That raises a deceptively simple question: When the bot clicks “Buy,” who agreed to the contract?

The short answer is usually the person or company that deployed, authorized, or controlled the bot—not the bot itself. But the short answer rarely ends the argument. The longer answer, which is the one that could generate billable hours, is whether the bot acted within the authority it was given.

The federal E-SIGN Act provides that a contract involving interstate or foreign commerce cannot be denied legal effect, validity, or enforceability solely because its formation involved one or more electronic agents, so long as the agent’s action is legally attributable to the person to be bound. E-SIGN removes the electronic-agent objection; it does not itself establish agency, assent, scope of authority, or compliance with other applicable law. 15 U.S.C. § 7001(h).  State law may matter as well, including state enactments of the Uniform Electronic Transactions Act (UETA), whose § 14 addresses automated transactions.

So the fact that no human physically clicked the button does not automatically make the transaction disappear. We crossed that bridge years ago with automated ordering systems. Today’s bots are just crossing it with your credit card in their (virtual) hands.

The harder issue is authorization.

Suppose a client tells an agent, “Find me a laptop under $1,500 with at least 32 gigabytes of memory,” and the agent buys one for $1,425. That looks comfortably authorized. Now suppose it buys a $2,300 laptop because it decides the improved processor is “worth the investment.” Helpful initiative, perhaps. Also a decent opening paragraph for a complaint.

Agency principles will matter. What authority did the user actually grant? What limits appeared in the prompt, account settings, purchasing policy, or platform terms? Did the user authorize the transaction itself? Did the merchant’s terms allow this type of automated or third-party access? Did the agent have authority to manifest assent to the merchant’s terms on the user’s behalf? And did the merchant have reason to know that the agent was operating outside its instructions?

These disputes will be won or lost on the digital record, and much of that record is logs.

Attorneys should stop thinking of the receipt as the complete record. It’s not a piece of paper in your pocket. The relevant evidence may include the user’s original prompt and follow-up instructions; spending limits and product filters; whatever agent action history exists, tool-call logs, audit trails, and system events; model and software versions; authentication records; cart changes; confirmation screens; and the merchant’s server logs.

Collect it early. AI systems and their vendors do not necessarily retain every step indefinitely. A clean-looking final confirmation can conceal ten earlier decisions, three rejected products, a changed budget, and one hallucinated free-shipping offer. Hallucinated by the bot, that is.

Then there is the chargeback problem. Consumers may assume that “the AI did it” means “unauthorized.” Card issuers and banks may see a more complicated record. A purchase made through credentials deliberately supplied to an agent is not automatically equivalent to a stolen-card transaction. Whether a customer has a chargeback right, an error-resolution claim, or some other remedy may depend on the payment method, the issuer’s and network’s rules, the authentication record, the instructions given to the agent, the merchant’s conduct, and whether the agent made an unauthorized purchase or merely made an authorized purchase badly.

In other words, buyer’s remorse does not become a stolen-card case just because software was involved.

Fraud and privacy add another layer. A shopping agent may see card details, purchase history, addresses, brand preferences, and perhaps the contents of an email account or calendar. A compromised agent could make an unauthorized purchase. A perfectly functioning agent could also be manipulated by a fraudulent listing, a poisoned recommendation, or a merchant designed to look legitimate to software rather than to a human.

For attorneys advising businesses, now is the time to ask practical questions. Are agent-made purchases permitted? Is human approval required above a stated amount? Are transaction logs preserved? Can the system explain which instruction caused it to choose a product? Can the agent accept arbitration clauses, subscriptions, or recurring charges? And who receives the alert when it gets creative?

Like agency law, consumer protection, and the rules of evidence, contract law isn’t going anywhere. It just has a new participant: one that works quickly, reads terms instantly, and has never once felt the healthy hesitation that comes from entering a credit-card number. Has it ever felt anything?

The bot may have clicked “Buy.” The case may turn on who told it that it could.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post Your Client’s Shopping Bot Clicked “Buy.” Who (or What) Made the Contract? appeared first on Burgess Forensics.

In honor of the week, here are a few things television has taught the public about digital forensics, along with what actually happens in the real world.

“Enhance.”
On TV, three keystrokes turn 40 pixels of smudge into a readable license plate. And then the computer instantly gives up the name, age, address, and next of kin for who it’s licensed to. In real life, you can’t recover detail the camera never captured. Enhance a smudge and you get a bigger smudge. (A very well-documented bigger smudge, but still.)The 30-second hack.
Hoodie, dark room, green text scrolling, “I’m in. The perp is on Hollywood & Vine and has a small thermonuclear warhead in his backpack. Get on it, STAT!” In real life, a forensic image of a phone can take hours, it has to be in the examiner’s hands, and reviewing what comes out of it can take days. The green text is optional.Deleted means gone.
The TV villain deletes a file and pours a drink. Not on the keyboard. Deleting a file is more like taking the name off a mailbox. The house is still standing until somebody new moves in, and there may be copies in the cloud, on a backup, or on the phone of the person who received it.

Results before the commercial break.
Real forensic work runs on chain of custody, hash values, validated tools, and documentation that would put a prime-time audience to sleep. That’s the point. It’s what holds up when the other side’s expert goes through it line by line. The documentation, not the TV script.

The expert always works for the good guys.
On TV, the real expert works for the good guys and the bad guy’s expert is always overconfident In real life, the evidence doesn’t know who hired you, and the examiner shouldn’t care. The data is the data, and it shows what it shows.My favorite TV forensic tech.
Numb3rs, Season 2, Episode 8, “In Plain Sight.” Amita Ramanujan opens the top casing plate of the hard drive (exposing the magnetic platters to open air – this is such a no-no!) and proceeds to wave a handheld magnetic sensor wand over the open spinning disks while Charlie watches the data flow onto the display screen. Oh, how I wish!Forensic science is slower and less photogenic than television. It’s also more interesting, because it’s real. Really.

#ForensicScienceWeek #DigitalForensics #eDiscovery #ExpertWitness

The post Happy Forensic Science Week! appeared first on Burgess Forensics.

I recently wrote about sanctions: the adverse-inference instruction, the spoliation finding, the judge with disapproval written all over his face telling the jury it may assume the worst about whatever got erased. That’s a high price to pay for hitting delete. It can cost real money, and sometimes much more. Sometimes it ends up costing the whole case. But the courtroom is not necessarily where the biggest bills come due.

Regulators send a different kind of invoice, and they can send a lot of them.

The three-billion-dollar housekeeping problem

Since December 2021, the SEC and the CFTC have been running a sweep, collecting what they politely call “off-channel communications.” Translation: business talk that happened on personal phones, in texts, in WhatsApp, in Signal, in whatever app someone reached for instead of the monitored work system. The firms were supposed to keep those records. They didn’t. So, the messages weren’t there when the regulators came looking. Toll calls, indeed.

The tab so far is north of $3 billion in combined penalties across more than 100 firms. It started small and almost quaint: JPMorgan, December 2021, a $125 million (okay, not so small to you and me) WhatsApp recordkeeping fine that looked at the time like a warning shot. It wasn’t a warning shot – it was just the opening bid.

And here’s the part attorneys may want to pay close attention to. The enforcement that hit the institutions is now working its way down to individuals. FINRA has picked up the baton and started suspending individual brokers for the same conduct. It’s been often said that all business is personal, but they didn’t mean penalties. Those corporate penalties are becoming personal. That text you fired off from your own phone doesn’t just belong to your employer’s compliance headache anymore.

One fine, for the deletion alone

Now a hop across the pond to Brussels for a clean illustration of the principle in Europe.

In June 2024 the European Commission fined International Flavors & Fragrances €15.9 million for obstructing an antitrust inspection. The underlying investigation into the fragrance industry is a separate matter and is still open as of IFF’s June 2026 filing. What earned the fine was this: during a 2023 dawn raid, while the Commission was reviewing employees’ mobile phones, a senior employee intentionally deleted WhatsApp messages exchanged with a competitor, after being told the inspection was underway.

Very bad timing. Not before. He deleted them after being told an inspection was happening.

It was the first time the Commission ever fined a company for deleting messages off a phone. And note the arithmetic, because it’s the whole thesis of this piece: the fine was set as a percentage of IFF’s total worldwide turnover, then cut in half because the company owned up and helped recover the data. The fine did not depend on proving that the messages established the suspected antitrust violation. The deletion itself was the offense.

“But the messages are gone. How do they even know?”

This is the question many ask, usually with real hope in their voice. It rests on the myth that a deleted message is a deleted event.

It isn’t. A message is not a single object sitting in one place. It’s an event that leaves marks in several places at once, most of them outside the sender’s reach.

Delete a text and the content may vanish from the handset (although it might also be recoverable from there), but the carrier may still maintain transaction records for an SMS or MMS, logging that a message moved from one number to another at a particular minute. That metadata won’t tell anyone what was said but it will tell an investigator that something was said, to whom, and when, and that is often more than enough. For encrypted apps that don’t use the carrier’s messaging service, evidence may exist elsewhere: in an enabled backup, in forensic remnants that may still be recoverable from the device, or on the other person’s phone.

That last one is the reversal worth dwelling on. In my usual line of work, “we have the logs” is what my side says when we’ve preserved the evidence, and the other side is squirming. In these cases it’s turned around. The logs that sink you are the ones the other side kept. Two firms message off-channel; one of them preserved its half of the conversation, and now the gap on the second firm’s system isn’t just a gap, it’s a documented absence with a matching record on the far end. The counterparty becomes the witness. In the fragrance case, the Commission caught the deletion during the raid and the deleted data was recovered through the backup system anyway. The employee erased his handset copy. He did not erase IFF’s backup.

Existence outlives content. That’s the line to remember. Should be the title of a book.

“Isn’t a fine just the cost of doing business?”

Some firms clearly treated the recordkeeping rules that way, right up until the number had ten figures in it. But there’s a subtler trap. When the deletion itself becomes the sanctionable act, the cooperation math changes. IFF’s fine got halved for coming clean and helping recover the data. The deletion still cost them eight figures. Without that cooperation, the Commission’s starting figure was twice as high. There’s no version of that ledger where hitting delete comes out ahead.

“My client isn’t a Wall Street bank or a fragrance conglomerate.”

Well, of course it’s not. But the logic doesn’t live in securities law or EU competition rules. It lives in one idea that runs through all of it: destroying evidence after you’re on notice is a separate wrong from whatever the evidence would have shown, and it carries its own separate price. Regulators call it obstruction. Judges call it spoliation. The custodian who cleaned up their phone the weekend after the litigation hold arrived is standing in the same spot as that senior employee in the fragrance case, minus the corporate turnover to cushion the landing.

So, what to do?

Nothing exotic. The unglamorous stuff, done early.

Preserve on notice. We know this goes without saying, but given that it’s still an issue, we’re saying it anyway. In U.S. civil litigation, the duty to preserve relevant evidence generally arises when litigation is reasonably foreseeable. If auto-delete settings can affect information in scope, suspend them.

Assume the other side kept their copy. Advise clients as though the counterparty preserved everything, because sometimes they did. A story that depends on a message never having existed is a story with a short shelf life. Hope and reality can be two very different things.

Preserve the phones before they’re “cleaned up.” Deleted-but-recoverable data may have a narrow window. It can disappear when the device is wiped, traded in, or overwritten through continued use or backup rotation. Phones also perform their own internal clean-up, so time matters. Preserve the device promptly, then have counsel and a qualified examiner determine the appropriate scope and acquisition method.

Don’t confuse encrypted with gone. Signal and similar apps can make content harder to recover, but encryption does not eliminate every potential source. Depending on the app and its settings, evidence may remain in an enabled backup, a screenshot, or a recipient’s device.

Deleting evidence can create consequences on several legal tracks. A court may impose remedies for spoliation, while a regulator may pursue recordkeeping violations or obstruction. Those categories can overlap, and the available penalties depend on the facts and the forum. What they share is that the deletion can become a problem of its own, apart from whatever the missing messages might have shown.

Ever had a “the messages are gone” case turn out to be nothing of the sort once you looked at the other side’s devices? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Sources: European Commission press release, IFF €15.9M (June 2024) · Holland & Knight, SEC/CFTC off-channel enforcement totals · Ex-Wells Fargo Broker Fined, Suspended for Off-Channel Texts to Colleague

The post Auto-Delete, Take Two: Regulatory Fines Can Dwarf Sanctions appeared first on Burgess Forensics.

Picture this: he knows he’s under investigation, but he’s anxious, he can’t sleep, and he wants to get ahead of the thing. So, he opens a chatbot at 1 AM and does what people do now: he talks, he types, he lays out his whole preferred theory of defense. He talks to his AI adviser about arguments that worry him and the facts he’d rather nobody saw. Thirty-one documents worth of them, as it turns out.

And then the FBI executes a search warrant, and those thirty-one documents come off his devices. Oh, no.

He says they’re privileged. The court says they’re not. Oh, double no.

That’s the short version of United States v. Heppner, decided in the Southern District of New York in February 2026. Judge Jed Rakoff held that a securities-fraud defendant’s conversations with a public AI tool (Anthropic’s Claude, as it happens) were protected by neither attorney-client privilege nor the work-product doctrine, and were fair game for the government to keep and cherish. Even if it was privileged when Heppner told it to attorneys, he waived the privilege when he disclosed it to Claude.

I’m a computer geek, not a lawyer, so I’ll stay out of the deep end on privilege doctrine. That’s your department, counselor. But the data side of this is my lane, and there’s a moral to the story.

“Come on. It’s just a fancy word processor.”

That was the argument, more or less, and the court didn’t buy it. See, a word processor doesn’t answer back. When your client types into a public chatbot, he isn’t just taking notes; he’s having a conversation with a third party. And sharing it with a third party can waive the confidentiality on which privilege depends.

It’s easy to forget that it’s not only that a human somewhere might read it. If you read the privacy policy on many consumer AI tools you’ll likely find that the provider reserves the right to log what you type, use it to train the model, and to hand it over to regulators or law enforcement when asked. And don’t even start with what happens to the data if and when another company buys the AI company.

He thought he was talking to a machine that forgets. Nope. Depending on the service, he was talking to one that remembers, transcribes, and keeps all the receipts.

“But he showed it to his lawyer afterward. Doesn’t that make it privileged?”

Privilege isn’t a stamp you get to press onto a document after the fact. The court was clear that sharing a preexisting document with counsel later doesn’t reach back in time and wrap it in protection. The horse is already out of the barn and Elvis has left the room. Walking it past your attorney on the way out doesn’t reverse history and put them back.

Rakoff found work product didn’t save it either. Under the Second Circuit authority he applied, the documents weren’t prepared by or at the behest of counsel and didn’t reflect counsel’s strategy, but rather that he made these on his own initiative, before anyone told him to. No lawyer’s fingerprints on it and no protection.

“So AI is radioactive now. Great.”

Well, not quite. Judge third left a door open. He suggested that if counsel had directed the client to use the tool, the AI might function more like a lawyer’s agent, the way a translator, an e-discovery vendor, or a forensic examiner does when brought in under the attorney’s umbrella. Different setup, potentially different result.

So the line that matters isn’t “AI, yes or no.” It’s who’s driving, under what terms, with what confidentiality. A consumer chatbot your client opened alone, long before dawn, is one thing. An enterprise tool, deployed under counsel’s direction, with a contract that forbids training on your data and locks down disclosure, is a very different animal. Same technology. Different lock, different key.

What does a forensics guy care about any of this?

Well, because I’m the one who finds it.

When a device comes in for examination, at least a portion of chatbot histories could be just another artifact now, sitting right alongside texts, browser history, and deleted photos. They’re potentially recoverable, they’re timestamped, and they read like a diary. People unwittingly treat these tools as a confidant that won’t repeat what it heard. Whether the exam is for the defense or the prosecution, the evidence is the evidence. If it’s there, it’s there.

That cuts both ways, by the way. It isn’t only defendants who overshare with a chatbot. Witnesses do it. Executives do it. The person on the other side of your case may have a transcript on a laptop that’s every bit as revealing, and under Heppner, likely to be discoverable.

Human nature doesn’t change but tools do. People have always talked too much when they’re frightened or overconfident. What’s new is that the confidant now writes it all down and reserves the right to share it.

So, what to do?

A few practical points from the data side of the fence. The privilege calls stay with you.

Ask early. When you map a client’s devices and accounts, ask which AI tools they’ve used and what they typed into them. It belongs on the same checklist as their email, their texts, and their cloud backups.

Limit the AI. ChatGPT and Gemini have Temporary Chat, Claude and Perplexity have Incognito Chat. As of September, 2026 some of the limitations include:

• ChatGPT Temporary Chat: not in ordinary history or memory and not used for training; OpenAI says a copy may remain for up to 30 days.
• Claude Incognito: not saved to chat history or memory and not used for training, but Anthropic normally retains it for 30 days.
• Gemini Temporary Chat: not in recent chats/activity and not used for training or personalization, but Google retains it for up to 72 hours.
• Perplexity Incognito: memory and search history are disabled; current Perplexity documentation says incognito sessions can persist for 24 hours.

These limit what is saved to tool memory, reflection, model training bit are not any guarantee that there won’t be artifacts saved to the local device.

Assume it’s recoverable. “I deleted the chat” is not the same as “the chat is gone.” Treat a chatbot transcript like any other piece of ESI, because, by and large, that’s what it is.

Get people off the consumer tools. The cheapest fix is behavioral. A client who understands that typing his case into a public chatbot is like telling it to a stranger on a train tends not to do it in the first place.

Bring the tool inside the tent. If AI is going to be part of the work, the setup, including direction, terms, and confidentiality, is what may keep it protected. Structure it on purpose, not by accident.

I’ll leave the doctrine to the lawyers. But I’ll say this much. Heppner isn’t really a story about artificial intelligence. It’s the oldest story there is with a new gadget in it. Typing to a chatbot may be no more secure than telling your neighbor, “Don’t tell anyone, but…” Confidentiality has always been something you can give away without meaning to. The chatbot just made it easier than ever.

Have you started asking clients about their AI use when you map their devices? I’d be curious what you’re finding, and whether you’ve seen one of these transcripts turn up where nobody expected it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

The post Your Client Told a Chatbot His Defense Strategy. Is It Still Privileged? appeared first on Burgess Forensics.

The bartender says, “Why are you here?”

The Fourth Amendment replies, “You’re going to need probable cause to ask me that.”

In some of my earlier articles and videos, I referred to a “Fourth Amendment search” without stopping to explain what that phrase means. Before we travel any farther through space-time, let’s fix that.

What is a Fourth Amendment search?

The seriousness of losing your car keys notwithstanding, in constitutional law, “search” is a legal term, not simply a description of someone looking for something.

Generally speaking, government intruding upon a person’s reasonable expectation of privacy may be considered a Fourth Amendment search. So, if they’re looking for your car keys, that could be a search.

It may also occur when the government physically intrudes upon a constitutionally protected person, house, paper, or effect for the purpose of obtaining information. Those ideas come from cases such as Katz v. United States and United States v. Jones, summarized by the Library of Congress in its discussions of the reasonable-expectation-of-privacy test and current search-and-seizure doctrine.

In plain English: when the government examines somewhere or something in which you have legally recognized privacy or property interests, the Fourth Amendment may enter the conversation.

That does not automatically mean the search was unconstitutional.

The next question is whether it was reasonable. A valid warrant ordinarily requires probable cause and must particularly describe the place to be searched and the persons or things to be seized. There are also established exceptions to the warrant requirement, because constitutional law (like any self-respecting bureaucracy) apparently dislikes simple answers almost as much as time travel dislikes consistent movie plots.

It doesn’t mean police need a warrant for literally everything. The big question is whether you had a reasonable expectation of privacy in the place or thing being searched. Your bedroom: probably so. The trash you left at the curb: courts have generally said probably not so. Your phone: increasingly, yes, and increasingly protected, but the details vary by circumstance and are still evolving. In Riley v. California, the Supreme Court generally required a warrant before police search a phone seized during an arrest, subject to recognized exceptions. But I’m a forensic examiner, not a lawyer, so the details are for your counsel, not for me.

What is the Fourth Dimension?

Well, by and large, it’s considered to be Time – at least that’s what Einstein thought when he talked about spacetime, though it was his former math professor that coined the term. No, spacetime is not when you’re binge-watching old episodes of Friends. It’s the usual three dimensions plus time, all tied up with a bright blue-shifted bow.

Of course, we know how to move through the first three dimensions. But surely, you’ve seen the protestors chanting about being able to use that fourth one:

“What do we want?”

“Time Travel!”

“When do we want it?”

“It’s irrelevant!”

What does time have to do with it?

Quite a lot, actually. Time can determine when a search began, how long it lasted, whether consent was still in effect, and whether an emergency or the scope of a warrant justified what happened next.

I once worked on a case in which someone apparently wished time travel were real and tried to simulate it. He set his computer’s clock backward and then created a demand document that appeared to predate the action the demand might have prompted. The clock cooperated but the rest of the forensic evidence was less accommodating. As it turns out, changing the time displayed by a computer is easier than changing the history recorded around it.

Modern technology makes the relationship even more interesting. A single piece of location information may disclose very little. A long history of location information can reveal a detailed portrait of a person’s movements and associations. In Carpenter v. United States, the Supreme Court treated historical cell-site location records as a distinctive privacy concern.

One point in space (or space-time) is a dot: create enough dots across time and you might have an unwitting biography.

Is it “time to get rid of the stuff”?

No. Let’s stop the clock right there.

Learning that a search may occur is not a cue to delete, conceal, destroy, alter, or toss anything into a conveniently available volcano. Doing so with the intent to interfere with an investigation can create serious, separate legal problems. Federal law, for example, expressly addresses the destruction, alteration, or concealment of records intended to obstruct certain federal matters. See 18 U.S.C. § 1519.

The better uses of time are less cinematic: pause before reacting, preserve potentially relevant information, pay attention to what is being requested and what is actually authorized.

It’s a very good idea to avoid physically interfering with officials.

And, when the situation is real rather than hypothetical, consider contacting a qualified lawyer.

Calling a lawyer is not an admission of wrongdoing. It is like calling the right mechanic when the warning light comes on in your time machine (well after the warranty expired). You may hope the problem is nothing but spinning the dial back and forth between dinosaurs and intergalactic civilization, but that is not a diagnostic procedure.

What if we could go back in time?

A constitutional time traveler would need more than one stop.

First, Philadelphia in 1787, where the Constitution was drafted. Then, the First Congress in 1789, where James Madison introduced proposed amendments. Finally, 1791, when ten amendments were ratified as the Bill of Rights.

The National Archives’ history of the Bill of Rights explains that the demand for explicit protections grew out of public concern about the new federal government’s power. The Fourth Amendment’s language reflects a desire to protect people against unreasonable searches and seizures and to prevent warrants from becoming open-ended permission slips.

If we could visit the debate, we might warn the participants:

Someday, people will carry their papers, correspondence, location history, financial information, calendars, and several thousand pictures of their pets and dinners – and their pets’ dinners – inside a handheld glowing rectangle.

After a long silence, someone would probably ask, “How did they fit people inside that little box?” Someone else would ask, “What is a selfie?” Benjamin Franklin would somehow already have an account and would be publishing the source code in Poor Richard’s Almanack.

The Fourth Amendment is not only for people accused of crimes

Privacy is not evidence of guilt. People close curtains without committing felonies. They use passwords without planning conspiracies. They close bathroom doors for reasons the Framers wisely left out of the constitutional text.

The Fourth Amendment matters because ordinary people generate extraordinary amounts of personal information. It establishes boundaries between individual life and government power. Those boundaries matter whether a person is guilty, innocent, mistakenly identified, merely nearby, or simply living a life that does not need to become public property.

Still, the Fourth Amendment is not a magical force field, and unlike time travel, it does not answer every question in advance. Courts still have to apply ideas such as reasonableness, probable cause, and particularity to the facts in front of them.

The lesson from the fourth dimension

We cannot return to yesterday and make a different decision. Yet. Similarly, we still can’t fast-forward through a difficult encounter. And importantly, we cannot travel to 1791 and ask Madison whether “papers and effects” includes cloud backups.

For now, understanding what a Fourth Amendment search means is useful enough. Technology records over time, and constitutional rights are easier to use when we understand them before anurgent occasion arises.

The Constitution, although written with a quill, still has something to say about the cloud.

So … if you had a working time machine and one stop, would you watch the Constitution get drafted, warn yourself about that time you made a really bad decision, or make a suspiciously well-timed investment? I’d like to know.

This article is for general educational discussion and is not legal advice. Fourth Amendment questions are highly fact-specific, and applicable rules may vary by jurisdiction.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

#FourthAmendment #ConstitutionalLaw #Privacy #DigitalPrivacy #CivilLiberties #LegalHumor

The post The Fourth Amendment Meets the Fourth Dimension appeared first on Burgess Forensics.

That made possible one of the more controversial investigative tools of the smartphone era: the geofence warrant, sometimes called a reverse-location warrant. Instead of starting with a suspect and asking where that person’s phone had been, police could start with a place and a time and ask Google which devices had been there.

It was the sort of technology made for a crime show and sure enough, it’s likely been in countless episodes of this and that cop show, with thousands of mentions in the news headlines. Draw a circle around the crime scene, pick a time window, find the phones inside it and start looking for your suspect.

There was just one problem. By the time the Supreme Court finally ruled on the practice this summer, Google had already pulled the plug on the system that made the classic Google geofence warrant work.

First, what exactly is geofencing?

The terminology gets muddled, especially outside the technical world.

Geofencing is a technology; a geofence warrant is a legal process that uses location records in a very particular way.

Geofencing itself is not dead, illegal or particularly exotic. A geofence is simply a virtual geographic boundary. Apps can use one to do something when a device enters or leaves an area. Retailers can use it to serve ads, which is just what we need – more ads, no? Your shopping app can notice that you’re near a store. A fleet-management system can report when a truck reaches a destination. Your smart-home system might turn on the lights for you when you get home.

A geofence warrant turns the idea around.

Instead of asking whether one known device crossed a boundary, investigators historically could give Google a geographic area and a time period and compel it to search its Location History database for devices whose records put them inside the “fence.” Initially, Google returned anonymized device information. Investigators could then narrow the candidates and, through additional steps, obtain identifying information. For some time, the technique was anything but obscure: Google received 982 geofence warrants in 2018 and more than 11,000 in 2020.

An ordinary warrant says, in effect, “Tell me where this person was.”

A geofence warrant says, “Tell me who was here.”

That difference became a rather large constitutional question.

Then Google changed the map.

In December 2023, Google announced a major redesign of Location History, now presented to users as Google Maps Timeline. Instead of keeping Timeline centrally on Google’s servers, Google said the information would be stored on the user’s device.

Google’s public explanation emphasized privacy and customer control. The company said putting Timeline on the device would give users “even more control” over this personal information. Location History was already opt-in and off by default.

There was another consequence, and it was a big one.

Once Google no longer possessed a giant centralized repository of users’ Location History, police could no longer hand Google a circle and a time period and have it search that repository for everybody inside.

Reporting at the time suggested that was not an accidental side effect. Forbes reported that a Google employee said that, along with the privacy benefits, the change was intended specifically to bring an end to these broad location searches. Google’s public announcement itself did not say that, so I wouldn’t put words in Google’s mouth. But the practical result is beyond dispute.

The migration took time. By July 2025, according to Google and the Supreme Court, Location History was being stored on individual devices rather than Google’s servers. Google told the Court that it was therefore no longer capable of responding to geofence warrants seeking that Location History data.

In other words, Google leapfrogged SCOTUS and redesigned where location evidence was stored.

Then SCOTUS arrived. On June 29, 2026, the Supreme Court decided Chatrie v. United States.

The case arose from a 2019 Virginia credit union robbery. Investigators did not initially know who the robber was. They obtained a geofence warrant directing Google to search Location History information for devices in the area with a 150-meter radius around the building during the relevant period. That process eventually helped identify Okello Chatrie.

The Supreme Court held that police conducted a Fourth Amendment search when they acquired Chatrie’s location information from Google, because a person has a reasonable expectation of privacy in his cellphone location information.

That’s significant., but it is narrower than saying, “The Supreme Court outlawed geofence warrants.” It didn’t.

The Court did not decide that every conceivable geofence warrant is unconstitutional, nor did it finally resolve whether the particular warrant in Chatrie satisfied all the requirements of the Fourth Amendment. Those questions remain more complicated.

And there is a touch of technological irony here. Justice Alito’s dissent actually called the Google procedure before the Court “now-obsolete.”

Rarely does technology have the courtesy to become obsolete while the Supreme Court is still writing the opinion.

So, are geofence warrants dead?

Google’s classic Location History geofence warrant largely is, but geofencing itself isn’t. Reverse-location searching isn’t necessarily, either.

Incidentally, Apple isn’t an alternative source for the same information. Apple says it has no data to provide in response to geofence requests. At least as far back as 2015, Apple was telling law enforcement that it did not track the geolocation of individual devices or retain GPS information for a specific device or user. An iPhone may know a great deal about where it has been. That doesn’t necessarily mean Apple does.

Other companies, however, may hold different kinds of location data that law enforcement can seek. Telecommunications carriers, app providers, ride-sharing companies and other services can possess records tied to where a device or account was at a particular time. Those systems are technically different from Google’s old Location History database, and they should not all be lumped together simply because somebody draws a circle on a map.

More important for lawyers, location evidence itself certainly hasn’t gone away.

Phones still contain or generate GPS information, Wi-Fi and Bluetooth data, application location records, photographs with location metadata, navigation history and other traces that may help answer the familiar question: Where was this phone?

But the source matters. So does the acquisition method.

A targeted search warrant for a known person’s records is not a Google geofence warrant. Location evidence extracted from a seized phone isn’t one either. Cell-site records aren’t Google Location History. A map with a dot on it may look wonderfully definitive on television, but the underlying technology determines what that dot actually means.

That is where the forensic work begins.

The map still isn’t the territory

Whatever Chatrie ultimately does to Fourth Amendment law, the forensic caution remains the same.

Location data can be remarkably powerful, and it can also be remarkably easy to oversell. A coordinate may carry an accuracy estimate. Different technologies derive location differently. A phone in a building is not necessarily a person in a particular room, and a dot on a map did not acquire certainty merely because PowerPoint made it red.

Ask where the location came from. Ask how it was collected. Get the underlying records and available accuracy information rather than relying solely on the tidy map someone prepared from them.

The old Google geofence may have gone away before the Supreme Court could finish arguing about it. The larger question has not:

When a phone tells us where it was, exactly what does it know, who else can get that information, and how certain should we be? Or, as The Bard might have imagined: To be there or not to be there: that is the geofence question. The forensic question is how well the data can answer it.

When has location data in one of your cases turned out to say less, or more, than everyone first assumed?

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe!

The post Geofence Warrants After Chatrie: SCOTUS Ruled on a Search Google Already Killed appeared first on Burgess Forensics.

If you practice long enough, you learn that the tools change but human nature doesn’t. Caveguy Ugg didn’t want anyone to know where he buried the mammoth haunch. Today the digging stick is a setting inside Signal, and the dirt is a “disappearing messages” timer. Same instinct, better encryption.

A million years post-Ugg, the same instinct turns up in the Delaware Court of Chancery. It’s a decision worth reading once, and worth repeating to a client twice.

Wait, isn’t the whole point of an encrypted app that the messages are gone?

Gone from the phone, maybe. Not gone from your obligations.

In In re World Wrestling Entertainment, Inc. Merger Litigation (Del. Ch., May 2026), Vice Chancellor Laster addressed exactly this. Senior people ran Signal with auto-delete turned on, after receiving litigation holds, several manually changed individual chats so messages would disappear in a little less than an hour. The court didn’t shrug. The court held that the first hold already reached Signal communications that overlapped with the potential deal. And even apart from the hold, it found that the duty to preserve sale-related evidence had arisen by August 31, 2022. That was months before the later sale-process hold. Sophisticated parties in that situation should reasonably have anticipated litigation.

The line worth taping to your monitor: litigation holds are not self-executing. Sending the memo, and even making sure they got it, is not the same as preserving the data. Somebody has to identify the relevant apps and devices, verify the settings, and actually disable the auto-deleted function.

So, what did it cost them?

The court didn’t reach for the biggest hammer. Rather than make a default judgment or give a blanket “assume the worst” instruction to a jury, it did something more surgical. It was arguably more dangerous for the sanctioned side: it presumed certain specific facts to be true and then shifted the burden, requiring the defense to overcome those presumptions by clear and convincing evidence rather than the usual preponderance. A bit of a switcheroo on the usual burden of proof ground floor.

Read that again if you litigate. The evidentiary floor moved. That’s not a slap on the wrist.

Now, I’m a forensic examiner, not a lawyer, and the doctrine here (when the duty attaches, what sanction fits) is your department, and it varies by jurisdiction. What I can tell you is the part that lives on my side of the table: how this actually plays out in the data.

Can’t your people just recover the deleted Signal messages?

Sometimes, but not always, and not the way Professor Google’s many advisors say. Here’s what’s real.

Disappearing-message apps are built to leave little behind, but “little” is not “nothing.” Copies and traces have a way of surviving in places people forget. A forensic acquisition or Signal backup made while the data still existed. The conversation on another participant’s or linked device where some data has survived. A screenshot somebody took. Notification artifacts preserved elsewhere. A message quoted in an email. Encryption is a strong lock on the message itself. It does nothing about the copies that already walked out the door and went for a jog.

But if the content is truly gone, the forensics may not bring back the words. This matters much for setting expectations with a client. What may be able to show is the activity on the device or app artifacts: that an app was installed, that auto-delete was switched on, that a timer was shortened at a telling moment. Note that we’re talking about what the device did, not who was holding it. Putting a specific person at the keyboard is a separate and much harder question. But in a spoliation fight, showing that a message was set to vanish, and when the setting changed, can matter as much as the words that vanished.

So, what to do?

If you represent the party with the duty, the practical steps are unglamorous and they work.

Identify the apps early. Ask, in plain language, what everyone messages on — not just email and texts. Signal, WhatsApp, Snapchat, Teams, the group chat nobody mentions.

Turn off disappearing settings the moment litigation is reasonably foreseeable, and confirm that preservation is actually occurring rather than trusting that the memo did the job.

Preserve any available backups, forensic images, and secondary devices before data rolls off or is overwritten. But don’t assume an ordinary phone backup contains Signal history—or that a Signal backup captured short-lived disappearing messages. It’s a good idea to collect that before today’s backup writes over yesterday’s.

Document your preservation, not just your hold. When someone later asks what you did, “we sent a notice” is a weaker answer than “we sent a notice and confirmed the settings on every device by this date.”

None of this requires a particular level of paranoia. It requires remembering that a message built to vanish can still leave a record of having been built to vanish.

Ever had a “disappearing” conversation turn out not to be the dead end everyone assumed? I’d like to hear how it surfaced.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post When “Auto-Delete” Becomes “Adverse Inference” appeared first on Burgess Forensics.

“He passed last month, and his whole life is locked inside his phone. Can’t you just get in?”

I hear some version of that rather often —more than you might think, in fact. The request comes from grieving families, from fighting families, and from the attorneys handling their estates.

From the grieving, it’s asked with a kind of hope. It’s as though the phone were a filing cabinet, and I kept the master key in a drawer. From the fighting, it’s asked with a harder edge, and even a kind of unfounded certainty, because by then everyone suspects the phone is holding something someone would rather it didn’t.

Sometimes I can help. Often the honest answer is: it depends on who planned, what’s stored where, and a couple of laws most people have never heard of.

A person’s digital life doesn’t end when they do. It just sits there —email, photos, messages, cloud backups, a crypto wallet, the online business, the loyalty points, the birthday wishes from casual friends who didn’t realize the intended recipient is gone —waiting for someone with the right authority (and sometimes the right password) to come along. The question your client is really asking is who that someone is, and whether the door will open when they get there.

“Isn’t the executor just entitled to all of it?”

Not automatically. This surprises people. Two things do most of the governing here, and they don’t always pull in the same direction.

The first is a federal privacy law, the Stored Communications Act, written in 1986, before almost any of your clients had an email address. In plain terms and except in narrow circumstances, it bars the companies that hold the actual words of emails, messages, and the rest of the electronic communications from handing over the contents. It really doesn’t care that Grandma died and the family is grieving. A provider can face liability for oversharing, so its reflex is “no.”

The second is a state law that most states have now adopted: RUFADAA —the Revised Uniform Fiduciary Access to Digital Assets Act (yes, it’s a mouthful; blame the committee that named it). Drafted by the Uniform Law Commission, it has been adopted in most U.S. states, though details and terminology may vary by jurisdiction. It gives executors, trustees, and agents under a power of attorney a legal path to a decedent’s digital assets while carving out those private communications for extra protection, to stay on the right side of that 1986 federal law.

Now the necessary disclaimer, and I mean it: I’m a forensic examiner, not a lawyer. RUFADAA’s details vary from state to state, so treat what follows as the lay of the land, not legal advice for your jurisdiction —that’s your department (or your attorney’s), not mine. But the structure is worth knowing cold, because it may decide who wins before a referee enters the picture.

The three-rung ladder (and it’s upside down from what people expect)

RUFADAA sets a priority order for who controls an account. Picture a ladder that the platform reads from the top down.

1. The online tool. If the person used a tool the platform itself provides, such as Facebook’s Legacy Contact, Google’s Inactive Account Manager, Apple’s Digital Legacy, then that choice sits on the top rung. It can even override a contradictory will. Let that land: a two-minute setting on a phone can outrank a document a lawyer carefully drafted.
2. The estate documents. No online tool? Then the directions in the will, trust, or power of attorney control who gets what, which is exactly why explicit “digital assets” language belongs in those documents now, not someday.
3. The fine print. Nothing from above? Then the platform’s terms of service decide. But note that those were written to protect the platform, not your client’s heirs.

Most people are sitting on rung three without knowing it.

So, what do the big platforms actually do?

• Apple’s Digital Legacy can provide a designated Legacy Contact access to eligible Apple Account data, such as certain iCloud-stored photos, files, notes, messages, and device backups, after Apple approves a request supported by the access key and proof of death. It does not provide the decedent’s device passcode or decrypt a passcode-locked device, although Apple can remove Activation Lock. It’s one of the more generous setups, though. One caveat: if a paid iCloud+ account stops being paid, Apple does not guarantee indefinite preservation of data exceeding the free storage allowance and reserves the right to restrict access to or delete stored content.
• Google’s Inactive Account Manager is triggered by inactivity, not death. Set a window, say, three or eighteen months, and Google will either share the data you chose with the people you named, or delete the account. If nobody set it up, the family is left negotiating with support. Inactive Account Manager is an access plan, not a preservation plan: Google’s separate inactivity and storage-quota deletion policies still apply.
• Facebook memorializes an account once it learns of a death, and a Legacy Contact can tend that memorial page, but Facebook does not hand over private messages. Full stop.

The pattern: the cloud is a locked building, and every landlord has its own rules for who gets a key, and which rooms that key opens.

Note that companies change policies and the above are accurate as of the writing of this article.

“What if I need it for a case, not the estate?”

This is where the fighting families come in. Same walls, different reason for wanting in. When a decedent’s texts or emails matter to a wrongful-death claim, a probate contest, or a business dispute, a subpoena to the provider still runs headfirst into the Stored Communications Act on content. Still, a properly authorized fiduciary may have a stronger route to a catalogue of communications or other non-content records than to message content, though providers may require formal documentation and may impose statutory or policy-based conditions.

Which is why, in my line of work, the device usually beats the cloud. A phone, laptop, or backup that’s lawfully in the estate’s possession, when examined with proper authority, frequently holds the messages, photos, and app data the platform won’t volunteer, plus deleted material that never made it into any legacy tool.

The catch is always the same pair: authority and access. The right to look, and a way in. And that “way in” is the quiet crisis. Desktop and laptop computers, and their physical backup drives, often give the enterprising computer geek a number of ways in. We’re frequently called on to excavate these potentially rich sources: existing files, deleted ones, and former drafts of the very documents and evidence a case turns on.

Phones are another matter. Modern ones are encrypted by default, so without the passcode, a legacy contact, or a good backup, even the family’s own forensic examiner can end up staring at a very expensive brick. (“Encrypted” isn’t always the dead-end people assume —but it isn’t a guarantee either.)

So, what to do?

This is the easy part, and it’s worth handing to clients now rather than litigating later.

• Set the online tools. Apple Digital Legacy, Google Inactive Account Manager, Facebook Legacy Contact. It only takes about five minutes each, and they sit on the top rung of the ladder.
• Put digital assets in the estate plan. Explicit language in the will, trust, and power of attorney authorizing the fiduciary to access digital assets, including the content of communications, is exactly the consent RUFADAA and the SCA are looking for.
• Keep an inventory, not a password list in the will. A will can become a public record; a sealed, separately stored list of accounts and where the keys live does not. Crypto especially. Custodial exchanges may have separate estate-access procedures, subject to identity, probate, and compliance requirements. But self-custodied crypto is unforgiving: no seed phrase or proper login and no crypto coins for you. No exceptions.
• Don’t “clean up” the device. For anything that might become contested, powering through a phone or running a factory reset can destroy evidence. It’s also very likely to raise spoliation questions in a contested case. When in doubt, preserve first and examine later.

The uncomfortable part

Most of us have built a whole second life online without realizing and left no instructions for it. For your clients, a few minutes of planning turns what would have been a legal-and-forensic headache into a routine handoff.

What’s the messiest digital-estate tangle you’ve run into? A locked phone nobody had the code to, a memorialized account, a crypto wallet with no key in sight? I’d like to hear how it played out.

Burgess Forensics: (866) 345-3345  |  steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post What Happens to Your Digital Life When You Die (And Who Can Access It) appeared first on Burgess Forensics.

Here’s the thing worth understanding: encryption locks the front door. It rarely locks the windows, the copies, and the spare key under the mat.

Modern devices encrypt data at rest. When an iPhone or a current Android phone or a laptop running FileVault or BitLocker is powered off or locked, the data on it is scrambled and, without the key, is effectively unreadable. That part is real, and it’s strong – it’s real strong. But “the data on that specific device, while it is locked” is a much narrower thing than “the information you’re after,” and the gap between those two is where most access actually happens.

The passcode is the whole ballgame — and people are careless with it. Full-disk encryption is only as strong as the credential protecting it. People reuse passwords, write them on sticky notes, store them in a notes app, share them with a spouse or an assistant, or pick something guessable. When access to a device is lawfully available — through consent, a cooperating party, or a court order — the encryption stops being an obstacle the moment the passcode is in hand.

And by the way, the data usually lives in more than one place. This is the point often missed. A message exists on the sender’s phone and the recipient’s. When the message’ sender deleted it from their phone, it doesn’t do anything to the recipient’s copy of the message. Photos sync to iCloud or Google Photos. Documents sync to cloud storage. Phones back up to a computer or to the cloud, sometimes automatically, sometimes in a form far easier to access than the locked handset itself. The encrypted device in the evidence bag may be the hardest copy of the data to reach — and the least necessary, once you map where else that same information lives.

Cloud accounts are their own doorway. When the data has synced to a provider, the relevant credential may be an account password rather than a device passcode, and the legal path may be a subpoena or warrant to the provider rather than an attempt on the hardware. Different lock, different key, often a more productive one.

The law here is genuinely unsettled, and that’s your department, not mine. Whether a person can be compelled to disclose or enter a passcode touches the Fifth Amendment, and courts around the country have landed in different places on it — some applying a “foregone conclusion” rationale, others declining to. Compelled use of a fingerprint or face has its own tangled line of cases. I’m a forensic examiner, not a lawyer, and I won’t pretend the doctrine is settled when it plainly isn’t. But knowing that these avenues exist — and that they’re contested — is the difference between assuming a device is unreachable and asking the right questions about how it might lawfully be reached.

So what should you actually do? Stop treating “it’s encrypted” as the end of the road, as a verdict. Treat it as one locked door in a building with several entrances. Ask where else the data lives — the other party’s device, the cloud, a backup, a synced computer. Preserve all of it early, before someone decides to tidy up. And bring in a forensic examiner before you conclude anything is impossible, because what’s feasible depends heavily on the specific device, the operating system version, and how the data was stored — details that change constantly and that a competent examiner tracks for a living.

Encryption is a strong lock. It is not a force field. The attorneys who understand the difference get to the evidence; the ones who don’t talk themselves out of it.

Have you ever had a case when a locked or encrypted device in your case was or was not actually a dead end? I’d love to hear about it.

Don’t miss a single issue of our informative newsletter … Subscribe now

The post Encrypted Doesn’t Mean Untouchable: What Attorneys Should Know About Device Access appeared first on Burgess Forensics.

That paperwork is metadata — data about data. And it travels with your files whether or not you invited it along for the trip.

Metadata is the stuff a document quietly jots down while you’re jotting down words. There’s a lot of potential information there: Who created it, when, and on what computer. Who edited it, and when they last saved it. Where a photo was taken, down to the GPS coordinates. What camera, what settings, what software. None of it shows up on the page. All of it comes along, like a stowaway.

Most of the time this is harmless, but occasionally, it’s the whole story.

A photo is a very talkative little file.

Take a picture with your phone and you’ve created a small autobiography. The image, surely, but tucked inside is a section called EXIF data: the make and model of the phone, the date and time down to the second, and, if location services were on, the exact spot on Earth where you stood. Share that photo in its original form and you may be handing over your home address without meaning to.

The good news: most social platforms started stripping this out a few years ago when there was a public hue and cry about it. The bad news: “most” is not “all,” and emailing the original file, or dropping it in a shared folder, sends the whole talkative package along.

Documents keep a diary too

A Word document remembers more than the final draft. Depending on your settings, it can carry the author’s name, the company the software was registered to, how long the file was open, and sometimes, a list of former edits and tracked changes and comments you thought you’d removed. Every “on second thought, delete that paragraph” can live on in the file’s memory.

The Internet is dotted with cautionary tales of press releases and legal filings that were sent out with the edits still readable underneath. The same is true with newsworthy congressional hearings. Most of us are not popular enough to warrant interest from the government. Still, the words on the page said one thing but the metadata said “here’s what we almost admitted.” Oopsie.

So, what to do?

There’s no need to get paranoid about this. Depending on what you’re shopping for, your grocery list is not a national secret. But a few practical habits go a long way:

• Before sending anything sensitive, look under the hood. In Word on Windows, “Inspect Document” should find and remove hidden data, comments, and tracked changes. Do it on the final version, not the draft.
• Turn off location tagging for your camera if you don’t need it — or scrub EXIF data from photos before sharing the originals. By the way, if litigation is foreseen that involves these photos, don’t scrub the EXIF metadata. It will be considered spoliation of data and will go poorly for you if and when it goes to court.
• Remember that “delete” inside a file often just means “hide.” Removing a comment from view is not always the same as removing it from the file.

None of this requires becoming a hermit. It’s the digital equivalent of checking your pockets before you send the coat to the cleaners.

Metadata isn’t sinister. It’s just honest — sometimes more honest than we’d like. The trick is knowing it’s there, so you decide what to share instead of the file deciding for you.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1984.

Don’t miss a single issue of our informative newsletter … Subscribe now!

The post The Metadata You Didn’t Know You Were Sending appeared first on Burgess Forensics.