High-Stakes Digital CSI

Much ink has been spilled addressing the privacy and security arguments surrounding Apple’s showdown with the U.S. Department of Justice (DOJ) earlier this year in connection with the massive law enforcement response and investigation into the most deadly terrorist attack on U.S. soil since Sept. 11, 2001. This is not another examination of those heavily debated legal issues. Rather, drawing on the facts that have been revealed publicly about the San Bernardino investigation, we set out here to present a case study on what can go wrong when digital evidence is mishandled, and to present a series of best practices for handling ESI—an acronym for “electronically stored information” that has been known to evoke dread and angst in even the most seasoned legal and investigative teams.

On Dec. 2, 2015, 14 people were killed and 22 were seriously injured at the Inland Regional Center in San Bernardino, California, in a despicable, abhorrent act of terrorism. The attack was carried out by Syed Rizwan Farook and Tashfeen Malik, a married couple that apparently had become radicalized jihadists somewhere along the way, despite otherwise conducting themselves as ordinary residents of a California suburb. The pair carried out their attack during a training event and holiday party for the San Bernardino County Department of Public Health. Farook was an employee of the San Bernardino County Department of Public Health, fueling speculation that his actions were that of a disgruntled employee that had lost his mind. Americans collectively watched as initial reports suggested another mass shooting in yet another soon-to-be infamous corner of the country. Soon, however, our dread quickly got worse when an even more terrifying plot emerged, and the reality set in that a likely ISIS-inspired terror attack had occurred on American soil. That night, Farook and Malik were killed in a shoot-out with police, who confronted the pair on a California street. With their deaths, any chance that their motives and affiliations with larger plots would be uncovered through interrogation was lost. It would come down to the tedious investigative task of reconstructing the pair’s entire lives, including their use of cellphones, computers and other digital media that have become the hallmarks of modern society.