The analysis, which tried but failed to recover the texts and investigated what happened to the public records — including messages exchanged during Seattle’s racial justice protests in the summer of 2020 — indicated that Durkan’s texts were set in July 2020 to delete after 30 days and that Best’s texts were “periodically deleted.”
“We investigated whether there were any events that could have changed [Durkan’s] text message retention settings without manual intervention, and to date have not identified any that apply,” a report on the analysis says.
The 52-page report, written by an expert with the California cybersecurity firm Unit 42 under contract with the City Attorney’s Office, was released late Friday to lawyers involved in lawsuits against the city related to the 2020 protests.
The contractor did not attempt to determine who deleted Durkan’s texts from her iPhone by changing the retention setting from “forever” to “30 days,” the report says, because “digital forensic evidence regarding who made changes does not typically exist on mobile devices.”
The analysis did determine, though, that the default retention setting should have been “forever.”
Best did not respond to messages left for her Saturday.
In an email, Durkan asserted Saturday that the report supports her contention she didn’t delete her text messages.
“As I have said all along, I did not change the retention settings on my phone and intentionally delete any data. The forensic report confirms my actions did not delete messages from the phone,” Durkan said.
“Fortunately, the city has been able to produce the majority of texts missing from my phone by recovering them from other devices. As I stated before, I believed electronic data from all city devices was being retained and archived, including text messages.”
But the analyst’s report didn’t determine who did or didn’t manually change the settings that deleted the mayor’s texts from her phone.
Durkan’s email also noted that the city’s information technology department “configured, issued and maintained” all of her phones, and worked on them in July 2020 “to fix different problems.” The department configured a new iPhone for her on July 9, 2020, after her old iPhone had fallen into salt water on July 4, 2020.
The report found that the IT department transferred the data from Durkan’s old phone directly to her new phone on July 9, 2020.
The analysis also inferred that someone selected the “disable and delete” option for storing texts from Durkan’s phone on iCloud on July 4, 2020, before the IT department made the switch. A Durkan spokesperson didn’t respond to a question asking whether Durkan disputed that finding, referring further questions to the city.
Durkan, whose term expired this past December, and Best, who retired in September 2020, were Seattle’s most important leaders in May and June 2020, as racial justice protests erupted, police deployed tear gas and activists occupied part of Capitol Hill.
But the mayor and police chief had texts that were not retained for extended periods of time, including in those crucial months, leaving the public in the dark about some of what they discussed and what occurred during key moments. The forensic contractor couldn’t find either leader’s texts from May 2020 and June 2020 backed up from their phones and stored elsewhere, according to Friday’s report.
The missing texts have become a point of contention in several ongoing lawsuits against the city, and a matter of public interest.
Under state law, anyone who willfully destroys a public record that’s supposed to be kept is guilty of a felony. Most elected and public officials in Washington, including Durkan, are required to take public-records training, which includes information about records-retention requirements.
David Perez, a lawyer representing Black Lives Matter activists suing the city over the Police Department’s crowd tactics during the 2020 protests, said in an email Saturday that while the report clearly shows that “someone manually, and deliberately” deleted Durkan’s messages, the analysis didn’t try to find out who did it.
“The person or persons responsible should be held accountable,” Perez said. “Despite spending all that money on a fancy report, the city has not decided to ask the most basic question of all: who hit the delete button.”
In an email Saturday, a spokesperson for current Mayor Bruce Harrell said Harrell had received a copy of Friday’s report and was “seeking legal clarification from the City Attorney’s Office on what the appropriate and legal course of action should be in these circumstances.”
Spokesperson Jamie Housen added Harrell “believes any potential investigation should involve a neutral third-party investigator,” rather than Seattle police, “to prevent the appearance of a conflict of interest.”
Much of the information in Friday’s report already had been uncovered in bits and pieces over the past nine months. But the report reinforced certain aspects and added new details.
The contractor that completed the report was hired in November 2020 by lawyers working for then-City Attorney Pete Holmes to try to recover Durkan’s texts and determine why they were gone. The public didn’t find out her texts were missing until May 2021, when The Seattle Times reported on a whistleblower investigation.
The Times subsequently reported that Best’s texts were also missing, along with the texts of at least seven other city officials, including members of Best’s command staff and fire Chief Harold Scoggins.
At some point, the forensic contractor’s work grew to include Best’s texts but didn’t attempt to determine what happened to the texts of the other officials.
Durkan’s office initially attributed the loss of her texts to an “unknown technology issue” but later acknowledged that her texts had been set to automatically delete after 30 days.
Neither Durkan nor anyone else has taken responsibility for selecting the 30-day setting.
Durkan has never accepted an interview request from The Times about the matter, and her office and the city’s IT department last year said they wouldn’t answer certain questions until the forensic report was complete.
Best’s account has evolved. When asked about the matter in May, Best acknowledged she had received a number of public records requests for her texts from the summer of 2020. She said she didn’t know how her texts disappeared, noting she thought her phone was being backed up.
“I turned in all my equipment when I left,” Best said. “I can’t begin to tell what happened, who had that information, where it went, all of that.”
During a sworn deposition about six months later, in November 2021, Best testified that she “deleted text messages periodically,” Friday’s report says.
The phone Best used in 2020 was never backed up to iCloud, “possibly due to a lack of available storage space,” the report added.
Forensic Report
The city’s lawyers hired The Crypsis Group, now called Unit 42, to investigate Durkan’s missing texts as part of Seattle’s defense against various lawsuits that stemmed from the summer of 2020. That includes the lawsuit Perez is involved with, alleging unnecessary violence by police against protesters, and a suit filed by business owners and residents who allege damages caused by the city’s tolerance of the Capitol Hill protest zone.
As of November 2021, the city had paid the contractor more than $400,000 for the work. Friday’s report is attributed to Kevin Faulkner, who has more than 18 years of experience in digital forensics, according to the report.
The report says Durkan’s texts are still missing, at least from her side of any exchanges, from Oct. 30, 2019, through June 25, 2020.
Durkan has said she switched phones on July 9, 2020, because the first phone had a cracked screen and had been “submerged in salt water” on July 4, 2020, “causing problems,” Friday’s report says.
Unit 42 analyzed data from Durkan’s phones and from backups from various points in time. The investigation, according to Friday’s report, indicated that Durkan’s phone was set to “disable and delete” texts stored in iCloud on July 4, 2020.
It also inferred that Durkan’s phone was set to delete texts older than 30 days at some point between July 4, 2020, and July 26, 2020. The analysis indicated that the phone was reset to store texts “forever” at some point between July 22, 2020, and July 26, 2020.
In August 2020, Durkan’s phone with the cracked screen and water damage was decommissioned and reset by the IT department. The email from Durkan on Saturday noted the report said that no backup of that phone’s data was made by the IT department on July 9, 2020. According to Friday’s report, an estimated 2,024 of Durkan’s texts were deleted from her phone and could not be recovered, except from people she messaged with.
Unit 42 also analyzed data from phones used by Best over several years and from backups in 2017 and 2019. The investigation indicated that Best’s phone, at the time she retired, was set to delete messages older than 30 days. But the analysis also indicated that Best had been deleting most of her texts more frequently than that.
Friday’s report said the analysis was “consistent with (Best’s) deposition testimony” that the former chief periodically deleted texts. It found “periodic deletion over time rather than a bulk deletion.”
What Now?
The missing texts came to light in May 2021 after a public records officer in Durkan’s office filed a whistleblower complaint with the Seattle Ethics and Elections Commission.
The resulting investigation found that the office’s legal counsel had broken the state’s public records law by excluding the mayor’s missing texts from certain requests and had diverged from best practices by not informing requesters about the missing texts.
Durkan’s office has been able to provide requesters with some missing texts from the summer of 2020 by retrieving them from people she was messaging with and whose texts were retained.
Texts between Durkan and Best have not been retrieved.
The public records officer who filed the whistleblower complaint and a colleague who supported her are suing the city, alleging they were forced to quit their jobs in retaliation for objecting to the way the records requests were being handled.
The Times is suing the city over how Durkan’s office and the Police Department handled requests by reporters, some of which were made before texts were deleted.
Perez, the lawyer for BLM activists who are also suing, noted that the report “confirms that the records were destroyed” after lawsuits had been filed.
“That means these records weren’t just public documents, they were critical evidence in ongoing litigation,” he said.
When the matter became public in May 2021, a spokesperson for Holmes said the forensic report was expected to be completed by late June 2021. Instead, many months passed and Durkan left office, as did Holmes.
Also in May 2021, several mayoral candidates spoke out about the matter. Harrell, who went on to win the November 2021 election, said Durkan should consider resigning. Colleen Echohawk, who finished third in the August 2021 primary, asked state Attorney General Bob Ferguson and King County Prosecutor Dan Satterberg to investigate.
Ferguson’s spokesperson said at the time the AG’s office had no authority to investigate the matter, adding “that authority rests with local law enforcement.”
Since then, Ferguson’s office has conducted a criminal investigation of a public official in a local jurisdiction at the request of Gov. Jay Inslee. That investigation resulted in charges alleging Pierce County Sheriff Ed Troyer made false reports against a Black newspaper carrier. On Sunday, Ferguson’s spokesperson said the office has not received a formal request or referral necessary to pursue a criminal case.
Satterberg’s office has not received the report nor a referral from any law enforcement agency about the matter, a spokesperson said Saturday.
(c)2022 The Seattle Times. Distributed by Tribune Content Agency, LLC.
