I am not a dinosaur. Except that I prefer e-mail to texting, and I forget that my students have never used a record player or lived without the Internet. I’m not near the national average of 14 daily visits to Facebook, and I’ve yet to text a photo of my genitals–a practice so routine that it has a name, “junk shots” and its very own app, “Snapchat.” When I need to know how to turn off a nagging dashboard light, I prefer written instructions over YouTube, and I do not video every concert and papal investiture I attend. I still have two landline phone numbers.
Omigosh! That last one. I AM a dinosaur!
According to the U.S. Center for Disease Control, more than 41% of American households have no landline phone, relying on wireless service alone. For those between the ages of 25 and 29, two-thirds are wireless-only. Per an IDC report sponsored by Facebook, four out of five people start using their smartphones within 15 minutes of waking up and, for most, it’s the very first thing they do, ahead of brushing their teeth or answering nature’s call.
I cite these astonishing statistics to underscore a tendency in e-discovery to seek information in those places where we’ve grown comfortable despite compelling evidence that relevant information is elsewhere. I’ve written on this “Streetlight Effect” before (at p. 252 of this collection of articles), in the context of the blind eye long turned to shortcomings of keyword search. The latest manifestation is graver still, and will make for a perilous future if we do not rise to the challenge now.
I speak of the rapid accretion of unique, relevant data on mobile devices that has greatly outstripped our ability (or willingness) to preserve and process same. Look around you. Do you see the look down generation out there? Why do you suppose the person in front of you on the jetway is walking so #$%^& slowly?
Apple just sold ten million units of its latest iPhone. Ten million. In a week. How many of those purchasers sought a better device for making phone calls? Did Apple even hint it had improved the phone as a phone? No siree, Bob!
More astonishing statistics:
Seventy-one percent of the U.S. population use smartphones. That’s up 40 percentage points in three years. Fifty-seven percent of the U.S. population now use tablets, up 45 percentage points in the same three years.
The implications are clear. Our data isn’t on our desks or in our shares anymore. The fault, dear Brutus, is not in our stars but in the palms of our hands. Yet, we wince to contemplate preservation and collection from mobile devices. We delude ourselves that whatever information is on the phone or tablet is replicated in the sources we don’t ignore. We suppose that, if we must someday deal with dem phones, dem phones, dem iPhones, their contents won’t be much different to preserve and process than stuff on personal computers.
Boy, are we in for a surprise when we hear da word of the cord(less).
We know how to acquire the contents of hard drives. We know about imaging and targeted collection. We’ve gotten good at culling, filtering and processing PC and server data. After all, most corporate data lives within identical file and messaging systems, and even those scary databases tend to be built on just a handful of well-known platforms.
Now, let’s talk mobile.
Let’s talk interfaces. We’ve been acquiring from hard drives for thirty years, using two principal interfaces: PATA and SATA. We’ve been grabbing data over USB for 15 years, and the USB 1, 2 and 3 interfaces all connect the same way with full backward compatibility. But phones and tablets? The plugs change almost annually (30-pin dock? Lightning? Thunderbolt?). The internal protocols change faster still: try six generations of iOS in four years.
Let’s talk encryption. There is content on phones and tablets that we cannot acquire at all as a consequence of unavoidable encryption. Apple lately claims that it has so woven encryption into its latest products that it couldn’t gain access to some content on its products if it tried. The law enforcement community depends on the hacker community to come up with ways to get evidence from iPhones and iPads. What’s wrong with THAT picture?
Let’s talk tools. Anyone can move information off a PC. Disk imaging software is free and easy to use. You can buy a write blocker suitable for forensics work for as little as $27.00. But, what have you got that will preserve the contents of an employee’s iPhone or iPad? Are you going to synch it with iTunes? Does iTunes grab all you’re obliged to preserve? If it did (and it doesn’t), what now? How are you going to get that iTunes data into Relativity? There’s no app for that.
Let’s talk time. It takes longer to acquire a 64Gb iPhone than it does to acquire a 640Gb hard drive. Yeah, you heard that right. Moreover, you can acquire several hard drives simultaneously; but, most who own tools to acquire phones can process just one phone at a time. It’s about as non-scalable a workflow as your worst e-discovery nightmare.
Starting to get the picture?
These are hard problems indeed; but, they are not intractable problems. Nor are they solved by pretending phones and tablets are just little PCs or that they simply don’t exist. We must stop kidding ourselves that handhelds don’t hold unique or discoverable information. Look up from your phones and tablets! They are now the center of our digital lives.
Yet, there’s a bright side. The tidal shift to handhelds will make our discovery lives easier because as we move to handhelds and tablets, we inevitably move to the Cloud. The Cloud is in most respects an easier environment in which to identify, preserve, process, search and produce ESI. Okay, you don’t see it that way now. But you will. You will.
Don’t believe me about migration to the Cloud? Try this: Spend some time with your handheld device disconnected from cell and WiFi service. What are you doing? Reading? Listening to music? Playing a game? I’ll tell you what you’re doing: you’re waiting for cell and WiFi service. Your data’s up there and out there. We could use handhelds the way we used desktops and laptops. We just don’t.
So, your challenges for today, Dear Reader (Homework! Now, he’s giving us homework?):
- What’s the difference between a Physical, Logical and File System (AFC) collection from an iOS device? When do you want one over another? What are the cost considerations?
- It’s 10:00am. The CEO hands you her 128Gb iPhone 6 Plus for preservation and icily asks, “When will I get this back? I’m flying out this afternoon and I NEED IT.” What do you tell her?
- You’ve learned that the information you’re seeking in discovery resides on Samsung Galaxy tablets. What form or forms of production do you specify in your request? What metadata do you need?
Yes, we will be grading on the curve.
CAtkins Support said:
While reading this on my smartphone, I am reminded that this is something we should all keep in our check list of things to ask when interviewing clients. I am curious about your thoughts on personal phones versus business phones. Many people combine the two, but others keep them separated. I would think (and hope) that keeping the two separate would have an easy answer, but I question the expectation when they are combined.
Great post, Craig!
The “one phone or two” debate has near-religious overtones. On the one hand, it’s about as dumb as towing a car behind your car. It’s not belt and suspenders, it’s belt and…belt. On the other hand, many are adamant in their unwillingness to cede access to private communications to their employers. I think both camps suffer from the uniquely American notion that owning the device is owning the data. It’s not, and the rest of the world comes to the question seeing the distinction and unwilling to sacrifice privacy on the altar of security. As Americans, we overestimate the levels of security and privacy we enjoy.
There is no easy answer because I don’t regard carrying two devices as “easy.” The various apps and services aren’t designed to make this separation of Church and State easy, and “easy” software solutions claiming to handily divide our personal and business lives have proven underwhelming in their performance and ease of use. Perhaps the answer lies in ‘dumber’ smartphones. That is, phones that don’t store data locally but serve only as viewers to Cloud sources. We haven’t the unblinking telecommunications infrastructure that makes this desirable now; and, it’s not something we will see in the sprawling U.S. for at least a decade or longer.
What a great article! In a day and age when more and more businesses rely on mobile devices to get work done, they need to know the risks. eDiscovery and computer forensics are a growing industry and this indeed will be a hurdle for them to tackle. Another issue to face in court, the challenge of retrieving accurate data.
Bob O'Reilly said:
This a great article that I will share with my Computer Applications for Paralegals Class. One of my informal polls of younger people — folks in their 20s addresses this – PC or Tablet or Smartphone and how they watch TV — antenna, cable provider (Comcast etc) or streaming service. Lots are cutting the cord.
I have seen some demonstrations of tools to collect from mobile devices that look good eg Access Data.
Nice article. This is a topic that is increasingly arising in smaller cases, where the only source of potentially relevant data is on smartphones owned by the plaintiff, truck driver, stander-by, etc. By the way, where did you get all the great statistics on smartphone/tablet usage?
I intended to reference my sources for all statistics put forward, but overlooked some. Sorry. The values quoted for cell and tablet usage and growth are based on research published by Frank N. Magid Associates which I initially gleaned from C-Net. The ten million units sold in a week figure for the iPhone 6 comes from the New York Times. Factual assertions in the “Let’s Talk Mobile” section are based on personal knowledge and experience.
Pingback: ILTACON 2019 at the Happiest Place on Earth | Ball in your Court
Pingback: Caig Ball: "Dem Phones, Dem Phones, Dem iPhones" | Law Practice Tips