BYOD And Disclosure

BYOD & DISCLOSURE · AGUIDEFORUKLAWYERS BYOD and Disclosure Personal Devices, Work Data and the Collection Nobody Signed Up For COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM PRIVACY-SCOPED EXTRACTION PROTOCOLS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the company's evidence on the employee's phone 03 Control: when personal-device data is disclosable 04 The routes: consent, contract, compulsion 05 Targeted collection: taking the work, leaving the life 06 Privacy, proportionality and the device owner's rights 07 Leavers, refusers and wiped devices 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : WORKDATAONPERSONALDEVICESISUSUALLYDISCLOSABLE , RARELYSEIZABLE , ANDALWAYSCOLLECTABLEWITHTHERIGHTPROTOCOL : THECRAFT ISTHEPROTOCOL § 0 2 · FIRSTPRINCIPLES The problem in plain English: the company's evidence on the employee's phone § 0 3 · CONTROL Control: when personal-device data is disclosable § 0 4 · THEROUTES The routes: consent, contract, compulsion § 0 5 · THESCALPEL Targeted collection: taking the work, leaving the life § 0 6 · RIGHTS Privacy, proportionality and the device owner's rights § 0 7 · THEHARDCASES Leavers, refusers and wiped devices § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE DEVICE SYSTEMS / WORK COMPUTER PERSONAL CORPORATE MDM / CLOUD & (TARGETED) TENANCY PROFILE BACKUPS COUNTERPART DELETED / DEVICES RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEPROTOCOLTHATTURNEDAREFUSALINTOAYES EXAMPLE2 · THEDISCLOSURESTATEMENTTHATFORGOTTHEPHONES EXAMPLE3 · THEEXITWIPEANDTHECONTAINERTHATLOGGEDIT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CUSTODIANCONSENTPROTOCOL ( CORETERMS ) § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The BYOD checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can my client require an employee to hand over their personal phone? Is WhatsApp on a director's personal phone within the company's control? What if the custodian's phone also holds another employer's confidential data? Our custodian left the company last year and will not cooperate. Options? Does GDPR prevent BYOD collection? What should a BYOD policy say to make disclosure workable? § 1 4 · REFERENCE Glossary BYOD MDM Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY