Inadvertently Disclosed Warrant Application Against Apple in a Criminal Investigation Against Retired Marine General Reveals Latest DOJ Search Procedures, the Dangers of Pacer and Too Much Court Record Transparency, and Much More – Part Two
This article is Part Two of the blog Examining a Leaked Criminal Warrant for Apple iCloud Data in a High Profile Case. See here for Part 1.
In Attachment B to the Application, entitled, Items To Be Seized, the government describes in Section I the Search Procedures they want Apple to follow. That’s where it gets really interesting for anyone in ediscovery. The fun continues in Section II, Information to be Disclosed by Provider, Section III, Information to be Seized by the Government, and Section IV Provider Procedures.
Section I starts off by directing Apple to make a forensic copy, i.w., bit by bit. The language for this is informative. Note how this intrusive request is characterized as a kind of nice courtesy to all of us other Apple iCloud users.
2 . To minimize any disruption of service to third parties, the PROVIDER’s employees and / or law enforcement personnel trained in the operation of computers will create an exact duplicate of the information described in Section II below.
Skipping to paragraph four of the Search Procedures section, the government talks about the search tools they may use. One would hope it is not an exhaustive list. There are so many other good tools out there. Just peruse around EDRM.net and you will see many of the best,
The search shall extract and seize only the specific items to be seized under this warrant (see Section III below ). The search team may use forensic examination and searching tools, such as “Encase” and “FTK” (Forensic Tool Kit), which tools may use hashing and other sophisticated techniques. The review of the electronic data may be conducted by any government personnel assisting in the investigation, who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, and technical experts.
In the next paragraph five, you see a “this crime only” type relevance limitation put on the search. That should keep it from being a general fishing expedition, of oh, gee, look what I found, yet another new crime.
The search team will not seize contraband or evidence relating to other crimes outside the scope of the items to be seized without first obtaining a further warrant to search for and seize such contraband or evidence.
In the next paragraph six a time limit for the search is self-imposed by the government, but of course a back door is provided to ask the court for more time, which, I hear, is the rule, not the exception. In other words, this time limit is about as flexible as one of Dali’s clocks.
The search team will complete its search of the content records as soon as is practicable but not to exceed 120 days from the date of receipt from the PROVIDER of the response to this warrant. The government will not search the content records beyond this 120-day period without first obtaining an extension of time order from the Court .
In paragraph seven, it is explained that after the search team completes its review of the data, the original production by Apple, the provider here, will then be “sealed and preserved” by the government, not returned and destroyed. The reasons given for this procedure is what you would expect, “authenticity and chain of custody purposes.”
In paragraph nine of the Search Procedures, the Application asserts that “Pursuant to 18 U.S.C. 2703(g) the presence of an agent is not required for service or execution of this warrant.” I am sure the search team of ediscovery experts who will actually do the work here are relieved to know that they won’t have to have an FBI agent looking over their shoulders the whole time. But it does raise the question as to who watches the watchers, or in their case, the seekers. I assume they will do a better job with cybersecurity that the NSA did with Snowden, or the Clerk here did with the sealed Applicatioin. Thumb drive cuff links anyone? Only $39.95 on Amazon.
Information to be Disclosed by Provider
Attachment B to the Application is entitled, Items To Be Seized. Section II of Attachment B describes the Information to be Disclosed by Provider, in this case Apple. This is paragraph ten of the Application. First of all, the Application makes clear that Apple must disclose the information, no matter where in the world Apple may have the ESI stored. So much for international privacy laws. This is a criminal warrant by the DOJ, so you do what the government says, the US government, or else. This is a real problem for countries with strong ESI privacy rights, such as those located in the EU. For good background on this, see The Ultimate Guide to GDPR and Ediscovery by Zapproved (EDRM 5/19/22) (Order in a civil case forbidding the forensic examination of the computers in China as “out of proportion with the needs of this case,” citing Rule 26 (b)(1), Federal Rules of Civil Procedure.)
Now comes the typical including without limitation laundry list of in paragraph 10 a. i-iv. It is quite an extensive list, including “buddy lists.” (I can’t believe anyone still uses that feature. I don’t even see it on my apple devices.) I quote this part 10. a. in full, except for subparagraph iii, which is provider specific, in case you want to use something obnoxiously long and complete like this yourself some day when subpoenaing a private party.
i . All e-mails , communications , or messages of any kind associated with the SUBJECT ACCOUNT, including stored or preserved copies of messages sent to and from the account, deleted messages, and messages maintained in trash or any other folders or tags or labels, as well as all header information associated with each e-mail or message, and any related documents or attachments.
ii. All records or other information stored by subscriber of the SUBJECT ACCOUNT including address books, contact and buddy lists, calendar data, pictures, videos, notes, texts, links, user profiles, account settings, access logs, and files. . . .
iv. All stored files and other records stored on iCloud for the SUBJECT ACCOUNT, including all device backups, all Apple and third-party app data (such as third-party provider emails and Whatsapp application chats backed up via iCloud), all files and other records related to iCloud Mail, iCloud Photo Sharing, My Photo Stream, iCloud Photo Library, iCloud Drive, iWork (including Pages, Numbers, and Keynote) , iCloud Tabs, and iCloud Keychain, and all address books, contact and buddy lists, notes, reminders, calendar entries, images, videos, voicemails, device settings, and bookmarks;
Just in case that list is not exhaustive enough for you, the government goes on to make the list even longer by adding a part b, specifically 10. b. i-iii found at pages 7-9 of 77 of the Application. Most of this is information that a provider might have about the subscriber, the target of the investigation. I quote below the subsection iii on encryption and keybags, which is pretty interesting and could have other uses by practitioners.
b. iii. All files, keys, or other information necessary to decrypt any data produced in an encrypted form, when available to Apple (including, but not limited to, the keybag.txt and fileinfolist.txt files);
Here is Apple’s explanation of what a keybag.txt file should contain, basically the passwords, and how it is used. It gets very complicated. The fileinfolist.txt is not explained by Apple, but appears to be a device file directory.
For background on the related issues of encryption in criminal wiretaps, and the problems this has been causing criminal investigations lately, see the excellent article by Zuckerman Spaeder LLP, in JD Supra, 6/10/22, entitled Warranted wiretapping? What to look for in this year’s Wiretap Report. Zuckerman cites the government Wiretap Report that in 2020 encryption was encountered in 398 wiretaps, and the plain text of the messages could not be decrypted in 383 of those. Yikes, that a 96% failure rate! Moreover, the expenses per wiretap reached an all-time high of $119,418 in 2020, up 183% from $42,216 in 2015. United State Courts, 2020 Wiretap Report. Also see the interesting article on a criminal ESI discovery case with bizarre facts to match the title, Despite Estimate of 37 Years to Crack iPhone, Government Doesn’t Have to Return it – Yet: eDiscovery Case Law, (EDRM, Cloud Nine, 3/27/20). Wonder if people will still even use phones in 37 years? I kind of doubt it.
_________________
To be continued . . . Part three of this Blog will examine Section III of the Application, namely Information To Be Seized by the Government, and Section IV, Provider Procedures. The last part of the blog will focus on the dangers of too much information, the dangers of Pacer, suggestions for its reform, the complex transparency of online court records, privacy rights and speculation on how the leak to the API in this case could have happened. In the meantime, please leave some comments below.
I’ve escaped the e-Discovery Niche After 15 Years of Super-Specialization
Ralph Losey, January 25, 2022
After fifteen years of writing weekly blogs on e-discovery, I took three years off to focus on implementation of all those words. Now I’m back, back to where I once belonged. Writing again, but writing not just about my Big Law niche, the fun little AI corner that I had painted myself into, but back to writing about ALL of my interests in Law and Technology. That has been my home since I started in legal practice in 1980 and at the same time started coding, mostly games, but also music software, midi creations and law office technology. Proud to recall that I was one of the first computer lawyers in the country. (Also one of the first to get in trouble with the Bar for my Internet Website, FloridaLawFirm.com, which they thought was a television broadcast!)
Ralph in the early 90s
Anyway, when not haggling with the Bar and fellow attorneys who would tease me, the first nerd, and call me a “secretary” (ooh how terrible) for having a keyboard on my desk. I kid you not! I used PCs when they first came out in my law firm as the new associate. I have had them on my desk to try to work smarter ever since. Not PCs necessarily, but all kinds.
So I’m back to where I once belonged, in the great big world of technology law, making deals and giving advice. Oh yeah, I may still consult on e-discovery too, especially the AI parts that so fascinated me ever since my Da Silva Moore breakthrough days. (Thank you Judge Andrew Peck.) For my full story, some of which I had to hide in my Big Law role as a super-specialist, see: https://www.losey.law/our-people/25-uncategorized/108-ralph-losey Not many people know I was a Qui Tam lawyer too; and for both sides.
Wait, there is still more. I’ve left the best for last. I went back home, left Big Law for good, and am now practicing law with my son, Adam Losey, daughter in law, Cat Losey, and thirteen other, crazy tech lawyer types at Losey.law. Yes, that is the real domain name and the name of the firm itself is Losey. So of course I had to go there. Check it out. Practicing law with my son is a dream come true for both of us. I’m loving it. It was lonely being the only tech wiz in a giant firm. Adam knows tech better than me, is much faster in every respect (except maybe doc review with AI) and he and Cat are obviously a lot smarter.
To my long-time readers, thanks for your encouragement. I heard you and got back to my roots of general tech-law, and got back to blogging and home. To quote the Beatles the funny “Get Back” song in their great LET IT BE album:
Rosetta (who are you talking about?) about Sweet Loretta Fart. . . .
Stay tuned, because a new blog is coming at you soon. Feel free to drop me an email at Ralph at Losey dot Law. Humans only please. Robots not welcome (unless you’re from the future and don’t have weapons).
It’s Mueller Time! I predict we will be hearing this call around the world for decades, including boardrooms. Organizations will decide to investigate themselves on sensitive issues before the government does, or before someone sues them and triggers formal discovery. Not always, but sometimes, they will do so by appointing their own independent counsel to check on concerns. The Boards of tomorrow will not look the other way. If Robert Muller himself later showed up at their door, they would be ready. They would thank their G.C. that they had already cleaned house.
Most companies who decide it is Mueller Time, will probably not investigate themselves in the traditional “full calorie” Robert Muller way, as good as that is. Instead, they will order a less expensive, AI based investigation, a Mueller Lite. The “full calorie” traditional legal investigation is very expensive, slow and leaky. It involves many people and linear document review. The AI Assisted alternative, the Mueller Lite, will be more attractive because of its lower cost. It will still be an independent investigation, but will rely primarily on internal data and artificial intelligence, not expensive attorneys.
I call this E-Vestigations, for electronic investigations. It is a new type of legal service made possible by a specialized type of AI called “Predictive Coding” and newly perfected Hybrid Multimodal methods of machine training.
Mueller Lite E-Vestigations Save Money
Robert Mueller investigations typically cost millions and involves large teams of expensive professionals. AI Assisted investigations are cheap by comparison. That is because they emphasize company data and AI search of the data, mostly the communications, and need so few people to carry out. This new kind of investigation allows a company to quietly look into and take care of its own problems. The cost savings from litigation avoidance, and bad publicity, can be compelling. Plus it is the right thing to do..
E-Vestigations will typically be a quarter the cost of a traditional Mueller style, paper investigations. It may even be far less than that. Project fees depend on the data itself (volume and “messiness”) and the “information need” of the client (simple or complex). The competitive pricing of the new service is one reason I predict it will explode in popularity. This kind of dramatic savings is possible because most of the time consuming relevance sorting and document ranking work is delegated to the AI.
The computer “reads” or reviews at nearly the speed of light and is 100% consistent. But it has no knowledge on its own. An idiot savant. The AI cannot do anything without its human handlers and trainers. It is basically a learning machine designed to sort large collections of texts into binary sets, typically relevant or irrelevant.
The human investigators read much slower and sometimes make mistakes (plus they like to get compensated), but they are absolutely indispensable. Someday the team of humans may get even smaller, but we are already down to around seven or fewer people per investigation. Compare that to the hundreds involved in a traditional Muller style document review.
Proactive “Peace of Mind” Investigations
This new legal service allows concerned management to proactively investigate upon the first indications of possible wrong-doing. It allows you to have greater assurance that you really know what is going on in your organization. Management or the Board then retains an independent team of legal experts to conduct the quick E-Vestigation. The team provides subject matter expertise on the suspected problem and uses active machine learning to quickly search and analyze the data. They search for preliminary indications of what happened, if anything. This kind of search is ideal for sensitive legal inquiries. It gives management the information needed without breaking the bank or publicizing the results.
This New Legal Service Is Built Around AI
E-Vestigations are a pre-litigation legal service that relies heavily on artificial intelligence, but not entirely. Investigations like this are very complex. They are nowhere near a fully automated process, and as mentioned the AI is really just a learning machine that knows nothing except how to learn document relevance. The service still needs legal experts, but a much smaller team
AI assisted investigations such as E-Vestigations have five compelling positive traits:
Cost
Speed
Stealthiness
Confidentiality
Accuracy.
This article introduces the new service, discusses these five positive traits and provides background for my prediction that many organizations will order AI assisted investigations in the coming years. In fact, due to the disappearing trial, I predict that E-Vestigations will someday take the lead from Litigation in many law firms. This prediction of the future, like most, requires a preliminary journey into the past, to see the longer causal line of events. That comes next, but feel to skip the next three sections until you come to the heading, What is an E-Vestigation?
King Litigation Is Dead
The glory days of litigation are over. All trial lawyers who, like me, have lived through the last forty years of legal practice, have seen it change dramatically. Litigation has moved from a trial and discovery practice, where we saw each other daily in court, to a discovery, motion and mediation practice where we communicate by email and occasional calls.
Although some “trial dogs” will not admit it, we all know that the role of trials has greatly diminished in modern practice. Everything settles. Ninety-nine percent (99%) of federal court civil cases settle without trial. Although my current firm is a large specialty practice, and so is an exception, in most law firms trials are very rare. A so-called “Trial Practice” of a major firm could go years without having an actual trial. I have seen it happen in many law firms. Good lawyers for sure, but they do not really “do trials,” they do trial preparation.
For example, when I started practicing law in 1980 “dispute resolution” was king in most law firms. It was called the “Litigation Department” and usually attracted the top legal talent. It brought in strong revenue and big clients. Every case in the top firms was either a “Bet the Farm” type, or a little case for kiddie lawyer training, we had no form-practice. Friedmann & Brown, “Bet the Farm” Versus “Law Factory”: Which One Works?(Geeks and Law, 2011).
The opposite, “Commodity Litigation,” was rare; typically just something for some divorce lawyers, PI lawyers, criminal lawyers and bankruptcy lawyers. These were not the desired specialties in the eighties, to put it mildly. Factory like practices like that did not pay that well (honest ones anyway) and were boring to most graduates of decent law schools. This has not changed much until recently, when AI has made certain Commodity practices far more interesting and desirable. SeeJoshua Kubicki, The Emerging Competitive Frontier in Biglaw is Practice Venturing (Medium, 1/24/19).
Aside from the less desirable Commodity practice law firms, most litigators in the eighties would routinely take a case to trial. Fish or Cut Bait was a popular saying. Back then Mediation was virtually unknown. Although a majority of cases did eventually settle, a large minority did not. That meant physically going to court, wearing suits and ties every day, and verbal sparing. Lots of arguments and talk about evidence. Sometimes it meant some bullying and physical pushing too, if truth be told. It was a rough and tumble legal world in the eighties, made up in many parts of the U.S. almost entirely of white men. Many were smokers, including the all-white bench.
Ah, the memories. Some of the Litigation attorneys were real jerks, to put it mildly. But only a few were suspected crooked and could not be trusted. Most were honest and could be. We policed our own and word got around about a bad apple pretty fast. Their careers in town were then soon over, one way or the other. Many would just move away or, if they had roots, become businessmen. There were trials a plenty in both the criminal and civil sides.The trials could be dramatic spectacles. The big cases were intense.
Emergence of Mediation
But the times were a changing. In the nineties and first decade of the 21st Century, trials quickly disappeared. Instead, Mediation started to take over. I know, I was in the first group of lawyers ever to be certified as a Mediator of High Technology disputes in 1989. All types of cases began to settle earlier and with less preparation. I have seen cases settle at Mediation where none of the attorneys knew the facts. They just knew what their clients told them. Even more often, only one side was prepared a knew the facts. The other was just “shooting from the hip.”
At trial the unprepared were quickly demolished by the facts, the evidence. At Mediation you can get away with it. The evidence is often just one side’s contention. Why bother to learn the record when you can just BS your way through a mediation? The truth is what I say it is, nothing more. There is no cross-exam. Mediation is a “liars heaven,” although a good mediator can plow through that.
What happened to all the Trial Lawyers you might ask? Many became Mediators, including several of my good friends. A few started specializing in Mediation advocacy, where psychodrama and math are king (typically division). Mediation has become the everyday “Commodity” practice and trials are now the “Bet the Farm” rarity.
With less than one-percent of federal cases going to trial, it is a complete misnomer to keep calling ourselves Trial Lawyers. I know I have stopped calling myself that. Like it or not, that is reality. Our current system is designed to settle. It has become a relativistic opinion fest. It is not designed to determine final, binding objective truth. It is not designed to make findings of fact. It is instead designed to mediate ever more ingenious ways to split the baby.We no longer focus on the evidence, on the objective truth of what happened. We have lost our way.
Justice without Truth is Destabilizing
Justice without Truth is a mockery of Justice, a Post-Modern mockery at that, one where everything is relative. This is called Subjectivism, where one person’s truth is as good as another’s. All is opinion.
This relativistic kind of thinking was, and still is in most Universities, the dominant belief among academics. Truth is supposed to be relative and subjective, not objective, unless it happens to be science. Hard science is supposed to have a monopoly on objectivity. Unfortunately, this relativistic way of thinking has had some unintended consequences. It has led to the kind of political instability that we see in the U.S. today. That is the basic insight of a new book by Pulitzer Prize winner, Michiko Kakutani. The Death of Truth: Notes on Falsehood in the Age of Trump (Penguin, 2018). Also see Hanlin, Postmodernism didn’t cause Trump. It explains him. (Washington Post, 9/2/18).
Truth is truth. It is not just what the company with the biggest wallet says it is. It is not an opinion. Objective truth, the facts based on hard evidence, is real. It is not just an opinion. This video ad below by CNN was cited by Kakutani in her Death of Truth. It makes the case for objectivity in a simple, common sense manner. The political overtones are obvious.
There is a place for the insights of Post-Modern Subjectivism, especially as it concerns religion. But for now the objective-subjective pendulum has swung too far into the subjective. The pause between directions is over and it is starting to swing back. Facts and truth are becoming important again. This point in legal history will, I predict, be marked by the Mueller investigation. Evidence is once again starting to sing in our justice system. It is singing the body electric. The era of E-Vestigations has begun!
What are E-Vestigations?
E-Vestigations are confidential, internal investigations that focus on search of client data and metadata. They uses Artificial Intelligence to search and retrieve information relative to the client’s requested investigation, their information need. We use an AI machine training method that we call Hybrid Multimodal Predictive Coding 4.0. The basic search method is explained in the open-sourced TAR Course, but the Course does not detail how the method can be used in this kind of investigation.
E-Vestigation is done outside of Litigation and court involvement, usually to try to anticipate and avoid Litigation. Are the rumors true, or are the allegations just a bogus attempt to extort a settlement? E-Vestigations are by nature private, confidential investigations, not responses to formal discovery. AI Assisted investigations rely primarily on what the data says, not the rumors and suspicions, or even what some people say. The analysis of vast volumes of ESI is possible, even with millions of files, because e-Vestigations use Artificial Intelligence, both passive and active machine learning. Otherwise, the search of large volumes of ESI takes too long and is too prone to inaccuracies. That is the main reason this approach is far less expensive than traditional “full calorie” Muller type investigations.
The goal of E-Vestigation is to find quick answers based on the record. Interviews may not be required in many investigations and when they are, they are quick and, to the interviewee, mysterious. The answers to the information needs of a client are sometimes easily found. Sometimes you may just find the record is silent as to the issue at hand, but that silence itself often speaks volumes.
The findings and report made at the end of the E-Vestigation may clear up suspicion, or it may trigger a deeper, more detailed investigation. Sometimes the communications and other information found may require an immediate, more drastic response. One way or another, knowing provides the client with legitimate peace of mind.
The electronic evidence is most cases will be so overwhelming (we know what you said, to whom and when) that testimony will be superfluous, a formality. (We have your communications, we know what you did, we just need you to clear up a few details and help us understand how it ties into guys further up the power chain. That help will earn you a lenient plea deal.) This is what is happening right now, January 2019, with the investigation of Robert Mueller.
Defendants in criminal cases will still plea out, but based on the facts, on truth, not threats. Defendants in civil cases will do the same. So will the plaintiff in civil cases who makes unsubstantiated allegations. Facts and truth protect the innocent. Most of that information will be uncovered in computer systems. In the right hands, E-Vestigations can reveal all. It is a proactive alternative to Litigation with expensive settlements. The AI data review features of E-Vestigations make it far less expensive than a Muller investigations. Is it Mueller Time for your organization?
Robert Mueller never need ask a question of a witness to which he does not already know the answer based on the what the record said. The only real question is whether the witness will further compound their problems by lying. They often do. I have seen that several times in depositions of parties in civil cases. It is sheer joy and satisfaction for the questioner to watch the ethically challenged party sink into the questioner’s hidden traps. The “exaggerating witness” will often smile, just slightly, thinking they have you fooled, just like their own attorney. You smile back knowing their lies are now of record and they have just pounded another nail into their coffin.
E-Vestigations may lead to confrontation, even arrest, if the investigation confirms suspicions. In civil matters it may lead to employee discharge or accusations against a competitor. It may lead to an immediate out-of-court settlement. In criminal matters it may lead to indictment and an informed plea and sentencing. It may also lead to Litigation in civil matters with formal, more comprehensive discovery, but at least the E-Vestigating party will have a big head start. They will know the facts. They will know what specific information to ask for from the opposing side.
Eventually, civil suits will not be filed that often, except to memorialize a party’s agreement, such as a consent to a judgment. It will, instead, be a world where information needs are met in a timely manner and Litigation is thereby avoided. A world where, if management needs to know something, such as whether so and so is a sexual predator, they can find out, fast. A world where AI in the hands of a skilled legal team can mine internal data-banks, such as very large collections of employee emails and texts, and find hidden patterns. It may find what was suspected or may lead to surprise discoveries.
The secret mining of data, otherwise known as “reading other people’s emails without their knowledge” may seem like an egregious breach of privacy, but it is not, at least not in the U.S. under the computer use policies of most groups. Employees typically consent to this search as a condition of employment or computer use. Usually the employer owns all of the equipment searched. The employee has no ownership, nor privacy rights in the business related communications of the employer.
The use of AI assistants in investigations limits the exposure of irrelevant information to humans. First, only a few people are involved in the investigation at all because the AI does the heavy lifting. Second, the human reviewers are outside of the organization. Third, the AI does almost all of the document review. Only the AI reads all of the communications, not the lawyers. The humans look at far less than one percent of the data searched in most projects. They spend most of their time in study of the documents the AI has already identified as likely relevant.
The approach of limited investigations, of going in and out of user data only to search in separate, discreet investigations, provides maximum confidentiality to the users. The alternative, which some organizations have already adopted, is constant surveillance by AI of all communications. You can predict future behavior that way, to a point and within statistical limitations of accuracy. The police in some cities are already using constant AI surveillance to predict crimes and allocate resources accordingly.
I find this kind of constant monitoring to be distasteful. For me, it is too Big Brother and oppressive to have AI looking at my every email. It stifles creativity and, I imagine, if this was in place, would make me overly cautious in my communications. Plus, I would be very concerned about software error. If some baby AI is always on, always looking for suspicious patterns, it could make mistakes. The programming of the software almost certainly contains a number of hidden biases of the programmers, typically young white dudes.
The one-by-one investigation approach advocated here provides for more privacy protection. With E-Vestigations the surveillance is focused and time limited. It is not general and ongoing.
Five Virtues of E-Vestigations
Although I am not going to go into the proprietary details here of our E-Vestigations service (contact me through my law firm if you want to know more), I do want to share what I think are the five most important traits of our AI (robotic) assisted reviews: economics, confidentiality, stealth, speed and accuracy.
Confidentiality:
Complete Secrecy.
Artificial Intelligence means fewer people are required.
Employee Privacy Rights Respected.
Data need never leave corporate premises using specialized tools from our vendor.
Attorney-Client Privilege & Work Product protected.
Stealthiness:
Under the Radar Investigation.
Only some in client IT need know.
Sensitive projects. Discreet.
Stealth forensic copy and review of employee data.
Attorneys review off-site, unseen, via encrypted online connection.
Private interviews; only where appropriate.
Speed:
Techniques designed for quick results, early assessments.
Informal, high-level investigations. Not Litigation Discovery.
High Speed Document Review with AI help.
Example: Study of Clinton’s email server (62,320 files, 30,490 disclosed – 55,000 pgs.) is, at most, a one-week project with a first report after one day.
Accuracy:
Objective Findings and Analysis.
Independent Position.
Specialized Expertise.
Answers provided with probability range limitations.
Known Unknowns (Rumsfeld).
Clients are impressed with the cost of E-Vestigations, as compared to traditional investigations. That is important, of course, but the speed of the work is what impresses many. We produce results, use a flat fee to get there, and do so very FAST.
Certainly we can move much faster than the FBI reviewing email using its traditional methods of expert linear review. The Clinton email investigations took forever by our standards. Yet, Clinton’s email server had only 62,320 files, of which 30,490 were disclosed (around 55,000 pages.) This is, at most, a one-week E-Vestigations project with a first report after one day. Our projects are much larger. They involve review of hundreds of thousands of emails, or hundreds of millions. It does not make a big difference in cost because the AI, who works for free, is doing the heavy lifting of actual studying of all this text.
Most federal agencies, including the FBI, do not have the software, the search knowledge, nor attorney skills for this new type of AI assisted investigation. They also do not have the budget to acquire good AI for assist. Take a look at this selection from the official FBI collection of Clinton email and note that the FBI and US Attorneys office in Alexandra Virginia were communicating by fax in September 2015!
State and federal government agencies are not properly funded and cannot compete with private industry compensation. The NSA may well have an A-Team for advanced search, but not the other agencies. As we know, the NSA has their hands full just trying to keep track of the Russians and other enemies interfering with our elections, not to mention the criminals and terrorists.
Unintended Consequence of Mediation Was to Insert Subjectivism into the Law
As discussed, the rise and commoditization of Mediation over the last twenty years has had unintended consequences. The move from the courtroom to the mediator’s office in turn caused the Law to move from objective to subjective opinion. Discussion of the consequences of mediation, and the subjectivist attitude it brings, complicates my analysis of the death of Litigation, but is necessary. Litigation did not turn into private investigation work. One did not flow into another. Litigation is not changing directly into private Investigations, AI assisted or not. Mediation, and its unexpected consequences, is the intervening stage.
1. Litigation → 2. Mediation → 3. AI Assisted Investigations
Mediation brought down Litigation, at least the all important Trial part of Litigation, not AI or private investigations. There is never a judge making rulings at a mediation. There are only attorneys and assertions of what. Somebody must be lying, but with Mediation you never know who. Lawyers found they could settle cases without all that. They did not need the judge at all. At mediation there are no findings of fact, no rulings of law, just droll agreements as to who will pay how much to whom.
The next stage I predict of AI Assisted Investigations is filling a gap caused by the unintended consequence of Mediation. Mediation was never intended to spawn AI Assisted Investigations, no such thing even existed. It was not possible. We did not have the technology to do something like this. The forces driving the advent of AI Assisted Investigations, which I call E-Vestigations, have little to do with Mediation directly, but are instead the result of rapid advances in technology.
Mediation was intended to encourage settlement and reduce expensive trials. It has been wildly successful at that; exceeded all expectations. But this surprise success has also led to unexpected negative consequences. It has led to a new subjectivistic attitude in Litigation. It has led to the decline of evidence and an over-relativistic attitude where Truth was dethroned.
Most of my Mediator friends strongly disagree, but I have never heard a compelling argument to the contrary. The death of the trial is a stunning development. But mediation has had another impact. One that I have not seen discussed previously. It has not only killed trials, it has killed the whole notion of objective truth. It has led to a mediation mind-set where the “merits” are just a matter of opinion. Where cost of defense and the time value of money are the main items of discussion.
That foreseeable defect has led to the unforeseeable development of an AI Assisted alternative to Litigation. It is led to E-Vestigations. AI can now be used to help lawyers investigate and quickly find out the true facts of a situation.
Many lawyers who litigate today do not care what “really happened.” Very post-modern of them, but come on? A few lawyers just blindly believe whatever damned fool thing their client tells them. Most just say we will never know the absolute truth anyway, so let us just try our best to resolve the dispute and do what’s fair without any test of the evidence. They try to do justice with just a passing nod to the evidence, to the truth of what happened. I am not a fan. It goes against all of my core teachings as a young commercial litigation attorney who prepared and tried cases. It goes against my core values and belief. My opinion is that it is not all just opinion, that there is truth.
I object to that mediation, relativistic approach. After a life in the Law chasing smoking guns and taking depositions, I know for a fact that witnesses lie, that their memories are unreliable, all too human. But I also know that the writings made by and to these same witness often expose the lies, or, more charitably put, expose the errors in human memory. Fraudsters are human and almost always make mistakes. It is an investigator’s job to check the record to find the slip-ups in the con. (I dread the day when I have to try to trace a AI fraudster!)
I have been chasing and exposing con-men most of my adult life. I defended a few too. In my experience the truth has a way of finding its way out.
This is not an idealistic dream in today’s world of information floods. There is so much information, the real difficulty is in finding the important bits, the smoking guns, the needles. The evidence is usually there, but not yet found. The real challenge today is not in gathering the evidence, it is in searching for the key documents, finding the signal in the noise.
Conclusion
Objective accounts of what happened in the past are not only possible, they are probable in today’s Big Data world. Your Alexa or Google speakers may have part of the record. So too may your iWatch or Fitbit. Soon your refrigerator will too. Data is everywhere. Privacy is often an illusion. (Sigh.) The opportunity of liars and other scoundrels to “get away with it” and fool people is growing smaller every day. Fortunately, if lawyers can just learn a few new evidence search skills, they can use AI to help them find the information they need.
Juries and judges, for the most part, believe in objective truth. They are quite capable of sorting through competing versions and getting at the truth. Good judges and lawyers (and jurors) can make sure that happens.
As mentioned, many academics and sophisticates believe otherwise, that there is no such a thing as objective truth. They believe instead in Relativism. They are wrong.
The postmodernist argument that all truths are partial (and a function of one’s perspective) led to the related argument that there are many legitimate ways to understand or represent an event. . . .
Without commonly agreed-upon facts — not Republican facts and Democratic facts; not the alternative facts of today’s silo-world — there can be no rational debate over policies, no substantive means of evaluating candidates for political office, and no way to hold elected officials accountable to the people. Without truth, democracy is hobbled. The founders recognized this, and those seeking democracy’s survival must recognize it today.
It is possible to find the truth, objective truth. All is not just opinion and allegations. Accurate forensic reconstruction is possible today in ways that we could never have imagined before. So is AI assisted search. The record of what is happening grows larger every day. That record written electronically at the time of the events in question is far more reliable than our memories. We can find the truth, but for that need to look primarily to the documents, not the testimony. That is not new. That is wisdom upon which almost all trial lawyers agree.
The truth is attainable, but requires dedication and skilled efforts by everyone on a legal team to find it. It requires knowledge of course, and a proven method, but also impartiality, discipline, intelligence and a sense of empathy. It requires experience with what the AI can do, and just as important, what it cannot do. It requires common sense. Lawyers have that. Jurors have that.
Surely only a weak-minded minority are fooled by today’s televised liars. Most competent trial lawyers could persuade a sequestered jury to convict them. And convict they will, but that still will not cause of rebirth of Litigation. Its’ glory days are over. So too is its killer, Mediation, although its death will take longer (Mediation may not even have peaked yet).
Evidence speaks louder than any skilled mediator. Let the truth be told. Let the chips fall where they may. King Litigation is dead. Long live the new King, confidential, internal AI assisted E-Vestigations.
In Part Two we consider the last seven gifts from the beloved client and how to deal with the problems and opportunities these presents present. Suggest you read Part One of this 2018 Christmas blog first. It has the full poem and discussion of the first five e-Discovery Gifts of Christmas.
What do you do When a client sends to you
Six Gigabytes of ESI for production that They determined are the only relevant few.
The problem here is not the six gigabytes of data to produce. That is easy, routine. The problem is how that ESI was determined to be relevant. Apparently here the client did it. And if this is a corporate client, it may mean the actual person or persons who did it are unknown. Maybe the client simply asked the persons accused to pick out and send the relevant evidence of the defense. Maybe they even invited the fox into the hen-house? What were the circumstances of the identification of the six gigabytes for review? What custodians? What time filter? Other culling?
The issue here is reasonability of search effort. It arises out of Rule 26(g) and the requirement that a search in response to a request for ESI must be reasonable. Good faith is presumed under the Rules because attorneys of record in the court proceeding are in charge of the discovery effort. They have a duty to the court in which they are allowed to appear as a member of the Court’s Bar. The trial attorneys may delegate to specialized experts, to be sure, but counsel of record signing the 26(g) response is the attorney ultimately responsible.
That is the sound ethical basis for the presumption of good faith. Licensed lawyers did it, not only that, they appeared of record in the court and as such are subject to the discipline and sanctions of the court. That presumption of good faith inherent in Rule 26(g) can be overcome and rebutted in circumstances where the responsible trial attorney, and his work-product experts, do not know what happened. Other facts may suggest bad faith, even intentionally negligent efforts. Half-hearted efforts suggest no real desire to find evidence that might hurt your case. That is not good.
When this kind of gift is brought to you it should trigger a series of questions. Hopefully you turn to your trusted check-list on questions to ask. Were the PSTs of the following custodians collected? Check. Were the standard hybrid multimodal ESI searches used? Check. Who was in charge? Etc.
You audit the efforts made and analyze what additional actions, if any, may still be required to satisfy your legal and ethical responsibilities. If you are satisfied, then make the production and sign the Rule 26(g) certification. You are counsel of record and it is your license to practice law on the line.
__________
What do you do When a client sends to you
Seven important emails that the opposing party omitted from the production to you?
What a great gift. This may be the evidence you need, literally, to prove that the other side is cheating on their discovery obligations, maybe even trying to hide the ball. That is game-changing news. Verify and authenticate first, as we will discuss with twelfth present. After you authenticate, then you may want to keep it secret for a while. See if gotcha-traps of counter-discovery might be possible to get them to lie even more, to dig the grave deeper. This is in accord with the general examination principle that when a witness is lying, go along with it, pretend you believe, and maybe they will embellish further under oath. Then, when you have their detailed lie as sworn testimony under oath, confront them with the lies. Every good lawyer deserves a Perry Mason moment. Every good liar in turn deserves their own Mueller moment of impeachment.
Use this information to try to flush out any fraud. And if none exists, which fortunately is still typical, and this prior omission by the producing party is usually an innocent (although colossal) mistake, then see if you can find out what happened.
Perhaps other documents important to the case still remain to be found? The aim is to force a redo and cure of the error, all to be paid for by the erring, producing party.
__________
What do you do When a client sends to you
Eight i-Phone Pluses with dirty pictures to view?
Get it into forensic hands as soon as possible. Do not let any metadata be altered accidentally. Let an expert find the pictures on the phone and get them into a database for your review. Limit your work to the lawyer part, decide if they are “dirty” as the client said, and what that means to your case. Are they what you expected? Hope for? Feared? Or did you have no idea any evidence like this would be forthcoming, not to mention why? The forensic player must be included, must be inserted into the start of the chain of custody. That way you can make sure that the evidence coming out of these eight i-Phones is admissible.
What if those eight phones, which are in fact all sophisticated computers with large flash drives, have hundreds of thousands of photo files on them? What if the search for the relevant few images of any significance to the case would be a long and laborious process? Traditional TAR will not help with pure image search because it searches text alone. Is there smart facial recognition software that might be useful? Other software? Alternative to straight linear review? Is this really worth the effort? What suggestions do others have? Client? Opposing counsel? The court?
__________
What do you do When a client sends to you
Nine portable hard-drives connected to custodian CPUs?
Same drill as with the iPhones, get all this data, and remember, there could be hundreds of millions of files with that many USB drives, into a forensic engineer’s hands ASAP. Preserve, cull and get some of the ESI into a database for review. Find the needles of important ESI in the vast haystacks of irrelevant data.
Think about the review, the cost and most prudent approach. Design a search process for this particular data that uses your standard tools and methods to meet the needs of the case. Analyze the proportionality factors. Improve your understanding of the search target. That is critical. How does that impact the outcome of the dispute? Do the math and start getting your hands into the digital mud, all at once, and all ASAP. Prevalence samples anyone? How many needles are there? That’s e-discovery for you, where all the effort should be front-loaded.
__________
What do you do When a client sends to you
Ten back-up tapes with no labels to view?
First thing to do is get the labels and all other information from the client about these tapes. You don’t want to pay an outside vendor to tell you what is on the client’s tapes, but that is always possible if they are truly a mystery. Do they have to be preserved? Do they also have to be searched? Why?
Duplicate ESI is not relevant. You only need produce one copy of the same document. Thus back-up tapes are not usually discoverable under Rule 26(b)(2)(B). After all, they just contain copies. However, sometimes the back-up tape may be the only place where a file still remains. If that is the situation in your case, then these files need to be saved. They may also need to be retrieved and searched. A common example of this might include the entire Mailbox collection of an employee, key custodian, who left the company before the hold. All email and attachments of this key custodian could have been deleted in the ordinary course, except for copies on certain backup tapes. In this situation you may have to restore that one custodian’s PST files from the tape and review them.
__________
What do you do When a client sends to you
Eleven Custodians with unfiltered data to purview?
Rejoice. The data is unfiltered so your techs get to do so, not the client’s IT. This way you can be sure that it is done right. You also do not have to worry about hidden filters, ones you did not know about or approve in advance. If it is global deduplication, for instance, no problem. You would want to do that anyway. But if it is keyword filtering, then look out. Easy to make mistakes at that, especially when not done by IT specialists. Better to test out keywords before you use them to eliminate ESI from review.
Testing and refining keywords is legal work because relevance is determined by legal analysis, not computer nor technical analysis. IT is notorious for sometimes exceeding their bounds and thinking they know best. When it comes to the Law, to the requirements of an adequate search, to relevance, client IT is out of their depth. That is your role as lawyer in a well functioning e-Discovery Team. Not sure, take a refresher of the TAR Course.
__________
What do you do When a client sends to you
Twelve Word Docs on a hard drive
That are too good to be true?
When a “too good to be true” electronic documents are your present, inspect them very carefully, especially the metadata. It might be a fake. The smoking gun might be smoke and mirrors. Question your client about the background and origin of all ESI, but especially hot documents that appear unexpectedly and late in a case. You have a legal and ethical duty to do so. See Eg: Lawrence v. City of N.Y., Case No. 15cv8947 (SDNY, 7/27/18) copy linked (Judge William Pauley) (“This Opinion & Order showcases the importance of verifying a client’s representations.”). Also see: Model Rule of Professional Conduct 3.3, Duty of Candor Toward the Tribunal:
A lawyer shall not knowingly: (1) make a false statement of fact or law to a tribunal or fail to correct a false statement of material fact or law previously made to the tribunal by the lawyer; … (3) offer evidence that the lawyer knows to be false. If a lawyer, the lawyer’s client, or a witness called by the lawyer, has offered material evidence and the lawyer comes to know of its falsity, the lawyer shall take reasonable remedial measures, including, if necessary, disclosure to the tribunal. A lawyer may refuse to offer evidence, other than the testimony of a defendant in a criminal matter, that the lawyer reasonably believes is false.
The official Comment to Rule 3.3 has some good insights into the purpose of this requirement:
[5] Paragraph (a)(3) requires that the lawyer refuse to offer evidence that the lawyer knows to be false, regardless of the client’s wishes. This duty is premised on the lawyer’s obligation as an officer of the court to prevent the trier of fact from being misled by false evidence. A lawyer does not violate this Rule if the lawyer offers the evidence for the purpose of establishing its falsity.
6] If a lawyer knows that the client intends to testify falsely or wants the lawyer to introduce false evidence, the lawyer should seek to persuade the client that the evidence should not be offered. If the persuasion is ineffective and the lawyer continues to represent the client, the lawyer must refuse to offer the false evidence. If only a portion of a witness’s testimony will be false, the lawyer may call the witness to testify but may not elicit or otherwise permit the witness to present the testimony that the lawyer knows is false.
Ralph Losey is an Arbitrator, Special Master, Mediator of Computer Law Disputes and Practicing Attorney, partner in LOSEY PLLC. Losey is a high tech law firm with three Loseys and a bunch of other cool lawyers. We handle projects, deals, IP of all kinds all over the world, plus litigation all over the U.S. For more details of Ralph's background, Click Here
All opinions expressed here are his own, and not those of his firm or clients. No legal advice is provided on this web and should not be construed as such.
Ralph has long been a leader of the world's tech lawyers. He has presented at hundreds of legal conferences and CLEs around the world. Ralph has written over two million words on e-discovery and tech-law subjects, including seven books.
Ralph has been involved with computers, software, legal hacking and the law since 1980. Ralph has the highest peer AV rating as a lawyer and was selected as a Best Lawyer in America in four categories: Commercial Litigation; E-Discovery and Information Management Law; Information Technology Law; and, Employment Law - Management.
Ralph is the proud father of two children, Eva Losey Grossman, and Adam Losey, a lawyer with incredible cyber expertise (married to another cyber expert lawyer, Catherine Losey), and best of all, husband since 1973 to Molly Friedman Losey, a mental health counselor in Winter Park.
1. Electronically stored information is generally subject to the same preservation and discovery requirements as other relevant information.
2. When balancing the cost, burden, and need for electronically stored information, courts and parties should apply the proportionality standard embodied in Fed. R. Civ. P. 26(b)(2)(C) and its state equivalents, which require consideration of importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.
3. As soon as practicable, parties should confer and seek to reach agreement regarding the preservation and production of electronically stored information.
4. Discovery requests for electronically stored information should be as specific as possible; responses and objections to discovery should disclose the scope and limits of the production.
5. The obligation to preserve electronically stored information requires reasonable and good faith efforts to retain information that is expected to be relevant to claims or defenses in reasonably anticipated or pending litigation. However, it is unreasonable to expect parties to take every conceivable step or disproportionate steps to preserve each instance of relevant electronically stored information.
6. Responding parties are best situated to evaluate the procedures, methodologies, and technologies appropriate for preserving and producing their own electronically stored information.
7. The requesting party has the burden on a motion to compel to show that the responding party’s steps to preserve and produce relevant electronically stored information were inadequate.
8. The primary source of electronically stored information to be preserved and produced should be those readily accessible in the ordinary course. Only when electronically stored information is not available through such primary sources should parties move down a continuum of less accessible sources until the information requested to be preserved or produced is no longer proportional.
9. Absent a showing of special need and relevance, a responding party should not be required to preserve, review, or produce deleted, shadowed, fragmented, or residual electronically stored information.
10. Parties should take reasonable steps to safeguard electronically stored information, the disclosure or dissemination of which is subject to privileges, work product protections, privacy obligations, or other legally enforceable restrictions.
11. A responding party may satisfy its good faith obligation to preserve and produce relevant electronically stored information by using technology and processes, such as data sampling, searching, or the use of selection criteria.
12. The production of electronically stored information should be made in the form or forms in which it is ordinarily maintained or in a that is reasonably usable given the nature of the electronically stored information and the proportional needs of the case.
13. The costs of preserving and producing relevant and proportionate electronically stored information ordinarily should be borne by the responding party.
14. The breach of a duty to preserve electronically stored information may be addressed by remedial measures, sanctions, or both: remedial measures are appropriate to cure prejudice; sanctions are appropriate only if a party acted with intent to deprive another party of the use of relevant electronically stored information.