Sharon D. Nelson & John W. Simek 2015-01-26 05:10:05
Evidence Online Social media preservation, harvesting, and authentication. © 2014 SENSEI ENTERPRISES INC. The Rapid Rise of Social Media It is somewhat mind-boggling to realize that Facebook is only a decade old. We now have more social media platforms than we can count. And yet, we have little concrete history of how it is being used in the courts; what opinions we have are often contradictory. Unless you’ve dealt with a particular judge, you may have no idea what kind of a ruling you are likely to get with respect to social media evidence. Those running a business or law firm that is active on multiple social media platforms may need to archive all that data for compliance reasons. In real life, many companies are not archiving, regulations notwithstanding. And few firms understand that their social media postings are subject to discovery until they receive a discovery request. As to the value of the evidence, it cannot be overstated. Some experts estimate that Facebook postings emerge as evidence in as much as 60 percent of divorce cases. Personal injury is probably a close second, most likely followed by employment cases. While this is by no means a scholarly article, these are observations and musings of two e-discovery and digital forensics experts who see a lot of social media preservation, harvesting, and authentication issues happening in preliminary hearings that will never be reported in a court opinion. Preservation—DIY or Outsource? It is useful to underscore that both parties have the duty to preserve relevant social media evidence. Often, aggrieved plaintiffs overlook that responsibility. Spoliation is not tolerated— and in one Virginia wrongful death case in which an attorney advised a client to “clean up his Facebook,” he paid for it dearly. Though he won the underlying case, he had to pay significant sanctions, including defense counsel’s fees and costs. He was also fired from his firm and suspended by the Virginia State Bar for five years. He ultimately resigned from the practice of law.1 Many people have to preserve social media for compliance reasons. Obviously, you have to preserve it if you are under a litigation hold; you certainly will want to preserve an adversary’s social media content. Companies that provide social media archiving and related e-discovery services include ArchiveSocial (archive social.com), X1 Social Discovery (.x1.com/products/x1_social_discovery/) and Hanzo (hanzoarchives.com). These companies are best used for larger efforts. Sometimes, if you need just a few social media postings preserved, you can save money by using digital forensics firms and tools that are accustomed to this sort of preservation, such as SnagIt, Camtasia, or Adobe Acrobat— generally saving several hundred dollars. The files are stored on their servers and any transfer of the files involves a chain of custody document. Some consultants will use products that log the user and the data and time of preservation, as well as hashing the file at the time of preservation. But why not do it yourself? Lawyers could certainly use any of the products we’ve cited above. They can also take screen shots or print out copies of social media pages admitted by courts—slightly horrifying in most cases because there is no metadata to authenticate something that can easily be spoofed. Lawyer and blogger Molly DiBianca wrote a comical post in July 2014 about a South Carolina case.2 In Wellin v. Wellin, defendants moved to compel production in native format after the plaintiffs “printed out responsive emails and provided photocopies of certain portions of those emails to defendants. Additionally, [one plaintiff] provided the content of several text message exchanges and Facebook posts by transcribing those messages on loose-leaf paper.” The judge granted the motion. We have become a DIY nation, but it really doesn’t make sense to preserve social media yourself. You don’t want to put anyone from your firm on the stand to authenticate the evidence, particularly because your firm and your client have a vested interest in the outcome of the case. Respected third party professionals constitute the avenue of choice—remember, experts live and die by their reputations. And, as mentioned previously, the costs of preservation are small—and cases rarely go to trial so the costs of testifying are generally avoided. Harvesting Social Media Evidence Many lawyers make the mistake of thinking they can obtain non-public social media posts by going to the social media provider. Though they may get certain information—subscriber info, dates of connections, IP addresses, etc.—they will not get content because the Stored Communications Act forbids it.3 Instead, they will generally have to obtain the data from the user or from a friend of the user who is willing to share it, assuming it is not public. No deceit can be involved in procuring the evidence. Judges often think it is hard for a user to get his or her own data, so we often advise lawyers to write out the steps to illustrate the simplicity. It takes only a few moments to request your Facebook data, and a response in the form of a .zip file containing all the posts and photos a user has put online generally comes back within three hours. Note that it will not return what others may have posted on the user’s account. In 2012, Twitter also made it possible to download your archive so you can get all your tweets (including retweets). In cases where the social media site provides no mechanism for a user download, we have seen user consent forms used— once filled out, they can then be sent to the provider, who will produce the content to the user. We have seen instances where judges have required login information for social media sites so that the other side could cruise for evidence, but it seems to us that these cases are rapidly going out of favor. In the paper world, you wouldn’t give one side the keys to the other side’s office so they could rummage through all the file cabinets. Likewise, they should have no right to do so in the digital world. The more narrowly a request is tailored, the happier judges seem to be. They tend to grant the most leeway in cases such as personal injury suits, where a defendant’s lifestyle is broadly in question. As a rule, comprehensive requests are identified as “fishing” by the courts and generally denied. A common misapprehension among attorneys making discovery requests is that all the social media content that may exist will be turned over to them. In practice, the data should go to the producing party’s attorney to screen for relevance and privilege before turning it over. If a judge is involved, it always works this way, but many times we see the whole kit and caboodle turned over to the requesting attorney. Authentication Authentication is usually simple if a third-party expert has been used or if self-authenticating software has been employed. You can also use requests for admissions—or perhaps lock the authenticity down in a deposition. Remember that the problem of authentication goes away if the other party provides his or her own social media postings. Still, we have seen cases where data is public because there are no privacy settings. In the case of businesses, it would defeat the purpose of social media if their posts were not public, but you often see an employee allowed to post on the company’s social media platforms who goes “rogue” in his postings. This is the perfect example of when it is critical to get the social media posts preserved before wiser heads can prevail and the postings are taken down. Sometimes, the expert testimony of third parties who have preserved the data is required. If data was deleted and then recovered, digital forensics experts may be required to authenticate whatever artifacts they recovered. Judge Paul Grimm, along with others, is certainly correct in saying that the caselaw in this area is “clear as mud,” with courts frequently coming down on all sides of the issues involved in authentication. One set of cases will not admit the evidence unless the proponent offers the court evidence of authenticity (the Maryland Standard). Another line of cases (the Texas Standard) looks to whether there was sufficient evidence of authenticity for a reasonable jury to conclude that the evidence was authentic.4 We have seen an uptick in the number of courts that adhere to the “duck” rule: If it looks like duck and quacks like a duck, it must be a duck. There are so many distinctive circumstances of characteristics in social media evidence, including content, use of nicknames, dates, Internet addresses, abbreviations, slang, knowledge of specific facts, replies to another post, etc., that the “duck” approach often works. We have heard from our local state judges in Virginia that, unless someone objects to the authenticity of the social media evidence (or its relevance), it will come in—that’s just common sense. As they candidly say, the system works and they are hesitant to make things more complicated than they need to be. Our heads spin when we try to imagine the kind of social media evidence we may be dealing with a decade hence. NOTES 1. http://www.abajournal.com/news/article/lawyer_agrees_to_five-year_suspension_for_advising_client_to_clean_up_his_f/. 2. http://www.delawareemploymentlawblog.com/2014/07/how-not-to-produce-facebook-evidence.html. 3. http://www.law.cornell.edu/uscode/text/18/part-I/chapter-121. 4. http://www.delawareemploymentlawblog.com/2014/02/delaware-supreme-court-rules-on-admissibilityof-facebook-evidence.html. SHARON D. NELSON and JOHN W. SIMEK are the president and vice president of Sensei Enterprises, a legal technology, information security, and digital forensics firm based in Fairfax, Virginia. For more information, go to senseient.com. This article was reprinted with permission of the authors.
Published by State Bar of Texas. View All Articles.
This page can be found at http://mydigimag.rrd.com/article/Technology/1916011/243822/article.html.