Tag Archives: evidence

June 19, 2012 · 7:00 AM

Case Study: The Importance of Integrated Social Media and Website Crawling Collection

One of the benefits of the very strong market adoption of our X1 Social Discovery software is that we receive a significant amount of invaluable and excellent customer feedback from very seasoned eDiscovery and law enforcement professionals. Many of these experts report that a good number of their social media investigation and collection cases also require general website collection. For instance, a person on Facebook promoting infringing technology may also be posting relevant information to industry web bulletin boards or maintaining their own website. It is thus important that a social media eDiscovery and investigation process feature integrated web collection and social media support.

For an effective process, website data should be collected, searched and reviewed alongside social media collections in the same interface. The collected website data should not be a mere image capture or pdf, but a full HTML (native file) collection, to ensure preservation of all metadata and other source information as well as to enable instant and full search and effective evidentiary authentication. All of the evidence should be searched with one pass, reviewed, tagged and, if needed, exported to an attorney review platform from a single workflow.

To illustrate what this looks like in the field, we recorded an 8 minute demonstration based in part upon a real life example reported to us by one of our customers. This case study, performed by our CTO Brent Botta, involves the collection of social media data as well as message board posts on the web. Importantly, this evidence is consolidated into a unified workflow to be searched in one single pass.

The investigation features X1 Social Discovery as the platform, which now features automated and integrated web crawling capabilities in addition to its renowned functionality for the collection and analysis of Facebook and Twitter content. We believe this is the only solution of its kind to collect website evidence both through a one-off capture or full crawling, including on a scheduled basis, and have that information instantly reviewable in native file format through a federated search that includes multiple pieces of social media and website evidence in a single case. Up to millions of web captures and social media items are searched instantly with the patented X1 search, tagged and exported from a single interface.

Like social media content, web pages bring their own unique but important challenges for evidentiary authentication. In the next week, we will be posting on best practices for the collection and authentication of web pages as evidence, so stay tuned!

Leave a comment

Filed under Best Practices, Preservation & Collection

Tagged as , , , , , , , , , , , , , , ,

December 12, 2011 · 10:29 AM

Legal Experts: Attorneys Have an Affirmative Duty to Address Social Media Evidence

First, many thanks to all who participated in our legal ethics and social media evidence collection webinar. Special thanks also to the esteemed Ralph Losey of Jackson Lewis for his participation. Ralph provided informative legal insight as always on this topic and there were many excellent questions and comments by participants. For those who did not attend, you can view and listen to the full recording here. (There is 1 hour MCLE ethics credit available for California attorneys who review the recording in its entirety).  

During the webinar, Ralph noted in the Q&A session that given the widespread importance of social media evidence to just about every type of litigation and investigation matter, it is incumbent on attorneys and their hired consultants to understand and address social media evidence as a standard practice. Losey cited the professional ethics and standards relating to the duty of competent representation. He is not the only prominent attorney or even court to proclaim this. In Griffin v. Maryland, which involved key social media evidence, the court opined that “it should now be a matter of professional competence for attorneys to take the time to investigate social networking sites.” (citing, Sharon Nelson et al., The Legal Implications of Social Networking, 22 REGENT U.L. REV. 1, 1-2 (2009/2010))

Additionally, in her excellent and comprehensive Delaware law review article, “Ethical Risks Arising From Lawyers’ Use of (and Refusal to Use) Social Media,” 12 DEL. L. REV. 179 (2011), attorney Margaret M. DiBianca asserts that the legal duties of competency and duty of diligent representation require that attorneys account for social media in the course of their discovery and investigation efforts. DiBianca pointedly notes that “[n]aysayers and late adopters alike may be equally surprised to learn that ignoring social media altogether may constitute a violation of their ethical obligations.”

And as we outlined a few weeks ago, the Plaintiff’s attorney in Lester v. Allied Concrete Company did not equate social media evidence with more traditional forms, causing him to blithely instruct his client to rid his Facebook page of damaging evidence, resulting in what many attorneys believe is the most severe eDiscovery court sanction imposed upon a lawyer. However, for every situation like the Lester case where relevant social media is brought to the forefront, there are presumably many others where important social media evidence is overlooked by attorneys and their service providers who do not include social media as part of their standard eDiscovery process checklist. As it is now established that social media is highly relevant as evidence, it is important that attorneys, paralegals, eDiscovery consultants and investigators proactively seek out such evidence and include its investigation in their standard processes and checklists. Many legal experts would say professional standards of care require it.

1 Comment

Filed under Legal Ethics & Social Media

Tagged as , , , , , , , , , , , , ,

November 9, 2011 · 11:26 AM

674 Published Cases Involving Social Media Evidence

Many in the legal and eDiscovery field cite the very illuminating research from the Duke Law Journal published in the spring 2011, which, based upon their search of the case law, identified nearly 300 federal court decisions through the end of 2009 that awarded e-discovery sanctions. This survey and others like it reinforce the sentiment that eDiscovery is crucial to nearly all litigation and internal investigation matters.

The work of the Duke Law Journal inspired us to search an online legal database of state and federal court decisions across the United States to identify the number of cases where evidence from social networking sites played a significant role. The numbers were quite an eye opener and exceeded even our high expectations.  From January 1, 2010 through November 1, 2011, 674 state and federal court cases with written decisions available online have involved social media evidence in some capacity.

The search was limited to the top four social networking sites and the tally came out as follows: Myspace (326 cases), Facebook (262), Twitter (49) LinkedIn (37). The numbers excluded results where the social networking site was either named as a party to the case or where such cases were cited as precedent.

Some quick analysis behind the numbers:

  • Sampling review indicates that a significant percentage if not the majority of the Myspace cases generally involved criminal matters.
  • While fewer in number, the Twitter and LinkedIn cases tended to involve higher stakes litigation such as corporate trade secret theft, trade libel, copyright, class action employment matters, and trademark infringement. (See e.g. AGENCE FRANCE PRESSE v. MOREL and Getty Images, In re Application of Chevron Corporation, Blayde v. Harrah’s Entertainment, Inc.)
  • Sampling review also suggests that simple printouts and screen captures or direct testimony of representatives from social media providers in criminal cases were the means used to obtain this evidence.
  • In several dozen cases the court addressed, and in several instances sustained, objections to the evidentiary authentication of social media evidence. This reaffirms that the authentication of social media evidence without best practices technology is a major concern.

This survey of course does not reflect the presumably exponentially more cases involving social media evidence but without a written opinion available online that reflects that involvement. Even so, these numbers are an important data point establishing the ubiquitous nature of social media evidence.

4 Comments

Filed under Authentication, Case Law

Tagged as , , , , , , , , , , , , ,

October 25, 2011 · 7:25 PM

Limitations of Facebook “Download Your Information” Feature for eDiscovery Preservation

In October 2010, Facebook provided a “Download Your Information” (“DYI”) feature to provide a means for a user to download to their computer data they have posted to their own accounts, including messages to and from friends.  It is built on top of Facebook’s Graph application programming interface and creates a compressed ZIP file.  “You really will have a copy of all your information in one place,” said David Recordon, Facebook’s senior open programs manager upon the announcement of the feature. “We built this product as something that’s useful for people, not for other developers.”  But is DYI useful or defensible for eDiscovery?

In making that assessment it is important to understand that the following key information is not included in Facebook’s DYI:

  1. Certain contributed content to other friend’s accounts. If an account owner/custodian were to post a picture to a friend’s wall, that post and associated comments would not be collected by DYI.
  2. Photos of the custodian posted to other users’ wall. Facebook allows a feature for users to tag photos to identify their friends who appear in a picture they are posting.  Unless that picture also appears on the custodian’s wall, it will not be collected by DYI, even though such photos are available to the custodian in the “photos of you” feature.
  3. Most Metadata Fields. Facebook contains over 20 unique metadata fields, all of which can be very important as substantive evidence or as information that helps establish an evidentiary foundation, which is particularly important for social media evidence.  DYI items include 2 metadata fields displayed in plain text.

As Facebook DYI is not designed to be an eDiscovery tool, it will not generate hash values of the information or provide a defensible chain of custody. KPMG, a leading eDiscovery service provider recently published a blog post constituting negative peer review of Facebook DYI, noting that Facebook DYI “was not conceived to be a forensic collection tool. The only original timestamps that it preserves are in the HTML files which can be easily modified.” 

As always, legal and eDiscovery professionals should test and validate their methodologies they employ to preserve and collect evidence and be aware of the emergence of best practices technologies in the industry that are subject to positive peer review.

3 Comments

Filed under Best Practices, Preservation & Collection, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , , , ,

October 3, 2011 · 7:36 PM

Facebook Evidence Disallowed By Court Due to Lack of “Identifying Characteristics”

There has been a lot of discussion on the recent case of State of Connecticut vs. Eleck, 2011 WL 3278663 (Conn.App. 2011), which highlights the importance of employing best practices technology to collect, preserve and produce social media evidence. In this case, defendant Robert Eleck sought to admit Facebook evidence at trial that would have impeached a prosecution witness, Simone Judway.  Judway denied authorship of the Facebook messages in question, claiming someone must have hacked her account, even though the evidence revealed that the hacking occurred after the subject messages were sent.  The court determined that Eleck, who offered only a simple printout of the Facebook items, failed to adequately authenticate the data, ruling that “it was incumbent on the defendant, as the proponent, to advance other foundational proof to authenticate that the proffered messages did, in fact, come from Judway and not simply from her Facebook account.”

Importantly, the court noted that while the emergence of social media evidence does not necessarily require new rules of evidence, “circumstantial evidence that tends to authenticate a communication is somewhat unique to each medium.”  The court cited precedent cases where emails, chat logs and texts were properly admitted based upon their supporting and unique metadata and other circumstantial evidence that provide “identifying characteristics.” See, e.g. United States v. Siddiqui, 235 F.3d1318, 1322-23 (11th Cir.2000) (e-mails properly authenticated when they included defendant’s e-mail address, the reply function automatically dialed defendant’s e-mail address as sender, messages contained factual details known to defendant, messages included defendant’s 625*625 nickname, and other metadata.) Dickens v. State, 175 Md.App. 231, 927 A.2d 32, 36-38 (2007) (threatening text messages received by victim on cell phone were properly authenticated when circumstantial evidence provided adequate proof message was sent by defendant); In re F.P., 878 A.2d91, 93-95 (Pa.Super.Ct.2005) (instant messages properly authenticated through circumstantial evidence including screen names and context of messages and surrounding circumstances).


State v. Eleck clearly illustrates why it is important to collect and preserve Tweets, Facebook and LinkedIn entries in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries or a combination of them contrasted with other entries can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our social media evidence white paper).

When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court.

6 Comments

Filed under Authentication, Case Law

Tagged as , , , , , , , , , , , , , , , , , , , , , ,