Devices which tell their own eDiscovery story

I mentioned in a recent article the “Frequent Locations” feature in iPhones and iPads. Whatever you think about being tracked in this way, I cannot say that it is very accurate, at least as shown on my iPad (it was switched off, I found, on my iPhone). Accurate or not, it is something to be aware of, whether for your own purposes or for fulfilling eDiscovery responsibilities.

Google Maps, meanwhile, keeps a much more comprehensive record of your travels, if you let it. I do (I wrote about this once before), and the article about Frequent Locations sent me to see what had been captured about my somewhat excessive travels in October, with Chicago, Nashville, Dallas and New Orleans in the US, Brussels, Lille, Ypres and Bruges in Belgium and France, and Cornwall, London and Oxford in the UK. It makes me tired just to look at it.

Google2

Google1You don’t know how to find this information? It turns out that I didn’t either, in the sense that I could not describe it when asked, however often I have seen it. The easiest way is to make a Google search while logged into Google. You see the group of icons shown at right (I am using a desktop computer for these examples).

Take the wheel for options, then History. That takes you to your Web Activity list, that record which betrays would-be poisoners, anarchists and admirers of the female form. You can delete that list, by the way, but don’t bank on that as protection from an investigator armed with EnCase or FTK.

At top left is an Options link. There, among other things, is your Youtube Watch History and Location History. In the latter, you can pick a date range or fine-tune the results to a particular time-and-place combination.

It shows our journey by car from Cornwall to Oxford at the end of our holiday…

Google3

Here’s our journey to Brussels. You get narrative detail for a given day on the left panel, and can zoom in for map detail. Mine has information about our train journey, the hotel and the time we arrived there, our taxi ride and walk round the city, the restaurant we ate at, and the time we got back to our hotel.

Google4

 

Google5On another day we took the train to Bruges. This map shows our peregrinations round the city from the railway station and back. Yes, we did go twice to the Tearoom Carpe Diem – we were there from 1.29 to 2.06, apparently, and again from 4.37 to 5.02. My éclair arrived at 12.55 – I know that because I took a picture with my iPhone, which helpfully recorded the place and time. It didn’t stay long on the plate, so the time shows the moment of delivery.

We overlooked this GPS data, by the way, when we wanted to go back to the cafe and couldn’t find it. Instead, we got its name from a photograph we had taken of its frontage and looked up its address on Google (it is not easy to type Wijngaardstraat into Google, and the GPS data would have saved much typing time).

For the Monday, I can see a day largely spent at the conference centre, then the taxi ride to the restaurant which we apparently entered at 7.47 and left at 11.34.

“Would you seek to deny, Mr Dale, that you ate at the Restaurant Bruneau in Brussels on the 26 October after spending most of the day at 118 Rue L’Aqueduc?”.

No, and I have the invoice (and happy memories) to prove it. It is worth bearing in mind, by the way, that this information may do more than prove a “case” against you – you may positively want to show that you were somewhere other than the locus in quo of the murder (or whatever) on the day in question.

Google7We drove round the Ypres Salient: the map shows that we went to the Christmas Truce Memorial, the Menin Gate and Sanctuary Wood. The straight lines seem to indicate that the “system” lost track of us for a while and drew the shortest line between the last known place and the next time we were picked up.

Below is the tortuous route into the car hire return at Lille or, rather, as you can see, round and round it in the rush hour until we finally found the entrance.

Google8

It’s not entirely complete or accurate, depending in part on the consistency of cell and wifi connections, but it is a reasonable set of pointers as to where I was during that month.

You could bring in other data – the GPS data in a photograph (as with the éclair mentioned above), the detail of phone records, the place shown as the origin of a tweet. None of it is definitive on its own – Gordon Exall, he of the Civil Litigation Brief, had a period in which his tweets from Yorkshire were labelled as if from Caerphilly for no obvious reason. It sets up a presumption, however, which may be helpful or not depending on the circumstances.

Geolocation evidence does not end with the data from a single target. I once saw a Nuix demo which allowed you to see what other location evidence had been captured within a given radius. Suppose you discovered, for example, that five alleged conspirators were at the same Brussels restaurant at the same time; it would would not necessarily prove a conspiracy, but it might undermine their claims that they had never met. The Nuix tool would make it easy to spot the facts; you can then set about making a case out of them.

You easily see that most of us are creating an evidence trail about ourselves all the time. Whether that matters for us as individuals will vary from person to person – I don’t much care. You will care, however, if you are responsible for collecting evidence for civil or criminal proceedings and don’t think about whether this kind of data should be unearthed. You can’t do that if you don’t even know that it exists.

Google9What? Oh yes, the éclair. Here it is, with the iPhone’s helpful time. date and location information. Wijngaardstraat 8, 8000 Brugge, Belgium. It seems that the iPhone and Google Maps have a different view as to which side of Wijngaardstraat that is. I don’t think the difference would matter very much if the evidence came to court.

Home

About Chris Dale

I have been an English solicitor since 1980. I run the e-Disclosure Information Project which collects and comments on information about electronic disclosure / eDiscovery and related subjects in the UK, the US, AsiaPac and elsewhere
This entry was posted in Discovery, eDisclosure, eDiscovery, Electronic disclosure, Nuix. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s