Texas Lawyer’s In-house Counsel Summit Dallas, Texas March 21, 2013 Bryan Foster Deloitte Financial Advisory Services LLP.

Texas Lawyer’s In-house Counsel Summit

Dallas, TexasMarch 21, 2013

Bryan Foster

Deloitte Financial Advisory Services LLP

Copyright © 2013 Deloitte Development LLC. All rights reserved.2

The legal context 3• Civil• Criminal

Mobile device proliferation 14

Mobile device discovery and forensics 18

Implications for in-house counsel 24

Q&A 29

Overview

Copyright © 2013 Deloitte Development LLC. All rights reserved.3 3

Disclaimer

The oral presentation and this written material (collectively, the “Materials”) contain general information only and Deloitte Financial Advisory Services LLP and its affiliates, are not, by means of these Materials, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. These Materials are not a substitute for such professional advice or services, nor should they be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor.

Deloitte Financial Advisory Services LLP and its affiliates shall not be responsible for any loss sustained by any person who relies on these Materials.

Arlinghaus, Joseph

Added disclaimer per DPM 10640

Mobile device discovery

The legal context*

*Note: Deloitte Financial Advisory Services LLP does not provide any legal advice or address any questions of law.


Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party's claim or defense — including the existence, description, nature, custody, condition, and location of any documents or other tangible things and the identity and location of persons who know of any discoverable matter. . . Relevant information need not be admissible at the trial if the discovery appears reasonably calculated to lead to the discovery of admissible evidence.

Federal Rule of Civil Procedure 26(b)(1), Discovery Scope and Limits, Scope in General


In general, a party may obtain discovery regarding any matter that is not privileged and is relevant to the subject matter of the pending action, whether it relates to the claim or defense of the party seeking discovery or the claim or defense of any other party. It is not a ground for objection that the information sought will be inadmissible at trial if the information sought appears reasonably calculated to lead to the discovery of admissible evidence.

Texas Rules of Civil Procedure, 192.3(a), Scope of Discovery


(a) In General. A party may serve on any other party a request within the scope of Rule 26(b):

(1) to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party’s possession, custody, or control:

*******

(B) any designated tangible things;

Federal Rule of Civil Procedure 34. Producing Documents, Electronically Stored Information, and Tangible Things. . .


A party may serve on another party — no later than 30 days before the end of the discovery period — a request for production or for inspection, to inspect, sample, test, photograph and copy documents or tangible things within the scope of discovery.

Texas Rules of Civil Procedure, 196.1(a), Request for Production and Inspection to Parties


Example Request

1. Please produce for inspection any and all mobile phones possessed by the Defendant from October 1, 2010 to present. (Plaintiff’s counsel will arrange for a replacement phone during the time of the inspection, not to exceed ten (10) business days from the date of production.)

Discovery request for mobile phones


“Generally, the duty to preserve arises when a party has notice that the evidence is relevant to litigation or . . .should have known that the evidence may be relevant to future litigation.”

Rimkus Consulting Group, Inc. v. Cammarata, 688 F. Supp. 2d 598, 612 (S.D. Tex. 2010) (citation and internal quotation marks omitted).

Preservation requirements — one court’s take


Defendant’s wiping of all emails, calendar items, text messages, and telephone records from . . . [Defendant’s mobile devices] warranted an adverse inference jury instruction regarding defendants’ failure to preserve data . . . that would have been advantageous to plaintiffs and disadvantageous to Defendants.

Sanctions for failing to preserve mobile device data

Southeastern Mechanical Services, Inc., v. Brody, et al., 657 F. Supp 2d 1293 (M.D. Fla. 2009)



“Cellphone carriers reported that they responded to a startling 1.3 million demands for subscriber information last year from law enforcement agencies seeking text messages, caller locations and other information in the course of investigations.”

Law enforcement cellphone demands

More Demands on Cell Carriers in Surveillance, New York Times, July 8, 2012http://www.nytimes.com/2012/07/09/us/cell-carriers-see-uptick-in-requests-to-aid-surveillance.html?pagewanted=all&_r=0

http://www.nytimes.com/2012/07/09/us/cell-carriers-see-uptick-in-requests-to-aid-surveillance.html?pagewanted=all&_r=0

http://www.nytimes.com/2012/07/09/us/cell-carriers-see-uptick-in-requests-to-aid-surveillance.html?pagewanted=all&_r=0


DOJ pen/trap devices

1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 20120

5000

10000

15000

20000

25000 Original orders

Pen register Trap and trace

ACLU, “New Justice Department Documents Show Huge Increase in Warrantless Electronic Surveillance, 09/27/2012”http://www.aclu.org/blog/national-security-technology-and-liberty/new-justice-department-documents-show-huge-increase

http://www.aclu.org/blog/national-security-technology-and-liberty/new-justice-department-documents-show-huge-increase

http://www.aclu.org/blog/national-security-technology-and-liberty/new-justice-department-documents-show-huge-increase


Mobile device proliferation


• 290+million mobile phones in the United States (ITU, 2011)• 88% of American adults have a cell phone and 19% have a tablet

computer (Pew, April 13, 2012)• Almost half (49.7%) of U.S. mobile subscribers now own smartphones

(Nielsen, February 2012)• 4.4 billion mobile subscribers worldwide, (Ericsson Mobility Report

Interim Update February 2013)• 53 percent of employees are using their own technology for work

purposes (Forrester Research, June 2012)

Mobile device proliferation


27% of the U.S. population own tablets and about half (49%) own smartphones

Among all respondents Total

Trailing millennials

(%)

Leading millennials

(%)Xers(%)

Boomers (%)

Matures (%)

Desktop computer 49 58 79 82 89

Laptop/Netbook 82 85 76 67 66

Multimedia smartphone 46 65 58 39 29

Multimedia handheld device 48 37 33 19 12

Tablet device 19 28 30 27 20

Dedicated e-reader 29 20 28 22 25

Flat-panel high-definition TV 62 69 68 72 80

Digital video recorder 41 49 50 50 59

75%

74%

49%

29%

27%

25%

70%

50%

49%

Minimum value

Maximum valueMidpoint value =

50 percentile

27%

Deloitte Development, LLC “Devices, Consumption, and the Digital Landscape”, 2012

Arlinghaus, Joseph

Provide source for thie informamtion on this slide.


Half of tablet owners are currently employing theirdevice in the work place, but few use it solely for work

Tablets: personal/work overlapTotal tablet usage

Personal use: 93%

Work use: 54%

Personalonly: 46%

Work only: 7%Both personaland work: 47%

Q. TABLETS: Respondents using the tablet device for personal use, for work, or for both?

Deloitte Development, LLC “Devices, Consumption, and the Digital Landscape”, 2012

Arlinghaus, Joseph

Provide source for thie informamtion on this slide.


Mobile device forensics


• More than 3600 devices • Multiple operating systems• Often not backwards compatible

Mobile devices and operating systems


• Application data• Audio• Bookmarks• Calendar• Call logs • Chat• Contacts• Cookies• Device information• Device settings• Device voicemail• Email

Mobile data types

• Files• Locations• Memory card content• MMS• Notes• Pictures• SMS • Tasks• Video• Web history• Wi-Fi history


• Physical — A physical collection of a mobile device, captures the physical device in its entirety. This is a bit for bit image of the data area of the mobile and allows the examiner to view the device’s unallocated space and recover deleted content in unallocated space

• Filesystem dump — A Filesystem Dump is a special variety of a Logical collection that captures everything on the physical device except unallocated space

• Logical — A Logical collection reads the data from the device and pulls it in to a report. The data collected will vary based on the capabilities of the device and vendor support

• Backup utility — Although using a Backup Utility such as iTunes or Desktop Manager to collect a device is a last resort; a device backup will often produce data on par with a File system collection or at a minimum above a Logical collection

Hierarchy of mobile forensics collections


The ten most commonly desired data types are preserved in Physical, Filesystem and Logical collections. This is of course dependent on the device capabilities and vendor support.

Data types from Physical, Filesystem and Logical

Data type In collection

Audio P/F/L

Calendar P/F/L

Call logs P/F/L

Contacts P/F/L

Device information P/F/L

Device voicemail P/F

Email P/F

Files P/F

Memory card content P/F/L

MMS P/F

Notes P/F/L

Pictures P/F/L

Server voicemail N/A

SIM card F/L

SMS P/F/L

Tasks P/F/L

Video P/F/L


• Current tools can be divided into software based tools and hardware based tools. No single tool covers all of the thousands of mobile devices. Hardware and software based solutions are needed to properly and efficiently perform collection and advanced data analysis.

• Tailor the tool to be used based on the make, model, and operating system of the mobile device being preserved. Secondarily, the type of preservation Physical, Logical or File System is selected based on the types of data of interest as well as the ability of the solution to extract that data.

Industry standard tools


Implications for in-house counsel


• Identify device types in enterprise• Know location of devices• Understand mobile device back-ups

Discovery/incident response plan


• Person to person communications (harassment)• Personal email accounts (IP theft)• Behavioral analysis (misuse of resources)• Bank fraud (malware)• VPN access to company network (hacking)• Lost or stolen items — (PII)

Investigations involving mobile devices


• Does your company provide clear direction to their end users on acceptable use?

• Some mobile device leading practices– Encryption of device– Anti-virus/malware scanning– Backup procedures– Acceptable usage policy

Mobile device security policy


• Device types• Usage dates• Physical location of devices• Device usage• Service provider account information

Mobile device asset tracking

Q&A

About DeloitteDeloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Please see www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.

Copyright © 2013 Deloitte Development LLC. All rights reserved.Member of Deloitte Touche Tohmatsu Limited

http://www.deloitte.com/about

http://www.deloitte.com/us/about