tracking digital footprints: electronic evidence from ... · tracking igital footprints electronic...

Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

Wednesday, March 14, 2018 Noon–1 p.m.

1 Practical Skills credit

iiTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

TRACKING DIGITAL FOOTPRINTS: ELECTRONIC EVIDENCE FROM SMARTPHONES, TEXT, VOICEMAIL, GPS, AND SOCIAL MEDIA

The materials and forms in this manual are published by the Oregon State Bar exclusively for the use of attorneys. Neither the Oregon State Bar nor the contributors make either express or implied warranties in regard to the use of the materials and/or forms. Each attorney must depend on his or her own knowledge of the law and expertise in the use or modification of these materials.

Copyright © 2018

OREGON STATE BAR16037 SW Upper Boones Ferry Road

P.O. Box 231935Tigard, OR 97281-1935

iiiTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

TABLE OF CONTENTS

Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

Faculty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

Presentation Slides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

ivTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

vTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

SCHEDULE

Presented by Tom Howe, Howe & Associates, Portland

11:30 Registration

Noon Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

F Using smartphone evidence, social media accounts, and GPS location information for better case outcomes

F Types of smartphone data that are captured and stored

F Social media as an online personal diary

F Geolocation information on smartphones, computers, social media, cameras, and other devices

1:00 Adjourn

FACULTY

Tom Howe, Howe & Associates, Portland. Mr. Howe is one of the leading e-discovery lawyers in the country, providing legal/technology consulting and expert witness services to the United States government, Fortune 500 corporations, law firms, and e-discovery service providers. He has also written major software systems for e-discovery vendors, law firms, and corporate clients. The Legal Operation Tracking System is a comprehensive program that tracks all legal matters within a corporate legal department, including its collection of documents and electronically stored information, enabling faster and more defensible discovery. Mr. Howe is a regular CLE presenter across the United States and internationally and has authored five books on law and technology. He is licensed to practice in Oregon and Washington and is certified in Computer Forensics and Electronic Counter Surveillance.

viTracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

1Tracking Digital Footprints: Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media

Tracking Digital Footprints

Tom HoweHowe & [email protected]

About Tom HoweeDiscovery LawyerExpert witness for Law Firms throughout the U.S. with smartphone, computer, email, and social media evidence.Author of 5 books on law and technology.Speaks at legal conferences in the U.S. and Canada, and presented CLEs in over 10 states.


Download Session MaterialsEverything you see on these slides is contained in a PDF file and all Word, Excel and PDF sample documents. You have it all!

Please download a zip file with all the PowerPoint slides and samples for this session.Download Link: http://howelawfirm.com/Events

Links to VendorsWeb links to vendors, products, and services are provided as examples.Do your own research to find the best vendors, products, and services to meet the specific needs of your law firm.


Goals of CLEImportance of Electronic Evidence from Smartphones, Text, Voicemail, GPS, and Social Media.Develop cost-effective and defensible strategies for dealing with electronic evidence.Examples of use of electronic evidence.

ORCP 43 – “electronically stored information”ORCP 43 specifically refers to “electronically stored information.”


PRESERVE AND COLLECT DEFENSIVELYFirst Step – preserve and collect evidence!Preserve data that is “reasonably anticipated to be relevant to litigation” to prevent spoliation or destruction of data.Preserve – act fast and early, including computers, smart phones, devices, and online data.

Sample Preservation Letter to ClientSample Preservation Letter to Client.docx


Sample Preservation Letter to Opposing PartySample Preservation Letter to Opposing Party.docx

Discovery Protocol Agreement


Collection

Collection OverviewCollect data in a defensible manner and make sure there is a “chain of custody” for all smartphone, computer, email, social media, and other electronic evidence.If the collection is not done correctly, all other parts of the e-discovery process are under attack: preservation, culling, processing, reviewing, and producing. Case law has many examples of expensive “do-overs”. An e-discovery mulligan is expensive.


BEST: Collection by Outside Independent ExpertIt is best to use an independent expert for collection, it is one of the least-expensive part of e-discovery but poses the greatest risk.

NEXT BEST: Collection by Law Firm Staff Typically, this may be a law firm’s IT person.They may be knowledgeable about computers, but not e-discovery and computer forensics.Searching in Outlook is not defensible.o You must collect before reviewing.o The search function in Outlook only searches the email message, not the attachments!o Searching and reviewing emails changes the metadata.

Lack of forensic certifications.You don’t want your employees on the stand.


WORST OPTION: Collection by ClientSelf Collection: See sanctions cases involving “self-collection” where parties (and their lawyers) were fined.Do not let clients collect their own data.They do not understand the concept of relevancy.Fear of deleting data – spoliation.Better for you to review data (e.g. text messages, emails, and Facebook information).

Remote Collection – PCs, Macs, and Cell Phones


Remote Collection Unit

Remote Collection AdvantagesClients do not have to be without their computers and cell phones.Clients pay a flat fee and save money!Clients do not pay a forensic expert for travel.Able to collect evidence wherever FedEx-UPS-USPS delivers.Collection process is defensible.Collection unit is fully encrypted.No self-collection so fewer chances of spoliation claim and evidence tampering.No Law Firm IT involvement or support issues.


Exciting Moment #1“Tom, I just got a new case. I need to collect and preserve the data only. I don’t want to review any of the data or incur any other costs. I just want to meet my preservation obligation and lock down the data in case I need it later.”The above lawyer gets ediscovery!

How to Get Opposing Party Electronic EvidenceNormal discovery process (Request for Production).Motion to Compel when evidence not produced.Use your own expert.Use a independent neutral joint expert.o Agree to Discovery Protocol.o Cull out privileged information.o Produce to the other party to conduct a legal review and provide you the production or produce to both sides.

Special Master: Court orders expert to carry out the directives in the Court Order. Sometimes and in camera review.


USING IPHONE AND OTHER SMART PHONE EVIDENCESmart phones (e.g. iPhone, Android, BlackBerry) are targeted for litigation.People save more and more valuable information on the phone: text messages, email, calendar, files, photos, videos, and browser history.

More Mobile Devices than People on EarthIn 2014, the number of mobile devices (7.7 Billion) exceeded the number of people (7 Billion) on Earth!According to the United Nations, more people have cell phones(over 7 billion) than toilets (4.5 billion).


Mobile Addiction or Obsession?

A Day at The Louvre


NomophobiaNomophobia (an abbreviation for "no-mobile-phone phobia") is an anviety with the fear of being out of mobile phone contact.Sleeping with your Smartphone by Harvard Business School professor, Leslie Perlow.

Smartphones Are Multifunctional


Captain Kirk Did Not Even Have Facetime!

Exciting Moment #2“Tom, I want to look at information on my own client’s phone.” The text messages, emails, and phone calls between the parties exist on your own client’s phone!o Family Law – Communication between spouseso Employments Law – Communication between employees.o Business Litigation – Conversations between businesses.


Look for Evidence that Does Not Exist on the SmartphoneWith electronic evidence you can prove a negative!No phone calls, text messages, photos, to prove sexual harassment.No visits or bookmarks to websites related to an alleged copyright violation.No photos of children to support the argument of lack of significant time with the children in a custody case.

CAN YOU HEAR ME NOW?Consider using smartphone evidence in every case!


Importance of Text Messages

Smart Phone DemoDemo: Sample Smartphone Evidence Report.pdfDemo: Search Term Report.pdfSample iPhone Reports are included in the materials.“Make things as simple as possible, but not simpler.” Albert Einstein


iPhone Evidence PDF Report - Summary

Calendar


Contacts

Documents


Images

Internet History


Text Messages

Phone Call Logs


Videos

Voicemails


VoicemailVoicemails can be even more damaging than emails.Alec Baldwin, during a bitter custody case with Kim Basinger over the custody of their daughter, Ireland, left a voice message for his 11-year-old daughter calling her a “rude, thoughtless little pig.”Voicemail file

Waze


WIFI

Smart Phone Demo – By Search TermDemo: Search Term PDF Report.pdf


SOCIAL MEDIA AND ONLINE “CLOUD” DATA

The Essence of Social MediaBefore social media, authors and creator of content tended to be book and magazine authors and news reporters.With social media, we are all authors. We no longer consume content of authors but create our own content to share (text, photos, and videos).


Social Media CrazinessSome people post information on social media with poor judgment, and some of the information may have legal consequences.

Employment Case – Taco Bell


Employment Case - IBM

http://www.foxnews.com/story/2007/02/17/man-sues-ibm-for-5-million-after-being-fired-for-visiting-adult-chat-room-at.html

Facebook – Disabled and Unable to Work


Instagram – Disabled and Unable to Work

Family Law EvidencePublic information from social media website related to parent’s behavior.Interactions between parent and child.Information posted about the children.See B.M. v. D.M. - Wife loses alimony when Husband uses Facebook, Myspace, and Blog entries and photo to show that ex-wife is not disabled and can work, as she is shown belly dancing.


How to Get Online Data?As a general rule, in civil cases, you cannot subpoena the third-party provider.Request the opposing party to produce it because it is within their reasonable control.Do you need to preserve your client’s Facebook account?Commonly used Social Media accounts in litigation”o Facebooko Google+o LinkedIno Instagramo Tumblro Twittero YouTube

Example: Facebook EvidenceThere is often evidence on a Facebook account a case (e.g. copyright, custody).See Facebook – Download Account.pdf in the samples. You can send this file to your client or the opposing party with instructions for how to download Facebook information.If you need information from the opposing party, request that they download the Facebook account and send it to you (it is within their reasonable control).On the top right menu, choose “Account Settings”:


Example: Facebook EvidenceClick “Download a copy of your Facebook data:

Example: Facebook EvidenceClick “Start My Archive”:


Example: Facebook EvidenceYou will receive an email when the download is complete:

Unzip file.Double-click on “Index.html” to run the Facebook account:

Facebook Legal Review PDF ReportsLegal Review for Relevancy, Privilege, Hot, and Redaction.Sample Facebook Evidence Report.pdf.


GPS Evidence CollectionCell TowerToll BoothsVehicle Black Box (Event Data Recorder)Vehicle GPS TrackingSmartphone GPS Information

Cell Towers (Call Detail Record)Example: Cell Towers (Call Detail Record) Sample.xlsx.


Cellular Provider Retention PeriodsLink: https://articles.forensicfocus.com/2017/04/18/cellular-provider-record-retention-periods.

Information Verizon ATTCall History 7 years 7 yearsSMS Content 3-10 days 0 daysTower Location for Call History 1 year 7 yearsTower Dumps 1 year 7 yearsRange to Tower 8 days 180 days

Toll Booths


Vehicle Black Box (Event Data Recorder)

Black Box - EDR (Event Data Recorder)

Event data recorders collect information from onboard computers continuously. Data sets are briefly stored and constantly replaced in a recirculating loop lasting about 5 seconds.

Vehicle Black Box (Event Data Recorder)Most often the speed, turning, braking, accelerating, decelerating, etc. about five seconds before the collision.

The EDR captures data in an accident in which airbags are deployed. EDR data can be retrieved and analyzed to help determine driver’s actions and how car performed at time of crash.


Event Data Recorder (EDR) Data

Air Bag Control ModuleAir Bag Control Module capability to store crash data on an event data recorderPhoto of the “Air Bag Control Module” from the accident of Timothy P. Murray, when was Lieutenant Governor of Massachusetts.

http://www.nytimes.com/2013/07/22/business/black-boxes-in-cars-a-question-of-privacy.html

http://www.nytimes.com/2013/07/22/business/black-boxes-in-cars-a-question-of-privacy.html


Event Data Recorder (EDR) CasesMass. Lt. Governor Tim Murray: On 2 November 2011, Mass. Lt. Governor Tim Murray crashed a government-owned vehicle on a stretch of Interstate 190 (initially, no citations were issued).Murray initially claimed he simply lost control on the ice, wasn’t speeding, was wearing a seat belt and braked. But those claims were all later disproven when the black box data recorder information was released. The data revealed the car was traveling 108 miles per hour, accelerated, and the Lt. Governor was not wearing a seat belt at the time the vehicle collided with a rock ledge and flipped over. Murray was unhurt in the accident. http://www.nytimes.com/2013/07/22/business/black-boxes-in-cars-a-question-of-privacy.html

Event Data Recorder (EDR) CasesN.J. Governor Jon Corzine: On 12 April 2007, N.J. Governor Jon Corzine was seriously injured in an automobile accident. According to the superintendent of state police, an Event Data Recorder in the SUV he was traveling in recorded he was traveling at about 91 MPH five seconds before the crash. The speed limit on the road is 65 MPH. The Governor was not the driver of the vehicle. http://www.nytimes.com/2007/04/18/nyregion/18corzine.html


Vehicle GPS TrackingExample 1: TrackR ($29.99 per month) - www.thetrackr.comExample 2: Spybase ($29.99 per month) -http://www.spybase.com/GPS-Tracking-Car-Tracker-Device-Spy-System-OBDII-p-p/mt-obd-usflt.htm. Simply plug the MT-OBD directly into any OBDII port located under the dashboard of every car manufactured after 1996.

Mini Portable Real Time GPS TrackerUses GPS satellite technology.


Use Google Earth with KMZ File Information

Use Google Earth with KMZ File Information


Smartphone GPS InformationSee: Settings/Privacy/Location Services/System Services

Smartphone Location InformationCheck “Location” setting on your phone.iPhoneo See Settings/Privacy/Location Serviceso Settings: Always, When Using, Never

Androido See Settings/Location


Smartphone App Locations ServicesSee: Settings/Privacy/Location Services

Smartphones GPS TrackingiPhone App: https://device-locator.comAndroid App: https://www.google.com/android/devicemanagerExample: https://device-locator.appspot.com/view/device.php


PRODUCING ELECTRONIC DATA TO THE REQUESTING PARTYMake sure to produce data in the format agreeable to the opposing party. Stipulate to the form of production or seek agreement in the meet and confer.Types of production:o Papero TIFF / PDFo Native (the standard)o Hosted

Native Format Preserves the MetadataMetadata is quite simply the characteristics or properties of a file. Literally, metadata means “data about data.” Metadata is simply any kind of information describing a set of data.


Why is Metadata Important?Metadata is extra information saved with a file that is not part of the content of the file.Let’s say you find an email that is very damaging to the other party. There are several defenses you may anticipate such as “I did not get the email” or “I did get the email, but I never read it.” The metadata may help you uncover the truth.

Example: Outlook Email Metadata


Producing Native Files on Computer or SmartphoneProvide the opposing party a zip file with the native files from the computer or phone.

EFFECTIVE TRIAL PRESENTATION OF ELECTRONIC EVIDENCE


Trial PresentationRemember, you are doing this to win the case!


Create Interactive Map

Create Interactive Map


Take Action – Social Media and GPSConsider Smartphone, Social Media and GPS evidence for future cases. A single piece of evidence can greatly impact the case.Preservation and collection must be done quickly before the evidence is gone.Smartphones contain all types of important evidence: text messages, voicemail, social media, and GPS information.Social Media texts, photos and videos can be useful evidence.GPS evidence includes: cell towers, toll booths, vehicle black boxes; vehicle GPS tracking; and smartphone GPS.Use effective trial presentation of the evidence.Result: better case outcomes!

Resources


ResourcesComplete PowerPoint PDF FilePreservation Letter/NoticesDiscovery Protocol AgreementSmartphone Evidence PDF Sample Report.pdfFacebook Evidence PDF Sample Report.pdfRemote Collection of Cell Phones and Computers.pdfEngagement Letter Updates for Smartphone and Computer Evidence.docxEmail Template - Change Passwords on Accounts.docxEmail Template - Use Caution with Social Networks.docxFacebook - Download Account.pdf