>>5161885 ob all
Two ways, at least, to read between the lines.
Graphic shows one way: The mobile devices were compromised on a subset of those issued by the FBI. The OIG hints at the size of the subset by refering to the subset (10%) of devices that were compromised after 31,000 had been changed-out. Before the change-out how many? Where? Issued to whom?
This way of looking at it also suggests that the users hacked the text message data (and other data) on their devices and reserved a hidden database that ESOC claims to not have known about. This prevented preservation of the data. This problem may have been a feature created or merely found and exploited by a subset of users.
Another way of looking at it? These devices were altered by a person or an entity within the security system for the purpose of monitoring particular users without their knowledge. To execute that purpose the ESOC had to be kept in the dark, officially, The data may have been preserved off-device some other way at some other place.
The difference between the two views? Well, nothing can be certain at this point, of course, but the first view would suggest that the database was held back for some as yet unknown reason. Was the purpose to tamper with evidence - to alter the text messages and other data? Was it a coarse attempt to hide chunks of data that would just deemed "missing"? How would any of this fit the established fact pattern of these particular users?
The second view would suggest that tampering was suspected beforehand and that precautions were taken to preserve the database where ESOC and the vendor could not reach it because both were blind to it. That suggests concerns about security at both ESOC and the vendor. If there are no indications of tampering with the database contents, then, this may prove out.
And that second view would fit, perhaps, with the Q pattern of pre-emptive (and lawful) interventions?