Tag Archives: evidence

Gibson Dunn Report: Number of Cases Involving Social Media Evidence “Skyrocket”

By John Patzakis

Global law firm Gibson Dunn has released their esteemed 2015 Mid-Year eDiscovery and Information Law Update.skyrocket In a section dedicated to social media, the Gibson Dunn update reports that “the use of social media continues to proliferate in business and social contexts, and that its importance is increasing in litigation, the number of cases focusing on the discovery of social media continued to skyrocket in the first half of 2015.”

The eDiscovery update addresses key themes and several cases involving key legal issues related to social media evidence, which were previously addressed on this blog. Two key highlights cite cases affirming that mere screenshot printouts of social media evidence are not defensible and clarify overall authentication requirements in order to admit social media evidence in court.

As noted by the report “in the first half of 2015, courts continued to find that the testimony of the individual who printed a copy of a social media webpage, or prepared a memorandum summarizing information obtained from the social media account, is insufficient to authenticate social media evidence.” The report cites Linscheid v. Natus Medical Inc., 2015 WL 1470122, at *5-6 (N.D. Ga. Mar. 30, 2015) (finding LinkedIn profile page not authenticated by declaration from individual who printed the page from the Internet); Monet v. Bank of America, N.A., 2015 WL 1775219, at *8 (Cal Ct. App. Apr. 16, 2015) (finding that a “memorandum by an unnamed person about representations others made on Facebook is at least double hearsay” and not authenticated).

The Report also cited “a major shift” in case law concerning the authentication of social media evidence. The Court of Appeals of Maryland determined that “in order to authenticate evidence derived from a social networking website, the trial judge must determine that there is proof from which a reasonable juror could find that the evidence is what the proponent claims it to be.”  Sublet v. State, 113 A.3d 695, 698, 718, 722 (Md. 2015) (citing U.S. v. Vayner, 769 F.3d 125 (2d Cir. 2014)). Previously in Maryland, social media evidence was admissible only if the judge was “convince[d] . . . that the social media post was not falsified or created by another user.”  Griffin v. State, 19 A.3d 415 (Md. 2011).

Under Sublet, the preliminary determination of authentication is made by the trial judge and is a “context–specific determination” based on proof that “may be direct or circumstantial.” Id. at 715 (citing Vayner). The court noted that “[t]he standard articulated in Vayner … is utilized by other federal and State courts addressing authenticity of social media communications and postings.”

These cases cited by Gibson Dunn illustrate why best practices software is needed to properly collect and preserve social media evidence. Ideally, a proponent of the evidence can rely on uncontroverted direct testimony from the creator of the web page in question. In many cases, such as in the Vayner case where incriminating social media evidence is at issue, that option is not available. In such situations, the testimony of the examiner who preserved the social media or other Internet evidence “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a finding” that the website documents are what the proponent asserts. Perfect 10, Inc. v. Cybernet Ventures, Inc. (C.D.Cal.2002) 213 F.Supp.2d 1146, 1154. (emphasis added) (See also, Lorraine v. Markel American Insurance Company, 241 F.R.D. 534, 546 (D.Md. May 4, 2007) (citing Perfect 10, and referencing MD5 hash values as an additional element of potential “circumstantial indicia” for authentication of electronic evidence).

One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship.

Leave a comment

Filed under Case Law, eDiscovery, Social Media Investigations

Social Discovery: An Interview With Howard Williamson

This week’s blog is something new for X1 – a Q & A with Howard Williamson, the General Manager for X1’s market leading Social Discovery product.  Howard is an experienced digital forensics expert and began his career in law enforcement, which gives him a unique perspective on the practice of social discovery.  I had the pleasure of interviewing Howard this week on what is a very hot topic – social discovery.

Why Social Discovery?

Howard:  I remember back in the mid-1990’s there was a real feeling of excitement around digital forensics.  It was the cutting edge of the forensics field and the work was really fun.  Social media is now what digital forensics was in the mid to late 1990s – it’s the cutting edge of where investigation and intelligence is right now.  The work is fun because there are lots of challenges; the fun part is taking the practice from good to great.  That is what attracted me to the opportunity at X1 – because X1 Social Discovery can make the practice great because the product addresses the challenges of defensibly collecting a high volume, diverse data set like social media.

How does the law enforcement background complement this role?

Howard:  Ultimately, the goal of social discovery is to collect data in a manner that allows it to be used in criminal or civil litigation.  Knowing how that process works is critical.  The law enforcement background gives that experience of defensible collection across many different types of digital evidence.  And, on the criminal side of things, the standards of defensibility are quite high, so carrying that over to the civil side means that X1 will always meet high authenticity standards.  I bring that high bar from the digital forensics world to this brave new world of social media.

What’s new about this practice?
Howard:  The nice thing about now versus the mid-1990s is that we are now using purpose-built tools like X1 Social Discovery rather than co-opting system administration and network tools like we did in the early days of computer forensics.  That makes the Modern evidenceprocess more efficient and more complete.
Rather than using a sledgehammer to put a nail in, we are using a hammer.  The tool is built specifically for social discovery and therefore makes the practice more efficient.  Whereas in the early days of digital forensics, collection procedures where often made up on the fly, with Social Discovery, the approach is much more structured and systematic.  At X1, with our experience, we are certainly able to think and react on the fly to new challenges, but with a purpose-built tool, we can do so much more efficiently.  And, in the eDiscovery world, efficiency and defensibility are two very important things.

Are you seeing social discovery specialists pop up? 

Howard:  What we are seeing is that digital forensics professionals and intelligence professionals are implementing social discovery into their processes and procedures.  There are not “specialists” in social media; rather, the social discovery tool allows more people to collect this type of data as part of a broader job.  They are also doing things like mobile forensics and other digital forensics.  Thus, X1 Social Discovery has become an important tool in their toolkit.  The tool actually makes it easier to bring social media content into the collection because the professional doesn’t have to dive deep into things like mobile operating systems.  It becomes easier to be an expert in social collection because the product makes it simple to collect and analyze.

Do you think that Social discovery is a mainstream practice now?

Howard:  It absolutely is.  The evidence of that is our business.  X1 has nearly 500 paid install sites and nearly 4,000 end users conducting social discovery.  These users got ahead of the curve and have social media integrated into their processes.  The growth opportunity is still huge because it is inevitable that case law will force everyone to take social media more seriously, in the way that the Enron case put a spotlight on electronic discovery in general.  Law enforcement got the importance of social media evidence early on.  Even though a more typically cautious industry, police departments see that social media is a critical form of evidence and have built it into collection processes.  This is how most areas of forensics have evolved.   There is an attitude that, if it’s good enough for criminal law, it’s good enough for civil court.  That is part of what’s exciting for X1 – we have a great base of law enforcement customers putting the product through the paces.  X1 Social Discovery is truly battle-tested and no other solution works quite as well.  We are nicely positioned as the social discovery leader in a mainstream market with high growth potential.

What should we look for in the next year of social discovery?

Howard:  I would expect to see the big social networks continue to gain traction.  I don’t foresee a new behemoth social network to challenge the popularity of Facebook and Twitter.  From an app perspective, self-destructing messaging looks to remain popular as privacy becomes more of a concern.  Forensics will play a large role in determining whether those messages are truly destroyed or actually discoverable.

X1 will continue to build out connectors to more and more social networks and improve reporting and deliverables.  There will be more ability to analyze the data within the investigation platform.   What X1 wants to enable is people to do their jobs within a given workflow.  Some users will want to collect and review social media directly within X1, and the tools enables them to do that.  Others have examiners collect the data, but then move to a review tool where litigators can look at it.

Big thanks to Howard Williamson for sharing his time with us.  If you have questions about social discovery, please contact us at info@x1.com for more information.

_________________________________________

Catch Howard’s lecture at HTCIA’s Annual Conference, Tuesday, August 26, where he will cover Social Media Collection and Review >

 

 

 

 

 

 

 

 

 

 

Leave a comment

Filed under Best Practices, Social Media Investigations, Uncategorized