Collecting Social Media Records For eDiscovery Investigations
By
Michael Riedyk

 

Social Media Is Risky Business

Today, over 73 percent of the US population utilizes some type of online community. In this moment in time, Facebook itself has more active users than China’s entire population; 1.40 billion.

ediscovery

While much of this use is personal, businesses are equally capitalizing on social media’s benefits of extended reach, flexibility and freedom as a means of communication. Across industries, organizations have jumped on the opportunity to use social media as a tool for branding, customer service, and sales – with a projection that digital sales could account for more than 40 percent of new inflow revenue within the next 5 years.

76 percent of businesses regard communications on social media as formal business records. Click to Tweet

Yet organizations are putting themselves at serious risk by using these networks blindly. 76 percent of businesses regard communications on social media as formal business records, but alarmingly, an overwhelming 46 percent have no idea that they carry actual legal responsibility for their social media content. Regulatory purposes aside, lawsuits and investigations now require social media discovery more than ever, posing a number of eDiscovery challenges with the multifaceted nature of these networks. This calls for a serious reminder of the need to treat social media just like all other official forms of business communications; that must be collected, filed and protected.

The Growing Use of Social Media in Investigations

Given the vast amount of information placed by individuals on websites, blogs and social media by the day, hour and minute, the internet is a rich resource of endless, up-to-date information and can provide great insight into an individual’s or organization’s intentions.

This is changing the eDiscovery landscape as we know it. Cases involving social media have continued to increase at a rapid pace, aiding cases all the way from workplace harassment to copyright infringement. A Lexis Nexis study found than 86 percent of investigators are using social media 2-3 times per month in the course of their duties. Digital evidence relevant to all these cases can come in a variety of forms; such as tweets, social media chat logs, instagram images, web pages, blog posts, Linkedin connections and a litany of others.

Social media poses unique archiving challenges that need to be considered.

86 percent of investigators are using social media 2-3 times per month in investigations. Click to Tweet

Multifaceted Nature

Unlike other forms of content, social media can often contain videos, images, comments and likes. For this reason, it’s important to find an archiving solution that captures all this content.

Deep Linked Content

A good 30 percent of social media messages contain links to third party website content. These links can change easily over time, or, if shortened with a URL shortener (i.e shortening a link:

https://www.pagefreezer.com/financial-services/ to http://ow.ly/10bDE4 or http://bit.ly/21WWqnz) will only be valid for a designated period time before they invalidate as links.

Also, web pages that are linked can commonly be deleted or changed over time. This makes capturing actual URLs and linked web pages a difficult task. An ideal solution not only collects the social media messages, but is also able to look up the original URL and automatically collect the deep linked web page for later reference.

Ever Evolving Platforms

Although social media networks like Twitter, Facebook and Linkedin may have much in common (like the ability to hashtag), they are also extremely unique. A common issue with archiving this content is that these platforms continue to change without any notice. Once a method for collecting content is determined, another update, or rise of new social media platform develops. It is difficult to keep up and customize without knowing what’s coming.

Real Time Activity

The beauty of social media is the speed in which it operates. With content being posted on twitter every second, archiving technologies need to be crawling regularly, capturing the absolute most recent content as it comes about.

Integration Requirements

Since simple screen shots won’t suffice in court. Organizations need the APIs of these networks to be able to integrate with their own applications to gather the information needed. APIs are unique to each network.

Record Keeping Expectations For eDiscovery

As digital information is easy to create, fake or alter, how do investigators collect and preserve social media evidence? How do they ensure the chain of custody is unimpeachable? How can they authenticate the evidence so that courts will accept it without question?

A screenshot or print screen is a common first step, but the problem is that screenshots can easily be photoshopped, and so are not an acceptable form of evidence as required by the Federal Rules of Evidence (FRE), Federal Rules of Civil Procedure (FRCP) and the E-Sign Act.

  • Federal Rules of Evidence
    FRE Rule 901 requires that Electronically Stored Information (ESI) like social media content must be authenticated to verify it is what it claims to be. Collecting metadata is often an expectation to help authenticate content.
  • Federal Rules of Civil Procedure
    The FRCP Rules 26 and 34 require organizations to collect, and be able to produce all necessary information for relevance and litigation if necessary. Rule 37 states that sanctions may be placed on parties who do not respond to discovery requests, or who fail to cooperate in the process.
  • E-Sign Act
    The E-sign Act is a federal law that allows the use of e-signatures to validate the data integrity and authenticity of digital files, including emails, office documents, social media messages and webpages; satisfying legal and regulatory compliance requirements.

Capture Checklist

In summary, these laws state that for social media and webpage evidence to be valid and accepted:

  • Original source code of the social media message, blog or webpage must be collected
  • Metadata must be collected
  • Digital signatures and time stamps must be placed on the data to provide evidence of data integrity and authenticity
  • Data should be prepared in EDRM-XML for easy processing and analysis in eDiscovery systems

Michael Riedyk is the co-founder of PageFreezer. PageFreezer is a SaaS (Software-as-a-Service) application that enables organizations and corporations of all sizes to permanently preserve their website and social media content in evidentiary quality and replay them as if they were still live. Uses for the archived data range from compliance with regulators such as the SEC, FINRA and the FDA to litigation preparedness, evidence capture, call center support and competitive intelligence.

RELATED ARTICLESMORE FROM AUTHOR