Author Archives: X1

December 9, 2014 · 8:10 AM

Social Media Evidence Law Update: Numerous Recent Decisions Disallow Social Media Screen Prints as Evidence

by John Patzakis

In recent months, courts in several reported decisions have excluded evidence in the form of screen captures of social media. These court decisions greatly impacted the overall matter, including directly resulting in the overturning of a criminal conviction. scales-justice-no-printThis is a very important trend as many criminal investigators and litigation support practitioners continue to rely on print screen without realizing the now torrent level of case law disallowing such evidence.

In the most recent example, in Moroccanoil vs. Marc Anthony Cosmetics, — F.Supp.3d —- (2014) a federal district court explicitly ruled that Facebook screenshots were inadmissible as the defendant in a trademark infringement action merely offered the screenshots without supporting circumstantial information, which is difficult to obtain when mere screenshots are relied upon. The Moroccanoil court cited Internet Specialties W., Inc. v. ISPWest, 2006 WL 4568796 which in that case ruled: “Defendant’s argument, that [web pages] could be ‘authenticated’ by the person who went to the website and printed out the home page, is unavailing.” The Moroccanoil court applied the same rule to Facebook screenshots.

In the criminal context, in United States vs. Vayner, 2014 WL 4942227 (C.A. 2 (N.Y.)), A US Federal Appellate Court, Second Circuit, recently overturned a criminal conviction upon finding that the lower court erroneously admitted a screenshot of the defendant’s alleged social media profile due to improper authentication. Earlier this year, in Commonwealth v. Banas, 2014 WL 1096140 a Massachusetts Appellate Court also ruled that a screen print of Facebook post submitted by the prosecution in a criminal case to be inadmissible on authentication grounds.

The courts that produced these decisions are very influential and these decisions will impact standards for, and the scrutiny of, all social media evidence collection in criminal and civil matters nationwide.

(As a side note, these recent decisions and other key issues involving social media evidence will be discussed at length in a December 16 webinar featuring computer forensics expert Craig Ball and Reed Smith eDiscovery counsel Patrick Burke: A Practical Approach to Social Media Discovery. The top-line speakers will cover the importance of social media discovery in today’s cases, recent challenges and best practices. The event is one week away as of this writing but — as a testament to this compelling and timely topic — we have nearly 600 registrants and seats are limited, so I encourage you to register now.)

The cases cited above and many others like them illustrate that social media provides torrential amounts of evidence potentially relevant to litigation matters, with courts routinely facing proffers of data preserved from various social media websites. One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available circumstantial evidence in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our white paper available here).

Additionally, when an examiner merely relies on print screen, they also severely limit the scope and thoroughness of the social media and internet collection. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This allows the examiner to build a much stronger case for authentication by building timelines, drawing more connections between witnesses and their various posts, collecting more collaborating metadata, and a litany of other means to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

So in sum, you can either have your cake and eat it too with X1, or incur much higher costs, overlook mountains of potentially case-winning evidence, arguably violate your ethical duty of competence, and face evidentiary challenges in court with print screen. Seems like an easy decision.

Leave a comment

Filed under Best Practices, Case Law, Social Media Investigations, Social Media Metadata

Tagged as , , , , , , , , , , , ,

December 3, 2014 · 7:55 AM

X1 CEO Message: A New Approach to Enterprise Search Resonates

by John Patzakis

In my two and half year tenure as CEO here at X1, we have seen tremendous progress and exciting growth with our next generation search solutions: X1 Search 8 and X1 Rapid Discovery. During this time, I have taken the very valuable opportunity to listen to our end users, executive sponsors and key stakeholders in IT about their X1 experience, their input on our product roadmap, and their perspectives on broader enterprise search.

On the enterprise search front, the recurring theme we hear again and again is that outside of the data managed by X1, enterprise search is a source of major frustration for organizations. This is confirmed by survey after survey where the vast majority of respondents report dissatisfaction with their current enterprise search platform. Simply put, the traditional approach to enterprise search has not worked. This is largely because most search solutions deployed in recent years focused on IT requirements — which see search as either a technical project or a commodity —rather than being end-user driven.

At X1, however, many of our customers report real progress with enterprise search, with firm-wide X1 rollouts being major wins at their organization. We believe that X1’s unique focus on the end-user is the key. You won’t find many other business productivity search solutions where the end users drive demand, instead of the tool being imposed on the end-users by IT or systems integrators. We continually hear countless testimonials from our users, at companies large and small who swear by their X1 and cannot imagine working without it. In speaking with industry analysts and other experts in the enterprise search field, this is an almost unheard of phenomenon, where end-user satisfaction with the companies’ enterprise search platform is usually around 10-15 percent, verses the 80-85 percent satisfaction ratio we see with X1.

So in view of this customer and industry feedback, we coined the phrase “business productivity search” to differentiate what X1 focuses on verses most other enterprise search tools, which are typically re-fashioned big data analytics or web search appliances. And the feedback we’ve received on this from end-users and industry experts alike is that this assessment hits the nail on the head. Business productivity search is not big data analytics and it is not web retrieval. It is its own use case with a workflow and interface that is tailored to the end users. X1 provides the end-user with a powerful yet user-friendly and iterative means to quickly retrieve their business documents and emails using their own memory recall as opposed to generic algorithms that generate false positives and a workflow ill-suited to business productivity search.

This analysis is crystalized in the accompanying chart differentiating X1’s approach to business productivity search versus big data analytics and web search.

3_forms_table

Click image to enlarge

These points are further explained in our four page white paper: Why Enterprise Search Fails in Most Cases…and How to Fix It.   But perhaps the most compelling illustration is this testimonial from 2013 Nobel Prize Winner in Chemistry and Stanford professor Dr. Michael Levitt, who states: “X1 is an intimate part of my workflow — it is essentially an extension of my mind when I engage in information retrieval, which is many times an hour during my workday.” In my opinion, you will not find that level of enthusiasm by end-users for other enterprise search platforms.

And X1 is a platform. Users need a single-pane-of-glass view to all of their information – email, files, SharePoint, archives like Symantec Enterprise Vault, and other enterprise repositories.  X1 Search 8 and our enterprise extension X1 Rapid Discovery provides just that – a user-friendly interface to all information that lets workers use their minds to find what they are looking for in an iterative search tailored by the end user.

But the hundreds of thousands of X1 end users know all this. The key takeaway for CIOs and other IT executives is that search is an inherently personal user experience, and the number one requirement, by far, for a successful search initiative is enthusiastic end-user adaptation. If the business professionals in your organization are not passionately embracing the search solution, then nothing else matters.

Leave a comment

Filed under Business Productivity Search, Enterprise Search

Tagged as , , , , , , , , , , , ,

November 17, 2014 · 12:01 PM

Amazon Re:Invent – With the Cloud, Avoid Mistakes of the Past

Last week, I had the opportunity to attend the Amazon Re:Invent conference in Las Vegas. Over 13,000 people took over the Palazzo for deep dive technical sessions to learn how to harness the power of Amazon Web Services (AWS). reinventThis show had a much different energy than other enterprise software conferences, such as VMworld.  Whereas most conferences feature a great deal of selling and marketing by the host, Amazon Re:Invent was truly more of a training show. Cloud architects spent a lot of time in technical bootcamps learning how AWS works and getting certified as administrators.

That is not to say that there was no selling or marketing going on; the exhibition hall featured myriad vendors that augment or assist with AWS deployments and solutions. The focus on the deep technical details, though, does point out the fact that we are still in the very early days of the cloud. Most of the focus of the keynotes was about getting compute workloads to the cloud – there was not a lot of mention of moving actual data to the cloud, even though that is certainly beginning to happen.  But, that is how the evolution goes. IT departments need to be comfortable moving workloads to the cloud as they begin to leverage the cloud. Building this foundation is also important to Amazon – the goal would be for many companies to completely outsource the IT data center.

It is important, however, to proactive plan for information management as more workloads and, importantly, data move to the cloud.  As the internet first emerged, companies dove into new technologies like email and network file shares only to create eDiscovery nightmares and make it virtually impossible to find information within digital landfills. It is key to learn from those mistakes rather than to repeat them when leveraging cloud-based technologies. In order to ensure both that end-users are happy with search experiences on data in the cloud and that Legal can do what they need to do from an eDiscovery standpoint. This means providing business workers with unified access to email, files, and SharePoint information regardless of where the data lives. It also means giving Legal teams fast search queries and collections. But, Cloud search is slow, as indexes live far from the information. This results in frustrated workers and Legal teams afraid that eDiscovery cannot be completed in time.

If a customer wanted to speed up search, it would have to essentially attach an appliance to a hot-air balloon and send it up to the Cloud provider so that the customer’s index could live on that appliance (or farm of appliances) in the Cloud providers data center, physically near the data. There are many reasons, however, that a Cloud provider would not allow a customer to do that:

  • Long install process
  • Challenging Pre-requisites
  • 3rd party installation concerns
  • Physical access
  • Specific hardware requirements
  • They only scale vertically

The solution to a faster search is a cloud-deployable search application, such as X1 Rapid Discovery. This creates a win-win for Cloud providers and customers alike. As enterprises move more and more information to the Cloud, it will be important to think about workers’ experiences with Cloud systems – and search is one of those user experiences that, if it is a bad one, can really negatively affect a project and cause user revolt. eDiscovery is also a major concern – I’ve worked with organizations that moved data to the cloud before planning how they would handle eDiscovery. That left Legal teams to clean up messes, or more realistically, just deal with the messes. By thinking about these issues before moving data to the cloud, it is possible to avoid these painful occurrences and leverage the cloud without headaches. At X1, we look forward to working closely with Amazon to help customers have the search and eDiscovery solutions they need as more and more data goes to AWS.

Leave a comment

Filed under Cloud Data, eDiscovery & Compliance, Enterprise eDiscovery, Enterprise Search, Hybrid Search, Information Access, Information Governance, Information Management

Tagged as , , , , , , , , , , , , , , , , ,

November 4, 2014 · 8:59 AM

Botched Social Media Evidence Collection Results in Overturned Conviction

by John Patzakis

Law Journal for webA US Federal Appellate Court, Second Circuit, recently overturned a criminal conviction upon finding that the lower court erroneously admitted a screenshot of the defendant’s alleged profile on “the Russian equivalent of Facebook,” (“VK.com”) due to improper authentication.

In United States vs. Vayner, 2014 WL 4942227 (C.A. 2 (N.Y.)), a jury convicted Aliaksandr Zhyltsou on a single count of the unlawful transfer of a false identification document. The government’s key evidence included a screen shot purporting to be Zhyltsou’s VK.com profile page. The lower court admitted the printout over Zhyltsou’s objection on insufficient authentication grounds. However, the appellate court determined that the government presented insufficient evidence that the page was what the government claimed it to be—that is, Zhyltsou’s profile page, as opposed to a profile page on the Internet that Zhyltsou did not create or control. The prosecution used the alleged profile page to establish a key connection between Zhyltsou and Vladyslav Timku, another perpetrator who reached a plea bargain and became the Government’s star witness.

Ultimately, the Court concluded that because the page was intended to corroborate testimony regarding the defendant’s alleged online identity, it was  “required that there be some basis beyond Timku’s own testimony on which a reasonable juror could conclude that the page in question was not just any Internet page, but in fact Zhyltsou’s profile. No such showing was made and the evidence should therefore have been excluded.”

This is a clear cut case of a conviction being thrown out over a social media evidence collection that failed to follow best practices. The federal second circuit, which covers all of New York, Connecticut and Vermont, is a very influential court and this decision will impact standards for and the scrutiny of all social media evidence collection in criminal and civil matters nationwide.

United States vs. Vayner is yet another case illustrating that social media provides torrential amounts of evidence potentially relevant to litigation matters, with courts routinely facing proffers of data preserved from various social media websites. This evidence must be authenticated in all cases, and the authentication standard is no different for website data or chat room evidence than for any other. Under Federal Rule of Evidence 901(a), “The requirement of authentication . . . is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” United States v. Simpson, 152 F.3d 1241, 1249 (10th Cir. 1998).

Ideally, a proponent of the evidence can rely on uncontroverted direct testimony from the creator of the web page in question. In many cases, such as in the Vayner case where incriminating social media evidence is at issue, that option is not available. In such situations, the testimony of the examiner who preserved the social media or other Internet evidence “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a finding” that the website documents are what the proponent asserts. Perfect 10, Inc. v. Cybernet Ventures, Inc. (C.D.Cal.2002) 213 F.Supp.2d 1146, 1154. (emphasis added) (See also, Lorraine v. Markel American Insurance Company, 241 F.R.D. 534, 546 (D.Md. May 4, 2007) (citing Perfect 10, and referencing MD5 hash values as an additional element of potential “circumstantial indicia” for authentication of electronic evidence).

One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our white paper available here).

Additionally, when an examiner merely relies on print screen, they also severely limit the scope and thoroughness of the social media and internet collection. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This allows the examiner to build a much stronger case for authentication by building timelines, drawing more connections between witnesses and their various posts, collecting more collaborating metadata, and a litany of other means to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court. The federal prosecutors in Vayner just learned this lesson the hard way.

1 Comment

Filed under Best Practices, Case Law, Social Media Investigations, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , ,

October 27, 2014 · 11:10 AM

The Time Has Come to Approach Search Differently

Anyone in the search / eDiscovery business lives and breathes search – we think about all day, every day because it is our livelihood.  At X1, we have many customers making real progress with enterprise search, so there can be the perception that organizations have learned to address the very real challenge of helping employees find information.  Thus, it can be surprising to run into research that shows just how bad the traditional approach to enterprise search is.

I came across the “Enterprise Search and Findability Survey 2014” on the Findwise website.  It is very interesting reading and really confirms that a new approach to enterprise search is needed.  Some of the key points, from my perspective, are;

  • Almost half of the survey respondents in large organizations (1,000 employees or more) find it difficult or very difficult to find information.
  • Almost two-thirds of respondents are either dissatisfied or very dissatisfied with their existing search applications.
  • Almost two-thirds of respondents believe it is very important to improve the ability to find the right information.

Simply put, traditional enterprise search did not work.  Too many employees complain about not being able to find what they are looking for.  The search solutions deployed over the last 15 years focused on IT requirements rather than end-user requirements.  These tools required end-users to tag and rate their search results, something end-users have neither the time nor the emotional investment to do.  This very point is something that Marcus Stimler, CTO of Capgemini UI, points out on the webinar we did earlier this month – the reliance of traditional search tools on end-users to tag information leads to a lack of findability.  This survey just confirms that fact.

It is not all doom and gloom, however, as many X1 customers know.  There is a better way to approach enterprise search and it begins with the end-user.  In today’s business world, end-users know what they want.  They demand good experiences with technology.   A web page with links to search results will not cut it in the enterprise.  Users need a single-pane-of-glass view to all of their information – email, files, SharePoint, archives like Symantec Enterprise Vault, and other enterprise repositories that users might access.   X1 Search 8 provides just that – a user-friendly interface to all information that lets workers use their brains to find what they are looking for.

Beyond the desktop, X1 Rapid Discovery indexes other sources of content – either on-premise or in the Cloud – and makes the information available alongside a user’s local content.  Perhaps the beauty of this approach lies mostly with its simplicity.  Workers are happy because they can find information.  IT is surprisingly happy because they have a search tool that is easily deployable, as opposed to the traditional complex science project.  This overall happiness is a result of a new approach to enterprise search starting with end-user requirements and extending outward.  It is a subtle difference, but a meaningful one that will drive the results of future findability surveys to a new level.

For more on our perspectives on why enterprise search initiatives often fail, while X1 is invariably successful, please download this short treatise. This was inspired by direct feedback from many successful X1 install sites.  In a nutshell, X1 addresses users’ personalized requirements for business productivity search.

3_forms_table

Click image to enlarge

A key mistake is to take big data or web search solutions and apply them to the very different use case of business productivity search. The matrix displayed here illustrates the key differences between these use cases.

Leave a comment

Filed under Business Productivity Search, Enterprise Search

Tagged as , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,