Ephemeral messaging apps like Snapchat, Telegram, WhatsApp, and Signal have become increasingly popular in recent years, especially among younger generations, and even businesses. These apps allow users to send messages, photos, and videos that disappear after a set period, making them popular for casual conversations, sharing funny moments, and sending sensitive information.
There are plenty of references, in the news, to ephemeral messaging applications. For example, in 2016, Brazil banned the use of WhatsApp for their citizens. Although this ban was short-lived, they saw a 500% increase in downloads for apps like Confide which is an alternative to WhatsApp.
The use of ephemeral messaging apps can create challenges for eDiscovery and forensics investigations. Ephemeral messaging apps can make it difficult to collect and preserve electronic evidence, leading to potential spoliation of evidence.
In this blog post, we will explore the challenges that ephemeral messaging apps pose for eDiscovery and forensics investigations and how organizations can overcome them.
The Challenge of Ephemeral Messaging Apps in eDiscovery
Ephemeral messaging apps pose several challenges for eDiscovery investigations. The main challenge is the temporary nature of the messages, making it difficult to collect and preserve electronic evidence for use in legal disputes.
Another challenge is the use of end-to-end encryption in many ephemeral messaging apps. End-to-end encryption makes it difficult for investigators to access messages in transit, which can impede the collection of evidence.
How Ephemeral Messaging Apps Affect Forensics Investigations
Ephemeral messaging apps also pose challenges for forensics investigations. When messages are deleted automatically, it can be challenging, if not impossible, to recover deleted data.
The appeal of using these types of messaging apps is that they provide additional security through automated message deletion. Although it’s typically assumed that these are completely secure, some services do provide online functionalities where account information is able to be exported from the account itself or via a backup in a cloud storage service.
It is sometimes necessary to do a manual collection of messages in an app, which requires the use of photography because we are unable to preserve them with our digital forensics‘ tools. We would typically use a camera with a zoom lens, attached to a tripod. Additionally, we typically transcribe the chats, depending on the requirements of the matter. As noted, this can be a time-consuming and expensive process depending on the volume of data that needs to be collected.
Overcoming the Challenges of Ephemeral Messaging Apps in eDiscovery and Forensics
Organizations can take several steps to overcome the challenges posed by ephemeral messaging apps in eDiscovery and forensics investigations. These include:
- Developing a clear policy: Organizations should develop a clear policy for the use of ephemeral messaging apps, including guidelines on how employees should use these apps and when they should be used.
- Monitoring: Organizations should monitor employee use of ephemeral messaging apps to ensure compliance with policies and to identify potential issues.
- Preservation: Organizations should implement processes for preserving data from ephemeral messaging apps when necessary. This can include training employees on how to save messages or implementing software tools to capture and archive messages automatically.
- Forensic analysis: Organizations should engage forensic experts to help with investigations involving ephemeral messaging apps. Forensic experts can use specialized tools and techniques to preserve and potentially recover deleted data and analyze data from different devices and sources.
Conclusion
Ephemeral messaging apps have become popular, but they pose challenges for eDiscovery and forensics investigations. The temporary nature of messages and the use of end-to-end encryption can make it difficult to preserve and collect. However, by implementing clear policies, monitoring employee use, and engaging forensic experts, organizations can overcome these challenges and ensure that they have the evidence they need to resolve legal disputes.
