Inadvertently Disclosed Warrant Application Against Apple in a Criminal Investigation Against Retired Marine General Reveals Latest DOJ Search Procedures, the Dangers of Pacer and Too Much Court Record Transparency, and Much More – Part Two
This article is Part Two of the blog Examining a Leaked Criminal Warrant for Apple iCloud Data in a High Profile Case. See here for Part 1.
Items To Be Seized – Search Procedures
searching for clues in ESI.
In Attachment B to the Application, entitled, Items To Be Seized, the government describes in Section I the Search Procedures they want Apple to follow. That’s where it gets really interesting for anyone in ediscovery. The fun continues in Section II, Information to be Disclosed by Provider, Section III, Information to be Seized by the Government, and Section IV Provider Procedures.
Section I starts off by directing Apple to make a forensic copy, i.w., bit by bit. The language for this is informative. Note how this intrusive request is characterized as a kind of nice courtesy to all of us other Apple iCloud users.
2 . To minimize any disruption of service to third parties, the PROVIDER’s employees and / or law enforcement personnel trained in the operation of computers will create an exact duplicate of the information described in Section II below.
Skipping to paragraph four of the Search Procedures section, the government talks about the search tools they may use. One would hope it is not an exhaustive list. There are so many other good tools out there. Just peruse around EDRM.net and you will see many of the best,
The search shall extract and seize only the specific items to be seized under this warrant (see Section III below ). The search team may use forensic examination and searching tools, such as “Encase” and “FTK” (Forensic Tool Kit), which tools may use hashing and other sophisticated techniques. The review of the electronic data may be conducted by any government personnel assisting in the investigation, who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, and technical experts.
In the next paragraph five, you see a “this crime only” type relevance limitation put on the search. That should keep it from being a general fishing expedition, of oh, gee, look what I found, yet another new crime.
The search team will not seize contraband or evidence relating to other crimes outside the scope of the items to be seized without first obtaining a further warrant to search for and seize such contraband or evidence.
In the next paragraph six a time limit for the search is self-imposed by the government, but of course a back door is provided to ask the court for more time, which, I hear, is the rule, not the exception. In other words, this time limit is about as flexible as one of Dali’s clocks.
The search team will complete its search of the content records as soon as is practicable but not to exceed 120 days from the date of receipt from the PROVIDER of the response to this warrant. The government will not search the content records beyond this 120-day period without first obtaining an extension of time order from the Court .
In paragraph seven, it is explained that after the search team completes its review of the data, the original production by Apple, the provider here, will then be “sealed and preserved” by the government, not returned and destroyed. The reasons given for this procedure is what you would expect, “authenticity and chain of custody purposes.”
In paragraph nine of the Search Procedures, the Application asserts that “Pursuant to 18 U.S.C. 2703(g) the presence of an agent is not required for service or execution of this warrant.” I am sure the search team of ediscovery experts who will actually do the work here are relieved to know that they won’t have to have an FBI agent looking over their shoulders the whole time. But it does raise the question as to who watches the watchers, or in their case, the seekers. I assume they will do a better job with cybersecurity that the NSA did with Snowden, or the Clerk here did with the sealed Applicatioin. Thumb drive cuff links anyone? Only $39.95 on Amazon.
Information to be Disclosed by Provider
Attachment B to the Application is entitled, Items To Be Seized. Section II of Attachment B describes the Information to be Disclosed by Provider, in this case Apple. This is paragraph ten of the Application. First of all, the Application makes clear that Apple must disclose the information, no matter where in the world Apple may have the ESI stored. So much for international privacy laws. This is a criminal warrant by the DOJ, so you do what the government says, the US government, or else. This is a real problem for countries with strong ESI privacy rights, such as those located in the EU. For good background on this, see The Ultimate Guide to GDPR and Ediscovery by Zapproved (EDRM 5/19/22) (Order in a civil case forbidding the forensic examination of the computers in China as “out of proportion with the needs of this case,” citing Rule 26 (b)(1), Federal Rules of Civil Procedure.)
Also, under the Application, it does not matter if Apple has already deleted the data. Apple must still restore and fetch it, if it is “still available.” Use your forensic experts and cough it up. See: EDRM Collection Standards, 1. Forensic Image (Physical or Logical Target) and 6.4. International Protocols. There is no proportionality, cost burden analysis in the Application that you would ordinarily see in a civil case. Apple is required to turn over all “wire and electronic communications” to the DOJ search team from October 1, 2016, to the date of the Application, April 15, 2022. See eg. my 5/28/18 blog, Proportionality Analysis Defeats Motion for Forensic Examination, discussing Motorola Sols., Inc v. Hytera Communications Corp., No. 17 C 1973 (N.D. Ill.).
Now comes the typical including without limitation laundry list of in paragraph 10 a. i-iv. It is quite an extensive list, including “buddy lists.” (I can’t believe anyone still uses that feature. I don’t even see it on my apple devices.) I quote this part 10. a. in full, except for subparagraph iii, which is provider specific, in case you want to use something obnoxiously long and complete like this yourself some day when subpoenaing a private party.
i . All e-mails , communications , or messages of any kind associated with the SUBJECT ACCOUNT, including stored or preserved copies of messages sent to and from the account, deleted messages, and messages maintained in trash or any other folders or tags or labels, as well as all header information associated with each e-mail or message, and any related documents or attachments.
ii. All records or other information stored by subscriber of the SUBJECT ACCOUNT including address books, contact and buddy lists, calendar data, pictures, videos, notes, texts, links, user profiles, account settings, access logs, and files. . . .
iv. All stored files and other records stored on iCloud for the SUBJECT ACCOUNT, including all device backups, all Apple and third-party app data (such as third-party provider emails and Whatsapp application chats backed up via iCloud), all files and other records related to iCloud Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork (including Pages, Numbers, and Keynote) , iCloud Tabs, and iCloud Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, device settings, and bookmarks;
Just in case that list is not exhaustive enough for you, the government goes on to make the list even longer by adding a part b, specifically 10. b. i-iii found at pages 7-9 of 77 of the Application. Most of this is information that a provider might have about the subscriber, the target of the investigation. I quote below the subsection iii on encryption and keybags, which is pretty interesting and could have other uses by practitioners.
b. iii. All files, keys, or other information necessary to decrypt any data produced in an encrypted form, when available to Apple (including, but not limited to, the keybag.txt and fileinfolist.txt files);
Here is Apple’s explanation of what a keybag.txt file should contain, basically the passwords, and how it is used. It gets very complicated. The fileinfolist.txt is not explained by Apple, but appears to be a device file directory.
For background on the related issues of encryption in criminal wiretaps, and the problems this has been causing criminal investigations lately, see the excellent article by Zuckerman Spaeder LLP, in JD Supra, 6/10/22, entitled Warranted wiretapping? What to look for in this year’s Wiretap Report. Zuckerman cites the government Wiretap Report that in 2020 encryption was encountered in 398 wiretaps, and the plain text of the messages could not be decrypted in 383 of those. Yikes, that a 96% failure rate! Moreover, the expenses per wiretap reached an all-time high of $119,418 in 2020, up 183% from $42,216 in 2015. United State Courts, 2020 Wiretap Report. Also see the interesting article on a criminal ESI discovery case with bizarre facts to match the title, Despite Estimate of 37 Years to Crack iPhone, Government Doesn’t Have to Return it – Yet: eDiscovery Case Law, (EDRM, Cloud Nine, 3/27/20). Wonder if people will still even use phones in 37 years? I kind of doubt it.
_________________
To be continued . . . Part three of this Blog will examine Section III of the Application, namely Information To Be Seized by the Government, and Section IV, Provider Procedures. The last part of the blog will focus on the dangers of too much information, the dangers of Pacer, suggestions for its reform, the complex transparency of online court records, privacy rights and speculation on how the leak to the API in this case could have happened. In the meantime, please leave some comments below.
Posted by Ralph Losey 
It’s Mueller Time! I predict we will be hearing this call around the world for decades, including boardrooms. Organizations will decide to investigate themselves on sensitive issues before the government does, or before someone sues them and triggers formal discovery. Not always, but sometimes, they will do so by appointing their own independent counsel to check on concerns. The Boards of tomorrow will not look the other way. If Robert Muller himself later showed up at their door, they would be ready. They would thank their G.C. that they had already cleaned house.
Most companies who decide it is Mueller Time, will probably not investigate themselves in the traditional “full calorie” Robert Muller way, as good as that is. Instead, they will order a less expensive, AI based investigation, a Mueller Lite. The “full calorie” traditional legal investigation is very expensive, slow and leaky. It involves many people and linear document review. The AI Assisted alternative, the Mueller Lite, will be more attractive because of its lower cost. It will still be an independent investigation, but will rely primarily on internal data and artificial intelligence, not expensive attorneys.
Robert Mueller investigations typically cost millions and involves large teams of expensive professionals. AI Assisted investigations are cheap by comparison. That is because they emphasize company data and AI search of the data, mostly the communications, and need so few people to carry out. This new kind of investigation allows a company to quietly look into and take care of its own problems. The cost savings from litigation avoidance, and bad publicity, can be compelling. Plus it is the right thing to do..
The computer “reads” or reviews at nearly the speed of light and is 100% consistent. But it has no knowledge on its own. An idiot savant. The AI cannot do anything without its human handlers and trainers. It is basically a learning machine designed to sort large collections of texts into binary sets, typically relevant or irrelevant.
This new legal service allows concerned management to proactively investigate upon the first indications of possible wrong-doing. It allows you to have greater assurance that you really know what is going on in your organization. Management or the Board then retains an independent team of legal experts to conduct the quick E-Vestigation. The team provides subject matter expertise on the suspected problem and uses active machine learning to quickly search and analyze the data. They search for preliminary indications of what happened, if anything. This kind of search is ideal for sensitive legal inquiries. It gives management the information needed without breaking the bank or publicizing the results.
E-Vestigations are a pre-litigation legal service that relies heavily on artificial intelligence, but not entirely. Investigations like this are very complex. They are nowhere near a fully automated process, and as mentioned the AI is really just a learning machine that knows nothing except how to learn document relevance. The service still needs legal experts, but a much smaller team
The glory days of litigation are over. All trial lawyers who, like me, have lived through the last forty years of legal practice, have seen it change dramatically. Litigation has moved from a trial and discovery practice, where we saw each other daily in court, to a discovery, motion and mediation practice where we communicate by email and occasional calls.
But the times were a changing. In the nineties and first decade of the 21st Century, trials quickly disappeared. Instead, Mediation started to take over. I know, I was in the first group of lawyers ever to be certified as a Mediator of High Technology disputes in 1989. All types of cases began to settle earlier and with less preparation. I have seen cases settle at Mediation where none of the attorneys knew the facts. They just knew what their clients told them. Even more often, only one side was prepared a knew the facts. The other was just “shooting from the hip.”
E-Vestigations are confidential, internal investigations that focus on search of client data and metadata. They uses Artificial Intelligence to search and retrieve information relative to the client’s requested investigation, their information need. We use an AI machine training method that we call Hybrid Multimodal Predictive Coding 4.0. The basic search method is explained in the open-sourced 
E-Vestigation is done outside of Litigation and court involvement, usually to try to anticipate and avoid Litigation. Are the rumors true, or are the allegations just a bogus attempt to extort a settlement? E-Vestigations are by nature private, confidential investigations, not responses to formal discovery. AI Assisted investigations rely primarily on what the data says, not the rumors and suspicions, or even what some people say. The analysis of vast volumes of ESI is possible, even with millions of files, because e-Vestigations use Artificial Intelligence, both passive and active machine learning. Otherwise, the search of large volumes of ESI takes too long and is too prone to inaccuracies. That is the main reason this approach is far less expensive than traditional “full calorie” Muller type investigations.
Defendants in criminal cases will still plea out, but based on the facts, on truth, not threats. Defendants in civil cases will do the same. So will the plaintiff in civil cases who makes unsubstantiated allegations. Facts and truth protect the innocent. Most of that information will be uncovered in computer systems. In the right hands, E-Vestigations can reveal all. It is a proactive alternative to Litigation with expensive settlements. The AI data review features of E-Vestigations make it far less expensive than a Muller investigations. Is it Mueller Time for your organization?
I find this kind of constant monitoring to be distasteful. For me, it is too Big Brother and oppressive to have AI looking at my every email. It stifles creativity and, I imagine, if this was in place, would make me overly cautious in my communications. Plus, I would be very concerned about software error. If some baby AI is always on, always looking for suspicious patterns, it could make mistakes. The programming of the software almost certainly contains a number of hidden biases of the programmers, typically young white dudes.
Stealthiness:
Speed:
As discussed, the rise and commoditization of Mediation over the last twenty years has had unintended consequences. The move from the courtroom to the mediator’s office in turn caused the Law to move from objective to subjective opinion. Discussion of the consequences of mediation, and the subjectivist attitude it brings, complicates my analysis of the death of Litigation, but is necessary. Litigation did not turn into private investigation work. One did not flow into another. Litigation is not changing directly into private Investigations, AI assisted or not. Mediation, and its unexpected consequences, is the intervening stage.
Most of my Mediator friends strongly disagree, but I have never heard a compelling argument to the contrary. The death of the trial is a stunning development. But mediation has had another impact. One that I have not seen discussed previously. It has not only killed trials, it has killed the whole notion of objective truth. It has led to a mediation mind-set where the “merits” are just a matter of opinion. Where cost of defense and the time value of money are the main items of discussion.
Objective accounts of what happened in the past are not only possible, they are probable in today’s Big Data world. Your Alexa or Google speakers may have part of the record. So too may your iWatch or Fitbit. Soon your refrigerator will too. Data is everywhere. Privacy is often an illusion. (Sigh.) The opportunity of liars and other scoundrels to “get away with it” and fool people is growing smaller every day. Fortunately, if lawyers can just learn a few new evidence search skills, they can use AI to help them find the information they need.
As Michiko Kakutani said in her book, 
The truth is attainable, but requires dedication and skilled efforts by everyone on a legal team to find it. It requires knowledge of course, and a proven method, but also impartiality, discipline, intelligence and a sense of empathy. It requires experience with what the AI can do, and just as important, what it cannot do. It requires common sense. Lawyers have that. Jurors have that.
In Part Two we consider the last seven gifts from the beloved client and how to deal with the problems and opportunities these presents present. Suggest you 
The issue here is reasonability of search effort. It arises out of Rule 26(g) and the requirement that a search in response to a request for ESI must be reasonable. Good faith is presumed under the Rules because attorneys of record in the court proceeding are in charge of the discovery effort. They have a duty to the court in which they are allowed to appear as a member of the Court’s Bar. The trial attorneys may delegate to specialized experts, to be sure, but counsel of record signing the 26(g) response is the attorney ultimately responsible.
What a great gift. This may be the evidence you need, literally, to prove that the other side is cheating on their discovery obligations, maybe even trying to hide the ball. That is game-changing news. Verify and authenticate first, as we will discuss with twelfth present. After you authenticate, then you may want to keep it secret for a while. See if gotcha-traps of counter-discovery might be possible to get them to lie even more, to dig the grave deeper. This is in accord with the general examination principle that when a witness is lying, go along with it, pretend you believe, and maybe they will embellish further under oath. Then, when you have their detailed lie as sworn testimony under oath, confront them with the lies. Every good lawyer deserves a Perry Mason moment. Every good liar in turn deserves their own Mueller moment of impeachment.
Same drill as with the iPhones, get all this data, and remember, there could be hundreds of millions of files with that many USB drives, into a forensic engineer’s hands ASAP. Preserve, cull and get some of the ESI into a database for review. Find the needles of important ESI in the vast haystacks of irrelevant data.
First thing to do is get the labels and all other information from the client about these tapes. You don’t want to pay an outside vendor to tell you what is on the client’s tapes, but that is always possible if they are truly a mystery. Do they have to be preserved? Do they also have to be searched? Why?
When a “too good to be true” electronic documents are your present, inspect them very carefully, especially the metadata. It might be a fake. The smoking gun might be smoke and mirrors. Question your client about the background and origin of all ESI, but especially hot documents that appear unexpectedly and late in a case. You have a legal and ethical duty to do so. See Eg: Lawrence v. City of N.Y., Case No. 15cv8947 (SDNY, 7/27/18) 
e-Discovery Team ® 