USAfx

The Department of Justice's Executive Office of the U.S. Attorneys has its own file exchange site called USAfx. See: http://usafx.justice.gov . In order to access the site you need to receive an email from a USAO asking you to register your account.

When a USAO chooses to share a folder on its network with defendants at a private law firm, they should receive an email like this one:

As you can see the government's system utilizes the popular cloud file sharing service box.com. The recipient simply needs to access the folder, and then right click on the box.com on the subfolders or files inside and download the contents to a zip file.

Multiple files or folders can be downloaded at once.

The files can only be made accessible for a maximum of 60 days.

The rumor is that it may not be advisable to use USAfx for more than 5 GB or more than 800 files. See this edition of the Federal Defender Newsletter.

Outline of Craig Ball's Electronic Discovery Workbook Part 7 - Mobile Devices

Here's a continuation of my outline of the 2016 edition of Craig Ball's Electronic Discovery Workbook which I last posted about March 5, 2017.

X. Opportunities and Obstacles: E-Discovery from Mobile Devices

A. Mobile Miracle 1. IDC, a market research firm estimates that digital data will grow at a compound rate of 42% through 2020. 2. As per U.S. Center for Disease Control, 41% of American households don’t have a land line. 3. As noted by SCOTUS in Riley v. California “Today, by contrast, it is no exaggeration to say that many of the more than 90% of American adults who own a cell phone keep on their person a digital record of nearly every aspect of their lives — from the mundane to the intimate.” 4. Smartphones have these instruments: a. Microphone b. Fingerprint reader c. Barometer d. Gyroscope e. Global positioning system f. Compass g. Accelerometer h. Radio i. Near Field communications j. Proximity, touch, and light sensors k. Still and video cameras

B. Mustering Mobile 1. Mobile device plugs change frequently a. 30 pin dock b. Lightning c. Thunderbolt

2. Windows and MAC are the only two operating systems for desktops, but mobile devices while for the most part either having Android or iOS also include: a. Tizen b. Symbian c. Motorola d. Sailfish e. Bada f. Yaffs g. Ubuntu h. Huawei i. Blackberry j. Windows Phone k. Nokia DCT4 3. Email messaging on mobile phones is encrypted so as to make it impossible to acquire. 4. Forensic disk imaging software can be downloaded for free for desktops, and write blockers can be purchased for $25, but mobile preservation tools are far more costly. $12K for hardware, $3K per year for software. Cellebrite offers data extraction devices for cell phones.

C. Challenges Across the EDRM 1. It takes longer to acquire data from a 64GB iPhone than it does from a 640 GB hard drive. An iPad full of data may take 48 hours to process. 2. Mobile Devices are upgraded and replaced frequently, so data maps may not be current. 3. Companies usually don’t have the means to preserve data on smartphones. iPhone does not give you a way to download or print text messages. 4. Relativity and Concordance cannot ingest and review data from mobile devices and their apps. 5. Predictive Coding not effective on much mobile data such as shorthand messaging.

D. Geolocation 1. Phones broadcast location to within 10 meters. 2. Phones will automatically ping for nearby routers 3. My Nest thermometer knows when someone has entered or left their home. 4. Alexa and Siri can be used to turn lights on and off. 5. Siri listens while an iPhone is being charge, not only when the user holds down the home button to activate her.

E. What to do? 1. Most people are reluctant to part with their smartphones. 2. It’s necessary to provide a replacement.

F. Four Options for Mobile Preservation 1. Demonstrate nothing on phone that can’t be obtained from other more accessible source. In the past Blackberry Enterprise Servers redirected data to Blackberry phones, but now most smartphones have unique data. 2. Sequester the device by putting it in Airplane mode. 3. Software Solutions: Decipher TextMessage and Ecamm PhoneView can preserve messaging. 4. Technician forensically imaging a phone is the most defensible approach. Cellebrite UFED, Micro Systemation XRY, Lantern or Oxygen Forensic Suite. a. Three levels of access i. Physical – most complete, but slowest. Device may have to be rooted or jailbroken. ii. Logical iii. File System b. Encryption schemes often frustrate forensic software.

3rd Edition of the Sedona Principles - Bye Bye Back-up Tapes, Hello Phase Gates

Today the public comment version of the third edition of the Sedona Principles: Best Practices, Recommendations & Principles for Addressing Electronic Document Production dropped here, https://thesedonaconference.org/publication/The%20Sedona%20Principles . Key updates have been made to the following principles:

Principle 5 - The obligation to preserve electronically stored information requires reasonable and good faith efforts to retain information that is expected to be relevant to claims or defenses in reasonably anticipated or pending litigation. However, it is unreasonable to expect parties to take every conceivable step or disproportionate steps to preserve each instance of relevant electronically stored information.

Note that the phrase, "be relevant to claims or defenses", and "or disproportionate steps" are new insertions to Principle 5 from the last edition of the Principles published in 2007, in response to the amendments of the Federal Rules of Civil Procedure in 2015. The new edition points out the reduced reliance by companies on backup tapes with the widespread implementation of dual, mirrored live systems. Hence the position that it's unreasonable for parties to take every conceivable step may no longer need to be stressed as strongly, as this was added to give businesses an out when facing the prospect of preserving data from voluminous backup tapes. The revised version of the principles includes a gentle suggestion to move away from the reliance on back-up tapes, "Parties that use backup tapes for archival purposes should be aware that these practices may lead to substantially higher costs for evidence preservation and production in connection with litigation. Parties seeking to preserve ESI for organizational purposes or litigation should consider employing means other than traditional disaster recovery backup tapes."

Principle 8 - The primary sources of electronically stored information to be preserved and produced should be those readily accessible in the ordinary course. Only when electronically stored information is not available through such primary sources should parties move down a continuum of less accessible sources until the information requested to be preserved or produced is no longer proportional.

". . . those readily accessible in the ordinary course" replaces the phrase "active data and information" from the 2007 edition. The second sentence replaces the prior statement that, "Resort to disaster recovery backup tapes and other sources of electronically stored information that are not reasonably accessible requires the requesting party to demonstrate need and relevance that outweigh the costs and burdens of retrieving and processing the electronically stored information from such sources, including the disruption of business and information management activities." The Sedona principles now recommend looking for discoverable ESI through a variety of sources that become less and less accessible rather than drawing a distinction between active data and back-up tapes. The Sedona conference reacts to the requirement of proportionality under FRCP 26, and suggests that the after data preserved in the ordinary course of business has been reviewed, the party should go through a series of 'phase gates', until the results are no longer worth effort. Near-line email archives and individual custodian hard drives are given as examples of intermediate sources between primary email systems and back-up tapes.

Principle 12 -The production of electronically stored information should be made in the form orforms in which it is ordinarily maintained or that is reasonably usable given the natureof the electronically stored information and the proportional needs of the case.

The 2007 edition of the Sedona Princples stressed the need for receiving parties to have the same ability to access, search and display produced information. The new edition notes how changes in technology have made providing the same ability impractical, or impossible and instead uses the phrase, "a functionally adequate ability". A document produced from a 'records management database system' is deemed to meet the provision of FRCP 34 requiring data to be produced in the form in which it is ordinarily maintained.