation is the recurring discipline — three decades of being the on-air cybersecurity voice for South Florida newsrooms is the same skill applied to a different audience.
Credentials
Coverage
Based in West Palm Beach. Available in-person across Florida and via remote deposition or trial appearance nationwide where the matter and the court allow.
Client voices
From the InfoStream years — the underlying traits that translate directly to expert testimony.
"He has the uncanny ability to explain the most complex process in very understandable terms. He is the ultimate professional who will not only do what he says but will go above and beyond."
"When I was researching a new server setup and install for a client of mine, Alan was a great resource. He answered my initial questions, provided great information and wasn't interested in selling unnecessary contracts. I highly recommend him."
FAQ
Conflict check within 24 hours of receiving a brief case description. Initial document review and scoping within the first two weeks of formal retention. Written expert report on a schedule the case requires — most matters land between six and twelve weeks from retention.
Both. The discipline is the same either way: review what the evidence supports, write what is defensible, and never overstate. Counsel hires expert witnesses for credibility under cross-examination, not for advocacy in disguise.
Run within 24 hours of receiving the parties involved and a one-paragraph case description. InfoStream client history (1994 onward) is checked along with any current advisory engagements. If a conflict exists, I say so immediately.
Yes. Florida is the primary practice base, with in-person depositions and trial appearances across the state. Out-of-state matters are handled via remote deposition or trial appearance where the court allows, and in-person travel where the matter warrants it.
Hourly, against a retainer drawn down as the matter progresses. Rate sheet provided at the conflict-check stage. No contingency arrangements — expert testimony is incompatible with outcome-tied compensation.
Yes. Specific case history and Rule 26 disclosures provided to retaining counsel under the engagement letter.
Retain
Send a brief description and I'll run conflicts within 24 hours. Florida and nationwide. Reports, depositions, and trial testimony.