Jillian Kuehl - Okay, welcome to Quimbee CLE. My name is Jillian and I'm a program attorney here at Quimbee. Today I'm joined by Brian Chase who's here to talk to us about how to find and use location information in litigation. Welcome, Brian.

Brian Chase - Hi. Thanks for having me.

Jillian Kuehl - Brian, why don't we start off, why don't you tell me a little bit about yourself and a little bit about the company you work for, ArcherHall.

Brian Chase - Sure. So I am recovering lawyer. I was practicing for about 10 years doing plaintiff personal injury and criminal defense. Made the switch to doing digital forensics work and I've been doing digital forensics for about eight years. I also teach at the University of Arizona, teach a trial skills course there. I joined ArcherHall who I'm with now in 2019 as the Managing Director of Digital Forensics and eDiscovery. ArcherHall is a digital forensics ediscovery company, so we do work all over the country collecting digital evidence, collecting data from cell phones, and computers, and location data like we're gonna talk about today. So we offer those kind of services where we collect that data, analyze it, testify about it at trial. We also offer those ediscovery services where we take that data, put it into a hosted review platform, you have platforms like Relativity being the biggest name out there, so that groups of attorneys can review that data, tag it, export it, produce it in litigation, and that's kind of the basics of our work. I'm based here in Tucson, Arizona, but like I said, we do work all over the country.

Jillian Kuehl - Great. So let's jump in and talk a little bit about location data. So what are the kinds of cases that you see where location data is really used?

Brian Chase - It's all over the place. People tend to think of criminal law when they're thinking of location data. Is there data that puts the suspect at the scene of the crime? And that's certainly a very common place that we see location data, but we see it all over. We see it in personal injury cases, on a hit and run case, trying to put the driver at the scene of a crash, trying to see how long a trucker might have been on the road based on their location data, trying to see where somebody was walking to or from. We've had it even come up in medical malpractice cases, trying to determine whether a physician was at the hospital at the time entries were being made in the patient's chart. Comes up in family law cases. Was a parent with the children when they were supposed to be? It comes up in worker's comp. Was the worker actually at the job site when they were injured? We've seen it in wage cases where employee's saying hey, I wasn't being paid for the work that I did and the employer's saying you weren't there, you weren't at the job site. So there's all different uses of location data. It's really not just limited to criminal cases. We see it in pretty much every type of case out there.

Jillian Kuehl - Okay, and so for these cases, where do you get the location data from?

Brian Chase - There are all sorts of sources of location data. There's everything from pictures to GPS data, data that you might be getting based on the GPS from your cell phone or from a navigation GPS like a TomTom or a Garmin or something like that. We get it in cell site data which is the cell towers that your phone connects to for phone calls and text messages. We see it in applications that you're using. If you're using an exercise app, that's tracking your location. If you have an Android phone, Google is tracking your location. We see devices that get plugged into people's cars to track mileage. There can be smart devices in people's homes or offices that can provide location data. So really there's a lot of sources out there. Attorneys tend to think just of the cell phone, and the cell phone is a source, but it's not always the best source. There's lots of sources of location data out there. Oh, um.

Jillian Kuehl - Sorry, I was muted. Yep. Okay. So you mentioned photographs and pictures is one of the sources of location data. So, how does a picture have location data?

Brian Chase - Yeah, so pictures have a type of metadata called EXIF data. It's E-X-I-F. It's just a special name for picture metadata, and the way it works is when you take a picture with your cell phone, your phone fills out kind of all of these EXIF metadata fields, and one of those is GPS information. Your phone will use the GPS, and it will embed in that EXIF data your location when you take the picture. There's all sorts of other information embedded in there too like the date and time that you capture the picture, the make and model of the phone, but if we have a picture from a cell phone, we can look at that EXIF data to see where that picture was taken, and presumably that location will match up with what you're actually seeing in the picture.

Jillian Kuehl - Okay, and so if you have a photo or let's say I delete a photo, how is that EXIF location preserved, I guess?

Brian Chase - So if the photo is deleted, the EXIF data goes along with it. It's stored within the file, what we call internal metadata stored inside the file itself. We might be able to recover that picture from other sources though. If you take a picture with your phone and then delete it, well you might have your phone backing up pictures to sources like Google Photos or iCloud, and just because you delete it on your phone doesn't mean it's deleted from one of those cloud sources. So we can go into one of the cloud sources like Google photos, download the photo, and examine the metadata, the EXIF data from there. We can't get it from all cloud sources though. If you upload a picture to something like Facebook or Instagram, those services will strip out that EXIF data. They'll remove it when you post that picture. They started doing this years ago when they realized stalkers were taking these pictures to figure out where people were, so they started removing that data. But backups of the phone, cloud backups of pictures or the phone itself if the pictures still exist are all great places to get that picture to be able to analyze that EXIF data.

Jillian Kuehl - And so that, if I delete something but it might have an iCloud backup that even if I wanted that data to go away, it would still automatically have that EXIF data in my cloud?

Brian Chase - It might. It depends on kind of how you've got that configured. There's two ways that you can get pictures there. So you can use iCloud to just kind of back up your data. You can also back up your phone to iCloud, and the picture could be in a backup of the phone. So let's say you have iCloud just syncing with your phone. If you delete a picture from your phone, that deletion will sync to iCloud, so the photo will get deleted from iCloud. But if you have your phone backing up to iCloud, there will also be in your iCloud account a backup file that is your phone's backup. We can actually download that using some specialized software and pull data out of that backup file as well. So if there's an old enough backup in there that still has the picture, we could get the picture in that way.

Jillian Kuehl - Interesting. So what about GPS data, and broadly, are there other sources of GPS data other than my phone?

Brian Chase - Sure. So, your phones are storing different types of GPS data, so like the pictures that we just talked about, EXIF data, that is GPS data. It's based on your phone using GPS. But your phone will do other things as well. So for example, Android phones will share their location with Google, and you can actually see your Android phone location history by going to a product called Google Timeline. Google Timeline just tracks where your phone has been. It uses things like GPS, wifi locations, cell tower data to kind of figure out where you are, and so you can all see that data up there. Sometimes we'll get GPS data from the phone itself. It will be saved on the phone. Not always. Depends on the make and model phone how much data we can get there. And there can be other GPS devices, like cyclists might use a Garmin bike computer to track their ride and that might have GPS built in. Some people out there still use separate GPS devices for driving directions, so like a TomTom or something like that, and that could have GPS location history. But most of the time, what we're looking at nowadays is some sort of GPS that came from the phone, whether the GPS is actually, the data is actually on the phone itself or uploaded to a cloud account like Google Timeline.

Jillian Kuehl - How specific is that GPS information? So can it tell, for example, if I'm riding a bike, if I'm riding a scooter, or walking?

Brian Chase - Yeah, so Google Timeline is really specific. It's pretty smart about what you're doing to move around, so it will know walking versus riding a bike versus being on a subway versus being on a bus or a motorcycle or a car. It can kind of distinguish between all of these modes of transit, and it will show you in the Google Timeline kind of what your journey was like. Maybe you started and you walked to the subway, so it will show that walk. It will show how long you were walking, how far you were walking, what streets you were on. It will show you entering the subway. It might even know what subway line you were on, what car you took to get to your next location. Then it will show you walking from there or getting in a taxi from there and going on to your next location. It's very granular, kind of minute-by-minute data, maybe not quite down to the minute, but it's very granular. You can really trace where somebody went over a period of time using Google Timeline.

Jillian Kuehl - So this is very like Big Brother-ish, and I definitely have Google apps on all of my devices and didn't know that this was happening. So, where can I get my own Google Timeline data?

Brian Chase - Yeah. You can log into your Google account and get it there. So it's maps.google.com/timeline, or just go to Google search and type in Google Timeline and you'll get the page. You'll have it. If you have an Android phone, you'll probably see lots of data there. If you have an iPhone, you might not see any. So iPhones, by default, are not sharing their data with Google. That different product. But if you install Google apps on your iPhone, you might be sharing your data with Google. It depends. Depends on how you're using those apps and what permissions you've given them. So for example, if you were using Google Maps, actively using it meaning like you were using it to get driving directions, that location data might be shared with Google, might. So again, depends on those permissions. But if you're not, if you just have Google Maps installed on your iPhone, it's not tracking your location, you're not gonna see anything in Google Timeline. But for the half or so of the population that's using Google or using Android phones, there could be a wealth of information out there in Google Timeline. You just go to the website, log in with username and password, and you can see all that data.

Jillian Kuehl - So other than myself, is there anyone else who can get access to that Google Timeline data?

Brian Chase - Yeah. Law enforcement can get it with a warrant. Lawyers can get it with a subpoena with a little bit of a caveat. There's a law called the Stored Communications Act. It prohibits disclosure of certain kinds of data with just a subpoena alone. Location data is kind of one of those types. It's a 1986 law. It's being applied to today's data. But basically what you'll need is a signed authorization from the account holder, so whoever's Google accountant is, you're seeking to get an authorization from them, attach it to your subpoena, then send it off and you can get it that way. Of course, the fastest way to do it is with username and password. So even if you're trying to get your client's data in a case, much better to just have your client give their username and password, log in and download that data versus trying to go through a subpoena. Even with the other side's data, trying to request it from the opposing party, better to have them download their data and produce that than it is to try to get a subpoena. It's just gonna take longer to do that to get that subpoena from Google.

Jillian Kuehl - Sure. And with this kind of data, are there any problems with relying on it? How reliable is this level or this kind of data here?

Brian Chase - So Google Timeline data is generally considered very reliable. It's a pretty accurate source of information, but it is an accurate source of information for that device, and Google does provide kind of like a margin of error so you can see how accurate they think they are in those numbers, but widely considered to be an accurate source of data in litigation. But there's problems. So I'll give you an example from a case that came out of Phoenix, Arizona. New York Times profiled this case a few years ago. There was a man that was arrested for murder. His phone was at the location of a homicide. So what happened was there was this murder. Law enforcement sent a warrant to Google and said Google, tell us all of the phones that were in the area of this murder on this date and time. It's called a Google geo-fence warrant. So they went through this geo-fence warrant process with Google. Through that process, they developed the suspects, they found out who the owner was of that phone, and they ended up arresting that owner. Problem was, he was at work at the time. He didn't have his phone on him. He had left his phone in his car, and I think he had let like a family member borrow that car. The family member I think might have been involved in the murder. I don't remember the details at that point. But the man that they arrested whose name was in the paper for being accused of this murder had nothing to do with it. So this data is reliable, but it's reliable to the device, not necessarily the user of that device. We don't know who had the device at the date and time in question. So when you're anytime you're relying on location data, it's gonna tell us about the device, not necessarily who was holding the device or who had the device at that relevant date and time. So there's always kind of other step that you need to go through. How do we know the person who I think owns this device had this device during the date and time of the incident? So it can be used incorrectly even though the data itself is fairly reliable.

Jillian Kuehl - Very interesting. Have you yourself had any personal experience or stories with something like this that might reflect, okay, this phone, this data was reliable but this was not the person I thought who had this device?

Brian Chase - It comes up quite a bit, especially in the criminal cases. So sometimes what the issue might be is saying okay well, my defendant who was charged with this crime and whose Google data puts him there, well the defendant says that what he does is signs into his brother's account, his friend's or brother's phone or friend's phone or something like that, and so it's the other person's device whose account who he signed into with his account that's actually responsible for that data. So we do see that from time to time. It's really tricky to kind of tease that out because what you have to do is kind of trace back that data from Google and say okay which device did this come from? Was this actually the defendant's phone, or was it somebody else's phone that the defendant signed into? And often what you might need to do at that point is a forensic exam of the cell phone to try to get those details of what accounts were logged in and when.

Jillian Kuehl - Okay, and so moving on to a new data point, what about cell site information? What is that?

Brian Chase - Yeah, cell site information or cell site location data, or location information, CSLI is how it's often abbreviated, is data that comes from the cellular network, so from Verizon, AT&T, T-Mobile. It's based on the cell towers or cell sites that your phone is connecting to for phone calls, text message and data usage. The carriers have to kind of track your location. Somebody calls you, the carriers need to know where to route that phone call so it gets to you. If you're in California on the phone and Verizon thinks you're in New York, that call's gonna get routed to New York. You'll never get it. So they're tracking your location to make sure that that data can get to and from your phone. So they store this information, and we can get it from the cellular networks to get kind of general idea of where a phone is located during a given timeframe.

Jillian Kuehl - And so how close of a location can you really get from this?

Brian Chase - Yeah, it gives us kind of a general location. So, each cell site is individually engineered for a particular area that the network wants to cover. So they're pulling out all these towers all over the place to try to avoid dead spots. Each towers can be individually engineered to cover some part of that area. The problem is we don't know what that is. You'll hear people say well, the coverage area is a mile, or it's 70% of the distance to the next tower, but we don't actually have that data from the carrier. So what it really tells us is the direction from the tower where the phone is located. The way it works is most cell towers, not all, but most have like three sectors. Sometimes you'll see one or two sectors, a sector just being an antenna on that tower. So next time you're driving around, look at that cell tower off on the side of the road. You'll see kind of a triangle shape set of antennas up at the top of the tower. That's a typical three-sector configuration. So the data we get from the carrier will say here's the location of the tower, the latitude and longitude of that tower, and here's which sector that was used by the phone and which direction called the azimuth that that sector is facing. And that's really all we get is just location of the tower, direction from the tower. So it gives us this kind of general location data. So as an example, I'm sitting here at my desk in downtown Tucson, Arizona. If we were to go get my cell tower data right now, it would clearly establish that I am in the general downtown Tucson area, but it's not gonna be able to distinguish between me being here at my desk versus at the law firm next door, versus the superior court about three block away or the federal district court about five blocks away. It's all gonna look kind of the same on that cell tower data. But it will establish that I'm not on the east side of town, or the north side of town, or in some suburb of Tucson. So it gives us this general location, but it doesn't get us as precise as GPS does.

Jillian Kuehl - So is there precise data that can be found from the cell site information?

Brian Chase - There is. So the carriers produce precision data. Each carrier has a different name for it. For example, AT&T calls it NELOS or NELOS data. T-Mobile calls it Timing Advanced. This data appears to show an exact location of the phone. The problem with it is we don't know exactly how it works. Each carrier has a kind of proprietary algorithm for figuring out where that phone is located. It's based on distance equals rate times time. We know the speed of the radio wave. Travels at the speed of light. We can measure the time it's taking to go from the tower to the phone and back again, so we can kinda measure that time. The problem though is it's much more complicated than just that. It's not just distance equals rate times time. There's all this big algorithm that they use, and they don't tell us how it works. They also don't tell us like what's the margin of error for it. So when you start thinking about this, might be for those litigators out there, you might be starting to think about dower.

Now how do we know this data's reliable? The problem is we don't. There's anecdotal evidence out there about reliability. There is not any study determining like what's the reliability of this data, and the carriers don't tell us how reliable the data is. They will provide accuracy estimates for some of the data, like AT&T will say well this data's accurate to within 500 meters, but the problem is I've seen cases where that's not true, where I've got GPS data and I know that that is outside that accuracy estimate from AT&T. So there are uses for it. It can be a great investigative tool. Law enforcement will use it in missing person cases when they're trying to locate somebody quickly, it's gonna be a great source, but when it comes to using it in the courtroom, you gotta use a little bit of caution on going through this data because it can be wrong and there are some issues with how this data works. It was never designed for litigation. It wasn't designed for lawyers. It was designed so the carriers could make their networks better, so they could find dead spots and improve their network. We're now kind of using it in litigation, but we've gotta be cautious about that use so that we're not over-relying on it or we're not misapplying it or introducing unreliable data to a jury.

Jillian Kuehl - So, I'm sure we've all listened to a podcast or two about a missing person, and they're using this cell site data. So I guess now that it is being moved into the courtroom, what are some other examples where this kind of information might actually come in handy or be relevant?

Brian Chase - Yeah. I had one case that I worked on where it was a hit and run collision. There was a woman who got rear ended on a highway outside of Phoenix, and the driver that hit her fled the scene on foot. When law enforcement arrived, they found the vehicle. The vehicle was actually a company-owned vehicle, so they called the company and they said hey, who's the driver that's associated with this vehicle? Who'd you give this to? And that company told him the employee. So law enforcement went to that employee's house, and he was there. He said I don't know what happened. Somebody must have stole my truck. I was at my friend's house the night before, I was drinking, I left my truck there, I went home, I haven't left my home this morning, and that was kinda the end of the case there from law enforcement's perspective. But the woman who was rear ended sued, she sued the company and they defended saying hey, stolen vehicle, we're not liable. But we got the defendant or the driver's, who we least we thought was the driver, that employee's cell site location information, and what we could see is that the first entry the morning of the crash, crash was around 6:30 in the morning, the first entry is off of a cell tower near the friend's house, which if he had left his phone in his truck the night before, that would make sense.

Then what we see is the next entries, and there's a whole bunch of 'em, over a dozen entries in that call detail record, the records we get from the carrier, that are using a cell site right near the crash, and you'd think okay, well if the car, if the phone was left in the truck the night before, of course it's gonna be there at the crash site. The problem is, those entries were related to phone calls and text messages, so now we'd be saying what, the thief is using this cell phone left in this truck after this crash. And then what we see happen is after all of those entries near the crash site, the phone ends up back near the defendant's home by the time law enforcement arrives, and the defendant had his phone on him when law enforcement got there. So, clearly this data shows that the defendant's not telling the truth about what happened, that he wasn't at home all morning 'cause in order for him to have been at home all morning, somebody had to have stolen his truck, used his phone, but then returned his phone to him before the police arrived. That obviously doesn't make a lot of sense. So it kind of established that the defendant was lying and at least was likely the driver of the vehicle. We can't say for certain. He could have been a passenger. He might have just been coincidentally near the crash scene. Seems unlikely at that point though. So that case, that data was used, and it actually ended up resolving that case is that they kind of stopped with the defense of the vehicle being stolen. The lawyers kind of realized their client was probably not telling about what happened that morning.

Jillian Kuehl - And how do you obtain cell site data to use in these types of cases?

Brian Chase - Yeah, very similar to what you would do with Google location data when you're talking about a subpoena. The individuals can't really get this data. They can't just log into your T-Mobile account and download it, but you can send in a subpoena to T-Mobile, or Verizon, or AT&T to get the data, but you do still have to comply with that Stored Communications Act, so you've gotta attach that signed authorization from the account holder, send it off with your subpoena to one of the providers. Most of them will accept those subpoenas via fax, so you don't actually have to go get a process server. Just get your subpoena and fax it over to them. Some of them even have email accounts where you can email them, and they'll produce that data. Law enforcement can, of course, get it with a warrant, and that's thanks to the 2018 Carpenter decision for those criminal practitioners out there. Carpenter says law enforcement needs a warrant to obtain this data for anything more than seven days of cell site location information.

Jillian Kuehl - And can you go into the facts of Carpenter a little bit maybe?

Brian Chase - Sure. So Carpenter, remembering my facts here, Carpenter was a case where there was a group of people robbing T-Mobiles and Radio Shacks, and the feds were investigating. They arrest some people. One of them I believe flips on Carpenter, provides Carpenter's phone number. Law enforcement goes and obtains 127 days' worth of the historical cell site location information. They do so under the Stored Communications Act. There's actually a provision in there that allows them to obtain that data without a warrant, using something called a 2703 order. That's just the citation. And so they use that order, they get the data. Carpenter challenges it and said no, you need a warrant to get this data, goes up to the US Supreme Court. The US Supreme Court agrees with Carpenter. The government had argued well what in the Stored Communications Act allows us to do it, plus this is third party records and you don't have a reasonable expectation of privacy thanks to the third party doctrine. If you're turning data over to a third party, you can't have an expectation of privacy in that data.

But the US Supreme Court actually declined to apply the third party doctrine. They essentially said you don't have to opt out of modern society to be protected by the fourth amendment. So even though that yes, this data is being turned over to Verizon, AT&T, T-Mobile, if you wanna have a cell phone, there's no way to opt out of that. That's the way it has to work to have a cell phone, and so you're still protected by the fourth amendment, you still have a reasonable expectation of privacy, and law enforcement needs a warrant for that data. Now they said they need a warrant for anything more than seven days. If you're looking for this, it's in the footnote like footnote two or three. They did not say that you do not need a warrant for less than seven days. So they gave us a kind of bright line rule to say seven days or more clearly would violate your expectation of privacy, but they did not go the other way to say well less than seven days would not violate that expectation. So if you're dealing with a case where they get five days of data without a warrant, there's still an argument to be made there. They just kind of left that one to seven-day period as kind of a gray area, but it's gonna be pretty rare to see a case where law enforcement wants less than seven days of data.

Jillian Kuehl - Do all of the mobile carriers, Verizon, T-Mobile, AT&T, do they keep this data all for the same amount of time or how long do they store this? How far can you go back?

Brian Chase - Yeah, it varies quite a bit. So Verizon's on the short end at a year, so they only keep the data for a year, so you better act quickly if you're dealing with Verizon. On the long end is AT&T. It's seven years. And then you've got T-Mobile in the middle there sort of at two years. Sprint just merged with T-Mobile last year. Sprint was at 18 months. Right now if you were to go try to get Sprint data, T-Mobile will actually be the one that responds to your subpoena, but I don't yet know how that 18 month retention schedule is working. I imagine it's gonna get changed to two years, but for this kind of interim and for the next few months or so until this transition is full, I would assume 18 months. Better to assume on the short end than the longer end. And then by this time next year, probably not gonna matter anymore because we're gonna be past that 18-month period anyway, but for the moment, assume 18 months for Sprint.

Jillian Kuehl - So moving on into other sources of location data, I assume everyone who's listening to this has probably downloaded an app on their phone at some point, and had that allow tracking, allow location information notification pop up. So you had mentioned apps earlier. What kind of apps actually store this location data?

Brian Chase - There are lots of apps storing your location, or at least potentially storing your location. There's gonna be obvious ones. If you're using some sort of drive tracking app, you see these a lot for people who want to kind of track their mileage for work or something like that, there'll be apps that can store your driving. There can be fitness apps. If you're using an app to track your run or your bike ride, that's obviously storing your location. But there can be many others. There can be social media, Facebook. If you install the Facebook app on your phone, you can let Facebook track your location and they'll track it just like Google Timeline, where you'll see all that same kind of data you would see in Google Timeline. Just uses your phone's GPS, monitors where you're going. And then there'll be apps that you don't even think about that are tracking your location. In one case where we downloaded a cell phone, we weren't really expecting to get a lot of location data, but it was worth trying, and it turned out, we got lots of location data. It was because there was an app installed on the phone that notified the user of nearby concerts, and so that app was tracking the user's location and writing that location to text files on the phone.

So you wouldn't really expect to see some app that notifies you about nearby events or concerts or things like that to have all sorts of location data about you, but when you think about it, it needs to know your location in order to tell you about what's nearby. There's also apps like your weather app that could be tracking your location. Not every app that's tracking your location is providing great sources of data. Your weather app is not using a very precise location, but if you're trying to determine was somebody in California or New Mexico at a time, the weather app's gonna be fine for that, but if you're trying to determine were they at one restaurant or were they a few blocks away at another restaurant, the weather app might not be sufficient, but a app designed to track your bike ride might be. So it kind of depends on those apps, but lots of different apps out there will track your location. Not all of that data we can get. It varies based on make and model of the phone, based on type of app that's in use, and some of them will share that data to your cloud account where we'd be able to get the data there, just like Google Timeline.

Jillian Kuehl - For things you mentioned like fitness trackers and Fitbits, things like that, I assume that this is also tracking more than just your location. So it's probably monitoring heart rate, how fast you're moving, that kind of thing. Is any of that relevant or could it be relevant in a court case or litigation?

Brian Chase - Yeah. Fitbit is a great source of data. So Fitbit is one of those that's sending data to your phone. So what it's doing is your watch is sending its data to your phone. Your phone is then sending that data up to the cloud. So we've got kind of two sources for that data, the phone and the cloud. Fitbit, of course, is tracking pace, and heart rate, and steps, and all sorts of information like that in addition to potentially tracking location, and you can get all of that data. I know another forensic examiner who was in a car crash and was able to look at her own Fitbit data, and determine how fast she was going at the time of the crash because there was enough data there. You can use Fitbit data in all sorts of cases. Maybe you've got a case where a pedestrian is hit by a car. Well you could use the Fitbit data not only to determine potentially where they were coming from, but you can look at the steps, and their distance walked, and their heart rate to kind of see, get a better picture of what was going on. There's a lot of additional data there with those exercise trackers.

So those have a lot of granular detail that you might not get from something like say an auto insurance app. If you've ever signed up for a new auto insurance policy, they'll offer to say hey, if we can track your driving for six months, we might give you a discount. Well those are, of course, not tracking your heart rate or your steps 'cause they don't care, but they are tracking your drive and they might be tracking the speed you're going. So different apps are tracking different things. The more apps you can get tracking location, the better idea you can get of what's going on. But some of those exercise trackers can really help with that granular level of detail that you might not get from another app that's just providing location.

Jillian Kuehl - I believe there's an app called Strava that works with devices like Fitbit to more or less track location. Do you know much about this app and kind of what's gone on with that?

Brian Chase - Yeah. Strava is one of those exercise apps that's one of kind of two big ones out there. Wahoo is another really popular one. And Strava will just, it's an app on your phone, it will use your phone's GPS and you can use it to track your run or your bike ride. Funny story about Strava though is a few years ago, maybe more than a few now, they decide it'd be a great idea to take all of this data they've been collecting, people exercising all over the world, their runs, their bike rides, all their workouts, anonymize this data and remove usernames from it, things like that, and then post it publicly, say look world, look at all these people using our apps and exercising. That turned out to be a bad idea. People got ahold of this data on the internet 'cause it was public now, and they started looking at all of this data, and they found all these location points from around CIA black sites, military installations, all sorts of things that the government doesn't acknowledge exist but you can see these very clear patterns of exercise around these facilities in the middle of deserts.

So, they were even able to take that data and kind of de-anonymize it, 'cause all you need is oh one or two known location points of a user to kind of backtrack and figure out which data is there. So they could, they took this data and were able to trace it back to individuals and kind of figure out how people were moving around the world. Turned out to be a really bad idea to anonymize this data and release it to the world. A few years or a year or so after this happened, the DOD came out and said hey, if you're deployed, don't use these apps, don't let things track your location. But a lot of people, you don't really think about it, you don't really think about all of these apps that are tracking you and how that data might be used. So Strava turned out to be a kind of a wake up call about all of this data, how we're being tracked, how we're getting, how our movements are being tracked by these companies, and how it could potentially become harmful, even when it's anonymized and released to the public. So Strava turned out to be a little bit of a warning story.

Jillian Kuehl - Definitely. I would say for sure a lot of us are, if not entirely unaware, at least mostly unaware of how much data is actually being collected about what we're doing, especially on our apps. Some of them seem so innocent, but obviously that's not the case.

Brian Chase - Yeah.

Jillian Kuehl - So, go ahead.

Brian Chase - Oh yeah, I was just gonna agree. Yeah, there's just so much data out there and you don't realize how much is being collected about you. All of these apps are collecting so much of our data, which from a litigation standpoint, can be a great thing. It leads to a lot of information in litigation. From a privacy standpoint, maybe not the best thing.

Jillian Kuehl - Maybe not. How can you get this information from these apps?

Brian Chase - Yeah, so there's usually gonna be, well at least one location, which is the app itself on the phone. So you do a forensic download of the phone. It's gonna require that you get an expert, somebody like us at ArcherHall or somebody else that does digital forensics. That means you're gonna need specialized software. Not all of this data is immediately visible to the user, so you're gonna have to be able to download the data using specialized techniques, and then pull the data out of the apps, and create a report of that location history. So that's the first source, kind of the apps on the phone. That's not always the best source though. Not every app can we get data from. It really depends on the make and model of the phone and the app that's installed. So for example, on iPhones, one of the kind of forensic methods of acquiring data from an iPhone is essentially running an iTunes backup, just like you would if you plugged your iPhone into your computer and wanted to back it up. Well when you're an app developer, you can decide if your app gets included in that iTunes backup or not. And so if the developer says no, don't include this data, we're not gonna get it when we do that kind of forensic download.

So sometimes we get the data from the phone, but not always, and the problem is if somebody were to call me up tomorrow and say well I've got this data, my client was using this app, can you get it, I might not have a clear answer because it depends on so many different factors like the app, like the make and model of the phone. But a lot of these apps, like Strava, like Fitbit, will send their data up to the cloud, so you can log into your cloud account, just like you would with like the Google Timeline account, and get your data there. So Fitbit, for example, when you create a Fitbit, or when you set up your Fitbit account, you have to install the app, you have to create an account, and so you can log into that account on your browser. You go to Fitbit's website, you log in, all of your data's there, and you can download it. So you can download it that way and preserve it, and that's actually the easiest way to get a lot of this data. If there is a cloud account, you can get it that way directly from the cloud. Doesn't require the user giving up their phone for hours on end to have it downloaded by an expert, and it also means that if you've got an expert acquiring that data, they can be anywhere in the world. As long as they have an internet connection, all they need to do is get that username and password to get signed into that account and download the data.

Of course, if that data's up in the cloud and if a company like Fitbit or Strava has access to it, that means it can also be produced with a warrant or subpoena complying with that Stored Communications Act, just like we talked about before. So a lot of this data, there's multiple ways to get it. There's the app, there's the cloud account, and then there's the subpoena plus authorization or warrant for law enforcement. So, check out different options depending on the app. The first place I would look is the cloud account, especially if you're doing it for your own client. Have them sign in, take a look, see what's there. That could be the easiest way to get it, certainly the least expensive and the most convenient for the user, and if you're trying to get it from the other side, they could potentially do the same thing, a request for production, ask them to sign into their Fitbit account and download that data and produce it. For most of these services, like let's say you wanted to figure out how you download that data, if you just go to Google and say type in like download my Fitbit data, you'll find the resources. Most of these companies publish a guide as to how you download your own data, and you can just walk through the steps there, and it tells you how you can get your own data.

Jillian Kuehl - Would I be able to read my own data? I know you had mentioned earlier that something was saving as a text file. I don't think I could open a text file if I tried, so if I downloaded this, would I be able to understand my own data?

Brian Chase - Maybe. It depends on the provider. So some of it is fairly easily readable. Some of it is not. It really depends on which company it is. So sometimes even if you get the data yourself, you're still gonna need an expert to interpret it. Most of the data is gonna be latitude longitude coordinates, so you can get it and you can manually plot each one of those coordinates and it might take you a while. We have specialized tools that let us do that, so we can kind of automate that process, takes a lot less time to map it out. Some of the data isn't even readable in that format, latitude and longitude, so it depends on the provider. Google, Google Timeline, you can download that data in what's called a KML format, which is just a file that you can open with Google Earth Pro. It's a free tool from Google. It's just a desktop client, so you download it from Google. You can then open up that KML file. But other times, Google produces data in what's called a JSON format, which for the average user, you're not gonna be able to make heads or tails of that. It's kind of a messy file. So it really just depends on the provider. Sometimes it's easily readable. Sometimes it's not, and you might need an expert to map that data for you, or just to speed up the process so you're not doing one data point at a time, and there's often gonna be hundreds or thousands of data points, depending on what timeframe you're looking at.

Jillian Kuehl - And how reliable is app data, because sometimes I open an app and it thinks I'm shopping in Japan, so that is the currency that I'm given? Obviously I'm not there, so how reliable is this really?

Brian Chase - Yeah, it varies a lot from app to app, and that could be one of the problems with some of this data. So for example, if you download a cell phone with a program called Cellebrite, it's the most commonly used mobile forensics tool in the market, Cellebrite's gonna take all of the location points it finds, it's gonna separate that out into its own location data section, and there's a tendency to just rely on that, but it's not necessarily reliable. So I gave you the example of the weather app, and your phone's weather app doesn't need your precise location, so it's gonna pull a more general location. It could be off by miles. So you have to look at what the app is, and sometimes you can't even tell from that how reliable that data can be. So if it's an app that's providing directions, driving directions or exercise, tracking a ride or a run or something like that, that's generally gonna be fairly reliable, but once you start getting into other sources, you need to really know what that app is doing. You've probably seen this before, both Android and iOS do it now, where if an app wants to use your location, you can specify to allow it to have your precise location or a more general location, and if you select the more general location, that data's gonna be kind of closer to cell tower data. It's gonna provide an area where you're in, but not a precise location. So you kind of have to know what those permissions are, know what the app is doing to try to get that information.

My advice is anytime you have data, whether it's GPS data or cell site data or app data, is try to combine it with something known, match it up with a known location point, because then it can help you figure out how reliable it is. So if you know this particular person was at this restaurant at this date and time, and two hours later, they're in a car crash, well what's the data from two hours before. Does the app show that they're at that restaurant, or does it show they're a few miles away? So anytime you can match it up to some known piece of information, that's gonna help to kind of determine that reliability of the app. The other thing that can be done, and this can get expensive, is testing. So let's say you're really interested in data from an app, and we just don't know. We don't know if it's a reliable location source or not. So what we can do is download the app and test. We run it with some GPS data or known locations, we let it track us for a few days, we download the phone, we look at the data and we match it up, and that can be a way of doing it, but it does take more time and some more effort to try to get that reliability. But just because you see a location there in the app, doesn't mean it's gonna be reliable. It's gonna take some further analysis.

Jillian Kuehl - All right, I'd like to talk about next probably, aside from apps, the thing we most use on our cell phones, and that would be text messages. So can you get location data from text messages, either on the phone or other texting platforms like WhatsApp, things like that?

Brian Chase - So, sometimes. Sometimes a user might just text about where they are. You might get a text saying oh yeah, I'm at the grocery store, or something like that, and that might be accurate, it might not. There's really no way to validate that without looking at other sources. But most of us, at some point or another, have received a text message of something like where are you, and when you get that, often your phone will prompt you to tap to give access to a location, and when you get that prompter and you hit that button, what your phone is doing is it's taking your location using GPS, and it's sending a map of your location to the other party.

So if there's a text message like that, that can be a really reliable source of information, and of course, if it's a text message, there's multiple sources of it, so you've got the sender of the message, and you've got the receiver of the message. If it's a group message, there might be multiple receivers of it. So you've got at least two different phones that are gonna have that location data, plus there might be backups of the text message. So if you back up your phone to iCloud like we talked about earlier, we could download that backup of the phone from iCloud, pull the text message out of that. If you back up your phone to your computer, you plug it in with a cable to your computer and back it up there, we can take that backup file off your computer and pull the text message from that backup file.

Some people, very rarely, but some people will pay to back their phone to Verizon, or AT&T, or T-Mobile. Verizon's the best example I know of this, like the My Verizon app. When I was on Verizon, it used to harass me to pay five or $10 a month to back up my data. If you do that, then the carriers will actually have content of your messages 'cause they'll be storing that if you pay for that service. But the other thing to keep in mind is it's not just us limited to text messages, be limited to any kind of chat messages, so Facebook Messenger, Google Chat, Signal, Telegram, WeChat, all of these various chat apps out there. Some of those chat apps will also store locations separately, usually more general, so you're gonna see like the city that somebody is texting from, but so you can have kind of multiple levels of location data from some of those chat apps. And those chat apps, not only is that data available on the phone, but if you're talking about something like Facebook Messenger, that data's gonna be stored on Facebook. So there's that cloud source as well, and once you're dealing with the cloud, that means the user can download that data, or again, it could be acquired with a warrant or subpoena plus that signed authorization. So lots of different sources there. It's not a common location source. You don't usually see messages like that, but it's usually an easy source to check, so it can come in handy and it's usually not too hard to check for that kind of data.

Jillian Kuehl - Are there other social media things like Yelp maybe where you can get my location if I'm looking up a restaurant or something?

Brian Chase - Yeah. So Yelp, Facebook, things like that allow you to check into different locations, and you'll see that sometimes publicly, so if someone's got a public Facebook account, you could see that check-in. Problem with that is, it's not necessarily reliable. You can definitely check into a place that you're not at, but it can give you a starting point. So let's say you see a check-in on Yelp at some business or a review on some business. You could then go to the business and see if they've got security camera footage or receipts or something like that that might establish that the user was there. Additionally, some of these apps like Facebook can track your location through the Facebook app on your phone. Kind of mentioned that one before. Facebook will work, if you have this enabled, just like Google Timeline, where it will track your location, and you can go log into your Facebook account and see all of that movement just like you would on Google Timeline. So sometimes you'll get things like that from social media apps as well. So they can be a really valuable source, and sometimes those can be done early stages of investigation could even before discovery because some of that information is just publicly available on the internet.

Jillian Kuehl - I have heard that you can get location information from just a download on a cell phone. Is that true?

Brian Chase - Sometimes. So, it depends on the make and model of the phone. Some phones, we're gonna get lots of location data. Some phones, we'll get almost none. There's lots of different potential sources on the phone. So there's things like the app data that we've seen before. There can be GPS information separate from that app. There can be photo EXIF data that we can get. Could be wifi locations. Wifi can be a great source of location. You can see when somebody was connected to a wireless network and then figure out where that wireless network is. The problem though is it's really not consistent. Different make and model phones give us different data, and it kind of changes as to what we can get. So new iPhones, for example, if you go buy a new iPhone today, and we go and download it tomorrow, probably not gonna get much location data, but from an iPhone eight, we'll probably get a lot more. So it varies based on make and model how much location data we can get. It's not always the best source of location information.

Jillian Kuehl - So all of the sources of location information that we've addressed so far have really had to do with cell phones. Are there any other devices that can give location data other than a cell phone?

Brian Chase - There's a lot. There's a lot of other sources. I think one of the most surprising sources for location data for most people is what we call IOT devices, internet of things devices. These are things like your Amazon Echo, your Google Home, your Nest Thermostat, your Philips Hue light bulbs, all these smart devices that we install in our homes. So IOT's kind of a broad category for internet of things and it really applies to all these other devices other than our laptops, desktop, cell phones that are connecting to the internet. And while a lot of those don't have GPS, the very nature of the device can help to establish location. So those kinds of devices can be useful, and they're really often overlooked because they don't have GPS, but interactions with them can help establish some of that location information.

Jillian Kuehl - So how do these devices, these IOT devices, store location information?

Brian Chase - Yeah, so it varies from device to device. They work very similar to say the Fitbit. Most IOT devices you have to install using an app on your phone. So you configure the device, you set it up using an app on your phone, the data gets sent to your phone and also up to the cloud. So we usually see data in two locations. There can be more than that though. Sometimes the device itself has some data on it. So it can vary based on which device you're looking at, and also vary in its usefulness. So let's take a smart lock as an example. A smart lock by itself doesn't have GPS on it, but it's installed on a door. Those don't tend to move around much, not the most, not the easiest thing to take with you to work every day to take the lock off your door. Tends to just stay on your door. But it tracks when your door is locked and unlocked, and how it is locked and unlocked.

 So if somebody's entering in a physical code, punching in a code to unlock the door, it will show that the lock was unlocked using that code. So now that means somebody had to have been standing at the door and know the code to that door to unlock it. If it was unlocked via the app, it will show that, and if it was unlocked via the app, well the person could be anywhere where there's an internet connection. Some locks, some smart locks allow you to tap your phone to the lock to unlock it, just like you would tap to pay at a store, and then we now have a device touching the lock, so now it's a, we at least tell where that device is, which generally means the user's there, but we talked about those issues before, not necessarily, but that can kind of provide some location information. So if you know John tapped his phone to his lock at 3:30 p.m., and then John is accused of being across town at 3:35 p.m., seems unlikely if five minutes before his phone was used to unlock his front door. And then that data, like I said, is gonna be maybe the app on the phone, could be in a cloud account, might be stored within the lock itself, so kind of different locations. Also depends on the device. So that's kind of how some of that data can be used based on the interactions with that data.

Jillian Kuehl - What about the Amazon Echos, the Google Voice or whatever it's called, how does me talking to something or someone in my house, talking to something develop any kind of location data?

Brian Chase - Yeah. So, these are very similar. They don't tend to move. Well, they're certainly more mobile than a smart lock. They tend to get plugged in and just kinda stay there. So people will plug 'em in in their kitchen or their living room and they don't tend to move much. With these devices, every time you talk to them, every time you say the wake word, so you say Alexa, it records what you say after that. It takes that audio recording and it sends it up to the cloud, sends it up to Amazon servers, where Amazon servers kind of figure out what you mean and then send that response back to the device. That recording is saved, that actual audio. So let's say we're trying to determine if somebody was home in a given time. We can look at that Amazon Echo data from an Echo that's in their kitchen, and if we see recordings, we see that device was in use at the time, we can then actually go play the recording, listen to who was talking to that device, and then put them in that room. We also get the device type that was used, so whether it was the Echo, or the Echo Show, or the whatever it's called, their smart microwave. If it's the microwave, probably a pretty good chance they're in the kitchen. That's probably not moving outside the kitchen very often.

So we can kind of get which device was used. We get that recording, and we get what the device responded back, which that part's not necessarily so important as the recording, 'cause then we can actually listen to it. Sometimes those recordings could be even more useful. So let's say you are trying to determine, was this device in the home? One I gave an example of when I was doing a similar presentation years ago is I had a device that was in my dining room, and I had a ceiling fan in there that was clicking at the time. You could hear the clicking in the background of the audio, so that really helped to establish that that Amazon device, that Echo device was in the dining room, because of some of the background noise it was picking up. So there's lots of uses for that data. The best piece of advice I can have is kind of be creative and think broadly when you're looking for this stuff, because there could be all these surprising sources, like an Amazon Echo, that can provide really valuable location information.

Jillian Kuehl - Can any of this be picked up if the devices are not awake? Let's say I don't say Alexa, can it still hear and pick up what's happening?

Brian Chase - It's not supposed to. So it's only gonna record when it hears something that sounds like Alexa. That doesn't mean it is the word Alexa, or there's a couple other words you can switch it to. There was a story of a, I think it was a Portland couple from a few years ago, where they were talking in their home about their hardwood floors and they get a frantic phone call from one of the, I think it was the husband's employee, saying like you're being hacked, disconnect all your devices, I just heard you talking about your floors, and so they freaked out and they contacted Amazon about this, and what happened was just this bizarre set of circumstances where the device heard them say what it thought was Alexa send a message to and then the employee's name, and so it then recorded their conversation thinking that was the message, and then it asked them, send this message to whoever, and it heard one of them say yes, so it sent the message. The problem was they were not in the same room as the Amazon Echo, so they didn't hear it talking back to them, but because the microphones on the device were so good, it heard them. So it was this kind of bizarre series of events that led to this. They weren't being hacked. It was just kind of a weird set of circumstances. So sometimes it can pick up things even if somebody wasn't talking to the device. It's not common, but it does happen from time to time. I'm sure most people who have one of these smart devices have had an experience where they've seen like the light light up and you're like why does it think I'm talking to it, but when that light's lighting up, it's recording. So it's useful to look at these things, even if somebody wasn't actively using it, 'cause it might have just happened to hear something that it thought was that wake word and started recording it.

Jillian Kuehl - And how can you get this data from these IOT devices?

Brian Chase - Yeah. So there's the device itself where you can kind of break into the device and read the data directly off of the storage chip. You're hardly ever gonna see that in litigation. It's really expensive, it's time-consuming, and it destroys the device. Plus the data that's stored locally on that device is usually only kept for about 30 days or so. So you're probably never gonna see that method. It's really only coming up in research. But then there's that data in the app, so that cell phone download, we might be able to get that app data, just like other apps we were talking about with location data. We might see it there in that app. How much data is in that app depends, again, on which smart device you're talking about. Plus there's the cloud, all this data's going up to the cloud. These devices are not that powerful, so a lot of them are relying on cloud to work, to function. Like Amazon is sending that recording up to the cloud for them to process it. So you can get it from the cloud account as well. And going back to cloud accounts, if it's in the cloud, the user should be able to download it, it's available via subpoena or warrant, and so there's kind of multiple ways to get at that data from the cloud perspective, and that, again, can be the easier way to do it depending on that device that's in question. Does vary quite a bit from device to device.

Jillian Kuehl - Is it more common now to see this information in litigation? Is it, I know you said some aspects of it can be very expensive. Is this accessible though, generally?

Brian Chase - Yeah. I'm seeing it all the time. We've probably got over a dozen cases pending right now with location data. It's coming up in all sorts of cases. We're seeing it all the time. And while some types of it can be more expensive, it's overall not that expensive to get a lot of this data and to map this data. You might be looking at maybe $1,500, $2,500 for some types of data like cell site data to map that out and have an expert provide an opinion. That's not that expensive depending on what's in controversy in your case. So obviously if you're dealing with a tiny case, it doesn't make sense to do this kind of stuff, but maybe you can do some of it yourself.

Some courts have ruled that GPS data doesn't need an expert, that juries are just generally familiar now with Google Maps and Apple Maps, and that doesn't require expert testimony, whereas cell site data does require expert testimony. That is not within the purview of a light witness and it's gonna require an expert. So some of this stuff is easier to use than others. Some of it doesn't require experts at all which makes it really accessible, especially things like Google Timeline, or even EXIF data from pictures. That's a little tricky as to whether or not a judge would allow that without expert testimony, but you don't need an expert to see that data. You can see that yourself. Just look up, save a picture to your computer, right-click on that picture, go to properties. Opens up a little window for you. There's a details tab. Shows you all that EXIF data. So some of this stuff is really accessible, doesn't need an expert, and therefore costs are pretty low, while others do require an expert. Sometimes the analysis is not that complex. Usually we're only interested in a day or two. Doesn't take that long to do a day or two with most of the forensics tools that are out there because they do help us automate and speed up that process, and then instead of having to map each individual data point by hand, which can take a long time, all we're doing is validating the results instead which is a much faster process. So it can vary, but overall, a lot of these costs are coming down because the data is becoming more accessible and easier to get.

Jillian Kuehl - Fantastic. Well Brian, I think that our audience has certainly learned a lot. I have most certainly learned a lot here, so thank you so much for your time. I'll just give it over to you now if you wanna give our audience the best way to contact you if they have any questions on this presentation going forward.

Brian Chase - Yeah, I'm always happy to take questions, so if you're sitting out there and you've got more followup questions, if you have a case you wanna discuss or brainstorm, please feel free to reach out to me. You can go to our website archerhall.com. That's A-R-C-H-E-R-H-A-L-L dot com. You'll find more information there. We have all sorts of resources for people up on our website. You're also welcome to email me. My email address is just [email protected]. Consultations with us are always free, so if you wanna reach out and brainstorm a case or get some opinions and see if there might be something out there that can help you, feel free to reach out to me. Happy to take that time and talk to you about your case. And then certainly if you do wanna get us on board as an expert, reach out, we'll give you a quote for our services. But don't be shy. Feel free to reach out with questions. Always happy to take questions in the future.

Jillian Kuehl - Great. Thank you so much, Brian. It was such a pleasure having you on today.

Brian Chase - Thanks for having me.