Bow Tie Law Selected by ABA Journal Blawg 100

November 30, 2010

I am honored and humbled Bow Tie Law was selected by the ABA Journal as one of the top 100 best law blogs by lawyers, for lawyers. 

I want to dedicate this honor to my late friend Howard Krosney, who was a loyal fan of Bow Tie Law and a great person.

Readers are being asked to vote on their favorites in each of the 4th Annual Blawg 100’s 12 categories. To vote, go to http://www.abajournal.com/blawg100. Voting ends at close of business on Dec. 30, 2010. 

There are many great blogs to vote for in the 12 categories.  If you would like to vote for Bow Tie Law in the “Legal Tech” category, please go to http://www.abajournal.com/blawg100/2010/legaltech.

Again, thank you all for your readership and support.


iPhone Forensic Capture and Analysis Results

November 29, 2010

by Peter Coons, Senior Vice President, D4 LLC 

Recently Apple claimed that 80% of the Fortune 100 are currently assessing iPhone’s for corporate use ( 50% are assessing the iPad).  Will the iPhone usurp BB as the smartphone leader in the corporate world?  Apple products seem to be everywhere already (I saw the iPod Touch highlighted in a “Toys R Us” Black Friday advertisement).  I don’t consider myself a MAC person yet I own 5 iPods, an iPhone, an iPad and a Mac Book.  OK.  Wow.  Maybe I am a MAC person.  Is there a 12 step program for that affliction?

Regardless of who the leader is today or tomorrow it’s a fact that smartphones and tablets will continue to be used and may even replace the traditional desktop or laptop for everyday business computing needs.  My iPad has replaced my traditional pencil and notepad.  I use it for most everything in my daily business activities.  This is a potential problem or boon for attorneys and eDiscovery practitioners.

D4 recently invested in some wonderful new hardware that allows for the capture of iPhones, iPads, and 3000 other smartphones and tablets!  I thought I would take an old iPhone we had laying around office and give it a test run.  Results are below.

Phone Stats: iPhone 3G 8 GB; Software version 3.1.2

Use: Used for personal and business purposes for about 12 months; heavy texting; pictures of family; heaving web browsing; multiple applications installed

Two Modes Tested (both modes are logical captures and not capturing data at physical device level):

                Basic Capture (“BC”) – Includes captures of Pictures, SMS (texts), call logs, videos, phone book,               audio and music files

                File System Capture (“FS”) – Captures files stored on the iPhone file system – think MAC file     system

Scenario 1: Basic Capture – No deletions performed.  Phone imaged as is.

Scenario 2: BC after manual deletion – I deleted all the pictures, call logs, SMS, videos, and contacts.  I did not delete music files.

Scenario 3: BC after system reset – I used the iTunes application in Windows to reset the device to factory settings.  When undertaking this action I was forced to upgrade the iPhone to version 4.1.2 OS.

Scenario 4: File System capture after manual deletion – I captured the file system after manually deleting pictures, call logs, SMS, videos, and contacts.  I did not delete music files.

Scenario 5: FS capture after system reset – I used the iTunes application in Windows to reset the device to factory settings.  When undertaking this action I was forced to upgrade the iPhone to version 4.1.2 OS.

Scenario 1 Findings:

Basic Capture – No deletions performed.  Phone imaged as is.

Item 1. Basic Capture (BC)
Call Log 22 incoming; 55 outgoing; 23 missed
SMS 4491
Email NA
Contacts NA
Calendar NA
Notes NA
Pictures 652
Songs 5
Web History NA
Bookmarks NA
Cookies NA
Kayak Travel NA
Google Maps NA
Passwords NA
Plists NA
Video 1
Phone Information YES
Podcasts NA
Network Info YES
Bluetooth Info YES
YouTube NA
HTML NA
GPS NA
Google Mobile App NA
Safari History NA

Capture reported on all items I expected.  Nothing shocking.

Scenario 2 Findings:

BC after manual deletion – I deleted all the pictures, call logs, SMS, videos, and contacts.  I did not delete music files.

Item 2. BC after manual Delete
Call Log 0
SMS 52
Email NA
Contacts NA
Calendar NA
Notes NA
Pictures 10
Songs 5
Web History NA
Bookmarks NA
Cookies NA
Kayak Travel NA
Google Maps NA
Passwords NA
Plists NA
Video 1
Phone Information YES
Podcasts NA
Network Info YES
Bluetooth Info YES
YouTube NA
HTML NA
GPS NA
Google Mobile App NA
Safari History NA

The pictures that remained after the manual deletion were actually album art from iPod.  I did not delete the music when I perfomed manual deletions.  I was surprised to find 52 text messages remaining.  When the texting app was viewed on the iPhone none were viewable.  From a forensics and electronic discovery this is interesting as items can be recovered even after manual deletions.  Other than the texts that were recovered I was not shocked by the results.

Scenario 3:

BC after system reset – I used the iTunes application in Windows to reset the device to factory settings.  When undertaking this action I was forced to upgrade the iPhone to version 4.1.2 OS.

Item 3. BC after system reset
Call Log 0
SMS 0
Email NA
Contacts NA
Calendar NA
Notes NA
Pictures 0
Songs 0
Web History NA
Bookmarks NA
Cookies NA
Kayak Travel NA
Google Maps NA
Passwords NA
Plists NA
Video 0
Phone Information YES
Podcasts NA
Network Info YES
Bluetooth Info YES
YouTube NA
HTML NA
GPS NA
Google Mobile App NA
Safari History NA

The only information available was the phone information, which is most likely from the SIM card.  I am not surprised by the results as a full system restore would purge the items purported to be captured by the Basic Capture.

 Scenario 4 Findings:

File System capture after manual deletion – I captured the file system after manually deleting pictures, call logs, SMS, videos, and contacts.  I did not delete music files.

Item 4. File System dump after manual delete
Call Log 0
SMS 52
Email 0
Contacts 210; 26 deleted; 236 total
Calendar YES
Notes YES in full
Pictures 264
Songs 20
Web History YES
Bookmarks YES
Cookies YES
Kayak Travel Evidence it was installed
Google Maps YES; history
Passwords None I could Find
Plists Many
Video 1
Phone Information YES
Podcasts None I could find
Network Info YES
Bluetooth Info YES
YouTube YES
HTML YES
GPS YES, info from Maps App, previous searches and destinations
Google Mobile App Search History
Safari History Search History

 

Jackpot!  Even after the manual deletion of what a typical user would be able to delete through the iPhone interface I was able to recover a lot of great information.  A cornucopia of forensics goodies including browsing history, deleted contacts, the same 52 text messages as in scenario 2, Google Maps information, calendar entries, notes and much more!   

Scenario 5 Findings:

FS capture after system reset – I used the iTunes application in Windows to reset the device to factory settings.  When undertaking this action I was forced to upgrade the iPhone to version 4.1.2 OS.

Item 5. FS dump after system reset
Call Log 0
SMS 0
Email 0
Contacts 0
Calendar 0
Notes 0
Pictures 0
Songs 0
Web History 0
Bookmarks 0
Cookies 0
Kayak Travel 0
Google Maps 0
Passwords 0
Plists 0
Video 0
Phone Information YES
Podcasts 0
Network Info 0
Bluetooth Info 0
YouTube 0
HTML 0
GPS 0
Google Mobile App 0
Safari History 0

 

Blanked!  I was somewhat surprised of what a good job the system restore did.  The only information was the basic phone information (probably from SIM).

 

Conclusion:  Without a full system restore there is plenty of useful information to be had on the iPhone for forensic analysis and traditional eDiscovery.  If you plan on selling your old iPhone make sure you do a full system wipe through iTunes.  That’s still no guarantee traces of data won’t be left behind but it’s better than a manul deletion of texts, call logs, etc.  In addition to the phone itself, a wealth of information would likely be available on the PC or MAC used to manage the iPhone.  That’s a different article and test! 

Dear Santa: I wish I was able to perform a full forensic physical capture to grab deleted space. With that type of capture I would expect to find deleted photos and other information even after a fully system reset through iTunes.  There are a few methods to accomplish this task and that will be the next test.

Final Thoughts: Attorneys dealing with eDiscovery preservation issues must realize the importance of identifying evidence that may exist outide traditional e-mail boxes and server shares.  The world is changing!

 



Cloudy ISP Personal Jurisdiction

November 18, 2010

ISP providers and a California-based company developed an internet activity inception device that monitored ISP subscriber’s internet usage.  The device collected websites visited and search term history.  The data was then transmitted to the Defendant in Redwood City, California for analysis to develop targeted marketing to the ISP subscribers. Valentine v. Nebuad, Inc., 2009 U.S. Dist. LEXIS 93454 (N.D. Cal. Oct. 6, 2009).

The ISP subscribers were not pleased when they learned their internet usage was being monitored and sold for targeted marketing.  They sued in the Northern District of California, claiming the Defendants violated the Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2510 et seq.; California’s Computer Crime Law, Cal. Pen. Code § 502; the Federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030; and California’s Invasion of Privacy Act, Cal. Pen. Code § 630 et seq. Valentine, at *6. 

None of the Plaintiffs were from California.  Other than the Defendant who developed the collection device (who went into liquidation by the time of the litigation), none of the other ISP Defendants were based in California.  In short, no one in California had their data collected. 

The Defendants moved to dismiss the case based on a lack of personal jurisdiction. 

Personal Jurisdiction Analysis

The Plaintiffs needed to show there was specific jurisdiction over the Defendants in order for the case to be heard in California.  The three-part test in the Ninth Circuit for specific jurisdiction is as follows:

 (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform some act by which he purposefully avails himself of the privileges of conducting activities in the forum, thereby invoking the benefits and protections of its laws;

(2)  The claim must be one which arises out of or relates to the defendant’s forum-related activities; and

(3)  The exercise of jurisdiction must comport with fair play and substantial justice, i.e. it must be reasonable.

Valentine., at *10-11.

The plaintiff must prove the first two prongs of the test; if the plaintiff is successful, the burden shifts to the defendant to “present a compelling case’ that the exercise of jurisdiction would not be reasonable.” Valentine, at *11.

“Purposeful availment” and “Purposeful direction”

 As for the first prong, the Court applied both the “purposeful availment” and “purposeful direction” tests to determine if there were sufficient minimum contacts with California. 

While the “purposeful direction” analysis did find the Defendants engaged in an intentional act, there were significant problems finding the conduct was “expressly aimed” at California due to the lack of any Californian Plaintiffs. Valentine, at *18-21.

As the Court explained:

Plaintiffs have provided no facts demonstrating harm suffered in California, and offer no meaningful “foreseeable effects” that occurred in California. Speculating that some Californians must have had their data intercepted while communicating with Plaintiffs is an inadequate basis for asserting personal jurisdiction.

Valentine, at *20-21.

“Purposeful availment” requires that a “defendant ‘have performed some type of affirmative conduct which allows or promotes the transaction of business within the forum state.’” Valentine, at *22.

The Court found that the ISP Defendants had “purposefully availed” themselves to the laws of California.  Valentine, at *24.

The Court took the “highly realistic” approach and noted that the ISP Defendants provided the data to the Defendant in California, which was used in the targeted advertising to the out-of-state Plaintiffs.  The profits from the advertising were split between the Defendants. 

As the Court explained, the “economic reality,” was that “much of this activity occurred in California, under the protection of California’s laws, to the benefit of both NebuAd and the ISP Defendants.”  Valentine, at *24, citations omitted. 

Forum-Related Activities  

The issue of whether the action arose out of forum-related activities was easily answered “yes.”  The data was collected and then used in California, which the Plaintiffs claimed violated California law.  Valentine, at *25.

Reasonableness

The Ninth Circuit has a seven factor test on whether or not exercising jurisdiction would be “reasonable”:

1) The extent of the defendant’s purposeful interjection into the forum state’s affairs; 2) The burden on the defendant;

3) Conflicts of law between the forum and defendant’s home jurisdiction;

4) The forum’s interest in adjudicating the dispute;

5) The most efficient judicial resolution of the dispute;

6) The plaintiff’s interest in convenient and effective relief; and

7) The existence of an alternative forum.

Valentine, at *25-26.

The Court held that exercising personal jurisdiction over the out-of-state Defendants was not reasonable.  Valentine, at *30.

As the Court explained: 

Even if NebuAd were not in the process of liquidation, it would be difficult to imagine how forcing the six out-of-state ISP Defendants to come to California to defend a lawsuit brought by out-of-state Plaintiffs could be reasonable. California and Plaintiffs both have little interest in having this dispute heard in this forum, especially given that Plaintiffs can file suit in the states where they — and the ISP Defendants — reside. Forcing the ISP Defendants to appear in California imposes a moderate burden on them, which is barely justified by whatever benefit they reaped from California law. Although hearing Plaintiffs’ claims against NebuAd and the ISP Defendants in one place may ultimately be more efficient, even  that apparent advantage fades away in light of NebuAd’s dissolution, and similar economies of scale could be achieved in separate fora through multidistrict litigation. Valentine, at *29-30.

Bow Tie Thoughts

When cloud-computing services turn into lightning storms because of disputes over interstate data breaches, Courts will find themselves in a perfect storm of personal jurisdiction analysis.  Cases will surface, with data hosted in one state, parties based in one and a service provider in another.  The analysis will be similar to the above case.  I would not be surprised if we see a case to rival Asahi Metal Industry Co. v. Superior Court, 480 U.S. 102 (1987) over “cloudy” personal jurisdiction questions in the future.


Establishing Prejudice: Putting the Brakes on Spoliation Motions

November 15, 2010

In a very short opinion, Magistrate Judge Facciola showed a path to putting the brakes on spoliation motions: “Assessing whether sanctions are warranted for the loss of otherwise discoverable information is a function of whether a party has been prejudiced by that loss.”  Davis v. Grant Park Nursing Home, LP, 2010 U.S. Dist. LEXIS 118853 at *3 (D.D.C. Nov. 9, 2010).  

Demonstrating prejudice is not new.  Judge Facciola discussed it in D’Onofrio v. SFX Sports Group, Inc., 06-cv-687, 2010 U.S. Dist. LEXIS 86711, at *11 (D.D.C. Aug. 24, 2010).  As Judge Facciola explained:

Prejudice to a party can only be examined by looking at all the information that is available, for only in that context can the nature and extent of the loss suffered be accurately gauged.

Davis, at *3. 

The path to controlling the rush to file spoliation motions is when these motions should be filed.  In this case, the Court held that discussing sanctions was “premature” until the end of discoveryDavis, at *3-4. At that time, the Court could accurately determine if there had been any prejudice from the alleged destruction of electronically stored information.  Davis, at *4.

Bow Tie Thoughts

The failure to issue a litigation hold and the preservation of evidence are unquestionably important issues.  Courts seek the truth of a matter and if evidence has been destroyed, sanctions should rightly issued on the offending party.

Now for the big “however”: the question of sanctions is not a game.  The hint of a failure to issue a litigation hold is not reason to put a party in a stockade.  While it should put a party on alert, there must be prejudice before a call to arms for sanctions.  Moreover, the a court is best able to determine if a party has suffered prejudice is at the close of discovery, not the beginning or middle of it.


Ahhh– We have to review the Text Messages for Mr. Big – Now What?

November 8, 2010

By Tom Groom, Vice President, D4 LLC

There are very few people today who don’t thumb text messages on their phones. We tend to treat text messages as if they can’t be retrieved once we hit send. “Nobody will find this” one may tell themselves. Oh really? What happens when opposing counsel requests text messages be included from one of your key custodians? At first you object in that your client’s text messages are not “reasonably accessible” but that argument isn’t as easy to win as it used to be. Once you’ve accepted the fact that review of the text messages is going to happen, the question hits you — “How can text messages most efficiently be reviewed?”

The answer may surprise you. Think of each individual text message as a record (like an email or Word document). If properly collected, each text message record has metadata associated with it that can be used to stitch together the bigger story. Text message timeframes are normally measured in seconds (vs. days as with email), so they are often reviewed in a separate database than email or scanned documents. The key for efficient text message review is to have a common “date and time” field to sort the messages in order to create a conversation. This is especially true if messages for more than one custodian are being reviewed. Another key is to leverage relational fields that can be used to associate phone numbers to participants as well as to enable “group and pivot” reports between phones, participants, timeframes and even conversational tone.

Relativity hosted by D4 provides such a platform, as shown in the screen shots below. Text messages from three different phones were placed into this database. From here the reviewer can choose which phones to include as well as which participants to include in the query. Sorting by date and time will piece together the text messages between parties which can help establish intent and/or reveal interesting behavior.

 

Using the new “Pivot” feature in the Relativity 6.x system, one can analyze which participant created the most messages.

 

By grouping on participant and pivoting on “tone”, one can determine which messages are sent and received for business, personal and with some enhancement, the type of conversational tone used in the message such as “aggressive” or “flirtatious”.

You will likely be involved with a case involving cell phone collection and review in the future.  When that happens, be assured there are processes and tools that you can leverage to make text messages collected from phones more useful for your matter.


Quashing Subpoenas with the Stored Communication Act

November 4, 2010

In a lawsuit over the death of a prison inmate, the Plaintiff served Yahoo with a subpoena for all of the Defendant’s email for a period of nearly two years.  Janice Chasten v. Franklin, 2010 U.S. Dist. LEXIS 113284 (N.D. Cal. Oct. 14, 2010).

The Defendant moved to quash the third-party subpoena on Yahoo, claiming the subpoena was “an unwarranted invasion of his privacy and is in violation of the Stored Communications Act.” Chasten, at *2.

The first issue was whether the Defendant had standing to challenge a subpoena on a third-party.  The Court held the Defendant did have standing, because the Defendant had a “personal right with respect to the emails sent from his Yahoo! email account and thus,” standing to quash the subpoena. Chasten, at *4.

The Defendant argued that the SCA prohibited Yahoo from disclosing the contents of his stored email in response to the third-party subpoena.  Chasten, at *4.

The Court’s legal findings were very direct: “He [the Defendant] is correct.”  Chasten, at *4.

As the Court explained, the SCA prohibits electronic communication providers or remote computing services (i.e., Cloud Computing) from “knowingly divulging the contents of their customers’ electronic communications or the records relating to their customers.”  Chasten, at *4.

To be blunt, a Federal Rule of Civil Procedure Rule 45 subpoena is not one of the exceptions for an electronic communication provider to knowingly disclosing stored information.  Chasten, at *4-5.

As there was no exception to the SCA to allow the production of the stored email, the Court held such production would be “an invasion . . . of the specific interests that the [SCA] seeks to protect.” Chasten, at *5.

Bow Tie Thoughts

Google, Yahoo!, Facebook and numerous other technology companies subject to the protections of the Stored Communications Act are based in Santa Clara County, California.  I suspect Magistrate Judges at the Federal Courthouse and Discovery Judges at the State Courthouse in San Jose, California will hear many such motions in the months to come.


Arguing Back-Up Tapes Are Not Reasonably Accessible

November 2, 2010

The Defendants in Johnson v. Neiman sought an order to not produce email messages located on back-up tapes on the basis the electronically stored information was not reasonably accessible. 

The Court agreed and issued a protective order.  Johnson v. Neiman, 2010 U.S. Dist. LEXIS 110496 (E.D. Mo. Oct. 18, 2010).

As the Court stated, “’reasonably accessible’ is best defined as whether the electronically stored information is kept in an accessible or inaccessible format (a distinction that corresponds closely to the expense of production).” Johnson, at *4. 

Federal Rule of Civil Procedure Rule 26(b)(2)(B) limits the production of electronically stored information as follows:

 (B) Specific Limitations on Electronically Stored Information. A party need not provide discovery of electronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost. On motion to compel discovery or for a protective order, the party from whom discovery is sought must show that the information is not reasonably accessible because of undue burden or cost. If that showing is made, the court may nonetheless order discovery from such sources if the requesting party shows good cause, considering the limitations of Rule 26(b)(2)(C). The court may specify conditions for the discovery.

Johnson, at *3-4. 

The Defendants explained the responsive data was on 5,880 back-up tapes.  Johnson, at *4. 

Further, it would take 1.5 hours to catalog a tape and 1 hour to restore (or 14,700 hours). 

Creating a PST would take approximately 5 minutes per each Outlook e-mail account and there were 13,468 email accounts (which would take 67,340 minutes/1,122.3 hours/46.7 days for PST creation). 

The estimated hourly cost was $76.03 ($1,117,641.00 for the tapes and $85,328.47 for the PST creation).  Johnson, at *4-5. 

The Court found, based on the facts presented, the back-up tapes to be not reasonably accessible.  Johnson, at *5. 

The Pro Se Plaintiff countered that the back-up tape “evidence is relevant and material to the defendants intent, state of mind and to prove other subjective bad feelings towards the Plaintiff.” Johnson, at *5.  While not a direct good cause argument, the Court evaluated the Plaintiff’s argument under the 7 factor “good cause” test stated in the Advisory Committee Notes to the Federal Rules of Civil Procedure.  Johnson, at *5-6. 

“Good Cause” Inquiry includes:

(1) The specificity of the discovery request;

(2) The quantity of information available from other and more easily accessed sources;

(3) The failure to produce relevant information that seems likely to have existed but is no longer available on more easily accessed sources;

(4) The likelihood of finding relevant responsive information that cannot be obtained from other, more easily accessed sources;

(5) Predictions as to the importance and usefulness of the further information;

(6) The importance of the issues at stake in the litigation; and

(7) The parties’ resources.

Johnson, at *5-6, citing Fed. R. Civ. P. 26(b)(2) advisory committee’s notes (2006 Amendment).

The Plaintiff, in the words of the Court, had “no idea what, if any, discoverable information may be obtained by cataloging, restoring, and searching the MDOC e-mails that are stored on the backup tapes.” Johnson, at *7-8. 

Furthermore, the Defendants produced over 914 documents in their initial disclosures and an additional 1500 pages in response to the Plaintiff’s discovery request.  Johnson, at *6-7. 

The Court held that there was a “slim likelihood that new and relevant information may be discovered does not outweigh the substantial burden and expense required to retrieve the information from the backup tapes.” Johnson, at *8. 

Bow Tie Thoughts

The dogmas of the quiet past are inadequate to the stormy present. The occasion is piled high with difficulty, and we must rise with the occasion. As our case is new, so we must think anew and act anew.

Abraham Lincoln, December 1, 1862.

Case law for nearly a decade has taken the position that back-up tapes are inaccessible as a matter of course.  Technology has changed so that dogmatic position is no longer valid.

There are new tools, such as Index Engines, on the market that reduce the cost to searching back-up tapes to $250 a tape. 

The challenge is this product knowledge seems limited to service providers and not the attorneys arguing that back-up tapes are not reasonably accessible.   Many attorneys still consider that back-up tapes are not reasonably accessible as a truism, unaware that technology has greatly reduced the cost arguments.  This is not a surprise, since lawyers are busy focusing on the subject matter of their cases and not watching for the newest e-Discovery product. 

In the current case, the prospect of restoring nearly 6,000 back-up tapes would still have been an instant undue burden argument at $250 a tape.  However, if the back-up tape count could be narrowed to a specific timeframe to reduce the tapes to a manageable number, indexing the data might not be cost prohibitive.  Moreover, sampling 5 or 6 back-tapes should not be unduly burdensome in determining if any further discovery is warranted.

This case is also a prime example of the importance of the Rule 26(f) conference and being able to state why a set of back-tapes is relevant.  It is highly unlikely a requesting party would want to review over 13,000 email accounts and restore all 5,880 back-up tapes.  Moreover, the workflow of manually creating PST’s and an hour to restore back-up tapes sounds like the work is being conducted by the party itself.  An outside service provider with the collection tools could greatly reduce the cost of collection and production. 

Regardless, the Plaintiff having “no idea what, if any, discoverable information may be obtained by cataloging, restoring, and searching the MDOC e-mails that are stored on the backup tapes,” certainly did not help their restoration arguments. Johnson, at *7-8.

While discovery in this case would not be cheap, it would likely be a lot less than argued in the opinion, if back-up tape indexing tools were used, custodians narrowed and a date range defined so there was a reasonable number of back-tapes.  Whether or not that would still mean the ESI was not reasonably accessible because of undue burden or cost would still need to be analyzed under Federal Rule of Civil Procedure Rule 26(b)(2)(B).

e-Discovery is always evolving.  As part of our duty of competency as attorneys, we need to be aware of the tools that can save costs and provide technologically correct arguments to the Court.  Just because one form of ESI was unduly burdensome in 2004, does not mean it is a dogmatic truth it will continue to be unduly burdensome in 2010.


Follow

Get every new post delivered to your Inbox.

Join 32 other followers