ACEDS 2016 eDiscovery Conference - 'The Future of E-Discovery' with Craig Ball

This past Wednesday I attended a presentation by Craig Ball on the “Future of E-Discovery” at the 2016 ACEDS E-Discovery Conference in New York City Craig Ball is an attorney, certified forensic examiner, and a court appointed special master. He's also an adjunct professor at the University of Texas who teaches a course on digital evidence. Ball was the recipient of the ACEDS lifetime achievement award at the conference, and is widely recognized as one of the world's leading experts on electronic discovery. His blog, https://ballinyourcourt.wordpress.com/ is one of the best online resources in the field of electronic discovery. Ball has given presentations on electronic discovery all around the world, which has given him an excellent perspective on the state of the field. Ball gave a multi-media presentation that made use of entertaining film stills, and films clips to underline his points. One of this principal concerns is the inability that lawyers to communicate about technical information. While lawyers still focus on paper, only .01% of information currently created is on paper. ESI exists in cloud networks; backup systems; network shares; servers; mobile devices; and email containers. While less than 1% of cases make it to trial, data is growing at 40% compound rate. The lengthy discovery process is becoming increasingly electronic and electronic data is growing in size. The new tech devices that have become part of all of our lives demonstrate this. Ball noted that the new Amazon echo records everything a user says and keeps it indefinitely. Whereas on the moon mission Apollo Guidance Computer had 12300 transistors, an iPhone 6 has roughly 2 billion transistors. The iPhone contains multiple types of sensors, a barometer, accelerometer, and a gyroscope.

In an iPhone's settings you can look up the user's most frequent locations, or track the user's movements as the device pings for available wifi networks.

Ball said that the law requires a mobile phone to always communicate its location so that it can always make emergency 911 calls. Most apps hold data in a way that makes it inaccessible Ball discussed the U.S. Supreme Court case, Riley v. California, 134 S.Ct. 2473 (2014) which held that warrantless searches of cell phones are unconstitutional. More than 90% of adults own cell phones and keep on their person a digital record of nearly every aspect of their lives. I was shocked when Ball showed a photo of a shoe box with a label that notified purchasers of a radio frequency identification device embedded in Salvatore Ferragamo shoes that is designed to help the manufacturer combat fraudsters. Ball did not mention that apparently the RFID chips can only be read from a distance of 4 centimeters. He then made a succession of 'crystal ball' predictions: 1. Increasingly the means for electronic discovery will be 'baked into' IT environments. Microsoft has acquired Equivio, a provider of electronic discovery services. Enterprise applications will have analytical capabilities and be able to preserve data in place, ab initio. Instead of going to the trouble of exporting emails to .pst archive files, processing will take place more safely at the source. 2. Collection from devices will diminish. As the world knows, data is widely stored in cloud networks. This allows data to be locked down in situ. The integrity of the data need not be altered. Even today one can lease processors online that are powerful enough to process 10 TB of data over a weekend. A super computer can be rented for an hour for less money than a teenager receives as an allowance. 3. Discovery from automobiles will be an emerging challenge. Cars are increasingly becoming a more sophisticated extension of our homes. While many cars now have cameras on the back bumper, soon they will come equipped with cameras all around. This has obvious implications for collision cases. Imagine tort case litigated with video from dozens of different vantage points. 4. Traditional approaches to digital forensics will falter. Hard drives with magnetic storage use a spinning disc that provides direct access to data by using a tone arm to read and write on concentric rings. This was an advance over magnetic tape which provides serial, not direct access to data. On conventional hard drives when data is deleted it doesn't mean that it's gone. A reference to the a file in the master file table is simply removed. The deleted data may later be overwritten but then partial information may still be recovered from slack space or in unallocated clusters. Solid State Drives function differently because they use wear leveling to prevent any one block from being written to too frequently. SSDs come overprovisioned with memory cells – each block will only last for 100,000 uses before it fails. Wear leveling makes the address exposed to the operating system in a different way that prevents conventional data recovery. The lower power consumption of SSDs means that they are likely to replace electromagentic drives. 5. Encryption will finally a formidable barrier. The recent dispute between the FBI and Apple shows this, and the conflict will continue. 6. Lawyers are still in a lexical mode, but increasingly interactions are verbal or gestural and don't employ lexical phonemes. Smart phones are an obvious example of how communication is performed through gestures. Even emoticons may be reviewed for meaning in legal cases. In predictive coding there are non-lexical sampling groups of words not for meaning but simply as symbols. Keyword searches have nothing to do with modern search techniques.

7. Finally, privacy will cast a shadow on the scope of discovery.