Gathering Mobile Legal Evidence

Investigators – like regulators at state boards and commissions – increasingly find evidence by way of mobile delivery.  For example, the board that licenses nurses may discover evidence about a registered nurse not on the web, but through a mobile app, such as a game.

Investigators need methods to record online evidence that arrives via mobile device, such as a tablet or smartphone.  (When I say "online" evidence, I mean information that is stored in the cloud, but rendered temporarily through a mobile device or mobile application.)

Format of Information Matters

The format and legal impact of information in a mobile context can be different from that in a desktop context.

For example, here is a screenshot of the top of this blog, at it appears through the default browser on an Android LG Optimus phone:

Phone Media 

If the user of that phone were looking for the “Privacy Vision” applicable to this blog, the user would have to scroll far to the bottom.

In contrast, here is the appearance of the same blog, as rendered via a desktop browser:

Web Desktop

The display of information is quite different.  The Privacy Vision appears down the right-hand column.

These differences in display can influence the effectiveness of legal disclosures to protected parties such as consumers.

Series of Video Demonstrations

My blogs have previously published and explained training videos on how to record evidence rendered through a desktop: See
  Police in Social Media,
  Chat with a Criminal,
  Audit of Online Trading

Investigator as Eyewitness

How could an investigator preserve what he sees as an eyewitness when he perceives legally-relevant evidence through a mobile browser or an app loaded on an iPhone?

This video demonstrates the investigator making a signed affidavit of precisely what he witnessed with his eyes.

This video shows what appears through the mobile browser, and how the browser interacted with the information, at a frozen moment in time.  At a different time, the information and the interactivity could be different.  The information is volatile and could become unavailable to the investigator at any time. (That is, I could delete this blog at any moment and prevent investigators from [directly] accessing it from that point forward.)

To better read the content captured in the video, click on full-screen mode in lower right-hand corner of the video.

Your Comments?

Dear Reader: What do you think of the video as an evidence collection method?  Do you have alternative methods to suggest?

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations for the SANS Institute.

Question:  After an investigator confiscates a smartphone, is he wise to use apps and credentials on the phone to access evidence in a social media account or in an online storage locker?