Peer to Peer Magazine

36 PEER TO PEER: THE QUARTERLY MAGAZINE OF ILTA | FALL 2017 FEATURES More ESI: IoT Data Presents New Challenges and Opportunities in Discovery these devices are already being subpoenaed in criminal maers. Given the unprecedented insight such data can provide into a person's daily life, there is no doubt that these devices will become a common target of discovery. Commercial IoT Data While recent headlines have highlighted Fitbit and Echo data as potential evidence, a more mundane source of IoT data that is relatively easy to capture could have significant consequences in civil litigation and regulatory maers: commercial and industrial equipment. IoT devices are ubiquitous in manufacturing and transportation. Imagine a widget. From its inception, it passes by several robots on the manufacturing line, all communicating information about it via Wi-Fi. It is then bundled into a package tracked via an NFC or RFID tag, which itself talks to many different systems as the widget travels along truck, rail and air routes. Eventually it is scanned at a point of sale, exchanging data with yet another system. By the time the widget reaches the end-purchaser, it has le a large volume of data in its wake. Discovery of this data could be relevant to any number of lawsuits: a simple contract dispute between the logistics company and the retailer, a complicated product liability class action lawsuit brought by consumers against the manufacturer, even a regulatory antitrust investigation against a group of distributors. This data, when pieced together, could tell a compelling story about the widget and the many aspects of its manufacture, distribution and sale. The data is probably already used by the companies involved in the widget's production for their own business reasons and thus likely available in an accessible and usable format. Most of the time IoT data will not be accessible in a "raw" form but rather in the form inherent to the application or system in question. The information obtained from an IoT system that uses optical and telemetric sensors to ensure that the widget passed through the required quality-control stages in its manufacturing process may be discoverable in a product liability maer but available only in summary form or scoped to a limited time frame or set of parameters. For this reason, the traditional electronically stored information (ESI)-related discovery tactic of requesting the raw data or a larger set of data from which to form a more comprehensive analysis may not be possible. Attorneys Must Learn and Adapt Aorneys need to adapt and understand the benefits balanced against the practical limitations that current IoT systems pose to legal discovery. Craig Ball, a longtime expert in the field of digital forensics and ediscovery, has a great article in his Ball in Your Court blog called "The Internet of Things Meets the Fours Stages of Aorney E-Grief " that explores the intersection of advanced technology and aorneys dealing with litigation and discovery. Accessing, preserving and analyzing IoT data is a new and growing field for legal professionals. The use of IoT data in discovery and litigation is still rare, but tipping points tend to come quickly. By practicing smarter discovery — for example, by focusing on the best source of data and using IoT-related data to tell a story or set a timeline of events — parties and their counsel will be beer prepared to use IoT information successfully as a critical part of their litigation strategy. It is important that aorneys stay informed about the current use of IoT data in discovery and litigation and keep up to date on advances in the use of digital evidence. By building professional relationships with legal technology experts in digital or cyber forensics and ediscovery, and by aending CLEs and events focused on new technologies, aorneys will be beer prepared to handle IoT data issues as part of their litigation management process. P2P Employers need to consider IoT devices and how their use in organizations affects preservation requirements as part of the corporate legal hold process. Organizations need to determine whether there are additional privacy concerns for using IoT data. This may differ across jurisdictions, adding another layer of complexity to data that may emanate from devices spread across legal privacy boundaries. Employers should follow the best practice of adding IoT- related information to data collected as part of the employee's normal role in the organization, and should include related language in employee consent clauses in employment agreements and acceptable use policies.

• Cover