Think your device is safe from scrutiny? Ask Tom Brady

Star quarterback learns employer can demand to see texting records

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someonePrint this page

How­ev­er you feel about Tom Brady, the Patri­ots, and foot­ball air pres­sure, today is a learn­ing moment about cell phones and evi­dence. If you think the NFL had no busi­ness demand­ing the quarterback’s per­son­al cell phone—and by exten­sion, that your com­pa­ny has no busi­ness demand­ing to see your cell phone—you’re prob­a­bly wrong. In fact, your com­pa­ny may very well find itself legal­ly oblig­at­ed to take data from your per­son­al cell phone.

New norm

Wel­come to the wacky world of BYOD—bring your own device. The inter­min­gling of per­son­al and work data on devices has cre­at­ed a legal mess for cor­po­ra­tions that won’t be cleared up soon. BYOD is a real­ly big deal—nearly three-quar­ters of all com­pa­nies now allow work­ers to con­nect with per­son­al devices, or plan to soon. For now, you should pre­sume that if you use a per­son­al com­put­er or cell phone to access com­pa­ny files or email, that gad­get may very well be sub­ject to dis­cov­ery require­ments.

Secu­ri­ty & Pri­va­cy Week­ly News Roundup: Stay informed of key pat­terns and trends

First, let’s get this out of the way: Any­one who thinks Tom Brady’s alleged destruc­tion of his per­son­al cell phone rep­re­sents obstruc­tion of jus­tice is falling for the NFL’s mis­di­rec­tion play. That news was obvi­ous­ly leaked on pur­pose to make folks think Brady is a bad guy. But even he couldn’t be dumb enough to think destruc­tion of a hand­set was tan­ta­mount to destruc­tion of text mes­sage evi­dence. That’s not how things work in the con­nect­ed world. The mes­sages might per­sist on the recip­i­ents’ phones and on the car­ri­ers’ servers, eas­i­ly acces­si­ble with a court order. That was just a leak designed to dis­tract peo­ple. (And I’m a Giants fan with a fan’s dis­like of the Patri­ots).

But back to the main point: I’ve heard folks say that the NFL had no right to ask Brady to turn over his per­son­al cell phone. “Right” is a vague term here, because we are still real­ly talk­ing about an employ­ment dis­pute, and I don’t know all the terms of NFL play­ers’ employ­ment con­tracts. But here’s what you need to know:

Tech­nol­o­gy and the law

There’s a pret­ty well-estab­lished set of court rul­ings that hold that employ­ers fac­ing a civ­il or crim­i­nal case must pro­duce data on employ­ees’ per­son­al com­put­ers and gad­gets if the employ­er has good rea­son to believe there might be rel­e­vant work data on them.

Prac­ti­cal­ly speak­ing, that can mean tak­ing a phone or a com­put­er away from a work­er and mak­ing an image of it to pre­serve any evi­dence that might pos­si­bly exist. That doesn’t give the employ­er carte blanche to exam­ine every­thing on the phone, but it does cre­ate pret­ty wide lat­i­tude to exam­ine any­thing that might be rel­e­vant to a case. For exam­ple: in a work­place dis­crim­i­na­tion case, lawyers might exam­ine (and sur­ren­der) text mes­sages, pho­tos, web­sites vis­it­ed, and so on.

It’s not a right, it’s a duty. In fact, when I first exam­ined this issue for NBC­News, Michael R. Over­ly, a tech­nol­o­gy law expert in Los Ange­les, told me he knew of a case where a com­pa­ny actu­al­ly was sanc­tioned by a court for fail­ing to search devices dur­ing dis­cov­ery.

Work gets per­son­al

People’s lives revolve around their phone, and they are going to become more and more of a tar­get in lit­i­ga­tion,” Over­ly said then. “Employ­ees real­ly do need to under­stand that.”

There is real­ly only one way to avoid this per­ilous state of affairs—use two cell phones, and nev­er mix busi­ness with per­son­al. Even that is a chal­lenge, as the temp­ta­tion to check work email with a per­son­al phone is great, par­tic­u­lar­ly when cell phone bat­ter­ies die so fre­quent­ly.

The moral of the sto­ry: the def­i­n­i­tion of “per­son­al” is shrink­ing all the time, even if you don’t believe Tom Brady shrank those foot­balls.

For fur­ther read­ing: here’s a nice sum­ma­ry of case law.

More on pri­va­cy and mobile devices:
Cana­da puts teeth into dig­i­tal pri­va­cy law
Secu­ri­ty must be part of device design as Inter­net of Things evolves
Mobile pay­ments get eas­i­er, but secu­ri­ty ques­tions remain
Mobile dat­ing apps come with hid­den haz­ards

 


Posted in Data Privacy, Data Security, News & Analysis