Case Law: United States v. Suarez

Government Sanctioned for Failure to Preserve Text Messages

United States v. Suarez, 2010 WL 4226524 (D.N.J. Oct. 21, 2010). In this federal criminal prosecution, the defendants sought sanctions citing the Government’s failure to produce text messages sent between a cooperating witness and FBI agents, who had deleted the messages from their cell phones to free memory. According to its Corporate Policy Directive, the FBI retained log server data and data on backup tapes for only 90 days and was unable to produce the text messages despite keyword and manual searches. Before discussing the alleged spoliation, the court deemed the messages as discoverable statements under the Jencks Act. The court then found no reasonable explanation as to why the Government delayed imposing a litigation hold until three months after it began searching for the text messages, nor as to why only some messages were deleted. Thus the court determined the Government violated its duty to preserve relevant data that was in its control in the midst of an ongoing investigation specifically aimed at prosecution. Citing the relative lack of criminal law in the Third Circuit regarding spoliation sanctions, the court relied on civil case law – including Pension Committee – and held the missing evidence was prejudicial and of “paramount importance.” Due to the absence of bad faith, the court issued a permissive adverse inference instruction.

Commentary

Preserving physical evidence, such as paper documents, is generally a passive exercise - if no intentionally destructive action is taken, the documents will likely exist when an investigator or lawyer comes to collect them. The same is not true with regard to electronically stored information (ESI), which may be lost through any number of passive means including computer user error and technical malfunctions, as well as regularly scheduled, automated deletions based on document retention policies and data management practices. Attorneys and investigators should therefore presume that ESI will not be indefinitely preserved, and must act proactively to initiate and enforce a legal hold or subpoena to safeguard relevant ESI.

In order to ensure readiness for quick action when the need to preserve and collect evidence arises, it is prudent to consider in advance the particularities that will affect data collection. In particular, the stream of newly emerging technologies continuously adds complexity to the way electronic data is collected. Collection practices involving these new technologies, such as mobile devices, must support the same basic principles as always: defensibility, efficacy, security and privacy.

In typical computer forensic collections and examinations using commercial software, data is write-protected in order to prevent its modification or deletion. However, the design of mobile devices and their memory often prevents the ability to write-protect the data. Thus, text and voice data stored on mobile devices can be considerably more fragile than other forms of data, which limits accessibility and increases the urgency of implementing preservation steps.

An effective collection will therefore need to preserve the initial data and accurately account for any changes that may occur during the collection. Due to the volatility of mobile device data, attorneys and investigators should enlist data collection experts that use proper processes to isolate the data, block transmitting signals during collection/analysis, document all procedural steps and record all actions taken, especially those that might alter the data in some way. Mobile devices are ever changing, and the typical examination methodology is to identify the system data, including the specific bytes that were changed during processing, and confirm that the user data was not affected.

It is also important to select appropriate methods and tools for collection, keeping in mind there are multiple options and combinations with varying costs, risks, benefits and capabilities. Experts can help select the most suitable collection tools and methods to protect data from corruption, ensure efficacy of the acquisition and control costs. Communicating clearly with a data collection expert regarding the particular nature and specifics of the task at hand will help to maximize the results by ensuring the most appropriate tools are used.

Creating a plan in advance of an incident is a necessary step in order to be prepared to expeditiously implement legal holds, subpoenas and search warrants, and make use of defensible collection methods. If electronic data is sought for potential use in litigation, parties must move quickly and assertively to avoid losing critical data. The simple truth is this: the longer you wait to begin a data collection or recover information, the less likely it is that it will be retrievable. Consulting an ediscovery expert will help speed the process, preserve data integrity, ensure the selection of appropriate tools, help control costs, and ultimately help preserve necessary and often fragile data.