Smartphones may hold hidden secrets for investigators

Take a quick look around your train carriage and one thing will quickly become clear: smartphones are everywhere. A growing army of people are using these devices to send and receive email, make phone calls, check the weather, book tickets and plan career moves.

Problems are beginning to arise, however, as these devices drift further into the gray area between work and play. It’s not uncommon these days for people to have a mish-mash of personal and work-related information and emails on their phones, but that can spell bad news for employers.

The connectivity that’s now possible via smartphones makes data sharing very easy and – in some cases – maybe too easy. Consider how simple it would be to use a smartphone to steal intellectual property within an office environment. Once a file is on a smartphone, it’s only a few taps away from being in someone’s email inbox, transferred over Skype, posted on Facebook and/or made available to millions as a simple one-click download.

Unless evidence is taken from the phone itself, this illegal activity may never be identified, as it would be almost impossible to know exactly which files, if any, were transferred to the phone. In fact, if the files were transferred to the phone via Bluetooth, the smartphone in question may have never even left the user’s pocket.

Protecting the firm

Sadly, security breaches can and do happen, and firms have a responsibility to protect themselves. Investigators can often get the evidence they need in the event of litigation or other investigation, since the phone itself can often reveal vital clues related to the theft of data, as well as the subsequent distribution.

However, the key challenge is to ensure the firm has a legal right to examine personal smartphones for evidence, should the need arise. Under current legislation, a personal device cannot be searched without obtaining explicit permission from the owner and/or via a court order.

To obtain a court order for this purpose, you’d need to persuade a judge that there is a real threat to the firm because of the potential for fraud, theft of IP, misappropriation of assets or similar concerns.

To make life easier in this situation, firms should really think about getting all staff and partners to sign a contract saying that their personal smartphones can be examined in the event of a dispute or investigation.

Of course, some people will be using their work devices to access personal information, but that scenario is more straightforward, as firms are normally entitled to examine company-issued smartphones in the name of protecting their business interests.

Smoking guns

Although firms have been monitoring, tracking and controlling the way that their employees use the internet at work for years, the widespread adoption of mobile devices means that the world is (once again) changing, especially as the rise of cloud computing is currently enabling a whole new generation to access business information while on the move.

However, a mobile phone is basically a database, and so in some ways it’s even easier to take information from a phone than a PC. Many smartphone users would be surprised to know just how much information is stored on their phones – even after they’ve deleted it.

Everything a person does on a mobile device can potentially be recovered – Facebook messages, wall posts, browser history, sent items, instant messaging and so on. You can also recover email contacts, calendar items, deleted messages and logs of file transfers.

As such, firms need to ensure they have both the legal and technical capabilities to examine smartphones if and when they are forced to take action. If the worst happens and a dispute arises, it may just provide investigators with the smoking gun they need.

pbeckett@navigant.com