HaystackID® Acquires Business Intelligence Associates, Inc.Read More

Social Media Discovery: Find the Smoking Gun

find the smoking gun

In the Social Media Discovery: Find the Smoking Gun webinar, BIA and ACEDS have collaborated to deliver important information about using social media investigations as a discovery technique for identifying key information for the fact-finding phase of litigation.

Using social media investigations as part of legal discovery is often the least expensive aspect of discovery, and is changing the litigation landscape.

With billions of active accounts across multiple social media channels, including Facebook, Instagram, Twitter, Snapchat and more, user-generated content is being created at an incredible pace.

Social media information is implicated in an ever-increasing number of matters and it’s no surprise that lawyers have found the need to gather, review and use information or images found on social media to aid in the prosecution or defense of their lawsuits.

That data can readily be collected and reviewed similar to other electronically stored information. And now, more than ever, Social Media Investigations are providing the smoking gun that makes or breaks a case.

In the Social Media Discovery Find the Smoking Gun webinar, you will learn about:

  • Preservation obligations
  • Ethical considerations
  • Admissibility requirements
  • Case stories that show how Social Media Investigations changed the outcome of actual trials
  • How to identify social media locations to be collected
  • How to preserve unique metadata and hash evidence items to aid in authentication

Webinar Speakers

Watch the Webinar

Webinar Q&A Session

What is the starting point for a social media collection? Meaning, what minimum information is needed to be able to initiate the process?

To begin a social media collection, you simply need the name of the person whose information you’re seeking. However, finding the correct person based on his or her name alone can be difficult (for example, without any background information, finding the correct “Robert Smith” on Facebook would present a challenge), so collecting some additional identifying information on the individual is helpful. Take a look at the checklist below for how to find the profiles and information you’re looking for.

Is there a good checklist to follow for creating a repeatable process when performing social media discovery?
  1. Start with a background report on the individual to confirm his or her identity and gather a list of family members and friends who can further help confirm that the profile you’re looking at is correct.
  2. Interview key custodians – it’s the best data identification method available. If you have more than a handful of custodians in your case, use a custodian questionnaire, which allows you to reach out to all your custodians at one time with different sets of questions for different groups.
  3. Look for clues to help you confirm you’re looking for – or found – the right person by searching his or her name and family members’ names. You can use Google, DuckDuckGo and various social media platforms, like Facebook, Twitter, Instagram, Pinterest, GoFundMe and others. Look for things like nicknames or maiden names that he or she might use on one or more social media profiles.
  4. Use a digital forensics team to help ensure any data collected will be admissible in court or other legal proceedings – simply printing a profile or saving it as a PDF is not enough. Once you find the relevant profiles, trained digital forensics technicians can help find additional data and ensure that all data collected is properly preserved, along with critical metadata, in a defensible manner. That team can also aggregate all data collected into a comprehensive report that can be used to further develop your case strategy.
What makes a forensic social media collection defensible?

This is commonly asked in our social media investigations Q&A private law firm or corporate legal department sessions. The answer is simple and differentiated: BIA’s entire process is guided and overseen by licensed private investigators, digital forensics professionals and attorneys, ensuring that data is collected and preserved in a way to make it defensible and admissible in court. Our technology captures social media posts as well as all related metadata, using a hashing algorithm to prove that they haven’t been altered and to ensure evidentiary integrity and admissibility. Our investigative team also logs all work and provides detailed reports to ensure the reliability of the process.

What are some key metadata points identified when performing a forensic social media collection?

A legally defensible social media collection is not simply a screenshot of relevant social media pages – it’s the extraction of data, including metadata, which is then authenticated using hash values. Ultimately, the hash value is a digital fingerprint that verifies the data has been untouched. If the report is run again and the value has changed, it proves that something has been added, deleted or altered on the profile or post. Metadata is the difference between defensible evidence and ‘nice try.’

We capture hundreds of factors when we do social media collection, and the types of metadata available vary depending on the platform. Key metadata points include the time and location a post was created, any updates to the post and its direct link.

When monitoring the social media accounts of jurors in a case, does that occur during or prior to trial?

Jury monitoring can be done during both voir dire and the trial. During the voir dire process, we use our tools and experience to mine social media and the internet to create potential jurors’ character profiles, which can assist clients in choosing the jury. Useful information can include criminal background, biases, reactions to controversial topics and even frequency of social media use (which can be helpful in understanding the likelihood of jurors using social media during the trial).

During the trial, we can set up a radius around a specific point (such as the courthouse where the trial is taking place) and track all social media use within that particular geographical area. This would have been useful to attorneys in the El Chapo case, where it was discovered that jurors were actively discussing the case on Twitter, leading to the possibility of a mistrial.

What are some of the best tools for collecting social media data?

There are a variety of options available, and the tool(s) should be selected based on the needs of the case and the experience of the investigators. At BIA, we have multiple tools so we can employ the most appropriate ones depending on the social media platforms and how the data will be used. For example, photo or text posts on Facebook are treated differently than videos from YouTube, which must be captured in a way that allows for audio transcription and visual description. Regardless of the tool used, it should collect and preserve metadata and other information in a defensible manner.

Additionally, once the data is collected, the files from the individual platforms may need to be standardized and moved to a review platform. That may require additional processes and tools.

Not all Social Media Investigation tools, techniques and technologies are created equal, so we suggest you ask your vendor about their specific process. Perhaps the most important thing is to find the right team that can get the evidence you’re looking for. Look for an investigative team that understands what’s permissible and what isn’t and that works within the law and the access granted by the platform and individuals.

When performing a Facebook account investigation, is it accurate that after looking at a public account three times you become part of the algorithm as a “suggested friend”?

We can’t say for sure about the “three times” rule, but it’s realistic to assume that if you are searching for the same person multiple times, Facebook would add this to their algorithm bucket. It probably doesn’t take much these days by means of data input for the algorithm to make a suggestion.

Webinar Transcript

Mary: Hello. My name is Mary Mack and I’m the executive director of ACEDS, Association of Certified eDiscovery Specialists. We are delighted today to bring you a webinar from our fabulous affiliates, BIA. We are going to be talking about social media discovery: find the smoking gun. We all know social media is very very powerful. As a matter of fact, it doubles our attendance overnight from some things that went out, so we’re absolutely delighted to take a look at social media and apply to eDiscovery. Your questions are very important as always. The Q&A tab is down at the bottom of your screen and if your question is not answered within the webinar, the good folks from BIA will reach out and answer your question afterward. Starting out, it’s my pleasure to introduce ACED, Mark MacDonald. He’s a senior vice president of business development at BIA. He’s got over a decade in eDiscovery including some advanced topics around data preservation, forensic investigation, computer forensic investigations, advanced data analysis, managed attorney review, and he also manages the client contract negotiations and high-level account management for BIA. He has brought with him another sense and is a wonderful long-standing contributor to our ACEDS community. He will be moderating, hosting, and taking it away now. Welcome, Mark, we’re so glad to have you back.

Mark: Thank you very much, Mary. That was quite an introduction, we have lunch for that one. We’re excited to be here today as always and to bring this power-packed lunch to you. This is a shortened version, thirty minutes, so we appreciate everybody coming. We have Barry Schwartz, one of our senior advisors, and Josh Serra, who leads the BIA social media discovery services division. Barry, why don’t you take it away? And I will follow up at the end if we have any questions that we have time to get to. We’ll bubble those up to our presenters, but if not, they’ll be on the BIA blog and we’ll send everyone a link. Barry, please feel free.

Barry: Thanks, Mark. Welcome everyone to our presentation. The first thing we want to discuss is the ABA model rule of confidence. And to highlight this rule quickly, it’s up to attorneys to be abreast of changes in the law, including the benefits and risks associated with relevant technology. To further that along, in 2016, the DC bar ethics opinion was issued, number 371, that said that it’s incumbent upon attorneys to be competent and zealous in their representation, which may require the investigation of potentially relevant social media postings of adverse parties and their counsel, other agents, and experts. That’s a very topic point obviously to our presentation today. And then one of the common threads across most of the BAR associations now is that notion of technical competence. Gallup California, sorry about that, whoever had the music on hold, California has issued its formal opinion that’s been often cited 1015:193. New York County Lawyer’s Association has their formal opinion as well that it’s the ethical duty of technical competence, with respect to the duty to protect the client’s confidentiality, including confidential information from cybersecurity risk and the handling of eDiscovery. So it’s out there as it’s a known entity or a known requirement that today attorneys should be well abreast of social media and its impacts on their various litigations.

There are a lot of preservation obligations associated with social media. I’ve got several cases listed here, I’ll just high spot them for us. The Cajamarca case, the first one listed, counsel failed to advise their client to preserve their Facebook communications. The plaintiff, in this case, was that person, and she deleted her Facebook posts and the end result was that the defendant, Regal Entertainment Group, obtained an adverse ruling and actually was awarded money for the failure of the plaintiff’s counsel to advise appropriately. Unfortunately Regal still lost the multi-hundred thousand dollar settlement, but they did recover several thousand dollars on that motion. In the second case down, the Kaitroll Case, interesting case. The defendant in this instance had deleted Facebook posts that showed that they were infringing upon the plaintiff’s trade style in how their restaurant was designed and so forth. The court required the defendant to restore the Facebook posts because they could still do that as they were still within the time frame. And as a result, the plaintiffs won their position. And then the poster child, for dealing with social media is I believe the Lester versus Allied Concrete Company. This case again is often cited and often talked about in webinars, but it makes the point that counsel had advised their client to clean up their profile, and as a result, the attorney in the case was sanctioned for over half a million dollars, and their client was also ordered to pay just under two hundred thousand dollars. So it’s out there, the courts are aware of it, and there are all sorts of obligations regarding protecting and maintaining eDiscovery.

And some other cases, and again here, given the interest of time, I’m going to high spot these as well. And the first case is the AvePoint case where claim of falsehood defamatory and deceptive tweets by the defendant. The court allowed the defendant to enter those tweets into evidence. And additionally, and we’ll talk about this in a little bit as well, the client had created a fake LinkedIn account and the fact that the defendant had done that was also allowed in as well. The Parker case is a case where a criminal was out on parole and had posted additional information after the parole was in effect, and showed one Facebook and so forth that the plaintiff or the party Parker was holding had guns and all sorts of things that were banned as a result of the parole and ended up back in the slammer for another couple of years. Move on to the next slide, and I believe you’re all going to get copies of the slide deck, the citations are here so you can dig back into these cases as you see fit.

One of the important cases here that I want to highlight though is this Gatto versus United Airlines because it’s very poignant for, in my opinion, one particular reason, and that is the relevance of terms of service in the social media platforms that all of us are familiar with. In this instance, Gatto had a personal injury suit against the airline and had unfortunately deactivated his Facebook account. The interesting thing here is that Gatto had not deactivated the account before the litigation had started, but had noticed an unusual login to his account, and as a result, closed it down. The unusual login or viewing of his account, because you can see that on Facebook who looks at your detail, was defense counsel looking at Gatto’s public posts on Facebook. And what happened was the account was closed, and defense counsel said it needed to be reinstated, however, in this instance, Gatto never reactivated the account, and the information posted on Facebook was no longer available because at that point in time Facebook had a policy where when an account was deactivated, data disappears after 14 days. Now it is 30 days or so, and I say or so because Facebook deactivates within 30 days, but the data isn’t quite gone for a period after that. So it’s important to know what your terms of service are, whether it’s a salesforce.com account, or it’s Twitter or any of the other commonly used social media platforms. Read those terms of service, they come into play all the time. And here’s, this I just pulled from Facebook’s site last week. They do not have a 30-day policy, and they do say that it may take them up to 90 days to do the data deletion. However, it’s not going to be accessible to you any longer after the 30 day cut-off. Maybe you can break into that 90-day frame and collect that data, but probably not likely.

And then, this slide is just representing the number and types of Cloud resources that are out there of a social media ilk that Josh will be talking to just in a couple of minutes. One of the other things to be aware of is on Twitter, there is the ability to observe tweets as they happen pretty much in real-time with some of the tools that are out there. And in this case, we had a client who asked us to monitor jury traffic within a certain geographic radius of the courthouse. And this is what we saw. Even though the court had instructed the jurors to not be talking, and unfortunately, they were. This particular bit of information just shows the wide prevalence of social media today. 1.5 billion daily users of Facebook, 126 daily users of Twitter, and it just goes on and on and on. It’s out there, and it’s in every one of our lives in one aspect or another. And it is implicated in many of the litigations that we see today.

We’re starting to bump up on some time considerations, but I will highlight these as well. Over half of attorneys, today see that social media is implicated in some of their litigation and some of their efforts now. A couple of the cases I have listed here, the Forman versus Henkin, and the Hinostroza cases are very similar. In each instance, the plaintiff alleged an injury of some sort, brain injury in the first case and slip and fall on the other. The plaintiffs did not want to disclose their social media posts, and in both of those instances, the court ordered that they should be admissible, including the private posts. And in both of those cases, the courts limited the time frame for the search of the private posts to a year before and a short period of time after the incident occurred. The Hummingbird case is interesting because it was an early case, from 2007. The court said with respect to both Facebook and yes, MySpace, that there was no expectation that the communications would remain confidential after, as I mentioned earlier, examining the terms of service and the privacy policies for both Facebook and MySpace. This graphic just shows the ever-expanding and widely used aspects of social media. Whether it be email, social media such as we know with Facebook and Twitter and LinkedIn and so forth, instant messaging, text messaging, as well as internal social media platforms that can be implicated. Some of the big ones that are used today are Slack, and Teams, and HipChat which is totally disappearing, and Google+ which is sunset. However some enterprising individuals have been able to scrape Google+ before the sunset at the beginning of April, and so all the public posts on Google+ are available in an archive situation. So that’s out there as well.

And so some of the dos and don’ts. It’s okay to examine public social media profiles. You should consider in almost every case, and in BIA’s opinion, you should retain an expert to collect and preserve that data. Some of the don’ts: don’t friend or follow the opposing party or jurors, don’t simply print the social media profiles, and Josh will talk in some detail about why that is something you should not do, and obviously don’t hack social media accounts. And as I mentioned with the pre-text, with the LinkedIn fake account, don’t pre-text or impersonate to gain social media info, specifically, you could run a file of the Gramm-Leach-Bliley Act or the Fair Debt Collection Practices Act. So how do you even begin to start identifying and evaluating and handling the ever-expanding universe here of data? And so some of the things that Josh will talk about are best practices developing a repeatable defensible workflow, which is something we talk about all the time here at BIA. If you are consistently doing something time after time after time, that in and of itself, if you’re doing it correctly, that becomes part of your process and procedures and it’s defensible, and use an expert to aid in your effort. So Josh here you go. 

Josh: Thanks, Barry. So I’m just going to go into a little bit of how we do our social media discovery at BIA. Typically, what we run most with our clients is our straight social media search. That’s where we’re going to be just doing a background search on the internet for any profiles of whomever we are hired to find. We’ll collect all those, all the profile information that is publicly displayed, and we’ll turn that into a physical report for our clients. When we extract that data, part of what is also collected is all the metadata from the profile. And that gets authenticated using hash values. I’ll go talk about hash values a little bit later. Essentially though, the hash values are what’s going to authenticate and allow this into evidence unlike a screenshot would. Another option we have is profile monitoring. Similar to our straight social media, we’ll use profile monitoring. We’ll find those profiles, create that report, we’ll check on these profiles weekly, monthly, whatever we’re asked of, and we’ll look for those changes and see if anything’s possibly being edited or deleted. Kind of looking for you know potential hiding of the evidence to establish some culpability. Similar to that is jury monitoring. We’ll actually do that same profile monitoring with the jury monitoring. That’s one aspect of it. Another one would be during board year we will help create character profiles that can assist our clients and their choosing of a jury. We’ll use things like the criminal background checks, along with their social media profiles to try and establish some sort of regular character profile of how this person might react to certain topics or maybe even discover how often they go on. If they go on daily you might be more likely to go on while you’re a jury member, when it’s against court rules. Obviously, that could end in a mistrial. Kind of similar to what is happening with the El Chapo case right now. Lastly, we also do news and article monitoring. It’s essentially how it sounds. We monitor the internet for any recent news articles for the subject that the client would like us to look for. We’ll check back on that periodically. 

And moving on, we’ll get into kind of our workflow here. Essentially, we will start with the background report. This kind of confirms identities. We’ll use things such as their family members, feeds, all of that will help us to confirm that the profile that we’re looking at is actually theirs. You can see their friends or find similarities in the likes on their posts. From there typically either go to Google, or we’ll go straight to Facebook. We find that Facebook is the most helpful platform to find because of the way they list their friends. They use real names often and maybe even you might find a nickname or something that is used that will help you find a profile on a different platform. When they have pictures that additional resource will help you find other profiles. Sometimes you can identify other profiles through those pictures that are listed on Facebook. We’ll use search engines, typically at the end such as Google or Duck Duck Go, and search for the name. That’s kind of our catch-all to make sure we aren’t missing anything. 

Typically, once we’ve found these profiles, we’ll provide them to our digital forensics team. We’ll have them put these URL’s into their extraction program. What happens there is as the program is extracting the data live, it assigns hash values to it. Hash value simply is a digital fingerprint. This allows you to corroborate that the data is there and that it is untouched. If you run that report again and the values have changed, that’s going to indicate that something had been edited, something had been deleted, something has been added. MD5 and SHA1 algorithms are typically the most popular for hash values. The report comes out with that metadata and its associated post or other information on the profile such as place of living, pictures, friends, etc. And it matches the metadata with that profile image. 

Barry: And Josh let me step in here for a sec. This metadata table that you see now, this is only an excerpt of probably a hundred different factors that we capture when we do social media collection. This is one of the key reasons, if not the primary reason, to not just do a screen capture of social media. You miss this information. The metadata, whether this is a Facebook collection, it’s similar for other social media collections. So it’s an important aspect that we don’t want to miss when you’re doing or when we’re doing a social media collection. This makes it entirely defensible and supportable in court. I’ll move on to the next slide for you. 

Josh: So running this we run into a lot of random difficulties and setbacks. One of the most common ones are the naming about the subjects. You come across somebody such as Robert Smith, obviously, there is going to be a lot of Robert Smiths’ on social media platforms. It is up to us to determine which one is the correct one if we could even find the correct one. Similar to that is ‘ethnic names’. Often we see something that looks very original to our American eyes and come to find out that it might be an extremely common name in Spain. Or if you get a name like Mohammad, which is known as being one of the most popular names on the planet, it makes it very difficult to distinguish which one is correct. Sometimes you run into having to determine which name is first when looking at the profiles because of the way that naming works in say China. Occasionally we run into foreign alphabets where the person’s name is written in Hindi or something similar to that. Nicknames can be another place of trouble. You might come to find out that they have a nickname they go by and all their social media profiles are under that name. That is kind of why Facebook is one of the best places to start if you can find family members that can lead you to your subject. If you find out if they have a nickname that can help you find out other profiles. Divorcees, widowers, oftentimes background reports don’t necessarily give you the name they are using for their profiles – whether it’s hyphenated, whether they’re using their married name or their maiden name. 

Obviously private or protected accounts, there is some public-facing data typically. You can only collect the public-facing data. Oftentimes though it is not enough that we would collect it. There’s just not much there to work with. Searching using the platforms can be extremely difficult, especially Facebook for instance. They have filtering capabilities, but the filtering capabilities often work against you. Security updates are something we are constantly battling with. The program is set to work with certain security standards. If those get updated, then our program either needs to wait for an update or we need to find a workaround such as manually operating the extractions. And then sometimes the program can crash, etc. If you’re running these extractions for days, you get set back you know five or seven days and have to restart it. 

Barry: Josh, let me step in and just identify that there are some field-specific social media sites that may be implicated in your matter. There are medical practitioners specific platforms, we name three of them here, similar for other professionals. It’s something to be aware of and how you ferret that out is to ask custodians as to what other social media platforms you might be using. They might be relevant in your particular case. Lastly, with respect to social media collection, and we talked about this with the jury selection issue, there is the ability with technology to draw a radius or circle or rectangle around a specific point and track all Twitter conversations in that particular geographic area, and as Josh had mentioned in the El Chapo case there were jurors talking on Twitter that may lead to a mistrial in his instance. It’s something that is very informative, interesting, and can be very effective. 

A couple of war stories to go through very quickly. We did a social media collection a little while ago and found a lifeguard that had claimed severe injury. She was indeed injured, ruptured her Achilles tendon, and said that she was now unable to enjoy herself in her normal social activities in exterior activities. We found through rigorous investigation on social media through friends and family that she was taking exotic vacations after injury, climbing waterfalls, and doing diving, and so forth and so on. And she clearly was not injured to the extent that she had claimed. And our next story, parents had claimed their child had received an injury at birth that had severely limited the child’s athletic ability. And in reality, that wasn’t the case. The child grew up attending football and soccer camps and was able to run 100-yard dash, well beyond his age. So again, social media allowed us to refute the claims. 

So as I mentioned a little bit ago, custodian involvement is key. The custodian is likely to be that person who is most knowledgeable with the client and is able to identify and segregate relevant information. So again, talking with custodians is a very important thing to do at the outset of your case, and as it is ongoing. It’s important because they are able to do the best with respect to data identification. And how BIA does it and how we would recommend it for most people, most clients, and most cases, is to interview the key custodians. But when you’ve got more than just a handful of custodians in your case, utilize a custodian questionnaire template that allows you to reach out to all of your custodians at one time with a set of questions. You may stratify it so that marketing people have one set of questions, engineering may have another set of questions, but then the report comes back where you can compare and contrast the answers. To that point, Mark, I’ll turn this back to you. Thank you all. If you have any questions that we have time to answer we’ll do that, otherwise thank you all for attending. Mark? 

Mark: Barry, Josh, thank you both. That was a lot of information to get through in a short period of time. We’re a couple of minutes over our cut-off time, but any questions that did come in we’ll put up on the BIA blog as I said before, and pass a link out to everybody that joined us today. Thank you very much for joining us for this find the smoking gun webinar, and hopefully, we’ll see you again soon on another ACEDS webinar. Have a great day.