Text Message Usage Is Exploding, But Usually Provides Useful Evidence Only In Criminal Cases

January 2010

Text messages are growing exponentially, so a thorough litigator or investigator naturally should evaluate whether evidence on mobile devices could impact his case. Consequently, we regularly get questions regarding the recoverability of text messages. The answer depends upon how much usage has occurred on the device from when the subject messages were sent, and the time when the device is given to us.

Texting has several significant communication advantages, so its popularity is likely to continue to increase. Texting does not require one to be a computer, as is required for sending emails and instant messaging. For short messages, texting is often less time-consuming than making a phone call or sending an e-mail. Finally, a text message is more discrete than a phone conversation when one does not want to be overheard. Most people are quite casual and direct in their text communications. When they are available, text messages can change the entire case.

The remainder of this article provides a primer on when your case may be able to use mobile devices evidence. See our related article regarding how an ESI mobile device collection should proceed.

Short message service (SMS) is a communication means that sends text between cell phones, or from a computer to a cell phone. The "short" part refers to the maximum size of the text messages - 160 letters, numbers or symbols in the Latin alphabet. Even when one is not talking on the phone, the device is communicating with its cell tower over a pathway called a control channel. This communication allows the cell phone system to know which cellphone is in, and changes cells as one travels. The control channel also provides the pathway for SMS messages.

Text messages do not go directly to the recipient’s cell phone, but are temporarily stored at the service provider’s facility. This storage allows the message to be delivered later if the recipient’s cell phone is out of range. The message is stored (for days if necessary) by the service provider until the message recipient turns on the cell phone or moves into range, at which point the message is delivered. Once delivered to the ultimate recipient, the message at the carrier’s facilities is deleted and soon overwritten. However, the service provider retains certain metadata, such as transmission time and location data, for a longer period.

However, unlike email messages, the text message delivery process typically bypasses a business entity’s central server/storage and backup processes. Consequently, text message content typically exists only in the senders’ and recipients’ devices, and the collection of electronically stored information (ESI) focuses on the mobile devices.

At the device level, similar to what occurs for a computer hard disk, the text message will remain stored on the recipient’s SIM card or the devices’ memory until the storage space is used for something else. However, with active use of the device, this provides a short storage life before being overwritten with more recent data. Unless the data is retrieved (or the device inactivated) promptly, it is likely that the possible evidence will be destroyed by the time a civil dispute has matured to the point where discovery is being exchanged. For this reason, SMS evidence is found more frequently in criminal matters, since law enforcement confiscate the devices when evidence is believed to possibly reside there.

Because of the short normal storage periods described above, the writer is aware of only the following cases where sanctions, adverse inference instructions or other punishment has occurred because of a failure to preserve this data.

1. United States of America v. Anthony Suarez and Vincent Tabbachino (USDC NJ, Criminal Action No. 09-932 (JLL), Oct. 21, 2010) provided an adverse inference instruction. The Court’s Order included:

   “…Not only is the culpability of the spoliating party relevant to selecting an appropriate adverse inference instruction, so is the resulting prejudice to the innocent party. Given the lack of evidence suggesting bad faith on the part of the Government and in light of the particular circumstances of this case, the Court deems the least harsh, “spoliation charge” most appropriate. At the close of evidence, the Court will issue the following charge to the jury:

   During the course of this trial you have heard evidence by way of stipulation and testimony that during the Government's investigation of Defendants, the cooperating witness, Solomon Dwek, exchanged numerous text messages with F.B.I. agents supervising the investigation. The Government was obligated to preserve all of these text messages, but they were either deleted by the agents themselves or not preserved by the Government. Specifically, although some text messages were in fact preserved, the Government failed to preserve other text messages, which pertained to Agent Russ and Agent McCarthy, from two key time periods: March 1 through March 16, 2009 and the entire month of July 2009. You may infer from the Government's failure to preserve these messages, or the fact that they were deleted by agents, that the missing text messages were relevant to this case and that they were favorable to both Defendant Suarez and Defendant Tabbachino. You are not required to make this inference, however, and you must consider any rebuttal evidence that has been offered by the Government with regard to this issue. Whether you ultimately choose to make the inference is your decision as the finder of fact.

2. (Southeastern Mechanical Services, Inc. v. Brody, 657 F.Supp.2d 1293 (M.D. Fla. 2009)) involved an employer's claim of misappropriation of trade secrets by its former employees, and provided an adverse inference jury instruction. But this occurred only because the mobile device users were too clever for their own good, and had purposefully wiped their devices (i.e., erased and overwritten all available storage). Had this deliberate act not occurred, one could guess that there would not have been any useful data remaining anyhow.

Like other electronic data, an SMS message contains metadata that includes the length of the message, a time stamp, the destination phone number, the message format, and the general geographic location of the sender and recipient when sent and received. As is generally the case, this metadata can be quite useful. For more information, see this metadata primer for lawyers.

As with any collection of digital evidence, mobile device evidence must be gathered in a forensically sound manner. This means that the data must be collected without changing the content. An electronic signature or hash should be performed on the collected data to insure that no subsequent changes are made to the data. For more information, see computer hash explanation.

Mobile device collections are more difficult than other ESI because:

1. The device itself must be available. This is different than e-mails that can typically be collected from a central server or from a user's hard drive.
2. Most mobile devices use a proprietary operating system.
3. New mobile devices are constantly being introduced, making it difficult to stay current on the technology and collection tools.
4. Mobile devices do not have standardized adaptors, causing a challenge simply having the correct hardware needed for the data transfer from the mobile device to the acquiring computer.

Fulcrum Inquiry performs computer forensic examinations, and special master assignments.