tracking digital footprints: electronic evidence from ... · tracking igital footprints electronic...
TRANSCRIPT
Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Wednesday, March 14, 2018 Noon–1 p.m.
1 Practical Skills credit
iiTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
TRACKING DIGITAL FOOTPRINTS: ELECTRONIC EVIDENCE FROM SMARTPHONES, TEXT, VOICEMAIL, GPS, AND SOCIAL MEDIA
The materials and forms in this manual are published by the Oregon State Bar exclusively for the use of attorneys. Neither the Oregon State Bar nor the contributors make either express or implied warranties in regard to the use of the materials and/or forms. Each attorney must depend on his or her own knowledge of the law and expertise in the use or modification of these materials.
Copyright © 2018
OREGON STATE BAR16037 SW Upper Boones Ferry Road
P.O. Box 231935Tigard, OR 97281-1935
iiiTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
TABLE OF CONTENTS
Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
Faculty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
Presentation Slides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
ivTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
vTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
SCHEDULE
Presented by Tom Howe, Howe & Associates, Portland
11:30 Registration
Noon Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
F Using smartphone evidence, social media accounts, and GPS location information for better case outcomes
F Types of smartphone data that are captured and stored
F Social media as an online personal diary
F Geolocation information on smartphones, computers, social media, cameras, and other devices
1:00 Adjourn
FACULTY
Tom Howe, Howe & Associates, Portland. Mr. Howe is one of the leading e-discovery lawyers in the country, providing legal/technology consulting and expert witness services to the United States government, Fortune 500 corporations, law firms, and e-discovery service providers. He has also written major software systems for e-discovery vendors, law firms, and corporate clients. The Legal Operation Tracking System is a comprehensive program that tracks all legal matters within a corporate legal department, including its collection of documents and electronically stored information, enabling faster and more defensible discovery. Mr. Howe is a regular CLE presenter across the United States and internationally and has authored five books on law and technology. He is licensed to practice in Oregon and Washington and is certified in Computer Forensics and Electronic Counter Surveillance.
viTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
1Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Tracking Digital Footprints
Tom HoweHowe & [email protected]
About Tom HoweeDiscovery LawyerExpert witness for Law Firms throughout the U.S. with smartphone, computer, email, and social media evidence.Author of 5 books on law and technology.Speaks at legal conferences in the U.S. and Canada, and presented CLEs in over 10 states.
2Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Download Session MaterialsEverything you see on these slides is contained in a PDF file and all Word, Excel and PDF sample documents. You have it all!
Please download a zip file with all the PowerPoint slides and samples for this session.Download Link: http://howelawfirm.com/Events
Links to VendorsWeb links to vendors, products, and services are provided as examples.Do your own research to find the best vendors, products, and services to meet the specific needs of your law firm.
3Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Goals of CLEImportance of Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media.Develop cost-effective and defensible strategies for dealing with electronic evidence.Examples of use of electronic evidence.
ORCP 43 – “electronically stored information”ORCP 43 specifically refers to “electronically stored information.”
4Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
PRESERVE AND COLLECT DEFENSIVELYFirst Step – preserve and collect evidence!Preserve data that is “reasonably anticipated to be relevant to litigation” to prevent spoliation or destruction of data.Preserve – act fast and early, including computers, smart phones, devices, and online data.
Sample Preservation Letter to ClientSample Preservation Letter to Client.docx
5Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Sample Preservation Letter to Opposing PartySample Preservation Letter to Opposing Party.docx
Discovery Protocol Agreement
6Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Collection
Collection OverviewCollect data in a defensible manner and make sure there is a “chain of custody” for all smartphone, computer, email, social media, and other electronic evidence.If the collection is not done correctly, all other parts of the e-discovery process are under attack: preservation, culling, processing, reviewing, and producing. Case law has many examples of expensive “do-overs”. An e-discovery mulligan is expensive.
7Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
BEST: Collection by Outside Independent ExpertIt is best to use an independent expert for collection, it is one of the least-expensive part of e-discovery but poses the greatest risk.
NEXT BEST: Collection by Law Firm Staff Typically, this may be a law firm’s IT person.They may be knowledgeable about computers, but not e-discovery and computer forensics.Searching in Outlook is not defensible.o You must collect before reviewing.o The search function in Outlook only searches the email message, not the attachments!o Searching and reviewing emails changes the metadata.
Lack of forensic certifications.You don’t want your employees on the stand.
8Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
WORST OPTION: Collection by ClientSelf Collection: See sanctions cases involving “self-collection” where parties (and their lawyers) were fined.Do not let clients collect their own data.They do not understand the concept of relevancy.Fear of deleting data – spoliation.Better for you to review data (e.g. text messages, emails, and Facebook information).
Remote Collection – PCs, Macs, and Cell Phones
9Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Remote Collection Unit
Remote Collection AdvantagesClients do not have to be without their computers and cell phones.Clients pay a flat fee and save money!Clients do not pay a forensic expert for travel.Able to collect evidence wherever FedEx-UPS-USPS delivers.Collection process is defensible.Collection unit is fully encrypted.No self-collection so fewer chances of spoliation claim and evidence tampering.No Law Firm IT involvement or support issues.
10Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Exciting Moment #1“Tom, I just got a new case. I need to collect and preserve the data only. I don’t want to review any of the data or incur any other costs. I just want to meet my preservation obligation and lock down the data in case I need it later.”The above lawyer gets ediscovery!
How to Get Opposing Party Electronic EvidenceNormal discovery process (Request for Production).Motion to Compel when evidence not produced.Use your own expert.Use a independent neutral joint expert.o Agree to Discovery Protocol.o Cull out privileged information.o Produce to the other party to conduct a legal review and provide you the production or produce to both sides.
Special Master: Court orders expert to carry out the directives in the Court Order. Sometimes and in camera review.
11Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
USING IPHONE AND OTHER SMART PHONE EVIDENCESmart phones (e.g. iPhone, Android, BlackBerry) are targeted for litigation.People save more and more valuable information on the phone: text messages, email, calendar, files, photos, videos, and browser history.
More Mobile Devices than People on EarthIn 2014, the number of mobile devices (7.7 Billion) exceeded the number of people (7 Billion) on Earth!According to the United Nations, more people have cell phones(over 7 billion) than toilets (4.5 billion).
12Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Mobile Addiction or Obsession?
A Day at The Louvre
13Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
NomophobiaNomophobia (an abbreviation for "no-mobile-phone phobia") is an anviety with the fear of being out of mobile phone contact.Sleeping with your Smartphone by Harvard Business School professor, Leslie Perlow.
Smartphones Are Multifunctional
14Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Captain Kirk Did Not Even Have Facetime!
Exciting Moment #2“Tom, I want to look at information on my own client’s phone.” The text messages, emails, and phone calls between the parties exist on your own client’s phone!o Family Law – Communication between spouseso Employments Law – Communication between employees.o Business Litigation – Conversations between businesses.
15Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Look for Evidence that Does Not Exist on the SmartphoneWith electronic evidence you can prove a negative!No phone calls, text messages, photos, to prove sexual harassment.No visits or bookmarks to websites related to an alleged copyright violation.No photos of children to support the argument of lack of significant time with the children in a custody case.
CAN YOU HEAR ME NOW?Consider using smartphone evidence in every case!
16Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Importance of Text Messages
Smart Phone DemoDemo: Sample Smartphone Evidence Report.pdfDemo: Search Term Report.pdfSample iPhone Reports are included in the materials.“Make things as simple as possible, but not simpler.” Albert Einstein
17Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
iPhone Evidence PDF Report - Summary
Calendar
18Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Contacts
Documents
19Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Images
Internet History
20Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Text Messages
Phone Call Logs
21Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Videos
Voicemails
22Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
VoicemailVoicemails can be even more damaging than emails.Alec Baldwin, during a bitter custody case with Kim Basinger over the custody of their daughter, Ireland, left a voice message for his 11-year-old daughter calling her a “rude, thoughtless little pig.”Voicemail file
Waze
23Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
WIFI
Smart Phone Demo – By Search TermDemo: Search Term PDF Report.pdf
24Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
SOCIAL MEDIA AND ONLINE “CLOUD” DATA
The Essence of Social MediaBefore social media, authors and creator of content tended to be book and magazine authors and news reporters.With social media, we are all authors. We no longer consume content of authors but create our own content to share (text, photos, and videos).
25Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Social Media CrazinessSome people post information on social media with poor judgment, and some of the information may have legal consequences.
Employment Case – Taco Bell
26Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Employment Case - IBM
http://www.foxnews.com/story/2007/02/17/man-sues-ibm-for-5-million-after-being-fired-for-visiting-adult-chat-room-at.html
Facebook – Disabled and Unable to Work
27Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Instagram – Disabled and Unable to Work
Family Law EvidencePublic information from social media website related to parent’s behavior.Interactions between parent and child.Information posted about the children.See B.M. v. D.M. - Wife loses alimony when Husband uses Facebook, Myspace, and Blog entries and photo to show that ex-wife is not disabled and can work, as she is shown belly dancing.
28Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
How to Get Online Data?As a general rule, in civil cases, you cannot subpoena the third-party provider.Request the opposing party to produce it because it is within their reasonable control.Do you need to preserve your client’s Facebook account?Commonly used Social Media accounts in litigation”o Facebooko Google+o LinkedIno Instagramo Tumblro Twittero YouTube
Example: Facebook EvidenceThere is often evidence on a Facebook account a case (e.g. copyright, custody).See Facebook – Download Account.pdf in the samples. You can send this file to your client or the opposing party with instructions for how to download Facebook information.If you need information from the opposing party, request that they download the Facebook account and send it to you (it is within their reasonable control).On the top right menu, choose “Account Settings”:
29Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Example: Facebook EvidenceClick “Download a copy of your Facebook data:
Example: Facebook EvidenceClick “Start My Archive”:
30Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Example: Facebook EvidenceYou will receive an email when the download is complete:
Unzip file.Double-click on “Index.html” to run the Facebook account:
Facebook Legal Review PDF ReportsLegal Review for Relevancy, Privilege, Hot, and Redaction.Sample Facebook Evidence Report.pdf.
31Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
GPS Evidence CollectionCell TowerToll BoothsVehicle Black Box (Event Data Recorder)Vehicle GPS TrackingSmartphone GPS Information
Cell Towers (Call Detail Record)Example: Cell Towers (Call Detail Record) Sample.xlsx.
32Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Cellular Provider Retention PeriodsLink: https://articles.forensicfocus.com/2017/04/18/cellular-provider-record-retention-periods.
Information Verizon ATTCall History 7 years 7 yearsSMS Content 3-10 days 0 daysTower Location for Call History 1 year 7 yearsTower Dumps 1 year 7 yearsRange to Tower 8 days 180 days
Toll Booths
33Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Vehicle Black Box (Event Data Recorder)
Black Box - EDR (Event Data Recorder)
Event data recorders collect information from onboard computers continuously. Data sets are briefly stored and constantly replaced in a recirculating loop lasting about 5 seconds.
Vehicle Black Box (Event Data Recorder)Most often the speed, turning, braking, accelerating, decelerating, etc. about five seconds before the collision.
The EDR captures data in an accident in which airbags are deployed. EDR data can be retrieved and analyzed to help determine driver’s actions and how car performed at time of crash.
34Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Event Data Recorder (EDR) Data
Air Bag Control ModuleAir Bag Control Module capability to store crash data on an event data recorderPhoto of the “Air Bag Control Module” from the accident of Timothy P. Murray, when was Lieutenant Governor of Massachusetts.
http://www.nytimes.com/2013/07/22/business/black-boxes-in-cars-a-question-of-privacy.html
35Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Event Data Recorder (EDR) CasesMass. Lt. Governor Tim Murray: On 2 November 2011, Mass. Lt. Governor Tim Murray crashed a government-owned vehicle on a stretch of Interstate 190 (initially, no citations were issued).Murray initially claimed he simply lost control on the ice, wasn’t speeding, was wearing a seat belt and braked. But those claims were all later disproven when the black box data recorder information was released. The data revealed the car was traveling 108 miles per hour, accelerated, and the Lt. Governor was not wearing a seat belt at the time the vehicle collided with a rock ledge and flipped over. Murray was unhurt in the accident. http://www.nytimes.com/2013/07/22/business/black-boxes-in-cars-a-question-of-privacy.html
Event Data Recorder (EDR) CasesN.J. Governor Jon Corzine: On 12 April 2007, N.J. Governor Jon Corzine was seriously injured in an automobile accident. According to the superintendent of state police, an Event Data Recorder in the SUV he was traveling in recorded he was traveling at about 91 MPH five seconds before the crash. The speed limit on the road is 65 MPH. The Governor was not the driver of the vehicle. http://www.nytimes.com/2007/04/18/nyregion/18corzine.html
36Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Vehicle GPS TrackingExample 1: TrackR ($29.99 per month) - www.thetrackr.comExample 2: Spybase ($29.99 per month) -http://www.spybase.com/GPS-Tracking-Car-Tracker-Device-Spy-System-OBDII-p-p/mt-obd-usflt.htm. Simply plug the MT-OBD directly into any OBDII port located under the dashboard of every car manufactured after 1996.
Mini Portable Real Time GPS TrackerUses GPS satellite technology.
37Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Use Google Earth with KMZ File Information
Use Google Earth with KMZ File Information
38Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Smartphone GPS InformationSee: Settings/Privacy/Location Services/System Services
Smartphone Location InformationCheck “Location” setting on your phone.iPhoneo See Settings/Privacy/Location Serviceso Settings: Always, When Using, Never
Androido See Settings/Location
39Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Smartphone App Locations ServicesSee: Settings/Privacy/Location Services
Smartphones GPS TrackingiPhone App: https://device-locator.comAndroid App: https://www.google.com/android/devicemanagerExample: https://device-locator.appspot.com/view/device.php
40Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
PRODUCING ELECTRONIC DATA TO THE REQUESTING PARTYMake sure to produce data in the format agreeable to the opposing party. Stipulate to the form of production or seek agreement in the meet and confer.Types of production:o Papero TIFF / PDFo Native (the standard)o Hosted
Native Format Preserves the MetadataMetadata is quite simply the characteristics or properties of a file. Literally, metadata means “data about data.” Metadata is simply any kind of information describing a set of data.
41Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Why is Metadata Important?Metadata is extra information saved with a file that is not part of the content of the file.Let’s say you find an email that is very damaging to the other party. There are several defenses you may anticipate such as “I did not get the email” or “I did get the email, but I never read it.” The metadata may help you uncover the truth.
Example: Outlook Email Metadata
42Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Producing Native Files on Computer or SmartphoneProvide the opposing party a zip file with the native files from the computer or phone.
EFFECTIVE TRIAL PRESENTATION OF ELECTRONIC EVIDENCE
43Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Trial PresentationRemember, you are doing this to win the case!
44Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Create Interactive Map
Create Interactive Map
45Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
Take Action – Social Media and GPSConsider Smartphone, Social Media and GPS evidence for future cases. A single piece of evidence can greatly impact the case.Preservation and collection must be done quickly before the evidence is gone.Smartphones contain all types of important evidence: text messages, voicemail, social media, and GPS information.Social Media texts, photos and videos can be useful evidence.GPS evidence includes: cell towers, toll booths, vehicle black boxes; vehicle GPS tracking; and smartphone GPS.Use effective trial presentation of the evidence.Result: better case outcomes!
Resources
46Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
ResourcesComplete PowerPoint PDF FilePreservation Letter/NoticesDiscovery Protocol AgreementSmartphone Evidence PDF Sample Report.pdfFacebook Evidence PDF Sample Report.pdfRemote Collection of Cell Phones and Computers.pdfEngagement Letter Updates for Smartphone and Computer Evidence.docxEmail Template - Change Passwords on Accounts.docxEmail Template - Use Caution with Social Networks.docxFacebook - Download Account.pdf
47Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media
48Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media