Are you Focusing Enough on the Potential Implications of Mobile Devices in eDiscovery?

Unlock the secrets of mobile device discovery in litigation with our latest episode featuring Kelly Twigger. Explore the crucial decision in Wegman v. US Specialty Sports Association Inc., where Magistrate Judge Robert Norway's ruling highlighted the increasing responsibilities of preserving electronically stored information (ESI) on mobile devices. This episode is your key to understanding the legal intricacies of mobile device usage in the workplace and the necessity for clear data preservation policies. Delve into the challenges organizations face, from user deletions to the limitations of cloud storage solutions like iCloud.

Enhance your eDiscovery expertise as we journey through the complexities of mobile device data preservation. Discover the obstacles posed by lost or damaged devices and factory resets, and learn about data recovery techniques that can mitigate these issues. This episode serves as a valuable resource for legal professionals looking to optimize their electronic discovery processes. With insights drawn from significant cases like Hunters v. City of Seattle and NRA Pork, we provide actionable strategies to ensure compliance and improve litigation outcomes. Don't miss this opportunity to refine your litigation strategies in the evolving landscape of eDiscovery.

Tune in for practical insights and actionable strategies to stay ahead in the complex landscape of eDiscovery.

Wegman v. U.S. Specialty Sports Ass’n, Inc.
Read the blog about this case- eDiscovery Assistant Blog
eDiscovery Assistant Website
Sign up for Kelly's Case of the Week Newsletter here
eDiscovery Assistant Free 7 day Trial (no credit card required)

Thank you for tuning in to Case of the Week with Kelly Twigger. If you found today’s discussion helpful, don’t forget to subscribe, rate, and leave a review wherever you get your podcasts. For more insights and resources on ediscovery, visit Minerva26 and explore our practical tools, case law library, and on-demand education from the Academy. Join us next episode as we break down another important case shaping the future of ediscovery.

Episode Transcript

Kelly Twigger (00:13):
Welcome to the Case of the Week podcast, where
each week, we break down arecent decision in electronic
discovery case law and talkabout the practical impact for
you and your clients and keepyou up to date on your
obligations with electronicallystored information as evidence.
If you're a litigator, legalprofessional or you love the
power of ESI as much as I do,this is the place to be.

(00:34):
I'm Kelly Twigger, the CEO andfounder of eDiscovery Assistant
and the principal at ESIAttorneys, with more than 25
years of experience navigatingthe evolving landscape of
litigation and e-discovery.
I'm a practicing attorney,author, speaker, entrepreneur
and now podcaster who works as adiscovery strategist and expert
for clients at ESI Attorneysand to provide that knowledge to

(00:55):
all legal professionals throughour e-discovery assistant
platform.
In each episode, we'll tackle anew decision in e-discovery
case law and how it shapes bothyour litigation strategy and
planning for risk mitigation.
If you're ready for blunt,actionable insights that keep
you ahead of the curve, andmaybe a few laughs along the way
, this is your go-to podcast.
Subscribe or follow now tostart embracing the power of our

(01:32):
case of the week series broughtto you by e-discovery assistant
.
This week's decision comes to usfrom wegman versus us specialty
sports association inc.
Which we'll refer to as utriple.
This decision is from UnitedStates Magistrate Judge Robert
Norway from the Middle Districtof Florida, from December 12th
of 2023.
As always, we tag each of theissues in our case law database

(01:56):
with our proprietary issuetagging structure, and this
week's issues include failure toproduce mobile device and scope
of preservation.
Judge Norway has four decisionsin our database from his seat
in the Middle District ofFlorida.
This is a very short decision.
I mean four or five paragraphs.
You could read it in about 10minutes.
So we're going to combine thefacts and analysis today and

(02:17):
really get to what are the keytakeaways from this case.
We're before the court here on amotion to compel the defendant,
donald Donatus, to returnproperty and join copying and
for fees and costs.
Donatus was an employee ofUSSSA who was put on
administrative leave and askedto return his mobile devices to
USSSA for imaging andpreservation.

(02:39):
Now the opening quote from thecourt here pretty much gives
away the punchline.
The court stated quote fewthings are certain in life or
litigation, but given therepresentations made by his
counsel at the recent hearing,donatus could bet dollars to
donuts that he has no choice butto turn over three electronic
devices in his possession thatbelong to the United States

(03:00):
Specialty Sports Association.
Close quote.
Now, prior to the hearing on themotion, the court had denied
Donatus' motion allowing him tocreate forensic copies of the
devices before returning them toUSSSA, and the court summarily
acknowledged in this motion thatthe both parties were aware of
the duty to preserve theinformation on the devices and

(03:21):
that that duty to preserveattached to those devices in
question.
The court then really looked atwhether or not the devices
belonged to the U-triple-S-Asuch that they needed to be
returned, and it found that theydid.
The court noted that counselfor Donatus conceded the
possession or the ownership byU-triple-S-A at the hearing,
citing to the language of theemployee handbook from USSSA,

(03:43):
which stated that quote alltechnology provided by USSSA,
including computer systems,communication networks,
association-related work recordsand other information stored
electronically, is the propertyof USSSA and not the employee.
Close quote.
Now, that's important becausethat's language directly from

(04:04):
the employee handbook, and partof our takeaways are the steps
you're going to need to take tomake sure that you have rights
to access this information.
Now, per the court, donatus'retention of USSSA's property
prevented USSSA from fulfillingits duty to preserve the
evidence, thereby prejudicing it.
The court also found and thisis key that quote organizations
know what their employees knowclose quote and that Donatus was

(04:27):
once USSSA's CEO.
Now that he's on administrativeleave and his relationship with
USSSA has soured, those devicescontain evidence that the
organization needed to determinewhat he knew when he learned
about it, what he did about itand who was involved.
Donatus's failure to returnUSSA's devices frustrated the

(04:47):
organization's collectionefforts, according to the court,
stymied its investigation intothe events that formed the basis
of plaintiff's claims andthwarted the preparation of the
organization's defenses.
All of those led to theprejudice and need for the
return of the data.
The court then required Donatusto return the unaltered devices
within three days and not toaccess, copy or tamper with any

(05:10):
of the ESI on the devices.
Now, things that are notincluded in the facts of this
decision are when Donatus wasplaced on administrative leave,
how long he's held those deviceswithout providing them to USSSA
.
We know that at least there wasone previous motion where
Donata said asked the court toallow him to make forensic

(05:30):
copies and to give thoseforensic copies to USSSA rather
than the actual devicesthemselves, and that motion was
denied.
Okay.
So what are our takeaways fromthis very short but really
important decision.
I picked this one today becausemobile device discovery is huge
right now.
It's everywhere and we'rehaving discussions about

(05:51):
possession, custody or control.
When do organizations have theability to get data from an
employee's personal device?
Does that employee use thedevice for work?
What if they don't use it forwork?
There's so much analysis goingon in this area right now that
it is of vast importance for youand your clients to be
understanding what theirobligations are with regard to

(06:12):
data on mobile devices and whatsteps they need to take to be
able to ensure the preservationof that data when they have a
duty to preserve it.
So takeaways as I just mentioned, employees' use of mobile
devices to conduct business isrampant.
Covid pushed us all in thatdirection very quickly, but the
advent of new technologies andnow the prevalent need to

(06:36):
respond instantly withinbusiness make the use of mobile
devices very necessary forbusiness.
We've steered away a lot fromBYOD policies, where companies
were providing devices andcompany business was to be
conducted on those devices.
More of what is in the marketnow and it's not exclusive.
There are certainly industriesthat are regulated that have

(06:56):
multiple devices, but a lot ofwhat we see working on the law
firm side is employers.
They know well that theiremployees are using their mobile
devices to conduct business andthat's going to subject them to
discovery.
All of that means that mobiledevices are a prime source of
evidence in discovery and thatyou need to be thinking about
how to acquire and preserveevidence from them out of the

(07:19):
gate when you're talking aboutlitigation.
Now, as I read this shortdecision in Wegman, the
immediate issue that came tomind was what data could be lost
as a result of USSS aides notreclaiming the devices from
Donatus prior to him going onleave.
We've seen so many examples ofdevices being lost, dropped in
the ocean or a lake,accidentally being stolen from

(07:40):
cars just about every excusethat you can think of as to why
they no longer exist.
If you want a good summary ofsome examples, you can look at
the Hunters v City of Seattlecase that we covered on Case of
the Week in 2023.
And all of that case law inthis area tells us that having a
plan for preserving data frommobile devices is crucial.
Now, in order to emphasize whatdata can be lost for failure to

(08:02):
act quickly, I reached out to acouple of colleagues on the
forensic side to confirm what Ialready know that actions taken
on data and on a cell phoneoften cannot be undone or
located by an expert.
Ryan Fry, who is a forensicsexpert with ModeOne, who have
designed software for the remotecollection of mobile devices,
identified multiple areas ofconcern or consideration when a

(08:26):
user's device is not preservedright away.
The most obvious is when it'slost, stolen or damaged, as we
just talked about.
The next is user deletion thatthe user specifically deletes
bubbles or entire threads ofconversations.
Now that's important becausethe deletion recovery window
from iOS devices is roughly 30to 40 days for user deleted

(08:47):
messages.
Some of that changed in the newoperating systems.
From iOS, it's different forAndroid, so you need to
understand which system you'redealing with.
The next is automatic deletionof ESI through settings where
message retention is set toautomatically delete message
after 30 days or one year.
Those are two options thatexist aside from the default,
which is forever.

(09:07):
So if a user has specificallyset their messages to roll off
at a certain period of time,that will impact the ability to
recover them.
We actually saw that in theHunters versus City of Seattle
case.
According to Ryan, without adeep dive forensic collection,
which is expensive and requiresan in-person process.
Recovering older user-deletedmessages or automatically

(09:29):
deleted messages is extremelychallenging and there's a very
low probability you're going toget that.
Data Proving user deletions arealso very challenging in court
without the other side'stranscript of the text thread or
messaging, whatever it meansfor that particular application.
So remember that for texts andinstant messages you've got on

(09:49):
the device from and to.
Sometimes, if they're a desktopdevice, you might also have
information that way.
So the question is is itavailable from another source?
It's easier to piece thattogether, but it's going to cost
a lot of time and money to doso.
So that's a considerationSpecific to iPhones.
Ryan also noted that there areiCloud concerns.
Many think that iCloud can bethe source of truth for device

(10:12):
collections and the risk thereincludes multiple things
authority, incompleteness andsecurity issues.
With regard to authority, ifthe custodian used their
personal iCloud account, thecompany may not have the
authority to get access to thosecontents.
That specifically usuallyrelates to text messages and
that's exactly what we saw inthe NRA Pork case that the court

(10:34):
held that there was no access,no availability for the
organization to have possession,custody or control over the
text messages because of the waythey had engineered their
devices for employee use.
The second that Ryan noted isincompleteness.
Depending on the configurationof the iCloud, a message may not
even be included in the iCloudbackup.
Many companies enforce policiesto not even allow phones to

(10:56):
backup to iCloud, since it isApple's public cloud and they
can't control or manage that.
So relying on the iCloud backuphas a lot of defects to the
thought process.
The final one is security.
Advanced data protectionrecently released for the iPhone
means access to iCloud data bycommercial products cease to
work and if and when they catchup, it still requires the device

(11:19):
to provide consent based onaccess to the decryption keys
that are no longer managed byApple.
So you've got another consentissue there to be able to gather
information from the iCloud.
Now, all of that came from RyanFry.
Appreciate, ryan, you weighingin there.
Thanks very much.
Another forensic professionalthat I talked to provided
additional considerations andadvice for both employers and

(11:41):
employees.
First, employees utilizingcompany-owned devices should
exercise data hygiene andsegregate their personal
activities and work activitieson different devices.
That doesn't happen very oftenin what we see with mobile
device discovery.
Working on the firm side, thisexpert noted that almost every
forensic examiner you meet willcarry two devices one from the

(12:01):
company they work, whereactivity occurs for work, and
one that they own themselves,where non-work activity occurs.
Next, this person noted thatany use of a personal device for
work may subject it todiscovery, and we've talked
about that multiple times here.
The standard from the courts iswhether or not relevant data
exists on the device.
There is, of course, the issueof possession, custody and

(12:23):
control, which I mentionedearlier, but the courts have
been leaning towards requiringproduction of devices even where
they are not company-issued butwhere there is relevant data
and the company was aware thatthe employee was using the
personal device for work.
Next from this expert, many,many more phones are being
surrendered by employees infactory reset mode and when that

(12:45):
happens, forensic tools areunable to recover data from a
factory reset mobile device.
Apple and Android devicescannot be physically imaged.
An advanced logical or fullfile system puller about the
best that a forensic expert cando, short of getting the
forensic bitstream image, whichis the gold standard for
preservation purposes.
So essentially, we can't dowhat we need to do to meet that

(13:08):
gold standard from a forensicperspective if the phone is set
to reset to factory settings.
That needs to be considered inyour exit interviews with
employees, where you either havea duty to preserve or you think
there's a potential, there willbe a duty to preserve.
Fourth, from this expert, cloudsynchronization, collaboration
and automatic backups offeralternative to a direct image in

(13:29):
circumstances where thecustodian refuses to cooperate.
Again, we have the limitationsthat Ryan Fry noted from this
issue, and this expert knowsthat it takes skill, which means
a lot of time and money, aswe've talked about, to
reassemble the puzzle piecesgiving the access that corporate
IT has to these alternativesources.
It's possible, but it's goingto be costly.

(13:50):
A good IT posture assumes thatthe employee ultimately doesn't
return all the devices thatthey've been issued.
Remote working has made theoff-boarding process for those
devices much more difficult, asthis expert notes, and a
thoughtful off-boarding processshould kick in well before the
final day of separation andincreases the odds that data is
returned to the corporation.
So get your exit process inline for your remote workers,

(14:13):
include mobile device data andinclude that that information is
going to be returned to you sothat you can review it prior to
the last day of employment forthat employee.
Thanks to my colleagues forwriting all of that crucial
information on why timing iscrucial in preserving mobile
devices.
We're going to keep an eye onthe Wegman matter to see if
anything untoward arisesfollowing the return of the

(14:36):
devices.
All right, that's our case ofthe week for this week.
Thank you so much for joiningme.
We'll be back again next weekwith another decision from our
eDiscovery Assistant database.
As always, if you havesuggestions for a case to be
covered on our case of the week,please drop me a line.
If you'd like to receive thecase of the week delivered to
your inbox via our weeklynewsletter, you can sign up at
ediscoveryassistantcom backslashblog and if you're interested

(14:56):
in doing a free trial of ourcase law and resource database,
you can jump toediscoveryassistantcom and click
to get started.
Thanks so much.
Have a great week.
Thanks for joining me on thecase of the week.
Podcast Tune in next episode asI discuss a new decision in
eDiscovery case law and identifythe issues you need to be
paying attention to and how theycan help you do better

(15:18):
discovery for your clients andleverage the power of ESI.
Be sure to subscribe and leavea review to help others discover
the show and be kept in theknow on all things electronic
discovery.
I'm Kelly Twigger.
See you next time.