Tag Archives: electronically stored information

October 20, 2015 · 4:01 PM

New FRCP Rule 37(e) Calls Out Importance of Social Media Evidence

By John Patzakis

A new version of Federal Rule of Civil Procedure 37(e) FRCP bookgoes into effect December 1, 2015, barring an unexpected act of Congress to amend or rescind the changes. Proposed rule 37(e), features a new title: “Failure to Preserve Electronically Stored Information,” and replaces the current subpart in its entirety, providing a uniform standard to resolve a split in case law among different Judicial circuits concerning serious ESI spoliation sanctions. Rule 37(e) will be the only Federal civil rule section addressing the duty to preserve ESI and thus serves as key guidance governing eDiscovery collection and preservation efforts.

Proposed Rule 37(e) is accompanied by official Committee Advisory notes. Judges and counsel refer to these Advisory notes to provide guidance and insight concerning the intent of the laws and how they should be applied. The Advisory notes are published alongside the statute and are in fact widely seen as an extension of the FRCP. The Advisory notes for new proposed Rule 37(e) include the following key section:

Another factor in evaluating the reasonableness of preservation efforts is proportionality. The court should be sensitive to party resources; aggressive preservation efforts can be extremely costly, and parties (including governmental parties) may have limited staff and resources to devote to those efforts. A party may act reasonably by choosing a less costly form of information preservation, if it is substantially as effective as more costly forms. It is important that counsel become familiar with their clients’ information systems and digital data — including social media — to address these issues (emphasis added).

This reference to social media is particularly notable as it is included in very important guidance concerning overall ESI preservation requirements.  The implication of the new law is clear:  social evidence is given at least equal weight and import as other forms of ESI such as email and documents. As an aside, the Advisory notes to the 2006 Federal Rules Amendments, specifically for Rule 37(f)  state: “When a party is under a duty to preserve information because of pending or reasonably anticipated litigation, intervention in the routine operation of an information system is one aspect of what is often called a ‘litigation hold.’”

Due in large part as a result of this mention, legal holds quickly became a core eDiscovery requirement, with an entire sub-industry spawned.  So there is no question that the Advisory notes are highly influential.

It is notable that social media evidence is already a core component of eDiscovery evidence collection efforts by most lawyers and practitioners.  Recently, the global law firm Gibson Dunn released their influential 2015 Mid-Year eDiscovery and Information Law Update. In a section dedicated to social media, the Gibson Dunn update reports that “the use of social media continues to proliferate in business and social contexts, and that its importance is increasing in litigation, the number of cases focusing on the discovery of social media continued to skyrocket in the first half of 2015.”

And as succinctly noted by The Florida Bar Association in its publication, Florida Law Journal, “Social Media Evidence: What You Can’t use Won’t Help You” (2014) Volume 88, No. 1:

“Social media is everywhere. Nearly everyone uses it. Litigants who understand social media–and its benefits and limitations– can immeasurably help their clients resolve disputes. If not properly researched, preserved, and authenticated, the best social media evidence is worthless.”

And:

“Social networking sites have grown from a few thousand users to more than a billion. These sites have become a preferred form of electronic communication, surpassing email in 2009. As of March 31, 2011, 9,370,620 Floridians had registered for a Facebook account, which is approximately half of the state’s population. Based on these statistics, it is inevitable that the social media accounts of at least one person involved in a dispute will have potentially relevant and discoverable information.“

And we are of course seeing this explosive trend in the adoption of X1 Social Discovery ahead of new FRCP Rule 37(e). X1 Social Discovery is the undisputed leader in its field for the preservation and analysis of social media and other internet evidence. If you are not one of the several thousand eDiscovery, legal, and digital investigation professionals who have enthusiastically incorporated X1 Social Discovery into your standard preservation protocols, new FRCP 37(e) should be your final call to action.

1 Comment

Filed under Case Law, eDiscovery, Social Media Investigations

Tagged as , , , , , , , , , , , , , , , , , , , , ,

January 22, 2014 · 1:00 PM

The Benghazi ESI Scandal

Last week, the United States Senate Intelligence Committee issued a bipartisan report finding that the deadly assault on the American diplomatic compound in Benghazi, Libya, which killed US Ambassador Chris Stevens and 3 other Americans, could have been prevented.

Bengazi

The account spreads blame among the State Department, the military and U.S. intelligence for missing what now seem like obvious warning signs in the weeks before the September 11, 2012, attack, including multiple clues and outright threats that appeared on social media — key evidentiary source of Electronically Stored Information (ESI) as defined by the Federal Rules of Civil Procedure.

And therein lies what could be the real scandal of the Benghazi affair – The failure of the US Intelligence Committee to monitor and investigate available social media evidence leading up to the attack in that volatile and dangerous part of the world.  The Senate report notes that “[a]lthough the Intelligence Community (IC) relied heavily on open source press reports in the immediate aftermath of the attacks, the IC conducted little analysis of open source extremist-affiliated social media prior to and immediately after the attacks.” And that there were “reports from the IC indicating that more in-depth intelligence exploitation of social media in the Benghazi area, including web postings by Libyan nationals employed at the Temporary Mission Facility, could have flagged potential security threats to the Mission facility or important information about the employees prior to the September 11, 2012, attacks.”

One of the missed clues identified by the Senate report, which includes 14 independent references to social media evidence, involved a prior May 22, 2012, attack on the Benghazi-based International Committee of the Red Cross (ICRC) building by militants with Rocket Propelled Grenades (RPGs). On May 28, 2012, a previously unknown organization, The Omar Abdurrahman Group, took to social media to claim responsibility for the ICRC attack and issued a direct threat against the United States. It is believed by many intelligence experts, and implied in the Senate report, that the Omar Abdurrahman group was responsible for the September 11, 2012, attacks on the American diplomatic compound.

The Senate report includes a key recommendation that the Intelligence Community “must place a greater emphasis on collecting intelligence and open-source information, including extremist-affiliated social media, to improve its ability to provide tactical warnings…” And separately, the Senate Intelligence Committee recommends that the “IC should expand its capabilities to conduct analysis of open source information including extremist-affiliated social media particularly in areas where it is hard to develop human intelligence or there has been recent political upheaval. Analysis of extremist-affiliated social media should be more clearly integrated into analytic products, when appropriate.”

Ironically, all these pieces of evidence and clues could have been very effectively gathered with specially designed investigation software that runs $945 a seat.

And speaking of written reports issued last week by prominent organizations that address the compelling trend of social media evidence, Gibson Dunn released their 2013 Year-End Electronic Discovery and Information Law Update. In a section dedicated to social media, the Gibson Dunn Update notes that “the number of cases involving social media evidence continues to skyrocket,” and that “Commentators and courts alike have noted that the use of social media evidence has become commonplace across all types of litigation.” The Update covers several cases, many of which have been addressed on this blog, involving key legal issues related to social media. It’s a good read, and is not unlike the Senate Intelligence Committee’s Benghazi report, in that both underscore the critical importance of social media evidence, for both reactive and proactive investigations of many stripes.

1 Comment

Filed under Social Media Investigations, Uncategorized

Tagged as , , , ,

December 6, 2011 · 11:25 AM

Producing Facebook and Twitter Evidence in Native Format

Per all recent case law on the subject, including for instance EEOC v. Simply Storage, social media evidence is considered Electronically Stored Information (ESI) on the same par as email and electronic files. This means that the various eDiscovery provisions of The Federal Rules of Civil Procedure (FRCP) apply to social media.  FRCP rule 34(b) requires that ESI be produced pursuant to a discovery request “in a form or forms in which it is ordinarily maintained or in a form or forms that are reasonably usable” unless the requesting party specifies a different format at the time of the request. Parties seeking formal discovery and who invoke the Rule 34(b) specification at the time of the discovery request are typically instructing that the responsive ESI be produced in native format with all metadata intact.

Without the right technology, producing social media evidence in native format with all metadata intact can be a difficult task at best and may lead to spoliation liability as a worst case but not far-fetched scenario. Social media archive solutions typically have very limited export capabilities and do not generally support native file and metadata export directly into review platforms. For this reason, X1 Social Discovery was developed collect and preserve social media in its native format and to integrate with leading attorney review and production platform Concordance. In fact, this Thursday, December 8, LexisNexis will be featuring X1 Social Discovery as part of their CLE webinar outlining best practices process and technology for addressing social media evidence.  The webinar speakers will be expert E-Discovery attorney Shannon Capone Kirk of Ropes & Gray and Don Swanson of Five Star Legal and Compliance Systems, Inc. Shannon will discuss the state of the law and recommended processes and Don will demonstrate a seamless and integrated workflow between X1 Social Discovery and Concordance. You can register for the CLE webinar at this link here.

The LexisNexis webinar will highlight that social media evidence collected, preserved, searched, analyzed and tagged with X1 Social Discovery can be quickly and seamlessly exported into Concordance while maintaining native file format and all metadata. We recently heard from one customer who exported thousands of tagged social media items from X1 Social Discovery into Concordance in a manner of minutes. We believe this functionality regarding scalable native file social media export is one of the many X1 Social Discovery features that are unique to the eDiscovery field. But I invite you to attend the webinar to assess this claim yourself.

1 Comment

Filed under Best Practices, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , , , , , , , , , , , ,

November 15, 2011 · 9:10 PM

Facebook Spoliation Costs Lawyer $522,000; Ends His Legal Career

PenaltyIn what many are calling the largest eDiscovery sanction penalty ever leveled directly against an attorney, a Virginia state judge ordered lawyer Matthew Murray to pay $522,000 for instructing his client to remove photos from his Facebook profile, and for his client to pay an additional $180,000 for obeying the instructions. A copy of the final order in Lester v. Allied Concrete Company is available here.

If Murray had initiated a proper legal hold concerning his client’s social media evidence instead of directing blatant spoliation, he would be a lot wealthier and likely kept his job. Instead, he apparently quit his position as managing partner of the largest personal injury firm in Virginia and, according to local press reports, he no longer practices law.

The court’s findings reflect that Murray told his client to remove several photos from his Facebook account on fears that they would prejudice his wrongful death case brought after his spouse’s fatal automobile accident. One of the photos depicts the allegedly distraught widower holding a beer and wearing a t-shirt emblazoned with “I [heart] hot moms.” Murray instructed his client through his assistant to “clean up” his Facebook account. “We do not want blow ups of other pics at trial,” the assistant’s email to Lester said, “so please, please clean up your Facebook and MySpace!”

This case reflects a trend we see based on anecdotal data points where a minority of legal and eDiscovery practitioners have not quite placed social media evidence on the same par as other electronic evidence. For instance, I believe it is highly unlikely that Murray would have instructed his client to delete all his emails or wipe his hard drive, but for some reason he differentiated social media evidence.

The attorneys we speak with are telling us that social media evidence is relevant to nearly every case they handle and the savvy ones are using social media evidence to win their cases. And as we recently noted, since 2010 social media evidence played a key role in 675 different cases with published decisions reflecting such involvement and in presumably tens of thousands more cases not involving published decisions. Those numbers will only increase as social media networks grow even more popular.

However, I was struck by one recent conversation where an eDiscovery consultant had not yet included social media data source in their standard investigation checklist. To be fair, there has not been best practices technology available to enable scalable, mainstream social media eDiscovery until recently, which impacts standard processes.

But just as the Virginia state court judge saw no difference between Facebook postings and other “traditional” electronically stored information, neither should anyone in the legal and investigative fields, especially since the software needed to get the job done is now available.

UPDATE: Here is copy of the previous court ruling determining sanctions were in order. The final order set the amount.

13 Comments

Filed under Best Practices, Case Law

Tagged as , , , , , , , , , , , , , , , ,

October 6, 2011 · 10:38 AM

Key Twitter Metadata Fields Lawyers and eDiscovery Professionals Need to Be Aware of

As discussed in our previous post, authentication of social media evidence can present significant challenges when you collect by screen shots, printouts or raw html feeds from an archive tool. This is just one reason why social media data must be properly collected, preserved, searched and produced in a manner consistent with best practices. When social media is collected with a proper chain of custody and all associated metadata is preserved, authenticity can be much easier to establish. As an example, the following are key metadata fields for individual Twitter items that provide important information to establish authenticity of the tweet, if properly collected and preserved:

Metadata Field Description
created_at UTC timestamp for tweet creation
user_id The ID of the poster of a tweet
handle User’s screen name (different from user name)
retweet_id The post ID of a retweet
retweet_user The username of the user who retweeted
Reply Indicates if this tweet is a reply
direct_message Indicates if this tweet is a direct message
Hashtags List of all hashtags in the tweet
Description Up to 160 characters describing the tweet
geo_enabled If the user has enabled geo-location (optional)
Place Geo-location from where user tweeted from
Coordinates Geo-location coordinates where tweet sent
in_reply_to_user_id unique id for the user that replied
profile_image_url location to a user’s avatar file
recipient_id unique id of direct message recipient
recipient_screen_name display name of direct message sender
screen_name display name for a user
sender_id unique id of direct message sender
Source application used to Tweet or direct message(i.e., from an iPhone or specific Twitter app)
time_zone a user’s time zone
utc_offset time between user’s time zone and UTC time
follow_request_sent Indicates request to follow the user
Truncated If the post is truncated due to excessive length

Any one or combination of these fields can be key circumstantial data to authenticate a single or group of social media items. US Federal Rule of Evidence 901(b)(4) provides that a party can authenticate electronically stored information (“ESI”) with circumstantial evidence that reflects the “contents, substance, internal patterns, or other distinctive characteristics” of the evidence. As outlined in our white paper, many cases have applied Rule 901(b)(4) to metadata associated with emails and other ESI. But you will not get all this key metadata from a printout, screen capture, or even most compliance archive tools. Best practices technology specifically designed to collect, preserve, search and produce social media for eDiscovery is required.

Facebook and Linkedin items have their own unique, but generally comparable, metadata. Stay tuned for our posting of key Facebook metadata in a few days.

2 Comments

Filed under Authentication, Preservation & Collection, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , , , ,