It usually does. By the time someone walks into your office with that story, the money has moved, often more than once. The ad may already be gone, as may the website it linked to.

But gone from view isn’t necessarily gone. Nobody can buy advertising without filling out (mostly digital) paperwork. The scammer did some homework on your client. Now it’s our turn to do some homework on the scam.

Why should I care? Isn’t this a consumer-protection problem?

It’s a consumer-protection problem that turns into litigation. The FTC reports about $3.5 billion lost to imposter scams in 2025, out of $15.9 billion in reported fraud losses. Social media is a leading way these scams first reach people. These scams are a form of social engineering, otherwise known as “human hacking.”

In September 2026, the FTC announced it was considering whether to extend its Impersonation Rule or take other action addressing platforms’ ad-targeting and optimization practices. It’s an early inquiry, and there’s no proposed rule text yet. Where that lands legally is for the lawyers, not computer geeks like me.

For me, the question is simpler: What survived, and where is it?

So what does the evidence trail look like?

Human nature persists and there has always someone interesting in profiting from the unwary. The tools are just different these days. The con artist used to need a storefront and a good suit. Or at least a convincing classified ad in a newspaper. Now an online ad account and a cloned website can reach thousands of potential victims.

Targeting records. Advertisers can select audiences by location, age, interests, and other characteristics. Platforms also use automated systems to decide who sees an ad. Those records can show why a particular retiree received a fake investment offer. Public ad libraries provide limited information; the platform may hold considerably more.

Payment records. Ads cost money, and that money came from somewhere. It might be a stolen credit card or a compromised business account. The name on the payment method could belong to another victim rather than the scammer.

Platform accounts. When was the account created? Who were the administrators? Login histories, IP addresses, and linked accounts may help establish who controlled an advertising campaign. A business page created last Tuesday and renamed twice tells a different story from a ten-year-old account, although neither proves who’s behind the keyboard.

Cloned websites. Fake banking and investment sites tend to carry leftovers from the original: analytics identifiers, file paths, copied images. Domain registration, hosting records, certificate transparency logs (crt.sh is a good place to start), and the Wayback Machine can pin down when a site appeared and how it was connected to others.

A cloned website is a forgery, and forgeries sometimes leave fingerprints in the margins.

Cryptocurrency transfers. Some scams finish with instructions to move funds into a supposedly safe wallet. It is amazing how many people follow these instructions, and it’s easy to judge when it’s not you. But in the heat of the moment, a particularly convincing set of interactions can get you to push the button and make the transaction. Like the candy at the checkout counter, it’s an impulse buy, and the scam is designed to keep you in the checkout line.

On transparent blockchains, investigators can follow transactions through multiple addresses. And by the way, “untraceable” crypto can turn out to be traceable. It’s just tedious. Records from exchanges may help identify account holders. But following the money and identifying who controls it are two different jobs.

Isn’t all that locked up inside the platform?

Some of it, yes. Some may be sitting on your client’s phone.

Browser history or the link they clicked, tracking codes and all. Screenshots, texts, emails, the wallet app. Roll them all together, and they might just establish what your client encountered and what happened next. They also point to which records to request elsewhere.

And they’re vulnerable. A frustrated or frightened client deletes the messages, clears the browser, or replaces the phone, and just like that, your starting point has disappeared.

Getting records from platforms can be complicated, particularly in civil litigation. The Stored Communications Act restricts certain disclosures, and content and non-content records raise different legal questions.

My job is to find what exists, tell you, and get it preserved before it doesn’t.

What about the defense side?

The trail cuts both ways.

Suppose your client’s name, credit card, or business page appears in the advertising records. Does that establish participation in the fraud? Hardly. Stolen identities and compromised accounts are all too common.

Login histories, payment records, and device evidence can separate the account’s owner from whoever was at the controls during the scam.

The evidence is the evidence, whichever side is asking.

So, what should happen first?

• Preserve the client’s devices and relevant accounts. Arrange an appropriate forensic acquisition before anyone cleans things up.
• Capture the advertisement and website immediately, including URLs, ad-library records if they’re available, and dated page captures.
• Send preservation requests early. Platforms, hosting providers, registrars, and exchanges all have retention windows, and they aren’t waiting for you.
• Trace cryptocurrency while the trail is warm. The longer funds sit, the more hops they take.
• Verify who controlled an account before settling on whose name is on it.

Scam ads are built to find people fast. The evidence they leave behind fades more slowly than most people assume, as long as someone goes looking before the retention clocks run out.

Have you had an impersonation-fraud matter where the platform or payment records changed the direction of the case? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

The post The Scam Ad Found Your Client Before Your Client Found a Lawyer appeared first on Burgess Forensics.

Not so fast.

It’s a natural first question after a firm gets hit. A thief taking privileged documents doesn’t automatically take the privilege with them.

Let’s take it apart. And a reminder: I’m a forensic examiner, not a lawyer. The final call on privilege is your attorney’s department, not mine.

Did the breach just waive my client’s privilege?

Generally, no. At least not by itself. Only previously privileged material gets that protection.

In Resolution Trust Corp. v. Dean, 813 F. Supp. 1426 (D. Ariz. 1993), an unauthorized leak of an internal legal memorandum did not waive attorney-client privilege. In Dukes v. Wal-Mart Stores, Inc., 2013 WL 1282892 (N.D. Cal. Mar. 26, 2013), unauthorized disclosures of an outside-counsel memo didn’t waive it either. These leak cases distinguish involuntary from voluntary disclosure.

Here’s the catch. Confidentiality precautions mattered. In Dukes, Wal-Mart’s own public comments waived privilege over disclosed content, although the court declined to extend that waiver to the entire memo.

Think of privilege as a fence around a field. A thief cutting through doesn’t make the field public land. Still, protect the fence: restrict access, assert privilege promptly, and object when someone tries to use the documents.

Jurisdiction and facts matter. Federal Rule of Evidence 502(b) addresses inadvertent disclosures in a federal proceeding or to a federal office or agency. Protection requires reasonable precautions and prompt, reasonable corrective steps. It isn’t a blanket safe harbor for stolen files.

Does privileged mean nobody can look at it?

Privilege is not a magic eraser for documents already on a leak site.

In Glencore International AG v. Commissioner of Taxation, [2019] HCA 26, Australia’s High Court held that privilege alone supplied no cause of action to recover stolen documents or restrain their use by tax authorities. That’s Australian law, not a U.S. rule. Winning the privilege argument and getting the genie back in the bottle are different fights.

What does the breached firm have to do?

ABA Formal Opinion 483 (2018) calls for reasonable efforts to detect breaches, stop them, mitigate harm, investigate, and restore services. Reasonable efforts, not perfection: a breach alone doesn’t establish an ethics violation.

The opinion requires notifying current clients when a breach involves, or has a substantial likelihood of involving, material client information. Significant disruption of representation can also require notice. It doesn’t impose the same Model Rules notice duty for former clients, but statutes and local rules may.

State notification laws and contractual deadlines need separate attention. Proof of stolen files isn’t always necessary before notice duties arise. Someone should watch the clock from day one.

Okay, what actually happened?

Now we’re in my neighborhood.

What left the building? Also ask what was accessed, altered, destroyed, or made unavailable. The evidence lives in fragile places: firewall logs, cloud audit logs, endpoint records, and the memory of running machines.

Wait too long, and the best evidence might just delete itself.

Contain the attack promptly. Preserve relevant logs, volatile data, and forensic images where feasible before wiping and rebuilding. Coordinate preservation with containment; don’t leave an attacker connected just to finish collecting evidence. (Did I have to say that?) Suspend relevant automatic deletion and document chain of custody. When litigation is reasonably anticipated, involve counsel in a preservation hold.

Will our forensic report be privileged?

Maybe. Don’t count on it.

In In re Capital One Consumer Data Security Breach Litigation, 2020 WL 2731238 (E.D. Va. May 26, 2020), affirmed June 25, the forensic report lacked work-product protection because Capital One hadn’t shown it would not have been prepared in substantially similar form without anticipated litigation. Work product and attorney-client privilege are distinct protections.

In Wengui v. Clark Hill PLC (D.D.C. 2021), a law firm’s forensic report failed both tests. Routing the engagement through counsel wasn’t enough.

Have counsel structure the investigation around actual legal needs, distinguish that work from ordinary remediation, and limit distribution appropriately. Courts look at substance over letterhead.

Human nature doesn’t change, but the tools do. (If you read many of my other articles, I may be sounding like a broken record here. Or maybe a mantra) People have been stealing secrets for as long as there have been secrets. Today the burglar just doesn’t need to jiggle the lock on your file room.

Have a response plan that names names. Protecting privilege takes action, not just a label on the file.

Has your firm, or a client, been through one of these? Did the privilege hold up, and what do you wish you’d preserved sooner? I’d love to hear about it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

The post Your Law Firm Was Breached. Is the Stolen Material Still Privileged? appeared first on Burgess Forensics.

Real life is less cinematic. The digital forensics expert often never reaches the witness stand at all. Instead, his report does the talking. It lands on the prosecutor’s desk, shapes the plea discussion, and sometimes ends the case – one way or the other –  before a jury is ever seated. The evidence doesn’t know who hired him, and digital “smoking guns” have a way of melting once someone looks under the hood.

When a client is facing cyberstalking or digital harassment charges, the prosecution’s case often arrives neatly packaged as a PDF of text message screenshots, a carrier call log, a few scans of filled-n forms, or a printed report from a mobile extraction tool.

To an aggressive defense attorney, that report shouldn’t look open and shut, no matter how it’s written. It should look like an invitation to start asking hard questions.

1. The “Shared Device and IP” Fallacy

A text message, an IP address, or a home Wi-Fi network is not a person. A common pitfall in digital harassment cases is assuming that because a message originated from an IP address or a device tied to a defendant, that specific defendant was behind the keyboard.  

• Shared Households and Open Networks: Family members, roommates, or visiting guests or half a dozen teenagers at a gaming party in the basement, may all be on the same Wi-Fi, and to the outside world, they share a single IP address.
• Compromised Accounts & Spoofed Headers: Malware, session hijacking, or spoofed identifiers can make it look like a device sent data it never touched. Without rigorous forensic attribution, such as physical proximity logs, biometric sign-ins, or physical keystroke analysis, an IP address is just a location, not a confession.

2. Context, Venting, and the Intent Gap

Prosecutors love to highlight the most inflammatory text messages out of context. But a raw chat log strips away the rhythm of a conversation.

• Was the message an isolated outburst during a bitter custody dispute, or part of an obsessive, calculated campaign?
• Is it clumsy, offensive venting, or does it meet the strict statutory threshold for a targeted, credible threat? Defense forensic work often involves reconstructing the entire communication history, including deleted messages, previous threads, and mutual exchanges. They want to show the true context of the interaction and challenge the alleged “course of conduct.”

3. The Report Nobody Can Read

Extraction reports from tools like Cellebrite and Magnet AXIOM can come in a couple of flavors, and both can be a problem.

Some are enormous. Thousands of pages of call logs, app databases, Wi-Fi connections, cached images, and system entries with names only an examiner could love. The few items that matter are in there somewhere, buried under everything else the phone ever recorded. Many attorneys open one, turn a few pages, and quietly close it again. That’s understandable. Too many clients,  too many pages, and a family they want to get home to sometime today. It’s also how important context gets missed.

Others are thin. A few dozen pages, cherry-picked down to the messages and records that support the charges. But a selection is not the whole phone, and what was left out may matter as much as what was kept.

Either way, ask for the full extraction in its native reviewable format, not just the PDF. Cellebrite’s Reader and AXIOM’s Portable Case let a defense examiner search, filter, and verify everything the tool captured, including what never made the printout.

4. Challenging the Extraction and the Chain of Custody

Digital evidence is fragile. If law enforcement used an unvalidated tool, failed to maintain proper hashing during acquisition, or searched a seized device outside the explicit scope of a search warrant, the digital trail loses its integrity. Furthermore, third-party cloud data or ephemeral messaging apps (like WhatsApp, Signal, or Snapchat) can leave conflicting timestamps across devices due to sync delays, server backups, and local timezone mismatches.

And a timestamp doesn’t always mean what it seems to. A file’s “created” date usually records when that copy landed on the device, not when the photo was taken or the document was written. A picture shot in 2019 and texted to someone last week may show a creation date of last week on the recipient’s phone. It’s less like a postmark and more like the “received” stamp on a letter. Which date the report shows, and what that date actually measures, can change the whole timeline.

What This Means for Defense Counsel

If you are defending a cyberstalking or digital harassment case, never take a prosecutor’s printout of digital communications at face value. I wouldn’t jump straight to assuming something was hidden on purpose, either. Often it simply wasn’t asked for. Cut them a break: prosecutors carry heavy caseloads too, and nobody thinks of everything. There may be something they didn’t think to ask for that you can. And a clean PDF export can’t show you the metadata, the sync artifacts, or the gaps in the timeline.

The data is the data, and it often tells a very different story once you examine the underlying extraction files.

Have you ever had a digital evidence trail completely unravel under forensic review? I’d like to hear about your courtroom experiences with electronic evidence.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post The Printout Isn’t the Proof: Digital Evidence for Criminal Defense Counsel appeared first on Burgess Forensics.

Stalking itself is nothing new. Human nature doesn’t change, but the tools do, and today’s stalker can carry a location tracker the size of a cookie and an app store’s worth of spyware dressed up as “parental monitoring.” Fortunately, the laws and forensic tools are finally, bit by painstaking bit, catching up.

For decades, prosecutors have been stuck squeezing 21st-century digital abuse into 20th-century harassment statutes. (The usual caveat: I’m a forensic examiner, not a lawyer, and these statutes vary a good deal from state to state. Your department, not mine.)

1. Criminalizing the Hardware, Not Just the Threat

One of the biggest hurdles in older cyberstalking cases was proving a “credible threat” of physical injury. No explicit threat, often no case.

Newer statutes are shifting the focus from verbal threats to the unauthorized deployment of surveillance technology. Laws banning non-consensual GPS or electronic tracking (like slipping an AirTag into a coat pocket), installing stalkerware on someone’s device, or deploying automated mass-messaging tools give prosecutors objective, physical acts to charge. You don’t have to guess what a text message meant when you can show who registered the tracker or when the monitoring app landed on the phone. An AirTag, for example, carries a serial number that Apple associates with the Apple ID that paired it, and that link can be obtained through legal process.

The cookie, it turns out, has a return address.

For you forensic folks, it’s useful to keep in mind that an AirTag is a Bluetooth-based tracker, not a miniature GPS receiver. And that stalkerware may implicate unauthorized-access or interception laws, depending on its operation and the jurisdiction. But neither installed software nor a nearby tracker automatically identifies the perpetrator. Serial numbers, account associations, installation artifacts, and provider records may help establish that connection. A Bluetooth encounter is a lead, not a signed confession.

2. Lowering the Bar to “Substantial Emotional Distress”

Statutes are also broadening the definition of harm. The federal stalking statute, 18 U.S.C. § 2261A, already reaches conduct that causes, or would reasonably be expected to cause, “substantial emotional distress,” and a number of states have moved in the same direction. Recognizing that a cyberstalker’s primary weapon is psychological erosion, these laws give weight to emotional distress, economic ruin, and reputational destruction.

This opens the door to prosecution in cases involving:

• Orchestrated online mobbing campaigns (like coordinated doxxing or swatting).
• Non-consensual image sharing or weaponized reputation destruction across professional and social networks.
• Relentless digital isolation, where a person’s accounts are repeatedly compromised, locked, or spoofed to sever their personal and professional lines of communication.

3. The Forensic Evolution: Multi-Platform Correlation

On the investigative side, the digital trail can now run far beyond a single exported chat log. Proving, or disproving, a stalking campaign means stitching scattered artifacts into a coherent timeline:

• Device Sync Artifacts & Cloud Logs: Correlating timestamps across messaging apps and their cloud backups to tie messages to a specific device and, where location data survives, to a specific place.
• API and Service-Provider Metadata: Access logs, IP addresses, and account-recovery records. VPNs and burner apps hide a lot, but people get tired and one login from home Wi-Fi can undo months of hiding.
• Authentication and Access Timestamps: Showing not just what was sent, but when an account was accessed, from where, and with what client application.

Wait, doesn’t all this correlation just help one side?

No, and this is the part that never makes the TV episode, doggone it. The same correlation that builds a case can take one apart. Accounts get spoofed. A shared family tablet gets blamed for what someone else typed. A neighbor or just someone parked nearby can piggyback onto an unprotected wifi network. A careful timeline shows who was holding the device and who wasn’t, and that surely matters to the defense every bit as much as to the prosecution.

What This Means for Litigators

Whether you represent the state, the accused, or someone seeking a civil protective order, relying on a single smoking-gun screenshot is a losing game. The strongest positions are likely to be built on patterns: device logs, carrier records, and system metadata correlated into a narrative that holds up under grueling cross-examination.

It is useful to note that overworked law enforcement may not have the resources to follow up every citizen’s concern or complaint that they are victims of the kind of cyberharassment we’ve been discussing here. They’re likely to require some more substantive evidence beyond what that citizen thinks is happening. The same goes for finding counsel to handle their case.

While the tools and laws are sharper than they used to be, the question remains whether your intake process captures those volatile records, through prompt device imaging and preservation requests to the platforms, before automated retention schedules make them disappear. Some providers keep certain logs for weeks or months, not years. Gone, gone, gone.

Have you seen prosecutors or civil attorneys in your area use these newer tool-based or emotional-distress statutes yet? I’d like to hear how it’s playing out in your practice.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post Modernizing the Armory: The Legislative and Forensic Tools Fighting Cyberstalking appeared first on Burgess Forensics.

That gives rise to an interesting question for legal practitioners: why is digital harassment so frequently relegated to an “add-on” charge, and what happens when the digital trail is all you have?

Why Standalone Charges Fall Flat

To understand why prosecutors hesitate to bring pure digital stalking cases to trial, you have to look at the practical and evidentiary hurdles that hit the prosecution at intake.

The Attribution Trap: Proving who typed the message beyond a reasonable doubt is still one of the toughest burdens in digital forensics. VPNs, burner phone apps, compromised accounts, and spoofed IP headers leave enough digital shadow to create reasonable doubt if a prosecutor doesn’t have a physical predicate act, like a traffic stop, a seized phone, or a ring camera feed, to anchor the keyboard to a specific set of hands.

Ambiguity of Intent: Digital harassment lives in the grey zone between constitutionally protected speech and criminal threats. Historically, to sustain a charge without infringing on free speech, many statutes required proving a “credible threat” of death or serious bodily harm. To make that point a bit more clearly, “You’re gonna get it!” isn’t likely to be considered a credible threat, whereas “Imma stab you in the eye tomorrow.” would certainly be. Unrelenting, malicious digital harassment that falls just short of an explicit physical threat often left prosecutors without a clear statutory hook.

Plea Bargaining & Resource Constraints: Digital forensics takes time, chain-of-custody documentation, and validated tool outputs that don’t fit neatly into a fast-moving misdemeanor docket. When cases do get charged, standalone digital counts are frequently the first bargaining chips dropped or pled down to simple harassment or disorderly conduct.

Before we go blaming law enforcement for cherry-picking, consider that cyberstalking doesn’t leave the kind of evidence prosecutors are used to (at least, so far). An assault leaves a black eye, bruises, broken bones. A burglary leaves an empty space (possibly the only non-dusty spot) where a stolen item used to be, an embezzler’s work shows up in missing dollars.

The harm – and often the point – is fear, anxiety, and a life rearranged around avoiding someone, none of which photographs very well. The evidence is spread across phones, laptops, social media accounts, email providers, and carrier records, much of it held by third parties who release it only under subpoena or warrant, and some of it gone before anyone thinks to ask. 

The Ground Is Shifting Under the Statutes

While that historical pattern remains true today, the legal and technical landscape is actively evolving. State legislatures and federal prosecutors are adjusting to modern reality, expanding how the law defines course of conduct.

Lowering the “physical threat” bar can result in more prosecutions for different types of harm. Newer statutory models are shifting focus from requiring a fear of physical injury to demonstrating substantial emotional distress or economic harm. This allows prosecutors to pursue standalone charges in severe cases involving doxing, non-consensual image sharing, or orchestrated online mobbing campaigns.

Lawmakers have begun targeting the tools, not just the threats. Legislators are increasingly criminalizing the underlying technology itself. Banning unauthorized GPS/AirTag tracking, stalkerware deployment, and automated mass-messaging tools gives prosecutors discrete, objective physical actions to charge, turning the act of digital surveillance itself into a substantive crime.

Federal Stalking Statutes are being amended and adjusted. The Department of Justice is increasingly utilizing 18 U.S.C. § 2261A to bring standalone federal charges when interstate digital harassment is structured, persistent, and well-documented.

What This Means for Litigators

Whether you handle criminal defense, prosecution, or civil restraining orders (where standalone digital evidence has long been king), the takeaway is simple: the threshold for what constitutes an actionable digital course of conduct is expanding.

In practice, a case rarely hinges on a single smoking-gun text. It hinges on the pattern: login timestamps matching access logs, device sync artifacts, metadata from cross-platform messaging, and correlation between IP hops and known geographic locations.

The laws are changing to meet the reality of modern harassment. The question is whether the digital evidence you are looking at supports a standalone narrative or merely an afterthought.

Have you seen cyberstalking charges brought as a primary count in your jurisdiction, or is it still mostly an add-on to physical claims? I’d like to hear what you’re seeing in the courtroom.

Questions about digital attribution, device artifacts, or analyzing electronic communication patterns? Burgess Forensics examines system logs, mobile artifacts, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post When Cyberstalking Is Just an “Add-On” Charge (And Why That’s Changing) appeared first on Burgess Forensics.

It might have API access. For the uninitiated, an API is a way for software systems to communicate and request actions from one another.  Think of it as a pal you gave a key to so they could feed the cat while you’re away. They can come in and use the can opener. They are not supposed to go through the medicine cabinet. The logs may help you work out which metaphorical rooms they visited, if anyone enabled the logging.

That should give anyone who drafts litigation holds a moment’s pause.

Two recent pieces in the news caught my attention. Ralph Losey’s August EDRM article, “When AI Agents Go Rogue, the Logs Become Evidence,” looks at the trail an agent leaves as it works across systems: commands, messages, access records, and the technical context around them. K&L Gates’ May 20 Litigation Minute comes at it from the preservation side. GenAI prompts, outputs, uploaded documents, and usage logs may fall within preservation obligations, and they may not be retained by default. Some disappear on a schedule. Others never exist at all unless someone turned on logging before anyone needed it.

Put the two together and you land on an uncomfortable question: does your client’s litigation hold reach the systems that are doing the work?

Isn’t this just the chatbot-history problem again?

Not quite. We’ve previously discussed chatbots as diaries. Somebody types something candid into a chat window, and months later opposing counsel finds it very interesting. A neat way to manufacture an exhibit!

Agents are different because they act. Give one a task and permission, and it may search repositories, pull files, call tools, change records, send messages, or hand the job off to another agent. Depending on the setup, each of those steps can leave records in a different system.

The human’s chat history is one chapter. What the agent wrote is part two.

What does that look like in a real dispute?

Picture a hypothetical procurement agent told to cut spending with a supplier. It reviews the contracts, pulls purchasing data, updates the vendor record, and drafts a termination notice. A manager approves the notice. Six months later, the supplier sues.

You preserve the manager’s email and the final letter. Good start.

Now suppose the case turns on whether the company considered an amendment guaranteeing minimum purchases. Did the agent retrieve it? Did a tool call fail? Was the workflow working from an outdated version? Did the manager see a warning before clicking approve?

The polished letter may tell you very little about how any of that happened. You might think the polish reflects enough light on the subject, but there’s more in deeper, possibly darker, places.

The answers, if they exist, sit in retrieval records, tool responses, approval events, and application logs that nobody put on the collection plan. The manager may remember clicking “approve” and not much else. That isn’t evasion, it may just be delegation.

So is the software a custodian now?

As a working concept, yes, and a useful one. Calling the agent a custodian forces two questions: where is the machine’s work recorded, and who can preserve it? It does not give software legal personhood or put it in a deposition chair. (Although I would pay to watch someone instruct an agent to answer only the question asked.)

Some accountable human should own the workflow, control the settings, and manage the vendor relationship. That person belongs in the preservation conversation, and that conversation needs specifics. Name the tools and workflows that touched the matter. Identify the accounts involved, human and service. Find out what records exist, where they live, and when they expire. Then test that preservation works, because a beautifully drafted hold notice doesn’t necessarily touch automated deletion.

Can’t we just take the agent’s word for what it did?

Um, no, it’s an AI. An agent’s report that it finished a task is a record of what it claimed; it doesn’t prove the task was completed. In our procurement example, “I reviewed all relevant agreements” should send someone looking for the retrieval and access logs that could help verify it. That ever-confident AI statement is not a timestamp.

And by the way, this cuts both ways. The same logs that might reveal a skipped amendment might also show the agent did what it said it did.

Does this mean keeping every machine event forever?

No. Discovery still turns on relevance, proportionality, and privilege. Rule 26 did not acquire an unlimited-storage exception because someone said “agentic.”

Nor does a missing log automatically mean sanctions. In federal court, Rule 37(e) asks, among other things, whether reasonable steps were taken to preserve the information, whether it can be restored or replaced, and whether prejudice or an intent to deprive supports a particular remedy. State rules vary, and how courts will apply all of this to agent logs is still being worked out. That part is your department, not mine. I know, I say this all the time, but it’s true.

So, what to do?

Get curious earlier. At intake, alongside “Who was involved?” ask “What automated systems acted on this?” In custodian interviews, have people walk through the workflow step by step, including the steps they delegated and then never actually saw.

That will tell you more than asking whether they “use AI,” which can mean anything from fixing a comma to letting software negotiate with a supplier.

Your client’s copilots and agents may hold part of the factual record. Find it while it still exists.

Has an automated system turned up in one of your matters yet, either as a source of evidence or as a gap in it? I’d like to hear how it went.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post When the AI Is a Custodian appeared first on Burgess Forensics.

That raises a deceptively simple question: When the bot clicks “Buy,” who agreed to the contract?

The short answer is usually the person or company that deployed, authorized, or controlled the bot—not the bot itself. But the short answer rarely ends the argument. The longer answer, which is the one that could generate billable hours, is whether the bot acted within the authority it was given.

The federal E-SIGN Act provides that a contract involving interstate or foreign commerce cannot be denied legal effect, validity, or enforceability solely because its formation involved one or more electronic agents, so long as the agent’s action is legally attributable to the person to be bound. E-SIGN removes the electronic-agent objection; it does not itself establish agency, assent, scope of authority, or compliance with other applicable law. 15 U.S.C. § 7001(h).  State law may matter as well, including state enactments of the Uniform Electronic Transactions Act (UETA), whose § 14 addresses automated transactions.

So the fact that no human physically clicked the button does not automatically make the transaction disappear. We crossed that bridge years ago with automated ordering systems. Today’s bots are just crossing it with your credit card in their (virtual) hands.

The harder issue is authorization.

Suppose a client tells an agent, “Find me a laptop under $1,500 with at least 32 gigabytes of memory,” and the agent buys one for $1,425. That looks comfortably authorized. Now suppose it buys a $2,300 laptop because it decides the improved processor is “worth the investment.” Helpful initiative, perhaps. Also a decent opening paragraph for a complaint.

Agency principles will matter. What authority did the user actually grant? What limits appeared in the prompt, account settings, purchasing policy, or platform terms? Did the user authorize the transaction itself? Did the merchant’s terms allow this type of automated or third-party access? Did the agent have authority to manifest assent to the merchant’s terms on the user’s behalf? And did the merchant have reason to know that the agent was operating outside its instructions?

These disputes will be won or lost on the digital record, and much of that record is logs.

Attorneys should stop thinking of the receipt as the complete record. It’s not a piece of paper in your pocket. The relevant evidence may include the user’s original prompt and follow-up instructions; spending limits and product filters; whatever agent action history exists, tool-call logs, audit trails, and system events; model and software versions; authentication records; cart changes; confirmation screens; and the merchant’s server logs.

Collect it early. AI systems and their vendors do not necessarily retain every step indefinitely. A clean-looking final confirmation can conceal ten earlier decisions, three rejected products, a changed budget, and one hallucinated free-shipping offer. Hallucinated by the bot, that is.

Then there is the chargeback problem. Consumers may assume that “the AI did it” means “unauthorized.” Card issuers and banks may see a more complicated record. A purchase made through credentials deliberately supplied to an agent is not automatically equivalent to a stolen-card transaction. Whether a customer has a chargeback right, an error-resolution claim, or some other remedy may depend on the payment method, the issuer’s and network’s rules, the authentication record, the instructions given to the agent, the merchant’s conduct, and whether the agent made an unauthorized purchase or merely made an authorized purchase badly.

In other words, buyer’s remorse does not become a stolen-card case just because software was involved.

Fraud and privacy add another layer. A shopping agent may see card details, purchase history, addresses, brand preferences, and perhaps the contents of an email account or calendar. A compromised agent could make an unauthorized purchase. A perfectly functioning agent could also be manipulated by a fraudulent listing, a poisoned recommendation, or a merchant designed to look legitimate to software rather than to a human.

For attorneys advising businesses, now is the time to ask practical questions. Are agent-made purchases permitted? Is human approval required above a stated amount? Are transaction logs preserved? Can the system explain which instruction caused it to choose a product? Can the agent accept arbitration clauses, subscriptions, or recurring charges? And who receives the alert when it gets creative?

Like agency law, consumer protection, and the rules of evidence, contract law isn’t going anywhere. It just has a new participant: one that works quickly, reads terms instantly, and has never once felt the healthy hesitation that comes from entering a credit-card number. Has it ever felt anything?

The bot may have clicked “Buy.” The case may turn on who told it that it could.

Questions about the digital trail behind an automated transaction? Burgess Forensics examines system logs, account activity, metadata, and other digital evidence. (866) 345-3345 | steve@burgessforensics.com

The post Your Client’s Shopping Bot Clicked “Buy.” Who (or What) Made the Contract? appeared first on Burgess Forensics.

In honor of the week, here are a few things television has taught the public about digital forensics, along with what actually happens in the real world.

“Enhance.”
On TV, three keystrokes turn 40 pixels of smudge into a readable license plate. And then the computer instantly gives up the name, age, address, and next of kin for who it’s licensed to. In real life, you can’t recover detail the camera never captured. Enhance a smudge and you get a bigger smudge. (A very well-documented bigger smudge, but still.)The 30-second hack.
Hoodie, dark room, green text scrolling, “I’m in. The perp is on Hollywood & Vine and has a small thermonuclear warhead in his backpack. Get on it, STAT!” In real life, a forensic image of a phone can take hours, it has to be in the examiner’s hands, and reviewing what comes out of it can take days. The green text is optional.Deleted means gone.
The TV villain deletes a file and pours a drink. Not on the keyboard. Deleting a file is more like taking the name off a mailbox. The house is still standing until somebody new moves in, and there may be copies in the cloud, on a backup, or on the phone of the person who received it.

Results before the commercial break.
Real forensic work runs on chain of custody, hash values, validated tools, and documentation that would put a prime-time audience to sleep. That’s the point. It’s what holds up when the other side’s expert goes through it line by line. The documentation, not the TV script.

The expert always works for the good guys.
On TV, the real expert works for the good guys and the bad guy’s expert is always overconfident In real life, the evidence doesn’t know who hired you, and the examiner shouldn’t care. The data is the data, and it shows what it shows.My favorite TV forensic tech.
Numb3rs, Season 2, Episode 8, “In Plain Sight.” Amita Ramanujan opens the top casing plate of the hard drive (exposing the magnetic platters to open air – this is such a no-no!) and proceeds to wave a handheld magnetic sensor wand over the open spinning disks while Charlie watches the data flow onto the display screen. Oh, how I wish!Forensic science is slower and less photogenic than television. It’s also more interesting, because it’s real. Really.

#ForensicScienceWeek #DigitalForensics #eDiscovery #ExpertWitness

The post Happy Forensic Science Week! appeared first on Burgess Forensics.

I recently wrote about sanctions: the adverse-inference instruction, the spoliation finding, the judge with disapproval written all over his face telling the jury it may assume the worst about whatever got erased. That’s a high price to pay for hitting delete. It can cost real money, and sometimes much more. Sometimes it ends up costing the whole case. But the courtroom is not necessarily where the biggest bills come due.

Regulators send a different kind of invoice, and they can send a lot of them.

The three-billion-dollar housekeeping problem

Since December 2021, the SEC and the CFTC have been running a sweep, collecting what they politely call “off-channel communications.” Translation: business talk that happened on personal phones, in texts, in WhatsApp, in Signal, in whatever app someone reached for instead of the monitored work system. The firms were supposed to keep those records. They didn’t. So, the messages weren’t there when the regulators came looking. Toll calls, indeed.

The tab so far is north of $3 billion in combined penalties across more than 100 firms. It started small and almost quaint: JPMorgan, December 2021, a $125 million (okay, not so small to you and me) WhatsApp recordkeeping fine that looked at the time like a warning shot. It wasn’t a warning shot – it was just the opening bid.

And here’s the part attorneys may want to pay close attention to. The enforcement that hit the institutions is now working its way down to individuals. FINRA has picked up the baton and started suspending individual brokers for the same conduct. It’s been often said that all business is personal, but they didn’t mean penalties. Those corporate penalties are becoming personal. That text you fired off from your own phone doesn’t just belong to your employer’s compliance headache anymore.

One fine, for the deletion alone

Now a hop across the pond to Brussels for a clean illustration of the principle in Europe.

In June 2024 the European Commission fined International Flavors & Fragrances €15.9 million for obstructing an antitrust inspection. The underlying investigation into the fragrance industry is a separate matter and is still open as of IFF’s June 2026 filing. What earned the fine was this: during a 2023 dawn raid, while the Commission was reviewing employees’ mobile phones, a senior employee intentionally deleted WhatsApp messages exchanged with a competitor, after being told the inspection was underway.

Very bad timing. Not before. He deleted them after being told an inspection was happening.

It was the first time the Commission ever fined a company for deleting messages off a phone. And note the arithmetic, because it’s the whole thesis of this piece: the fine was set as a percentage of IFF’s total worldwide turnover, then cut in half because the company owned up and helped recover the data. The fine did not depend on proving that the messages established the suspected antitrust violation. The deletion itself was the offense.

“But the messages are gone. How do they even know?”

This is the question many ask, usually with real hope in their voice. It rests on the myth that a deleted message is a deleted event.

It isn’t. A message is not a single object sitting in one place. It’s an event that leaves marks in several places at once, most of them outside the sender’s reach.

Delete a text and the content may vanish from the handset (although it might also be recoverable from there), but the carrier may still maintain transaction records for an SMS or MMS, logging that a message moved from one number to another at a particular minute. That metadata won’t tell anyone what was said but it will tell an investigator that something was said, to whom, and when, and that is often more than enough. For encrypted apps that don’t use the carrier’s messaging service, evidence may exist elsewhere: in an enabled backup, in forensic remnants that may still be recoverable from the device, or on the other person’s phone.

That last one is the reversal worth dwelling on. In my usual line of work, “we have the logs” is what my side says when we’ve preserved the evidence, and the other side is squirming. In these cases it’s turned around. The logs that sink you are the ones the other side kept. Two firms message off-channel; one of them preserved its half of the conversation, and now the gap on the second firm’s system isn’t just a gap, it’s a documented absence with a matching record on the far end. The counterparty becomes the witness. In the fragrance case, the Commission caught the deletion during the raid and the deleted data was recovered through the backup system anyway. The employee erased his handset copy. He did not erase IFF’s backup.

Existence outlives content. That’s the line to remember. Should be the title of a book.

“Isn’t a fine just the cost of doing business?”

Some firms clearly treated the recordkeeping rules that way, right up until the number had ten figures in it. But there’s a subtler trap. When the deletion itself becomes the sanctionable act, the cooperation math changes. IFF’s fine got halved for coming clean and helping recover the data. The deletion still cost them eight figures. Without that cooperation, the Commission’s starting figure was twice as high. There’s no version of that ledger where hitting delete comes out ahead.

“My client isn’t a Wall Street bank or a fragrance conglomerate.”

Well, of course it’s not. But the logic doesn’t live in securities law or EU competition rules. It lives in one idea that runs through all of it: destroying evidence after you’re on notice is a separate wrong from whatever the evidence would have shown, and it carries its own separate price. Regulators call it obstruction. Judges call it spoliation. The custodian who cleaned up their phone the weekend after the litigation hold arrived is standing in the same spot as that senior employee in the fragrance case, minus the corporate turnover to cushion the landing.

So, what to do?

Nothing exotic. The unglamorous stuff, done early.

Preserve on notice. We know this goes without saying, but given that it’s still an issue, we’re saying it anyway. In U.S. civil litigation, the duty to preserve relevant evidence generally arises when litigation is reasonably foreseeable. If auto-delete settings can affect information in scope, suspend them.

Assume the other side kept their copy. Advise clients as though the counterparty preserved everything, because sometimes they did. A story that depends on a message never having existed is a story with a short shelf life. Hope and reality can be two very different things.

Preserve the phones before they’re “cleaned up.” Deleted-but-recoverable data may have a narrow window. It can disappear when the device is wiped, traded in, or overwritten through continued use or backup rotation. Phones also perform their own internal clean-up, so time matters. Preserve the device promptly, then have counsel and a qualified examiner determine the appropriate scope and acquisition method.

Don’t confuse encrypted with gone. Signal and similar apps can make content harder to recover, but encryption does not eliminate every potential source. Depending on the app and its settings, evidence may remain in an enabled backup, a screenshot, or a recipient’s device.

Deleting evidence can create consequences on several legal tracks. A court may impose remedies for spoliation, while a regulator may pursue recordkeeping violations or obstruction. Those categories can overlap, and the available penalties depend on the facts and the forum. What they share is that the deletion can become a problem of its own, apart from whatever the missing messages might have shown.

Ever had a “the messages are gone” case turn out to be nothing of the sort once you looked at the other side’s devices? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Sources: European Commission press release, IFF €15.9M (June 2024) · Holland & Knight, SEC/CFTC off-channel enforcement totals · Ex-Wells Fargo Broker Fined, Suspended for Off-Channel Texts to Colleague

The post Auto-Delete, Take Two: Regulatory Fines Can Dwarf Sanctions appeared first on Burgess Forensics.

Picture this: he knows he’s under investigation, but he’s anxious, he can’t sleep, and he wants to get ahead of the thing. So, he opens a chatbot at 1 AM and does what people do now: he talks, he types, he lays out his whole preferred theory of defense. He talks to his AI adviser about arguments that worry him and the facts he’d rather nobody saw. Thirty-one documents worth of them, as it turns out.

And then the FBI executes a search warrant, and those thirty-one documents come off his devices. Oh, no.

He says they’re privileged. The court says they’re not. Oh, double no.

That’s the short version of United States v. Heppner, decided in the Southern District of New York in February 2026. Judge Jed Rakoff held that a securities-fraud defendant’s conversations with a public AI tool (Anthropic’s Claude, as it happens) were protected by neither attorney-client privilege nor the work-product doctrine, and were fair game for the government to keep and cherish. Even if it was privileged when Heppner told it to attorneys, he waived the privilege when he disclosed it to Claude.

I’m a computer geek, not a lawyer, so I’ll stay out of the deep end on privilege doctrine. That’s your department, counselor. But the data side of this is my lane, and there’s a moral to the story.

“Come on. It’s just a fancy word processor.”

That was the argument, more or less, and the court didn’t buy it. See, a word processor doesn’t answer back. When your client types into a public chatbot, he isn’t just taking notes; he’s having a conversation with a third party. And sharing it with a third party can waive the confidentiality on which privilege depends.

It’s easy to forget that it’s not only that a human somewhere might read it. If you read the privacy policy on many consumer AI tools you’ll likely find that the provider reserves the right to log what you type, use it to train the model, and to hand it over to regulators or law enforcement when asked. And don’t even start with what happens to the data if and when another company buys the AI company.

He thought he was talking to a machine that forgets. Nope. Depending on the service, he was talking to one that remembers, transcribes, and keeps all the receipts.

“But he showed it to his lawyer afterward. Doesn’t that make it privileged?”

Privilege isn’t a stamp you get to press onto a document after the fact. The court was clear that sharing a preexisting document with counsel later doesn’t reach back in time and wrap it in protection. The horse is already out of the barn and Elvis has left the room. Walking it past your attorney on the way out doesn’t reverse history and put them back.

Rakoff found work product didn’t save it either. Under the Second Circuit authority he applied, the documents weren’t prepared by or at the behest of counsel and didn’t reflect counsel’s strategy, but rather that he made these on his own initiative, before anyone told him to. No lawyer’s fingerprints on it and no protection.

“So AI is radioactive now. Great.”

Well, not quite. Judge third left a door open. He suggested that if counsel had directed the client to use the tool, the AI might function more like a lawyer’s agent, the way a translator, an e-discovery vendor, or a forensic examiner does when brought in under the attorney’s umbrella. Different setup, potentially different result.

So the line that matters isn’t “AI, yes or no.” It’s who’s driving, under what terms, with what confidentiality. A consumer chatbot your client opened alone, long before dawn, is one thing. An enterprise tool, deployed under counsel’s direction, with a contract that forbids training on your data and locks down disclosure, is a very different animal. Same technology. Different lock, different key.

What does a forensics guy care about any of this?

Well, because I’m the one who finds it.

When a device comes in for examination, at least a portion of chatbot histories could be just another artifact now, sitting right alongside texts, browser history, and deleted photos. They’re potentially recoverable, they’re timestamped, and they read like a diary. People unwittingly treat these tools as a confidant that won’t repeat what it heard. Whether the exam is for the defense or the prosecution, the evidence is the evidence. If it’s there, it’s there.

That cuts both ways, by the way. It isn’t only defendants who overshare with a chatbot. Witnesses do it. Executives do it. The person on the other side of your case may have a transcript on a laptop that’s every bit as revealing, and under Heppner, likely to be discoverable.

Human nature doesn’t change but tools do. People have always talked too much when they’re frightened or overconfident. What’s new is that the confidant now writes it all down and reserves the right to share it.

So, what to do?

A few practical points from the data side of the fence. The privilege calls stay with you.

Ask early. When you map a client’s devices and accounts, ask which AI tools they’ve used and what they typed into them. It belongs on the same checklist as their email, their texts, and their cloud backups.

Limit the AI. ChatGPT and Gemini have Temporary Chat, Claude and Perplexity have Incognito Chat. As of September, 2026 some of the limitations include:

• ChatGPT Temporary Chat: not in ordinary history or memory and not used for training; OpenAI says a copy may remain for up to 30 days.
• Claude Incognito: not saved to chat history or memory and not used for training, but Anthropic normally retains it for 30 days.
• Gemini Temporary Chat: not in recent chats/activity and not used for training or personalization, but Google retains it for up to 72 hours.
• Perplexity Incognito: memory and search history are disabled; current Perplexity documentation says incognito sessions can persist for 24 hours.

These limit what is saved to tool memory, reflection, model training bit are not any guarantee that there won’t be artifacts saved to the local device.

Assume it’s recoverable. “I deleted the chat” is not the same as “the chat is gone.” Treat a chatbot transcript like any other piece of ESI, because, by and large, that’s what it is.

Get people off the consumer tools. The cheapest fix is behavioral. A client who understands that typing his case into a public chatbot is like telling it to a stranger on a train tends not to do it in the first place.

Bring the tool inside the tent. If AI is going to be part of the work, the setup, including direction, terms, and confidentiality, is what may keep it protected. Structure it on purpose, not by accident.

I’ll leave the doctrine to the lawyers. But I’ll say this much. Heppner isn’t really a story about artificial intelligence. It’s the oldest story there is with a new gadget in it. Typing to a chatbot may be no more secure than telling your neighbor, “Don’t tell anyone, but…” Confidentiality has always been something you can give away without meaning to. The chatbot just made it easier than ever.

Have you started asking clients about their AI use when you map their devices? I’d be curious what you’re finding, and whether you’ve seen one of these transcripts turn up where nobody expected it.

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

The post Your Client Told a Chatbot His Defense Strategy. Is It Still Privileged? appeared first on Burgess Forensics.