Cloud data security is a shared responsibility, but it’s a shared responsibility that is governed, ultimately, by the contract.

SearchCompliance.com Editorial Director Scot Petersen recently sat down with Jeffrey Ritter, an attorney and recognized expert on technology law, to discuss how bring-your-own-device (BYOD) programs, cloud use and vendor relationships are influencing data protection strategy.

via The evolution of data protection strategy in the cloud and BYOD era.

“Phone Password Breaker becomes an alternative way to get access to iOS devices’ content,” said Vladimir Katalov, CEO of Moscow-based ElcomSoft, in a statement. “With a valid Apple ID and a password, investigators can not only retrieve backups to seized devices, but access that information in real time while the phone is still in the hands of a suspect.”

Information from iPhone backups is in high demand by forensic customers, according to ElcomSoft. No wonder, since an estimated 125 million Apple users store some type of data in iCloud, which offers 5GB of storage for free, and which is easily enabled via a checkbox in the iOS device settings. By accessing data stored in an iCloud backup, investigators could keep tabs on a suspect without the suspect having any idea that their cloud-based data was being accessed.

via Forensic Tool Grabs iPhone, iPad Data Remotely – Security – Storage security – Informationweek.

iCloud allows users to store data from their devices on remote computer servers and share their files between multiple iOS devices. In addition, iCloud can be used as a data synchronization center for email, contacts, organizer events, bookmarks, pictures and other information. Various sources quote the service has as many as 125 million users as of April 2012.

iCloud backups are incremental. When set up to use the iCloud service, iPhones automatically connect to iCloud network and backup their content every time a docked device gets within reach of a Wi-Fi access point. This is to say, iCloud backups represent a fresh, near real-time copy of information stored in iPhone devices, including information about recently made and received calls, sent and received text and email messages, and so on.

Regardless of their location, iPhone backups contain essential information stored in the device. Information stored in iPhone backups includes email, accounts and passwords, call logs and text messages, calendars, appointments, contacts and organizer information. Pictures and Web browsing history including URLs of recently visited sites is also included. Information stored in iPhone backups can be essential for investigations, and is in high demand by forensic customers.

via Forensic access to iCloud backups.

The problem with screening data with keywords is that it doesn’t do what we assume it does. Applying a keyword filter to a data set (i.e., a Boolean search) is simultaneously over- and under-inclusive. Language (and human beings’ use of language) is inconsistent and imprecise. Keyword/Boolean searches are over-inclusive in that a simple Boolean search lacks the “intelligence” to differentiate between synonyms (e.g., you search for documents related to an insect infestation at an apple orchard, and you end up with thousands of documents about Apple computers).

via E-discovery: Change your thinking about e-discovery.

Following up on the case summary from last week (posted May 1, 2012) in which the court denied defendant’s motion to quash the District Attorney’s subpoena and issued an order requiring the production of defendant’s user information and Tweets from Twitter, Inc., this week brings us Twitter, Inc.’s motion to quash the court’s order.  Filed on May 7, 2012, the motion seeks to quash the court’s order on the grounds that the order imposes an undue burden on Twitter for reasons including that it requires them to violate the law.

Opening its brief, Twitter notes that section 2703(d) of the Stored Communications Act provides that “[a] court issuing an order pursuant to this section, on a motion made promptly by the service provider, may quash or modify such order, if. . . compliance with such order otherwise would cause an undue burden on such provider.”  Twitter argues that the order compelling its production of the defendant’s information imposes an undue burden for three reasons.

via Twitter Seeks To Quash Order Requiring Production of Account Holder’s User Information, Tweets : Electronic Discovery Law.

Ads touting the benefits of cloud computing and the “cloud readiness” of software products are visible in airports, print media and on TV, and surveys predicting the rapid adoption of cloud computing solutions appear regularly. But how do cloud computing solutions affect the production of electronic documents and information in a litigation setting?

Smart Business spoke with James P. Martin, CMA CIA CFE, managing director of Cendrowski Corporate Advisors, regarding the issues that can arise when attempting to obtain information when a party has information stored in the cloud.

What is cloud computing?

Cloud computing describes an IT model in which computing resources can be obtained and utilized on an as-needed basis; this is why cloud computing is often referred to as ‘utility computing.’ The end user is provided a turnkey solution that is supported and maintained by the service provider at a remote location.

Cloud computing is enabled by rapid, reliable Internet communications, and, in fact, ‘the cloud’ is a term referring to the pool of resources hosted on the Internet.

What are some common cloud solutions that should be considered in litigation?

Cloud computing applications include hosted email products, such as Gmail or Hotmail, picture hosting services, text message services, hosted document processing, as well as social media services such as Facebook, Myspace, or dating sites. These sites would potentially have data that could be relevant to the litigation.

How does a cloud solution affect electronic discovery?

Moving to a cloud computing solution does not remove an organization’s document retention requirements, and many cloud solutions tout their ability to help the organization meet statutory requirements.   If the cloud vendor performs services to the public, access to the data stored in that solution would be subject to the restrictions of the Stored Communication Act.

It is also important to understand that this is an emerging area of law. Third-party solutions are evolving rapidly, and social media services are creating issues and carrying information that was inconceivable a few years ago. The legal system is dealing with emerging issues related to these new technologies and case law is changing rapidly.

via How electronic discovery during litigation is impacted by information stored in the cloud | Smart Business.

According to a survey of about 2,000 households with Internet access, Consumer Reports projects that about 13 million U.S. Facebook users don’t use or are not aware of the social network’s privacy controls.

With more than 900 million users, however, that’s only about .01 percent of those on the social network.

via 13 Million U.S. Facebook Users Not Using Privacy Controls | News & Opinion | PCMag.com.

Upon releasing the the results of the study this week, the data protection regulatory agency urged consumers to take better care of their data. It also released a list of ways individuals can securely delete personal information from old devices.

“Many people will presume that pressing the delete button on a computer file means that it is gone forever,” U.K. Information Commissioner Christopher Graham in a statement. “However this information can easily be recovered,”

via One in 10 secondhand hard drives in U.K. contain personal data – Computerworld.

This week the Department of Justice and the court’s Administrative Office (AO)  jointly developed a set of recommendations aimed at easing what it calls one of the most challenging aspects of its work: wading through  ”electronically stored information (ESI)” for the discovery or evidence gathering phase of a court case. ESI can include everything from writing, drawings and charts to photographs, e-mail, voice-mail and computer file folders.

In the news: Fabulous space photos from NASA’s Hubble telescope

“An expansion in the amount of digital data, the number of devices on which it can be created and stored, and the declining cost of storing such information have resulted in the increased presence of ESI in federal criminal litigation,” said Theodore Lidz, the AO’s Assistant Director for the Office of Defender Services in a statement. “Often the amount of information ranges from tens of thousands to millions of pages. While difficult to quantify, the expectation is that use of the recommendations will limit overall criminal justice discovery costs, reduce the number of discovery disputes, and shorten the time for processing complex cases.”

via Layer 8: Federal courts scuffle in face of digital information overload.

The Trojan horse is dubbed TapLogger by its creators and was designed to demonstrate how data from a smartphone’s accelerometer and orientation sensors can be abused by applications with no special security permissions to compromise privacy.

via Proof-of-concept Android Trojan uses motion sensor to determine tapped keys – Computerworld.