I am not a dinosaur. Except that I prefer e-mail to texting, and I forget that my students have never used a record player or lived without the Internet. I’m not near the national average of 14 daily visits to Facebook, and I’ve yet to text a photo of my genitals–a practice so routine that it has a name, “junk shots” and its very own app, “Snapchat.” When I need to know how to turn off a nagging dashboard light, I prefer written instructions over YouTube, and I do not video every concert and papal investiture I attend. I still have two landline phone numbers.
Omigosh! That last one. I AM a dinosaur!
According to the U.S. Center for Disease Control, more than 41% of American households have no landline phone, relying on wireless service alone. For those between the ages of 25 and 29, two-thirds are wireless-only. Per an IDC report sponsored by Facebook, four out of five people start using their smartphones within 15 minutes of waking up and, for most, it’s the very first thing they do, ahead of brushing their teeth or answering nature’s call.
I cite these astonishing statistics to underscore a tendency in e-discovery to seek information in those places where we’ve grown comfortable despite compelling evidence that relevant information is elsewhere. I’ve written on this “Streetlight Effect” before (at p. 252 of this collection of articles), in the context of the blind eye long turned to shortcomings of keyword search. The latest manifestation is graver still, and will make for a perilous future if we do not rise to the challenge now.
I speak of the rapid accretion of unique, relevant data on mobile devices that has greatly outstripped our ability (or willingness) to preserve and process same. Look around you. Do you see the look down generation out there? Why do you suppose the person in front of you on the jetway is walking so #$%^& slowly?
Apple just sold ten million units of its latest iPhone. Ten million. In a week. How many of those purchasers sought a better device for making phone calls? Did Apple even hint it had improved the phone as a phone? No siree, Bob!
More astonishing statistics:
Seventy-one percent of the U.S. population use smartphones. That’s up 40 percentage points in three years. Fifty-seven percent of the U.S. population now use tablets, up 45 percentage points in the same three years.
The implications are clear. Our data isn’t on our desks or in our shares anymore. The fault, dear Brutus, is not in our stars but in the palms of our hands. Yet, we wince to contemplate preservation and collection from mobile devices. We delude ourselves that whatever information is on the phone or tablet is replicated in the sources we don’t ignore. We suppose that, if we must someday deal with dem phones, dem phones, dem iPhones, their contents won’t be much different to preserve and process than stuff on personal computers.
Boy, are we in for a surprise when we hear da word of the cord(less).
We know how to acquire the contents of hard drives. We know about imaging and targeted collection. We’ve gotten good at culling, filtering and processing PC and server data. After all, most corporate data lives within identical file and messaging systems, and even those scary databases tend to be built on just a handful of well-known platforms.
Now, let’s talk mobile.
Let’s talk interfaces. We’ve been acquiring from hard drives for thirty years, using two principal interfaces: PATA and SATA. We’ve been grabbing data over USB for 15 years, and the USB 1, 2 and 3 interfaces all connect the same way with full backward compatibility. But phones and tablets? The plugs change almost annually (30-pin dock? Lightning? Thunderbolt?). The internal protocols change faster still: try six generations of iOS in four years.
Let’s talk encryption. There is content on phones and tablets that we cannot acquire at all as a consequence of unavoidable encryption. Apple lately claims that it has so woven encryption into its latest products that it couldn’t gain access to some content on its products if it tried. The law enforcement community depends on the hacker community to come up with ways to get evidence from iPhones and iPads. What’s wrong with THAT picture?
Let’s talk tools. Anyone can move information off a PC. Disk imaging software is free and easy to use. You can buy a write blocker suitable for forensics work for as little as $27.00. But, what have you got that will preserve the contents of an employee’s iPhone or iPad? Are you going to synch it with iTunes? Does iTunes grab all you’re obliged to preserve? If it did (and it doesn’t), what now? How are you going to get that iTunes data into Relativity? There’s no app for that.
Let’s talk time. It takes longer to acquire a 64Gb iPhone than it does to acquire a 640Gb hard drive. Yeah, you heard that right. Moreover, you can acquire several hard drives simultaneously; but, most who own tools to acquire phones can process just one phone at a time. It’s about as non-scalable a workflow as your worst e-discovery nightmare.
Starting to get the picture?
These are hard problems indeed; but, they are not intractable problems. Nor are they solved by pretending phones and tablets are just little PCs or that they simply don’t exist. We must stop kidding ourselves that handhelds don’t hold unique or discoverable information. Look up from your phones and tablets! They are now the center of our digital lives.
Yet, there’s a bright side. The tidal shift to handhelds will make our discovery lives easier because as we move to handhelds and tablets, we inevitably move to the Cloud. The Cloud is in most respects an easier environment in which to identify, preserve, process, search and produce ESI. Okay, you don’t see it that way now. But you will. You will.
Don’t believe me about migration to the Cloud? Try this: Spend some time with your handheld device disconnected from cell and WiFi service. What are you doing? Reading? Listening to music? Playing a game? I’ll tell you what you’re doing: you’re waiting for cell and WiFi service. Your data’s up there and out there. We could use handhelds the way we used desktops and laptops. We just don’t.
So, your challenges for today, Dear Reader (Homework! Now, he’s giving us homework?):
- What’s the difference between a Physical, Logical and File System (AFC) collection from an iOS device? When do you want one over another? What are the cost considerations?
- It’s 10:00am. The CEO hands you her 128Gb iPhone 6 Plus for preservation and icily asks, “When will I get this back? I’m flying out this afternoon and I NEED IT.” What do you tell her?
- You’ve learned that the information you’re seeking in discovery resides on Samsung Galaxy tablets. What form or forms of production do you specify in your request? What metadata do you need?
Yes, we will be grading on the curve.