Are you Focusing Enough on the Potential Implications of Mobile Devices in eDiscovery?

Unlock the secrets of mobile device discovery in litigation with our latest episode featuring Kelly Twigger. Explore the crucial decision in Wegman v. US Specialty Sports Association Inc., where Magistrate Judge Robert Norway's ruling highlighted the increasing responsibilities of preserving electronically stored information (ESI) on mobile devices. This episode is your key to understanding the legal intricacies of mobile device usage in the workplace and the necessity for clear data preservation policies. Delve into the challenges organizations face, from user deletions to the limitations of cloud storage solutions like iCloud.

Enhance your eDiscovery expertise as we journey through the complexities of mobile device data preservation. Discover the obstacles posed by lost or damaged devices and factory resets, and learn about data recovery techniques that can mitigate these issues. This episode serves as a valuable resource for legal professionals looking to optimize their electronic discovery processes. With insights drawn from significant cases like Hunters v. City of Seattle and NRA Pork, we provide actionable strategies to ensure compliance and improve litigation outcomes. Don't miss this opportunity to refine your litigation strategies in the evolving landscape of eDiscovery.

Tune in for practical insights and actionable strategies to stay ahead in the complex landscape of eDiscovery.

Wegman v. U.S. Specialty Sports Ass’n, Inc.
Read the blog about this case- eDiscovery Assistant Blog
eDiscovery Assistant Website
Sign up for Kelly's Case of the Week Newsletter here
eDiscovery Assistant Free 7 day Trial (no credit card required)

Thank you for tuning in to Case of the Week with Kelly Twigger. If you found today’s discussion helpful, don’t forget to subscribe, rate, and leave a review wherever you get your podcasts. For more insights and resources on ediscovery, visit Minerva26 and explore our practical tools, case law library, and on-demand education from the Academy. Join us next episode as we break down another important case shaping the future of ediscovery.

Chapters

• 0:13 Mobile Device Discovery and Preservation
• 1:29 Case Introduction
• 2:08 Facts and Analysis
• 5:43 Key Takeaways
• 8:15 Mobile Device Data Preservation Considerations

Transcript

Kelly Twigger: 0:13

Welcome to the Case of the Week podcast, where each week, we break down a recent decision in electronic discovery case law and talk about the practical impact for you and your clients and keep you up to date on your obligations with electronically stored information as evidence. If you're a litigator, legal professional or you love the power of ESI as much as I do, this is the place to be. I'm Kelly Twigger, the CEO and founder of eDiscovery Assistant and the principal at ESI Attorneys, with more than 25 years of experience navigating the evolving landscape of litigation and e-discovery. I'm a practicing attorney, author, speaker, entrepreneur and now podcaster who works as a discovery strategist and expert for clients at ESI Attorneys and to provide that knowledge to all legal professionals through our e-discovery assistant platform. In each episode, we'll tackle a new decision in e-discovery case law and how it shapes both your litigation strategy and planning for risk mitigation. If you're ready for blunt, actionable insights that keep you ahead of the curve, and maybe a few laughs along the way, this is your go-to podcast. Subscribe or follow now to start embracing the power of our case of the week series brought to you by e-discovery assistant.

Kelly Twigger: 1:36

This week's decision comes to us from wegman versus us specialty sports association inc. Which we'll refer to as u triple. This decision is from United States Magistrate Judge Robert Norway from the Middle District of Florida, from December 12th of 2023. As always, we tag each of the issues in our case law database with our proprietary issue tagging structure, and this week's issues include failure to produce mobile device and scope of preservation. Judge Norway has four decisions in our database from his seat in the Middle District of Florida. This is a very short decision. I mean four or five paragraphs. You could read it in about 10 minutes. So we're going to combine the facts and analysis today and really get to what are the key takeaways from this case.

Kelly Twigger: 2:21

We're before the court here on a motion to compel the defendant, donald Donatus, to return property and join copying and for fees and costs. Donatus was an employee of USSSA who was put on administrative leave and asked to return his mobile devices to USSSA for imaging and preservation. Now the opening quote from the court here pretty much gives away the punchline. The court stated quote few things are certain in life or litigation, but given the representations made by his counsel at the recent hearing, donatus could bet dollars to donuts that he has no choice but to turn over three electronic devices in his possession that belong to the United States Specialty Sports Association. Close quote.

Kelly Twigger: 3:04

Now, prior to the hearing on the motion, the court had denied Donatus' motion allowing him to create forensic copies of the devices before returning them to USSSA, and the court summarily acknowledged in this motion that the both parties were aware of the duty to preserve the information on the devices and that that duty to preserve attached to those devices in question. The court then really looked at whether or not the devices belonged to the U-triple-S-A such that they needed to be returned, and it found that they did. The court noted that counsel for Donatus conceded the possession or the ownership by U-triple-S-A at the hearing, citing to the language of the employee handbook from USSSA, which stated that quote all technology provided by USSSA, including computer systems, communication networks, association-related work records and other information stored electronically, is the property of USSSA and not the employee. Close quote. Now, that's important because that's language directly from the employee handbook, and part of our takeaways are the steps you're going to need to take to make sure that you have rights to access this information. Now, per the court, donatus' retention of USSSA's property prevented USSSA from fulfilling its duty to preserve the evidence, thereby prejudicing it. The court also found and this is key that quote organizations know what their employees know close quote and that Donatus was once USSSA's CEO. Now that he's on administrative leave and his relationship with USSSA has soured, those devices contain evidence that the organization needed to determine what he knew when he learned about it, what he did about it and who was involved.

Kelly Twigger: 4:43

Donatus's failure to return USSA's devices frustrated the organization's collection efforts, according to the court, stymied its investigation into the events that formed the basis of plaintiff's claims and thwarted the preparation of the organization's defenses. All of those led to the prejudice and need for the return of the data. The court then required Donatus to return the unaltered devices within three days and not to access, copy or tamper with any of the ESI on the devices. Now, things that are not included in the facts of this decision are when Donatus was placed on administrative leave, how long he's held those devices without providing them to USSSA. We know that at least there was one previous motion where Donata said asked the court to allow him to make forensic copies and to give those forensic copies to USSSA rather than the actual devices themselves, and that motion was denied. Okay. So what are our takeaways from this very short but really important decision.

Kelly Twigger: 5:43

I picked this one today because mobile device discovery is huge right now. It's everywhere and we're having discussions about possession, custody or control. When do organizations have the ability to get data from an employee's personal device? Does that employee use the device for work? What if they don't use it for work? There's so much analysis going on in this area right now that it is of vast importance for you and your clients to be understanding what their obligations are with regard to data on mobile devices and what steps they need to take to be able to ensure the preservation of that data when they have a duty to preserve it.

Kelly Twigger: 6:22

So takeaways as I just mentioned, employees' use of mobile devices to conduct business is rampant. Covid pushed us all in that direction very quickly, but the advent of new technologies and now the prevalent need to respond instantly within business make the use of mobile devices very necessary for business. We've steered away a lot from BYOD policies, where companies were providing devices and company business was to be conducted on those devices. More of what is in the market now and it's not exclusive. There are certainly industries that are regulated that have multiple devices, but a lot of what we see working on the law firm side is employers. They know well that their employees are using their mobile devices to conduct business and that's going to subject them to discovery. All of that means that mobile devices are a prime source of evidence in discovery and that you need to be thinking about how to acquire and preserve evidence from them out of the gate when you're talking about litigation.

Kelly Twigger: 7:21

Now, as I read this short decision in Wegman, the immediate issue that came to mind was what data could be lost as a result of USSS aides not reclaiming the devices from Donatus prior to him going on leave. We've seen so many examples of devices being lost, dropped in the ocean or a lake, accidentally being stolen from cars just about every excuse that you can think of as to why they no longer exist. If you want a good summary of some examples, you can look at the Hunters v City of Seattle case that we covered on Case of the Week in 2023. And all of that case law in this area tells us that having a plan for preserving data from mobile devices is crucial. Now, in order to emphasize what data can be lost for failure to act quickly, I reached out to a couple of colleagues on the forensic side to confirm what I already know that actions taken on data and on a cell phone often cannot be undone or located by an expert.

Kelly Twigger: 8:15

Ryan Fry, who is a forensics expert with ModeOne, who have designed software for the remote collection of mobile devices, identified multiple areas of concern or consideration when a user's device is not preserved right away. The most obvious is when it's lost, stolen or damaged, as we just talked about. The next is user deletion that the user specifically deletes bubbles or entire threads of conversations. Now that's important because the deletion recovery window from iOS devices is roughly 30 to 40 days for user deleted messages. Some of that changed in the new operating systems. From iOS, it's different for Android, so you need to understand which system you're dealing with. The next is automatic deletion of ESI through settings where message retention is set to automatically delete message after 30 days or one year. Those are two options that exist aside from the default, which is forever. So if a user has specifically set their messages to roll off at a certain period of time, that will impact the ability to recover them. We actually saw that in the Hunters versus City of Seattle case.

Kelly Twigger: 9:19

According to Ryan, without a deep dive forensic collection, which is expensive and requires an in-person process. Recovering older user-deleted messages or automatically deleted messages is extremely challenging and there's a very low probability you're going to get that. Data Proving user deletions are also very challenging in court without the other side's transcript of the text thread or messaging, whatever it means for that particular application. So remember that for texts and instant messages you've got on the device from and to. Sometimes, if they're a desktop device, you might also have information that way. So the question is is it available from another source? It's easier to piece that together, but it's going to cost a lot of time and money to do so. So that's a consideration Specific to iPhones.

Kelly Twigger: 10:06

Ryan also noted that there are iCloud concerns. Many think that iCloud can be the source of truth for device collections and the risk there includes multiple things authority, incompleteness and security issues. With regard to authority, if the custodian used their personal iCloud account, the company may not have the authority to get access to those contents. That specifically usually relates to text messages and that's exactly what we saw in the NRA Pork case that the court held that there was no access, no availability for the organization to have possession, custody or control over the text messages because of the way they had engineered their devices for employee use. The second that Ryan noted is incompleteness. Depending on the configuration of the iCloud, a message may not even be included in the iCloud backup. Many companies enforce policies to not even allow phones to backup to iCloud, since it is Apple's public cloud and they can't control or manage that. So relying on the iCloud backup has a lot of defects to the thought process. The final one is security. Advanced data protection recently released for the iPhone means access to iCloud data by commercial products cease to work and if and when they catch up, it still requires the device to provide consent based on access to the decryption keys that are no longer managed by Apple. So you've got another consent issue there to be able to gather information from the iCloud. Now, all of that came from Ryan Fry. Appreciate, ryan, you weighing in there. Thanks very much.

Kelly Twigger: 11:35

Another forensic professional that I talked to provided additional considerations and advice for both employers and employees. First, employees utilizing company-owned devices should exercise data hygiene and segregate their personal activities and work activities on different devices. That doesn't happen very often in what we see with mobile device discovery. Working on the firm side, this expert noted that almost every forensic examiner you meet will carry two devices one from the company they work, where activity occurs for work, and one that they own themselves, where non-work activity occurs. Next, this person noted that any use of a personal device for work may subject it to discovery, and we've talked about that multiple times here. The standard from the courts is whether or not relevant data exists on the device. There is, of course, the issue of possession, custody and control, which I mentioned earlier, but the courts have been leaning towards requiring production of devices even where they are not company-issued but where there is relevant data and the company was aware that the employee was using the personal device for work.

Kelly Twigger: 12:37

Next from this expert, many, many more phones are being surrendered by employees in factory reset mode and when that happens, forensic tools are unable to recover data from a factory reset mobile device. Apple and Android devices cannot be physically imaged. An advanced logical or full file system puller about the best that a forensic expert can do, short of getting the forensic bitstream image, which is the gold standard for preservation purposes. So essentially, we can't do what we need to do to meet that gold standard from a forensic perspective if the phone is set to reset to factory settings. That needs to be considered in your exit interviews with employees, where you either have a duty to preserve or you think there's a potential, there will be a duty to preserve.

Kelly Twigger: 13:23

Fourth, from this expert, cloud synchronization, collaboration and automatic backups offer alternative to a direct image in circumstances where the custodian refuses to cooperate. Again, we have the limitations that Ryan Fry noted from this issue, and this expert knows that it takes skill, which means a lot of time and money, as we've talked about, to reassemble the puzzle pieces giving the access that corporate IT has to these alternative sources. It's possible, but it's going to be costly. A good IT posture assumes that the employee ultimately doesn't return all the devices that they've been issued. Remote working has made the off-boarding process for those devices much more difficult, as this expert notes, and a thoughtful off-boarding process should kick in well before the final day of separation and increases the odds that data is returned to the corporation. So get your exit process in line for your remote workers, include mobile device data and include that that information is going to be returned to you so that you can review it prior to the last day of employment for that employee. Thanks to my colleagues for writing all of that crucial information on why timing is crucial in preserving mobile devices. We're going to keep an eye on the Wegman matter to see if anything untoward arises following the return of the devices.

Kelly Twigger: 14:37

All right, that's our case of the week for this week. Thank you so much for joining me. We'll be back again next week with another decision from our eDiscovery Assistant database. As always, if you have suggestions for a case to be covered on our case of the week, please drop me a line. If you'd like to receive the case of the week delivered to your inbox via our weekly newsletter, you can sign up at ediscoveryassistantcom backslash blog and if you're interested in doing a free trial of our case law and resource database, you can jump to ediscoveryassistantcom and click to get started.

Kelly Twigger: 15:03

Thanks so much. Have a great week. Thanks for joining me on the case of the week. Podcast Tune in next episode as I discuss a new decision in eDiscovery case law and identify the issues you need to be paying attention to and how they can help you do better discovery for your clients and leverage the power of ESI. Be sure to subscribe and leave a review to help others discover the show and be kept in the know on all things electronic discovery. I'm Kelly Twigger. See you next time.