Taking care about time and place data in eDiscovery – things may not be as simple as they seem

Electronic communication makes discovery all so easy, doesn’t it? After all, no less a person than Neil Gorsuch, a justice of the US Supreme Court, was recently mentioned in a Legaltech News article here in these terms:

“And it can’t be burdensome,” Gorsuch said, according to the Supreme Court’s transcript. “I heard [burden], was your third, but in an age where everything’s online and can be handed over on a disk or a thumb drive, that—that—that much pretty much disappears too.”

This is why one UK judge, himself familiar with both the rules and the technology, said at a conference last year that we must keep disclosure disputes away from the Court of Appeal. That absolute certainty which comes of rising to the top of the legal tree might lead one of our senior judges to say something equally daft, burdening the rest of us with the consequences forever.

Time and place are two key components for establishing the truth about a document. It is helpful to understand, if you understand nothing else, that neither is as easy as may appear, at least when something vital turns on getting it right. I recall a story from the very early days of computer forensics where law enforcement kicked down the door of some East Coast premises, confident that the timestamps on a document had taken them to the right door. In fact the server had been bought second-hand from a West Coast company and no-one had changed the clock to reflect the new time zone.

The story as told didn’t actually make much sense, but this was back in the 1980s, and I was less critical then. It made me conscious, however, of the need to take great care when considering documents where the date of creation, editing and accessing a document might matter (as opposed to the very many cases where nothing much turns on this). As cross-border commerce and communication have increased, and as the device-types and comms software multiply, so it becomes critical to understand the nuances of timestamps.

For that we must turn to an expert, and no-one is more expert in this field than Craig Ball. He is also a master of explanation, able to make the complex comprehensible. In a recent article called It’s about time!, Craig Ball explains the complexity of timestamps. He says “Clues to time are clues to truth because temporal metadata helps establish and refute authenticity, accuracy, and relevancy.”

I will leave you to read Craig’s article and move to another area which is more complex than appears. That is place, another potentially critical element when considering the authenticity of a document or, more clearly, whether it was created where the metadata suggests (and time and place are interlinked, as suggested above, where timestamps may not accurately reflect the time zone).

Neil Gorsuch would say, perhaps, that this is easy. My iPhone, for example, captures the location at which I took a picture. One might confidently assert that if the picture shows a location in its metadata , then that was the place at which the picture was taken. I have, indeed, made such an assertion myself, adding that a nude celebrity who was worried about the circulation of a picture might well be more concerned about where it was taken than about what it showed.

Yesterday, however, I took an iPhone picture by the river, close to home just north-west of Oxford.

The metadata, however, said that it was taken in Canning Crescent. There is a Canning Crescent in Oxford, and it is by the river – but in south-east Oxford. The useful website As the Crow Flies tells me that this is 2.8 miles from where I took the picture.

Most of central Oxford lies between the two places. So a policeman, a celeb-hunting journalist, or a suspicious spouse might be barking up the wrong tree if they used the location data to draw conclusions about the phone’s whereabouts. Another picture of the same scene, taken a few seconds earlier with a different GPS-enabled camera, shows the correct location, so there was no general GPS failure that morning. It may be down to different GPS providers. It is worth knowing that your instant confidence may be misplaced, before you kick the door down.

It doesn’t have to be pictures – make a note in Evernote, for example, while connected to a mobile signal, and the note records where you were when you created it. Or not, depending on the GPS accuracy (I have just tested my Evernote and it is accurate to within about 10 feet).

So take care not to jump to conclusions about time and location data. It may be right. It may not matter if it is right. But where it does matter, you may need an expert to decipher it properly.

Home

About Chris Dale

Retired, and now mainly occupied in taking new photographs and editing old ones.
This entry was posted in Discovery, eDisclosure, eDiscovery, Electronic disclosure, Evidence, Forensic data collections and tagged . Bookmark the permalink.

Leave a comment