The Right to Privacy in Modern Discovery: a review of another great law review article – Part 3

September 13, 2022
Professor Allyson Stuart (image by Losey)

This is the conclusion of the blog, The Right to Privacy in Modern Discovery: a review of another great law review article. See here for Part 1 and Part 2. This blog series considers the interplay between privacy and civil discovery as discussed in the law review article by Professor Allyson Haynes Stuart, entitled A Right to Privacy for Modern Discovery, 29 GEO. MASON L. REV. (Issue 3, 2022).

Part Three wrap up the series with longer than usual concluding remarks. Professor Stuart’s important article and insights are tied to efforts of the electronic discovery community. I plea for further efforts and make some specific suggestions, including a proposed change to Rule 26(b)(1) to add privacy as a proportionality factor. Evidence Rule 502 may also need to be revised. Vendors should also focus on new technological solutions. The need to address the problem of discovery privacy is urgent. EDRM, The Sedona Conference, the Advisory Committee on Civil Rules, and other important legal groups need to focus on this now, not later.

Conclusion

Ralph Losey August 29, 2022

I look forward to hearing much more from Allyson Stuart in the years to come. We need to begin a new dialogue on how to treat confidential information in civil discovery. Judges and private practitioners like myself are facing these issues every day. Professor Stuart’s article is a good step towards finding a practical solution. A Right to Privacy for Modern Discovery, 29 GEO. MASON L. REV. (Issue 3, 2022). This is the first scholarly article I have seen focused solely on privacy in civil discovery, as opposed to the many legal articles on privacy in general, or ones just focused on attorney-client privilege, or international privacy. That is one reason her new article is so important.

I am impressed by Professor Stuart’s points and suggestions, but would like to hear more comments on her proposed framework. I hope her article and this blog series starts Sedona-style dialogues on the subject in many fora, not just The Sedona Conference. See eg. The 13th Annual Sedona Conference Institute Program on eDiscovery: Protecting Privacy, Confidentiality, and Privilege in Civil Litigation. This March 2019 Sedona Conference event in Charlotte was co-chaired by the well-known, retired Judge Andrew Peck and Andrea L. D’Ambra and had a great faculty. I would like to hear Sedona’s input concerning Professor Stuart’s article and proposals. Also see the 2018 publication, The Sedona Conference Data Privacy Primer. This Data Privacy Primer was a project of The Sedona Conference Working Group Eleven on Data Security and Privacy Liability and was first published for comments in January 2017. Much has changed since then, not only the shock and disruption of Covid and politics, and the ever accelerating advance of personal technologies and social media, but especially the recent, radicalizing shock of Dobbs.

Let’s hope that all serious students, practitioners, judges and scholars of the law, including Sedona, will revisit the discovery privacy issues and hear from the next generation of experts like Professor Stuart. This time I suggest groups narrow their focus to discovery as a sub-set of privacy. Let’s look at the trees, not just the forest. That is what working lawyers like me really need right now. Sedona and others may also want to have another group work on post-Dobbs personal privacy activity rights. That involves serious political issues way beyond my pay grade, and so I have no recommendations, aside from saying that The Sedona Conference would be a good place to try and reach legal sanity. So too would my current personal favorite, the EDRM. Let’s all cooperate and try to figure this out together.

Losey pondering yet another question “way above his pay grade”

Pleading for further rules revisions is, however, within my limited wheel-house. Even without the further advice of scholars and experts, I am ready to commit to Professor Stuart’s admittedly reluctant suggestion that Rule 26(b)(1), Frankenstein or not, be revised once again, to include Privacy as a factor in proportionality analysis. You could get fancy with the revisions, but I am presently inclined to go with a short and simple solution and just include the words “the privacy considerations” on the 26(b)(1) list:

Image by Losey

. . . and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, the privacy considerations, and whether the burden or expense of the proposed discovery outweighs its likely benefit.

When the Advisory Committee on Civil Rules takes up this proposal, and I urge them to begin the consideration process at their next meeting, they should not only consider individual, corporate and government privacy rights, but also the costs and burdens to litigants to protect these rights. That should be part of any Committee comments, which are always included with a rules revision and carry great weight.

Redaction can be very expensive. In my experience as a practitioner over the last couple of years, it is much more expensive and burdensome than privilege logs. More expensive still, is the effort to cull out irrelevant ESI for privacy protection in productions.

Good work has been accomplished in cutting the costs of privilege logs, but now we should focus on the related, but different issue of privacy protocols for other types of confidential information in civil discovery. See eg. the work of the EDRM on privilege logs). Also see the excellent 2015, The Sedona Conference Commentary on the Protection of Privileged ESI. The Sedona publication discusses four general principles concerning privileged communications. The fourth principle is easily applicable to proportional privacy protection in civil discovery. It states “Parties and their counsel should make use of protocols, processes, tools, and technologies to reduce the costs and burdens associated with the identification, logging, and dispute resolution relating to the assertion of privilege.” The Sedona Conference Commentary on the Protection of Privileged ESI.

It is time to conclude and move beyond the privilege log projects and focus on related issues, other privacy protection concerns in discovery, including redaction protocols, court sealing protocols, filter team protocols, and confidentiality agreements and orders. We should look for ways to protect privacy rights, including the rule tweak here suggested. But in so doing we should be careful to control the costs. We do not want to create an accidental Frankenstein monster that eats up more time and money, not less. There are other many possibilities to both protect privacy and control costs. One might be expanding the scope of Evidence Rule 502 to include all types of confidential ESI within quick peek protection. Others solutions might be more technological in nature.

EDRM Graphic

Another possible answer with great promise is far greater use of Special Masters and discovery mediators. See: EDRM’s “Using Special Masters and Discovery Mediators to Resolve eDiscovery Disputes: A Bench Book for Judges and Attorneys 2022 Edition” (draft public comment version). Certainly there are initial upfront costs to use of a Special Master, but good ones can and will save far more expense to the parties than they cost. Far more. It will also speed things up. The costs of motion practice and excessive discovery remain an enormous cost and time waster, one that Masters and mediators with discovery and tech experience, knowledge are uniquely positioned to help control. This process can be abused too, as we are seeing now in the news.

EDRM graphic

As usual, the success of any endeavor like this, of more rules, best practices and technology solutions, will depend on education of bench and bar, the cooperation of litigation counsel in implementation, and the active, learned supervision of judges. It will also depend heavily on pre-litigation records management and related record keeping best practices. See eg. the work of the EDRM going back to 2013 and the EDRM graphic here summarizing the protocol recommended.

Confidential, secret documents should not just be left lying around. And flushing secret materials down toilets is not proper, legal disposition. Companies, individuals and the government, especially the Executive branch of the federal government, must do a far better job. The laws governing confidential documents and privacy must be taken seriously and enforced. See eg. FULL TEXT OF THE OFFICIAL COURT REDACTED SEARCH WARRANT AGAINST DONALD TRUMP. The popular Internet meme that “privacy is dead” is a hacker myth, promoted by greedy tech-corporations, over-zealous journalists, foreign spies, criminals and kleptocrats everywhere. No society can function without privacy. A total lack of privacy is unnatural and wrong. It is an inalienable human right. The great Justice Brandeis correctly characterized “the right to be let alone” as “the right most valued by civilized men.” Olmstead v. United States, 277 U.S. 438 (1928) (dissent).

Privacy in discovery is a real problem in both civil and criminal litigation. See eg. In re Warrant, No. 22-8332-BER, 2022 U.S. Dist. LEXIS 150388 (S.D. Fla. Aug. 22, 2022). It requires our immediate attention, discussion and early response. Continued delay in addressing the discovery issues, the costs, benefits and burdens, will only make the situation worse. I come back to the proactive, stitch in time saying that I have analyzed before in the context of litigation. Professor Stuart’s article has started the stitching in a scholarly, but accessible manner. We should be grateful to her for that and continue the important work.

Leave a Comment » | Evidence, Forensic Exam, informaton, Lawyers Duties, Metadata, New Rules, Related Legal Webs, Review, Search, Spoliation/Sanctions, Technology | Permalink
Posted by Ralph Losey

The Right to Privacy in Modern Discovery: a review of another great law review article – Part 2

September 8, 2022
Professor Allyson Stuart (image by Losey)

This is part two of the blog series, The Right to Privacy in Modern Discovery: a review of another great law review article. See here for Part 1. This blog series considers the interplay between privacy and civil discovery as discussed in the law review article by Professor Allyson Haynes Stuart, entitled A Right to Privacy for Modern Discovery, 29 GEO. MASON L. REV. (Issue 3, 2022). The blogs are supplemented by Allyson’s written comments and video interviews.

In Part Two we continue review of the article, plus share Professor Stuart’s supplementary comments and videos. They will address criminal law considerations and the impact of the Supreme Court’s bombshell case rendered in draft and then final form after her article. Dobbs v. Jackson Women’s Health Organization, 597 U.S. _ (2022). The Professor’s unexpected comments are somewhat hopeful, at least in so far as civil e-discovery is concerned.

Supreme Court on Privacy and Technology

Photo by Losey of the Supreme Court before the fences went up

Next up in our review of Professor Stuart’s law review is subsection B. Supreme Court Case Law on Privacy and Technology of Section II. Privacy in Modern Discovery. She starts off with a good summary of civil discovery law.

Under the discovery rules, there is no concept of “reasonable expectation of privacy.”267 A diary entry is perfectly discoverable if it is relevant.268 A statement shouted from a rooftop is not discoverable if irrelevant. Instead, the rules speak in terms of privilege.269 Federal courts recognize that privacy interests are implicated in the discovery rules and that courts should protect privacy interests as part of their issuance of protective orders,270 but do not treat discovery as constrained by the Fourth Amendment. However, concepts of privacy have inevitably overlapped. Many courts refer to “expectations of privacy” in the context of civil discovery.271

She then discusses the series of Supreme Court cases noting how technology today has changed privacy analysis in criminal cases and then concludes subsection B as follows:

There are implications of this theory too in the civil discovery context. In addition to discovery of cell phone information, where courts have already applied recent Supreme Court doctrine in protecting against broad examination,302 other types of discovery should be viewed through this lens, including social media, health tracker data, and other information from devices connected to the IoT.

A Modern Framework for Privacy Protection in Discovery

The next subsection is C., A Modern Framework for Privacy Protection in Discovery. Here Allyson Stuart lays out her proposal for reform of civil discovery. Here is the summary she provides in the opening paragraph.

First, privacy rights in discovery are protected by the Constitution when requests touch on personal, intimate matters, or implicate rights to association like donor or membership lists, and are protected by public policy when they implicate state or federal statutory confidentiality provisions. Second, when such privacy rights are implicated, courts should require a higher showing of relevance as opposed to discovery that is solely for purposes of impeachment or is otherwise “collateral.” Courts should apply higher limits still when private information is sought from or implicates the rights of third parties. And third, even where information sought does not fall within traditional notions of confidentiality or constitutional zones of intimacy, the totality of what is comprised within broad sets of data may implicate privacy pursuant to the mosaic theory. All three of these bases for restriction are proper subjects for arguments that discovery is not proportional under Rule 26(b), or should be protected under Rule 26(c).

I urge you to read the full article for her complete argument for this new framework for privacy protection in discovery. A Right to Privacy for Modern Discovery, 29 GEO. MASON L. REV. (Issue 3, 2022).

Professor Allyson Stuart’s Conclusion

After the framework discussion and argument in the article, comes the all important conclusion. It is excellent, so I reproduce it in full, again to entice you to read the whole article.

As in the Fourth Amendment context, discovery has been upended by changes in technology. Information that was not capable of creation is now saved automatically in vast databases. Formerly private communications are now shared in semi-public fora. People’s movements, bodily functions—indeed, their entire lives—are chronicled by devices on their wrists or their countertops. Courts can and should apply privacy protections when this data is sought in discovery.

Text messages and other communications may be private if they implicate personal relationships or otherwise intrude on the zone of intimacy. Fitbit data intrudes on privacy of medical and other personal information, and may include GPS data that gives a detailed record of a user’s activity every day. Social media account information too could offer a detailed portrait of a user’s life, and could implicate associational and other constitutional privacy rights. Finally, all of these discovery requests risk the privacy of third parties. These considerations are appropriate for a court in balancing the need for the discovery—including how relevant it is to the claim—against the intrusion into the privacy of the party and others. The law gives courts the discretion to say this comprehensive, intrusive discovery is not proportional.

Privacy in the Context of Criminal Discovery

I asked Allyson Stuart to comment on an issue slightly outside of her article, but related, namely privacy in criminal discovery. I wrote about this recently in a lengthy blog series, Examining a Leaked Criminal Warrant for Apple iCloud Data in a High Profile Case, Part One, Part Two and Part Three. She later read this series, but before that, commented generally on privacy in the context of criminal discovery. Again, I share these comments from a private email with her permission:

One thing that I find interesting is the idea that the Fourth Amendment should apply to civil discovery.  I cite at least one article making that argument in my article.  Otherwise there is certainly more robust protection under the Fourth Amendment than under interpretation of Rule 26.  In particular, Jones, Riley and Carpenter do a good job with changing technology in the 4th A. context.

Professor Stuart and I also discussed by video the Fourth Amendment’s indirect impact on civil discovery. Again, here is our chat shared with her permission.

Professor Stuart on the Fourth Amendment and Civil Discovery (Losey video)

My blog series Examining a Leaked Criminal Warrant for Apple iCloud Data in a High Profile Case concerned the leak of a criminal warrant that was filed under seal and was supposed to remain secret. The public posting of the secret warrant on Pacer appears to have been an accident, a major blooper to be sure. My article discusses the dangers posed to both civil and criminal suits by wide-spread public access to Pacer. Also see: The Sedona Conference Commentary on the Need for Guidance and Uniformity in Filing ESI and Records Under Seal. My concerns about Pacer are broad-based: First Amendment rights, individual privacy rights, privacy rights of individuals under investigation, the rights of criminal investigators for unimpeded discovery of the truth, and the rights of litigants to preserve trade-secrets and other confidential information. Professor Stuart agreed generally with these comments on Pacer in my article, stating in correspondence, which, again I have permission to publish:

Wow, what a blunder. And I think for all the reasons you mention this makes it more important than ever to limit private material at the front end. Sealing or confidentiality can be problematic. TMZ has a field day when anything shows up involving celebrities (not that I am particularly sorry for them). But the whole “practical obscurity” of court filings is clearly a thing of the past, and the federal government moves so slowly when it comes to technology. 

The recent case concerning a normally secret criminal warrant against a past President, one that has high First Amendment values for that reason, is instructive on litigants privacy, Pacer and balancing privacy interests against the public’s right to know. In re Warrant, No. 22-8332-BER, 2022 U.S. Dist. LEXIS 150388 (S.D. Fla. Aug. 22, 2022). Motions to unseal the warrant were brought by almost every major news organization in the world as Intervenors and opposed by DOJ. On August 22, 2022, Magistrate Judge Reinhart ordered the Warrant to be unsealed, but only after the DOJ first had an opportunity to suggest redactions. He imposed a deadline of August 25, 2022, for the DOJ to file, under seal, the warrant with redactions. His reasoning is very timely and instructive:

Despite the First Amendment right of access, a document can be sealed if there is a compelling governmental interest and the denial of access is “narrowly tailored to serve that interest.” Globe Newspaper Co. v. Superior Court, 457 U.S. 596, 606, 102 S. Ct. 2613, 73 L. Ed. 2d 248 (1982). . . .

The Government argues that unsealing the Affidavit would jeopardize the integrity of its ongoing criminal investigation. The Government’s motion says, “As the Court is aware from its review of the affidavit, it contains, among other critically important and detailed investigative facts: highly sensitive information about witnesses, including witnesses interviewed by the government; specific investigative techniques; and information required by law to be kept under seal pursuant to Federal Rule of Criminal Procedure 6(e).” ECF No. 59 at 8. . . .

After weighing all the relevant factors, I find that the Government has met its burden of [*16]  showing good cause/a compelling interest that overrides any public interest in unsealing the full contents of the Affidavit. . . . I must still consider whether there is a less onerous alternative to sealing the entire document. The Government argues that redacting the Affidavit and unsealing it in part is not a viable option because the necessary redactions “would be so extensive as to render the document devoid of content that would meaningfully enhance the public’s understanding of these events beyond the information already now in the public record.” ECF No. 59 at 10; see also Steinger, 626 F. Supp. 2d at 1237 (redactions not feasible because they would “be so heavy as to make the released versions incomprehensible and unintelligible.”). I cannot say at this point that partial redactions will be so extensive that they will result in a meaningless disclosure, but I may ultimately reach that conclusion after hearing further from the Government. . . . I therefore reject the Government’s argument that the present record justifies keeping the entire Affidavit under seal. 

Id. at *15

On August 26, 2022, the judge approved the redacted warrant and it was unsealed and opened to public view. I then was able to immediately download a copy and post it on my blog, FULL TEXT OF THE OFFICIAL COURT REDACTED SEARCH WARRANT AGAINST DONALD TRUMP.

 Dobbs v. Jackson Women’s Health Organization

I also asked Professor Stuart to address for my readers the limited topic of what Dobbs has done to the right to privacy in discovery. She is currently working on a full article on this important subject. So please take this short comment as something of a teaser. I will let you know when the full article is released. Her full essay will look more generally “at how far the Dobbs decision goes to eroding not just the right to choose but the more general right to privacy that Roe found implicit in the Constitution.” Stuart, private correspondence with Losey, August 2022. In the meantime, here is her comment on Dobbs.

In sum, Dobbs most directly threatens the right to privacy in the sense of autonomy and decision-making.  It is less of a threat to the privacy of information. This conclusion is buttressed by the decision by the Court in the previous term striking a California statute that required disclosure of donor information, Americans for Prosperity Foundation v. Bonta, 594 U.S. __ (2021).  While grounded in the First Amendment’s freedom of association, the opinion gives broad support to privacy concerns respecting anonymity in relation to “sensitive causes.”

Professor Stuart, Id.

Professor Stuart was kind enough to create a video for us that further explains this distinction and the impact of Dobbs.

Professor Stuart on “Dobbs” and right to privacy (used with permission)

Stay tuned for Part 3 coming soon with the Conclusion of this series. I will make specific suggestions for how to build upon the important work of Professor Stuart in privacy and discovery, including yet another revision to Frankenstein Rule 26, and how the EDRM, The Sedona Conferences and other organizations can help.

Leave a Comment » | Evidence, Forensic Exam, informaton, Lawyers Duties, Metadata, New Rules, Related Legal Webs, Review, Search, Spoliation/Sanctions | Permalink
Posted by Ralph Losey

The Right to Privacy in Modern Discovery: a review of a great, new law review article – Part 1

August 29, 2022
Professor Allyson Stuart

Summary and analysis of Professor Allyson Stuart’s much needed law review article on privacy in ediscovery in civil litigation. The article is supplemented with written and video interviews of Professor Stuart on ediscovery and privacy issues. In Part 2 there will be a special focus on the impact of the Supreme Court’s overturn of Roe v Wade, which was rendered after the article’s publication.

This blog is the first part of my review of one of the most informative and useful law review articles I have read in a long time. A Right to Privacy for Modern Discovery, 29 GEO. MASON L. REV. (Issue 3, 2022). The article is by Professor Allyson Haynes Stuart of the Charleston School of Law. I encourage you to download and read A Right to Privacy for Modern Discovery and keep it handy for its many good case citations. Professor Stuart is a bona fide expert in this area. She specializes as both a scholar and legal practitioner in information privacy, e-discovery and Internet law; three of my favorite subjects.

This is my second venture this year into review of law reviews. For the first on another of my favorite subjects, artificial intelligence, see the May 2022 blogs, Robophobia: Great New Law Review Article – Part 1, Part 2 and Part 3 and Professor Wood’s article, Robophobia. Woods, Andrew K., Robophobia, 93 U. Colo. L. Rev. 51  (Winter, 2022). These highly intelligent, engaging law professor attorneys, Woods and Stuart, give me renewed hope for the profession in general and, especially, for the key areas of technology law.

About Professor Allyson Hynes Stuart

Allyson Haynes Stuart

Allyson Haynes Stuart joined the Charleston School of Law faculty in 2004. Allyson is a 1995 magna cum laude graduate of the University of South Carolina. Upon graduation she clerked for David C. Norton, District Court Judge for the District of South Carolina in Charleston. She then worked as an associate for Cleary, Gottlieb, Steen and Hamilton from 1997-2002, and then as a director of the legal department at Sony Corporation of America, 2002-2004. At Charleston School of Law Stuart Professor Stuart teaches contracts, civil procedure, evidence, information privacy law and e-discovery. She has also taught as an adjunct professor at Brooklyn Law School and at the Institute Empresa (I.E.) Law School in Madrid, Spain.

Professor Stuart has written many other articles of interest to readers, including:

Allyson Stuart has also served as Of Counsel for the Crystal law firm, since 2015. The firm has an intriguing slogan: “Lawyers for Lawyers and International Matters.” The firm says that it is primarily a transactional law firm that offers some litigation services.

To conclude the personal introduction, Allyson, like me, has her own YouTube Channel, focusing on legal instruction. Professor Stuart’s videos, made in 2013, are on what she calls “flipping the classroom.” They address most first semester Contracts issues as well as some difficult aspects of Evidence.

Introduction to Professor Stuart’s Article

Privacy in discovery has been largely ignored in rules of civil procedure and left to the courts and lawyers to come up with their own solutions. The result is a hodge-podge of case law and local rules. This area of the law is, as Professor Stuart aptly describes, buried in “surprising obscurity.” Her article is a much needed unearthing and organization of the law. As Professor Stuart explains in her introduction after discussion of federal civil procedure rule changes:

Amid all these changes, little attention has been paid to privacy as opposed to time and expense.10 The Rules do not provide for explicit protection against discovery based on privacy,11 with the exception of redaction of personal information under Rule 5.2.12 There has long been the idea that privacy protection exists against government searches and seizures, but that there is no such concept in civil discovery.13 However, close analysis of cases reaching back to the adoption of the Rules shows that federal courts have in fact used privacy rationales to protect against discovery in many areas. District courts in particular have developed an interpretation of the Rules that protects litigants and non-litigants from discovery; courts have developed certain categories of protected information based on a balancing of the right to privacy against the need for the information in the context of the litigation.14 This law derives from Supreme Court precedent, from public policy represented in federal and state statutes, and from discretionary judicial application of the Rules. This Article unearths this body of law from its surprising obscurity. With a firm grounding in the foundations and justifications for federal protection of privacy in discovery, and in light of recent Supreme Court doctrine, the Article describes how privacy arguments can address increasingly intrusive discovery demands.

Overview of Professor Stuart’s article, A Right to Privacy for Modern Discovery

After an Introduction, A Right to Privacy for Modern Discovery begins with a historical overview of privacy in civil discovery, including the landmark case of Hickman v. Taylor, 329 U.S. 495 (1947). Professor Stuart observes that discovery protections can be divided into two broad categories. One is protection for information or communications deemed confidential, including attorney-client, trade-secret, business records, tax returns. The other is protection for personal privacy reasons, which professor Stuart explains:

is based on Supreme Court interpretation of the constitutional right to privacy in intimate or otherwise highly personal matters, including marriage, contraception, sexual activity, medical information, family relations, and other personal information. In addition, the Constitution protects against compelled disclosure of information that would violate a person’s First Amendment rights, such as freedom of association.

As to the Constitution based privacy protection provided to discovery in civil proceedings (criminal proceedings are not discussed directly in this article), Professor Stuart notes three broad areas:

  1. Freedom from Compelled Disclosure of Association: NAACP v. Alabama and Seattle Times v. Rhinehart.
  2. Privacy of Intimate Matters: Griswold v. Connecticut, Whalen v. Roe, and Roe v. Wade.
  3. Freedom from Compelled Disclosure of Personal Matters: Whalen v. Roe, Nixon, and Reps. Comm.

Next the article considers the public policy of privacy in discovery and identifies three basic grounds:

  1. Statutory Publication Shelters
  2. Persuasive State Law
  3. Balancing the Privacy and Litigation Interests

As to the balancing used to provide privacy to litigants, four factors are considered:

  1. Clear Relevancy Rather Than Mere Impeachment
  2. Evidentiary Influences
  3. Third Party Protection
  4. Protective Measures

The next section is Privacy in Modern Discovery, discussed in detail below, followed by the Conclusion. The Privacy in Modern Discovery section, which is the real meat of the article, is divided into three main parts:

  1.  Discovery Today, which includes E-Discovery and Proportionality, Modern Subjects of Discovery such as cell phone and social media, Fitbits and other smart trackers, and other discovery from the Internet of Things.
  2. Supreme Court Case Law on Privacy and Technology, including the impact on civil discovery of issues arising in criminal cases, such as cell-phone searches, GPS tracking and the “mosaic theory” of collective personal data accumulation.
  3. A Modern Framework for Privacy Protection in Discovery, examining the current arguments about privacy in discovery.

Discovery Today

Professor Stuart’s Privacy in Modern Discovery section begins, as noted, with the Discovery Today overview (II.A.). Most readers here will already be familiar with these topics and discussion, so I will not go into them in depth. One important insight she provides pertains to the omission of “privacy” as an express factor for proportionality consideration under the Rule 26(b), FRCP.

While the Rules revisions generally addressed the tremendous rise in ESI volume and costs with emphasis on judicial intervention, cooperation, and reduction in scope, they did not give specific attention to issues of privacy.219 However, as discovery’s intrusiveness has pervaded not just vast storage databases and email but chronicles of individuals’ personal lives, privacy has received more attention. Commentators have advocated for privacy to be a factor in the proportionality equation,220 and courts have followed suit.221 Privacy has also featured prominently in recent Fourth Amendment case law, which has in turn influenced discovery decisions.

In a recent email exchange with Allyson Stuart on the interesting point of Rule 26(B), I pressed her on whether she thinks the Rule should be changed again. Here is her response, which, I should add, she gave me permission to include in this blog post:

I have mixed feelings about yet another revision to the Frankenstein that is Rule 26.  As it is, many practitioners fail to pay attention to the revisions, treating the scope as still including anything that would lead to the discovery of relevant evidence and failing to recognize that proportionality is nothing new.  I think instead the culture needs to be curbed, and attorneys should not try to obtain a vast amount of e-discovery simply because it is accessible. The casual nature of email, text and some social media content make them catnip for attorneys, but I really believe there is a chilling effect on litigation because of it.  In particular, if the only relevance for certain discovery is impeachment value, it should be weighed less strongly against competing privacy interests.  All that said, I would love it if the word privacy were included in the proportionality factors.

Author’s Correspondence 8//9/22 with Professor Stuart

I love how she describes Rule 26 as a Frankenstein. The question remains should privacy be added as another body part to the proportionality considerations. In a video conference with Professor Stuart on August 23, 2022, she expanded on this point. Here is the relevant excerpt, which, I should again add, Allyson Stuart gave me permission to record and publish.

Aside from Rule 26(b) and including privacy factors as part of a proportionality analysis, another hot issue today practitioners is cell-phone discovery. It is found at II.A.2.a. Professor Stuart’s article and case citations and discussion on this point are a helpful starting point for your research. Be sure to look at the article itself for the all-important footnotes.

As the Supreme Court has recognized, cell phones are ubiquitous.222 Courts find a strong privacy interest in the content of those devices, particular when a party seeks a forensic examination of the phone.223 Like inspection of litigants’ hard drives and other computer systems,224 inspection of cell phones implicates privacy rights, privileged communications, and non-relevant information.225 Courts are therefore reluctant to order litigants to submit their cell phones to their opponent for purposes of forensic examination absent necessity for purposes of finding highly relevant evidence, or proof of spoliation.226 Courts also find a strong privacy interest in cell phone records.227 Courts have been strongly persuaded by recent Supreme Court Fourth Amendment doctrine in finding privacy rights in this data.228

Professor Stuarts discussion of case law is also very interesting in the Fitbit and Internet of Things sub-sections of Discovery Today (II.A.2.c.&d.). She points out that:

All of these subjects of modern discovery push the boundaries of privacy. Technology enables the gathering and storage of vast amounts of information that create digital chronicles of individuals’ personal lives. This phenomenon has been the focus of recent Supreme Court decisions in the Fourth Amendment context.

In Part 2 of this blog series I will go on to next section of her article, II.B., entitled Supreme Court Case Law on Privacy and Technology. This is very interesting, especially considering the Supreme Court bombshell case on abortion that came down after her article. Dobbs v. Jackson Women’s Health Organization, 597 U.S. _ (2022). Part 2 will go into all of this, along with criminal law considerations, and several more written and video interviews of Professor Stuart, including an interview that goes beyond discovery issues to consider the general privacy implications of Dobbs. I will also consider the privacy implications and other issues raised by the recent Donald Trump criminal warrant.

Leave a Comment » | Evidence, Forensic Exam, informaton, Internet Regulation, Lawyers Duties, Metadata, New Rules, Related Legal Webs, Review, Search, Security, Spoliation/Sanctions, Technology | Permalink
Posted by Ralph Losey

Examining a Leaked Criminal Warrant for Apple iCloud Data in a High Profile Case – Part Two

June 28, 2022

Inadvertently Disclosed Warrant Application Against Apple in a Criminal Investigation Against Retired Marine General Reveals Latest DOJ Search Procedures, the Dangers of Pacer and Too Much Court Record Transparency, and Much More – Part Two

This article is Part Two of the blog Examining a Leaked Criminal Warrant for Apple iCloud Data in a High Profile Case. See here for Part 1.

Items To Be Seized – Search Procedures

The “real” Sherlock
searching for clues in ESI.

In Attachment B to the Application, entitled, Items To Be Seized, the government describes in Section I the Search Procedures they want Apple to follow. That’s where it gets really interesting for anyone in ediscovery. The fun continues in Section II, Information to be Disclosed by Provider, Section III, Information to be Seized by the Government, and Section IV Provider Procedures.

Section I starts off by directing Apple to make a forensic copy, i.w., bit by bit. The language for this is informative. Note how this intrusive request is characterized as a kind of nice courtesy to all of us other Apple iCloud users.

2 . To minimize any disruption of service to third parties, the PROVIDER’s employees and / or law enforcement personnel trained in the operation of computers will create an exact duplicate of the information described in Section II below.

Skipping to paragraph four of the Search Procedures section, the government talks about the search tools they may use. One would hope it is not an exhaustive list. There are so many other good tools out there. Just peruse around EDRM.net and you will see many of the best,

The search shall extract and seize only the specific items to be seized under this warrant (see Section III below ). The search team may use forensic examination and searching tools, such as “Encase” and “FTK” (Forensic Tool Kit), which tools may use hashing and other sophisticated techniques. The review of the electronic data may be conducted by any government personnel assisting in the investigation, who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, and technical experts.

In the next paragraph five, you see a “this crime only” type relevance limitation put on the search. That should keep it from being a general fishing expedition, of oh, gee, look what I found, yet another new crime.

The search team will not seize contraband or evidence relating to other crimes outside the scope of the items to be seized without first obtaining a further warrant to search for and seize such contraband or evidence.

In the next paragraph six a time limit for the search is self-imposed by the government, but of course a back door is provided to ask the court for more time, which, I hear, is the rule, not the exception. In other words, this time limit is about as flexible as one of Dali’s clocks.

The search team will complete its search of the content records as soon as is practicable but not to exceed 120 days from the date of receipt from the PROVIDER of the response to this warrant. The government will not search the content records beyond this 120-day period without first obtaining an extension of time order from the Court .

In paragraph seven, it is explained that after the search team completes its review of the data, the original production by Apple, the provider here, will then be “sealed and preserved” by the government, not returned and destroyed. The reasons given for this procedure is what you would expect, “authenticity and chain of custody purposes.”

In paragraph nine of the Search Procedures, the Application asserts that “Pursuant to 18 U.S.C. 2703(g) the presence of an agent is not required for service or execution of this warrant.” I am sure the search team of ediscovery experts who will actually do the work here are relieved to know that they won’t have to have an FBI agent looking over their shoulders the whole time. But it does raise the question as to who watches the watchers, or in their case, the seekers. I assume they will do a better job with cybersecurity that the NSA did with Snowden, or the Clerk here did with the sealed Applicatioin. Thumb drive cuff links anyone? Only $39.95 on Amazon.

Information to be Disclosed by Provider

Attachment B to the Application is entitled, Items To Be Seized. Section II of Attachment B describes the Information to be Disclosed by Provider, in this case Apple. This is paragraph ten of the Application. First of all, the Application makes clear that Apple must disclose the information, no matter where in the world Apple may have the ESI stored. So much for international privacy laws. This is a criminal warrant by the DOJ, so you do what the government says, the US government, or else. This is a real problem for countries with strong ESI privacy rights, such as those located in the EU. For good background on this, see The Ultimate Guide to GDPR and Ediscovery by Zapproved (EDRM 5/19/22) (Order in a civil case forbidding the forensic examination of the computers in China as “out of proportion with the needs of this case,” citing Rule 26 (b)(1), Federal Rules of Civil Procedure.)

Also, under the Application, it does not matter if Apple has already deleted the data. Apple must still restore and fetch it, if it is “still available.” Use your forensic experts and cough it up. See: EDRM Collection Standards, 1. Forensic Image (Physical or Logical Target) and 6.4. International Protocols. There is no proportionality, cost burden analysis in the Application that you would ordinarily see in a civil case. Apple is required to turn over all “wire and electronic communications” to the DOJ search team from October 1, 2016, to the date of the Application, April 15, 2022. See eg. my 5/28/18 blog, Proportionality Analysis Defeats Motion for Forensic Examination, discussing Motorola Sols., Inc v. Hytera Communications Corp., No. 17 C 1973 (N.D. Ill.).

Now comes the typical including without limitation laundry list of in paragraph 10 a. i-iv. It is quite an extensive list, including “buddy lists.” (I can’t believe anyone still uses that feature. I don’t even see it on my apple devices.) I quote this part 10. a. in full, except for subparagraph iii, which is provider specific, in case you want to use something obnoxiously long and complete like this yourself some day when subpoenaing a private party.

i . All e-mails , communications , or messages of any kind associated with the SUBJECT ACCOUNT, including stored or preserved copies of messages sent to and from the account, deleted messages, and messages maintained in trash or any other folders or tags or labels, as well as all header information associated with each e-mail or message, and any related documents or attachments.

ii. All records or other information stored by subscriber of the SUBJECT ACCOUNT including address books, contact and buddy lists, calendar data, pictures, videos, notes, texts, links, user profiles, account settings, access logs, and files. . . .

iv. All stored files and other records stored on iCloud for the SUBJECT ACCOUNT, including all device backups, all Apple and third-party app data (such as third-party provider emails and Whatsapp application chats backed up via iCloud), all files and other records related to iCloud Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork (including Pages, Numbers, and Keynote) , iCloud Tabs, and iCloud Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, device settings, and bookmarks;

Just in case that list is not exhaustive enough for you, the government goes on to make the list even longer by adding a part b, specifically 10. b. i-iii found at pages 7-9 of 77 of the Application. Most of this is information that a provider might have about the subscriber, the target of the investigation. I quote below the subsection iii on encryption and keybags, which is pretty interesting and could have other uses by practitioners.

b. iii. All files, keys, or other information necessary to decrypt any data produced in an encrypted form, when available to Apple (including, but not limited to, the keybag.txt and fileinfolist.txt files);

Here is Apple’s explanation of what a keybag.txt file should contain, basically the passwords, and how it is used. It gets very complicated. The fileinfolist.txt is not explained by Apple, but appears to be a device file directory.

For background on the related issues of encryption in criminal wiretaps, and the problems this has been causing criminal investigations lately, see the excellent article by Zuckerman Spaeder LLP, in JD Supra, 6/10/22, entitled Warranted wiretapping? What to look for in this year’s Wiretap Report. Zuckerman cites the government Wiretap Report that in 2020 encryption was encountered in 398 wiretaps, and the plain text of the messages could not be decrypted in 383 of those. Yikes, that a 96% failure rate! Moreover, the expenses per wiretap reached an all-time high of $119,418 in 2020, up 183% from $42,216 in 2015. United State Courts, 2020 Wiretap Report. Also see the interesting article on a criminal ESI discovery case with bizarre facts to match the title, Despite Estimate of 37 Years to Crack iPhone, Government Doesn’t Have to Return it – Yet: eDiscovery Case Law, (EDRM, Cloud Nine, 3/27/20). Wonder if people will still even use phones in 37 years? I kind of doubt it.

_________________

To be continued . . . Part three of this Blog will examine Section III of the Application, namely Information To Be Seized by the Government, and Section IV, Provider Procedures. The last part of the blog will focus on the dangers of too much information, the dangers of Pacer, suggestions for its reform, the complex transparency of online court records, privacy rights and speculation on how the leak to the API in this case could have happened. In the meantime, please leave some comments below.

2 Comments | AI Ethics, Evidence, Forensic Exam, informaton, Lawyers Duties, Metadata, Review, Search, Technology | Permalink
Posted by Ralph Losey

« Previous Entries
%d bloggers like this: