Tag Archives: collection

September 27, 2016 · 10:02 AM

LTN: Social Media Evidence Even More Important than email and “Every Litigator” Needs to Address It

legaltech-news-thumbBrent Burney, a top eDiscovery tech writer of Legaltech News, recently penned a detailed product review of X1 Social Discovery after his extensive testing of the software. (Social Media: A Different Type of E-Discovery Collection, Legaltech News, September 2016). The verdict on X1 Social Discovery is glowing, but more on that in bit. Burney also provides very remarkable general commentary on how social media and other web-based evidence is essential for every litigation matter, noting that “email does not hold a flicker of a candle to what people post, state, admit and display in social media.” In emphasizing the critical importance of social media and other web-based evidence, Burney notes that addressing this evidentiary treasure trove is essential for all types and sizes of litigation matters.

Consistent to that point, there is a clear dramatic increase in legal and compliance cases involving social media evidence. Top global law firm Gibson Dunn recently reported that “the use of social media continues to proliferate in business and social contexts, and that its importance is increasing in litigation, the number of cases focusing on the discovery of social media continued to skyrocket.” Undoubtedly, this is  why Burney declares that “every litigator should include (X1 Social Discovery) in their technical tool belt,” and that X1 Social Discovery is “necessary for the smallest domestic issue all the way up to the largest civil litigation matter.” Burney bases his opinion on both the critical importance of social media evidence, and his verdict on the effectiveness of X1 Social Discovery, which he lauds as featuring an interface that “is impressive and logical” and providing “the ideal method” to address social media evidence for court purposes.

From a legal commentary standpoint, two relevant implications of the LTN article stand out. First, the article represents important peer review, publication and validation of X1 Social Discovery under the Daubert Standard, which includes those factors, among others, as a framework for judges to determine whether scientific or other technical evidence is admissible in federal court.

Secondly, this article reinforces the view of numerous legal experts and key Bar Association ethics opinions, asserting that a lawyer’s duty of competence requires addressing social media evidence. New Hampshire Bar Association’s oft cited ethics opinion states that lawyers “have a general duty to be aware of social media as a source of potentially useful information in litigation, to be competent to obtain that information directly or through an agent, and to know how to make effective use of that information in litigation.” The New York State Bar similarly weighed in noting that “A lawyer has a duty to understand the benefits and risks and ethical implications associated with social media, including its use as a … means to research and investigate matters.” And the America Bar Association recently published Comment [8] to Model Rule 1.1, which provides that a lawyer “should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.”

The broader point in Burney’s article is that X1 Social Discovery is enabling technology that provides the requisite feasibility for law firms, consultants, and other practitioners to transition from just talking about social media discovery to establishing it as a standard practice.  With the right software, social media collections for eDiscovery matters and law enforcement investigations can be performed in a very scalable, efficient and highly accurate process. Instead of requiring hours to manually review and collect a public Facebook account, X1 Social Discovery can collect all the data in minutes into an instantly searchable and reviewable format.

So as with any form of digital investigation, feasibility (as well as professional competence) often depends on utilizing the right technology for the job.  As law firms, law enforcement, eDiscovery service providers and private investigators all work social discovery investigations into standard operating procedures, it is critical that best practices technology is incorporated to get the job done. This important LTN review is an emphatic punctuation of this necessity.

 

Leave a comment

Filed under Social Media Investigations

Tagged as , , , , , , , , , , , , , , , ,

April 27, 2015 · 10:35 AM

Judges Believe Social Media will Have Biggest Effect on eDiscovery Over the Next Two Years

The good folks at Exterro recently released a very interesting report titled “Federal Judges Survey, eDiscovery Best Practices and Trends.”  The title includes a link to download the report, which I highly recommend reading as it is good to know what the judges who rule on eDiscovery all the time are thinking.  Overall, the report calls for some necessary disruptive change in the practice of eDiscovery in order to demonstrate competency.  There are some excellent tips in the report on how eDiscovery professionals can improve and what kinds of trends we should be on the lookout for.

One finding stood out to me in particular – the Judges surveyed felt that social media would be the technology trend with the biggest effect on eDiscovery over the next two years.

Exterro Survey

As the report states, “Attorneys must be aware that all emerging technology platforms are just like email; if they hold relevant evidence you are accountable for preserving the data.”  At X1, we’ve known this for quite some time.  We’ve blogged about cases where the old way of doing social discovery – print screen – has been shown to lack authenticity standards and not meet the duty of competency that lawyers must meet.  To see the Judges recognize this as a critical trend rather than just a niche corner of the market validates what we have known for years.

It is no coincidence that X1’s Social Discovery product continues its rapid upward trajectory.  There is simply no other product on the market that offers a true investigative platform for this critical new data type.  Such a social media investigative platform will include:

  • Tight API connections to the major social media publishers like Facebook, LinkedIn, Twitter, and Instagram. The API connection allows for the capture of unique metadata that each publisher adds to its data.
  • A web crawler and capture capability that creates a copy of the page to be stored for processing into a preservation repository.
  • The ability to keep data forensically sound. This requires calculating MD5 hash values of individual items upon capture and maintaining those values through export. The platform must keeps logs and reports of all actions on data. It also must be able to use metadata to establish chain of custody and authentication.

The challenge with social media – unlike email – is that much of the data resides outside the walls of an organization.  Collection of social media becomes a challenge. Companies cannot simply call Facebook or Twitter and request all of the information for various custodians.  It is possible to take screenshots of various web pages or social media sites, but as case law points out, screenshots are not necessarily admissible as evidence.  Plus, screenshots take a technical toll on eDiscovery – they can be difficult to index and may require OCR, which still may not be able to pull text out of the image.  That is where an investigative platform like X1 Social Discovery is so important to a competent eDiscovery practice.

2 Comments

Filed under Best Practices, Social Media Investigations

Tagged as , , , , , , , , , , , , , , , ,

November 4, 2014 · 8:59 AM

Botched Social Media Evidence Collection Results in Overturned Conviction

by John Patzakis

Law Journal for webA US Federal Appellate Court, Second Circuit, recently overturned a criminal conviction upon finding that the lower court erroneously admitted a screenshot of the defendant’s alleged profile on “the Russian equivalent of Facebook,” (“VK.com”) due to improper authentication.

In United States vs. Vayner, 2014 WL 4942227 (C.A. 2 (N.Y.)), a jury convicted Aliaksandr Zhyltsou on a single count of the unlawful transfer of a false identification document. The government’s key evidence included a screen shot purporting to be Zhyltsou’s VK.com profile page. The lower court admitted the printout over Zhyltsou’s objection on insufficient authentication grounds. However, the appellate court determined that the government presented insufficient evidence that the page was what the government claimed it to be—that is, Zhyltsou’s profile page, as opposed to a profile page on the Internet that Zhyltsou did not create or control. The prosecution used the alleged profile page to establish a key connection between Zhyltsou and Vladyslav Timku, another perpetrator who reached a plea bargain and became the Government’s star witness.

Ultimately, the Court concluded that because the page was intended to corroborate testimony regarding the defendant’s alleged online identity, it was  “required that there be some basis beyond Timku’s own testimony on which a reasonable juror could conclude that the page in question was not just any Internet page, but in fact Zhyltsou’s profile. No such showing was made and the evidence should therefore have been excluded.”

This is a clear cut case of a conviction being thrown out over a social media evidence collection that failed to follow best practices. The federal second circuit, which covers all of New York, Connecticut and Vermont, is a very influential court and this decision will impact standards for and the scrutiny of all social media evidence collection in criminal and civil matters nationwide.

United States vs. Vayner is yet another case illustrating that social media provides torrential amounts of evidence potentially relevant to litigation matters, with courts routinely facing proffers of data preserved from various social media websites. This evidence must be authenticated in all cases, and the authentication standard is no different for website data or chat room evidence than for any other. Under Federal Rule of Evidence 901(a), “The requirement of authentication . . . is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” United States v. Simpson, 152 F.3d 1241, 1249 (10th Cir. 1998).

Ideally, a proponent of the evidence can rely on uncontroverted direct testimony from the creator of the web page in question. In many cases, such as in the Vayner case where incriminating social media evidence is at issue, that option is not available. In such situations, the testimony of the examiner who preserved the social media or other Internet evidence “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a finding” that the website documents are what the proponent asserts. Perfect 10, Inc. v. Cybernet Ventures, Inc. (C.D.Cal.2002) 213 F.Supp.2d 1146, 1154. (emphasis added) (See also, Lorraine v. Markel American Insurance Company, 241 F.R.D. 534, 546 (D.Md. May 4, 2007) (citing Perfect 10, and referencing MD5 hash values as an additional element of potential “circumstantial indicia” for authentication of electronic evidence).

One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our white paper available here).

Additionally, when an examiner merely relies on print screen, they also severely limit the scope and thoroughness of the social media and internet collection. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This allows the examiner to build a much stronger case for authentication by building timelines, drawing more connections between witnesses and their various posts, collecting more collaborating metadata, and a litany of other means to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court. The federal prosecutors in Vayner just learned this lesson the hard way.

1 Comment

Filed under Best Practices, Case Law, Social Media Investigations, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , ,

February 26, 2014 · 1:13 PM

Avoid SharePoint eDiscovery Headaches Before They Begin

by Barry Murphy

Sharepoint no colorLast week, this blog featured highlights from the very successful SharePoint eDiscovery webinar with Reed Smith.  It is a topic that came up time and again in my tenure as an analyst; companies and government Agencies are becoming tightly bound to SharePoint and want to be sure that eDiscovery ordeals can be avoided.

Microsoft SharePoint continues to gain widespread traction in organizations large and small.  A recent Forrester Research survey found that 66% of respondents will deploy SharePoint server in the next 12 months (source: Forrester Research August 2013 Global SharePoint Usage online survey).  The attraction to SharePoint is obvious – the system creates business benefits: enabling collaboration in efficient ways; providing ways to track versions of documents edited by multiple parties; allowing non-technical business people to apply basic workflow to content-driven processes, and providing faster access to information (via search and integration with the MS Office suite of apps).

For the value it creates, SharePoint can cause eDiscovery and information governance headaches if proper planning does not take place.  It is all too easy to assume that if information is searchable, eDiscovery will be no problem when the time comes.  But, as is often the case in life, the devil is in the details.  Because SharePoint allows users to add value to content (e.g. adding workflow tasks), there is the factor of metadata to consider.

In eDiscovery, metadata is a critical component of ESI that can wreak havoc on collection efforts.  When we talk about metadata for native ESI, we are usually concerned about the Operating System (OS) fields that are kept in the File Allocation Table (FAT). Different OS formats support a wide variety of fields such as different dates, attributes, permissions and file name formats (long vs. short). These fields are not usually stored within the actual file and so are very vulnerable to alteration or complete loss when items are read or copied. Forensic collection is focused on preserving this ‘envelope’ information so that evidence can be authenticated and the context reconstructed in court. That is only half of the metadata story. Microsoft Office and other programs retain non-displayed information within the header and body of all common file types, especially with the adoption of the XML based Office 2007 file formats.

This metadata issue is only extended with SharePoint because most collection efforts are focused only on grabbing SharePoint document libraries (as they are stored on file systems).  But SharePoint is so much more than document libraries (if it weren’t, it would simply be another file share sitting out there).

A defensible SharePoint collection solution will be able to capture document libraries, metadata, and truly enable contextual preservation.  When considering a SharePoint collection tool be sure that it:

  • Allows for incremental preservation, monitoring changes, identifying and preserving different document versions, and incrementally preserve to multiple matters over time
  • Maps to custodian access and prevent over-preservation, collecting and preserving only what is relevant to a particular custodian, not the entire SharePoint site
  • Is deployable in the same fashion as SharePoint, which tends to be highly decentralized and siloed; thus the collection solution should be deployable on-demand, directly to SharePoint sites through a highly automated, remote installation, with intuitive administration and operation performed through a standard web browser

At the end of the day, informed customers will make sure that the collection tool can get more than just SharePoint document libraries, but all metadata, as well.  Also, look for solutions that will not impact the production environment too heavily; you don’t want to bring SharePoint to its knees when it is a valuable business application.  And finally, get legal and IT together on the same page about how to reasonably prove that your SharePoint preservation and collection methodologies and tools are defensible.

Leave a comment

Filed under Information Governance

Tagged as , , , , , , , , , , , , , , ,

February 24, 2014 · 7:35 AM

Highlights from Reed Smith’s SharePoint eDiscovery Webinar

by John Patzakis

Reed Smith recently hosted an excellent webinar on SharePoint eDiscovery challenges, led by Patrick Burke with the firm’s eDiscovery team. The webinar featured a substantive and detailed discussion on the nuances, pitfalls and opportunities associated with eDiscovery of data from SharePoint sites. This topic is very timely as the majority of enterprises are deploying the Microsoft platform at an accelerated rate, with the solution reaching $1 billion in sales faster than any other Microsoft product in history. Burke noted that “SharePoint has exploded across corporate networks, and are filling rapidly with ESI,” but that “the bad news is that it’s not centralized. There is no single place to go to search through the ESI across an organization’s SharePoint sites to identify which SharePoint Site holds the ESI you’re looking for.”

As SharePoint enables enterprises to consolidate file shares, Intranet sites, internal message boards and wikis, project management, collaboration and more into a single platform, it provides significant operational efficiencies as well as eDiscovery challenges. The vast majority of current SharePoint deployments are versions 2007 or 2010, and neither have meaningful internal eDiscovery or even export features. This is one reason why SharePoint eDiscovery is fraught with over-collection, resulting in much higher costs and time delays that what is typically seen with other similar data stores such as email servers and file shares.

In addressing best practices for eDiscovery of SharePoint sites, Burke advised, among other key points, that the litigation hold process must not only involve individual custodians but the SharePoint administrator as well: “As it usually isn’t feasible to search all an organization’s SharePoint sites, the first step is to talk to the key custodians (through litigation hold questionnaire processes) and ask them which SharePoint sites they use (to identify) relevant ESI.” From there, “the cross-check involves talking with the SharePoint administrator, who can look up all the SharePoint sites to which the custodian’s belong.”

A full video recording of the webinar can be accessed here >

Appliance-based eDiscovery solutions or remote collections do not work as it may take weeks, if not months, to copy a multi-terabyte SharePoint site over a network connection and a large corporation may have several dozens of SharePoint silos from which to collect.  Manual collection efforts, which are geared toward mass “data dumps,” are also time consuming and are typically very costly due to the extensive processing and data massaging required to put the SharePoint data back into context.

Instead, what is needed is a solution such as X1 Rapid Discovery can quickly and remotely install and operate within the same local network domain to enable localized search, review and early case assessment in place. X1 Rapid Discovery’s full content indexing and preview of native SharePoint document libraries and lists, as well as its robust search, document filters, intuitive review interface uniquely enables targeted and contextual search, preservation and export of SharePoint evidence in its native format. In fact, we believe it is the only solution available that enables true in-place early case assessment and eDiscovery review of SharePoint sites, including iterative search, tagging and full fidelity preview in place, without the requirement to first export all of the data out of the platform.

To learn more, sign on to the recorded webinar or please contact us for a further briefing to learn how to save your organization or your clients tens of thousands of dollars on litigations costs associated with SharePoint.

Leave a comment

Filed under Best Practices, Case Law, eDiscovery & Compliance, Enterprise eDiscovery, Information Access, Preservation & Collection

Tagged as , , , , , , , , ,