News & Events

Green vs. Blue Bubbles: A Thought on Thorough e-Discovery

Green vs. Blue Bubbles: A Thought on Thorough e-Discovery

If you own an iPhone, take a look at your most recent text messaging threads. Are the words contained in a blue or a green speech balloon?

A blue speech balloon indicates that the communication was sent via Apple’s proprietary iMessage protocol, while a green balloon indicates that the communication was sent as a SMS text message. The difference is that an iMessage exchange is the default where both participants in the conversation are using Apple iOS devices and iMessaging has not been turned off in the device’s settings; the protocol utilizes the available data connection (cellular or wi-fi) to complete the exchange through Apple’s servers, using the users’ respective phone numbers or Apple IDs for sender-recipient identification. On the other hand, if one or both of the conversation participants is not using an iOS device, SMS text messaging protocol will be used to deliver the message over the cellular provider’s service network to complete the exchange.

What does this have to do with litigation? Well, when conducting discovery, it’s crucial to subpoena all the right entities to get a complete picture of a party’s communications. Obviously, nothing replaces full forensics of the mobile device itself and any physical backups. But where the device is missing or unavailable, a lone subpoena to a party’s wireless carrier for text messaging records could prove lacking if he or she is an iOS user; Apple’s records and data should also be subpoenaed to the extent possible.

Apple, however, apparently doesn’t retain iMessage data for a set period of time on its own servers per se; rather, the iMessage data are stored in the user’s iCloud backup, and only for as long as it takes for a subsequent backup to overwrite the older data. So, as is the case with wireless providers, time is of the essence, especially in light of the fact that backups and data syncs from the device to iCloud tend to be automatic and frequent.

With Apple iOS devices eclipsing Android in smartphone market share at the end of 2014[2], it seems increasingly likely that a “text message” between two devices being sought in discovery was not actually sent via SMS, and the carrier will thus have no record of it. Similar considerations should also be made with regard to communications taking place within one of the many social media Apps that have proprietary in-App data exchange functions. And, undoubtedly, your best resource for finding out about all those Apps is likely someone much younger (and hipper) than the newest associate in the firm.

M. Ryder Lee

LeeRyder141050xc