Tag Archives: technology

September 11, 2019 · 10:02 AM

Overcoming Evidentiary Challenges to Social Media Evidence

By John Patzakis

As succinctly noted by The Florida Bar Association in its publication, Florida Law Journal: “Social media is everywhere. Nearly everyone uses it. Litigants who understand social media–and its benefits and limitations–can immeasurably help their clients resolve disputes…it is inevitable that the social media accounts of at least one person involved in a dispute will have potentially relevant and discoverable information.“ However, the FLJ warns that “If not properly researched, preserved, and authenticated, the best social media evidence is worthless.” “Social Media Evidence: What You Can’t Use Won’t Help You” (2014) Florida Law Journal, Volume 88, No. 1. social-media-cases3

In fact, many courts have rendered “smoking gun” and other key web-based evidence worthless because the proponent offered a simple printed a copy of a social media webpage, and thus failed to meet evidentiary authentication requirements. Notable recent cases with such rulings include Linscheid v. Natus Medical Inc. 2015 WL 1470122, at *5-6 (N.D. Ga. Mar. 30, 2015), (finding LinkedIn profile page not authenticated by declaration from individual who printed the page from the Internet); Monet v. Bank of America, N.A., 2015 WL 1775219, at *8 (Cal Ct. App. Apr. 16, 2015), (memorandum by an unnamed person about representations others made on Facebook is at least double hearsay” and not authenticated), Moroccanoil vs. Marc Anthony Cosmetics, 57 F.Supp.3d 1203 (2014), (Facebook screenshots inadmissible in a trademark infringement without supporting circumstantial information).

Commonwealth v. Mangel 181 A.3d 1154 (2018), is a must-read case that provides an instructive and detailed case study on the perils of improperly collecting social media evidence for court.  In that case, the Superior Court of Pennsylvania addressed the standard for admissibility of social media posts and ultimately disallowed into evidence a social media post presented by the prosecution as a simple screen shot. In Mangel, the State charged the defendant with aggravated assault and harassment and sought, in a pre-trial hearing, to introduce evidence of an image of bloody hands posted to Facebook, as well as messages allegedly authored by the defendant. The Facebook account at issue bore the defendant’s name, hometown and high school, which the prosecution argued was sufficient to authenticate the proffered evidence.

Both the trial court and the appellate court found that merely presenting evidence that the posts and messages came from a social media account bearing the Defendant’s name was not enough to allow the evidence in. Instead, the court noted that “authentication of electronic communications, like documents, requires more than mere confirmation that the number or address belonged to a particular person. Circumstantial evidence, which tends to corroborate the identity of the sender, is required.” Metadata is a key form of circumstantial evidence, and the Mangel court noted the conspicuous omission of two key metadata items: the date the post was created, and account ID:

“A thorough review of the Facebook posts and messages themselves raises specific issues. First, the evidence presented by the Commonwealth does not indicate the exact time the posts and messages were made. The incident which brought about the instant criminal charges occurred allegedly on June 26th, 2016, according to the Criminal Information. The lack of a date and timestamps raises a significant question regarding the connection of the posts and messages to the alleged incident on June 26th, 2016. Furthermore, the ‘Tyler Mangel’ who allegedly authored the Facebook posts and messages does not specifically reference himself in the incident on June 26th, 2016; rather, other individuals, many of them who are not directly involved in the instant criminal case, reference a ‘Tyler Mangel’ in response to a post made and in subsequent conversations about an alleged assault.”

By using best practices instead of print screen, practitioners can avoid the falling victim to outcomes like in Mangel. A party can authenticate electronically stored information (“ESI”) per Rule 901(b)(4) and Rule 902(14) with circumstantial evidence that reflects the “contents, substance, internal patterns, or other distinctive characteristics” of the evidence.  Many courts have applied Rule 901(b)(4) by ruling that metadata and file level hash values associated with ESI can be sufficient circumstantial evidence to establish its authenticity, including Lorraine v. Markel American Insurance Company, 241 F.R.D. 534 (D.Md. May 4, 2007.

For further analysis on additional case law, applicable rules of evidence and practice tools, X1 has prepared a detailed white paper on evidentiary authentication of social media and other web-based evidence. You can access this valuable resource here.

Leave a comment

Filed under Authentication, Best Practices, Case Law, eDiscovery, Preservation & Collection, Social Media Investigations, Social Media Metadata

Tagged as

November 17, 2014 · 12:01 PM

Amazon Re:Invent – With the Cloud, Avoid Mistakes of the Past

Last week, I had the opportunity to attend the Amazon Re:Invent conference in Las Vegas. Over 13,000 people took over the Palazzo for deep dive technical sessions to learn how to harness the power of Amazon Web Services (AWS). reinventThis show had a much different energy than other enterprise software conferences, such as VMworld.  Whereas most conferences feature a great deal of selling and marketing by the host, Amazon Re:Invent was truly more of a training show. Cloud architects spent a lot of time in technical bootcamps learning how AWS works and getting certified as administrators.

That is not to say that there was no selling or marketing going on; the exhibition hall featured myriad vendors that augment or assist with AWS deployments and solutions. The focus on the deep technical details, though, does point out the fact that we are still in the very early days of the cloud. Most of the focus of the keynotes was about getting compute workloads to the cloud – there was not a lot of mention of moving actual data to the cloud, even though that is certainly beginning to happen.  But, that is how the evolution goes. IT departments need to be comfortable moving workloads to the cloud as they begin to leverage the cloud. Building this foundation is also important to Amazon – the goal would be for many companies to completely outsource the IT data center.

It is important, however, to proactive plan for information management as more workloads and, importantly, data move to the cloud.  As the internet first emerged, companies dove into new technologies like email and network file shares only to create eDiscovery nightmares and make it virtually impossible to find information within digital landfills. It is key to learn from those mistakes rather than to repeat them when leveraging cloud-based technologies. In order to ensure both that end-users are happy with search experiences on data in the cloud and that Legal can do what they need to do from an eDiscovery standpoint. This means providing business workers with unified access to email, files, and SharePoint information regardless of where the data lives. It also means giving Legal teams fast search queries and collections. But, Cloud search is slow, as indexes live far from the information. This results in frustrated workers and Legal teams afraid that eDiscovery cannot be completed in time.

If a customer wanted to speed up search, it would have to essentially attach an appliance to a hot-air balloon and send it up to the Cloud provider so that the customer’s index could live on that appliance (or farm of appliances) in the Cloud providers data center, physically near the data. There are many reasons, however, that a Cloud provider would not allow a customer to do that:

  • Long install process
  • Challenging Pre-requisites
  • 3rd party installation concerns
  • Physical access
  • Specific hardware requirements
  • They only scale vertically

The solution to a faster search is a cloud-deployable search application, such as X1 Rapid Discovery. This creates a win-win for Cloud providers and customers alike. As enterprises move more and more information to the Cloud, it will be important to think about workers’ experiences with Cloud systems – and search is one of those user experiences that, if it is a bad one, can really negatively affect a project and cause user revolt. eDiscovery is also a major concern – I’ve worked with organizations that moved data to the cloud before planning how they would handle eDiscovery. That left Legal teams to clean up messes, or more realistically, just deal with the messes. By thinking about these issues before moving data to the cloud, it is possible to avoid these painful occurrences and leverage the cloud without headaches. At X1, we look forward to working closely with Amazon to help customers have the search and eDiscovery solutions they need as more and more data goes to AWS.

Leave a comment

Filed under Cloud Data, eDiscovery & Compliance, Enterprise eDiscovery, Enterprise Search, Hybrid Search, Information Access, Information Governance, Information Management

Tagged as , , , , , , , , , , , , , , , , ,

November 4, 2014 · 8:59 AM

Botched Social Media Evidence Collection Results in Overturned Conviction

by John Patzakis

Law Journal for webA US Federal Appellate Court, Second Circuit, recently overturned a criminal conviction upon finding that the lower court erroneously admitted a screenshot of the defendant’s alleged profile on “the Russian equivalent of Facebook,” (“VK.com”) due to improper authentication.

In United States vs. Vayner, 2014 WL 4942227 (C.A. 2 (N.Y.)), a jury convicted Aliaksandr Zhyltsou on a single count of the unlawful transfer of a false identification document. The government’s key evidence included a screen shot purporting to be Zhyltsou’s VK.com profile page. The lower court admitted the printout over Zhyltsou’s objection on insufficient authentication grounds. However, the appellate court determined that the government presented insufficient evidence that the page was what the government claimed it to be—that is, Zhyltsou’s profile page, as opposed to a profile page on the Internet that Zhyltsou did not create or control. The prosecution used the alleged profile page to establish a key connection between Zhyltsou and Vladyslav Timku, another perpetrator who reached a plea bargain and became the Government’s star witness.

Ultimately, the Court concluded that because the page was intended to corroborate testimony regarding the defendant’s alleged online identity, it was  “required that there be some basis beyond Timku’s own testimony on which a reasonable juror could conclude that the page in question was not just any Internet page, but in fact Zhyltsou’s profile. No such showing was made and the evidence should therefore have been excluded.”

This is a clear cut case of a conviction being thrown out over a social media evidence collection that failed to follow best practices. The federal second circuit, which covers all of New York, Connecticut and Vermont, is a very influential court and this decision will impact standards for and the scrutiny of all social media evidence collection in criminal and civil matters nationwide.

United States vs. Vayner is yet another case illustrating that social media provides torrential amounts of evidence potentially relevant to litigation matters, with courts routinely facing proffers of data preserved from various social media websites. This evidence must be authenticated in all cases, and the authentication standard is no different for website data or chat room evidence than for any other. Under Federal Rule of Evidence 901(a), “The requirement of authentication . . . is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” United States v. Simpson, 152 F.3d 1241, 1249 (10th Cir. 1998).

Ideally, a proponent of the evidence can rely on uncontroverted direct testimony from the creator of the web page in question. In many cases, such as in the Vayner case where incriminating social media evidence is at issue, that option is not available. In such situations, the testimony of the examiner who preserved the social media or other Internet evidence “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a finding” that the website documents are what the proponent asserts. Perfect 10, Inc. v. Cybernet Ventures, Inc. (C.D.Cal.2002) 213 F.Supp.2d 1146, 1154. (emphasis added) (See also, Lorraine v. Markel American Insurance Company, 241 F.R.D. 534, 546 (D.Md. May 4, 2007) (citing Perfect 10, and referencing MD5 hash values as an additional element of potential “circumstantial indicia” for authentication of electronic evidence).

One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our white paper available here).

Additionally, when an examiner merely relies on print screen, they also severely limit the scope and thoroughness of the social media and internet collection. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This allows the examiner to build a much stronger case for authentication by building timelines, drawing more connections between witnesses and their various posts, collecting more collaborating metadata, and a litany of other means to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court. The federal prosecutors in Vayner just learned this lesson the hard way.

1 Comment

Filed under Best Practices, Case Law, Social Media Investigations, Social Media Metadata

Tagged as , , , , , , , , , , , , , , , ,

October 27, 2014 · 11:10 AM

The Time Has Come to Approach Search Differently

Anyone in the search / eDiscovery business lives and breathes search – we think about all day, every day because it is our livelihood.  At X1, we have many customers making real progress with enterprise search, so there can be the perception that organizations have learned to address the very real challenge of helping employees find information.  Thus, it can be surprising to run into research that shows just how bad the traditional approach to enterprise search is.

I came across the “Enterprise Search and Findability Survey 2014” on the Findwise website.  It is very interesting reading and really confirms that a new approach to enterprise search is needed.  Some of the key points, from my perspective, are;

  • Almost half of the survey respondents in large organizations (1,000 employees or more) find it difficult or very difficult to find information.
  • Almost two-thirds of respondents are either dissatisfied or very dissatisfied with their existing search applications.
  • Almost two-thirds of respondents believe it is very important to improve the ability to find the right information.

Simply put, traditional enterprise search did not work.  Too many employees complain about not being able to find what they are looking for.  The search solutions deployed over the last 15 years focused on IT requirements rather than end-user requirements.  These tools required end-users to tag and rate their search results, something end-users have neither the time nor the emotional investment to do.  This very point is something that Marcus Stimler, CTO of Capgemini UI, points out on the webinar we did earlier this month – the reliance of traditional search tools on end-users to tag information leads to a lack of findability.  This survey just confirms that fact.

It is not all doom and gloom, however, as many X1 customers know.  There is a better way to approach enterprise search and it begins with the end-user.  In today’s business world, end-users know what they want.  They demand good experiences with technology.   A web page with links to search results will not cut it in the enterprise.  Users need a single-pane-of-glass view to all of their information – email, files, SharePoint, archives like Symantec Enterprise Vault, and other enterprise repositories that users might access.   X1 Search 8 provides just that – a user-friendly interface to all information that lets workers use their brains to find what they are looking for.

Beyond the desktop, X1 Rapid Discovery indexes other sources of content – either on-premise or in the Cloud – and makes the information available alongside a user’s local content.  Perhaps the beauty of this approach lies mostly with its simplicity.  Workers are happy because they can find information.  IT is surprisingly happy because they have a search tool that is easily deployable, as opposed to the traditional complex science project.  This overall happiness is a result of a new approach to enterprise search starting with end-user requirements and extending outward.  It is a subtle difference, but a meaningful one that will drive the results of future findability surveys to a new level.

For more on our perspectives on why enterprise search initiatives often fail, while X1 is invariably successful, please download this short treatise. This was inspired by direct feedback from many successful X1 install sites.  In a nutshell, X1 addresses users’ personalized requirements for business productivity search.

3_forms_table

Click image to enlarge

A key mistake is to take big data or web search solutions and apply them to the very different use case of business productivity search. The matrix displayed here illustrates the key differences between these use cases.

Leave a comment

Filed under Business Productivity Search, Enterprise Search

Tagged as , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

September 10, 2014 · 8:33 AM

End-User Computing & Search Go Hand-In-Hand

webinar_works_landing

by Barry Murphy

Last week, John Patzakis here at X1 blogged about the VMworld 2014 event and how it has become the Comdex for enterprise IT.  I was at the show and it was very clear that end-users are the future of IT.  The trend has been talked about for quite some time and is commonly called the consumerization of IT.  The heat around that topic has tended to focus on devices and not as much on what is behind information access on those devices.  But, as BYOD takes off and mobility becomes increasingly important, enterprises care more and more about the flow and availability of information.  Why?  Because easy access to information is critical to the end-user acceptance of enterprise IT offerings; when users cannot quickly find what they are looking for, they reject what IT rolls out to them.  Without that end-user acceptance, there is no chance for a positive ROI on any IT project.

End-user experience is so key that VMware has named a division of its company “End User Computing.”  That EUC unit made several major acquisitions in the last year, including Airwatch and Desktone.  This is because technology providers need to win the battle with end-users.  For an example of a company that built its business on the backs of end-users and leveraged those relationships to bully its way into enterprise IT, look no further than Apple.  As VDI users have learned, it is critical to bake search requirements into virtual desktop deployments from the get-go in order to ensure an optimal user experience.  And, as Brian Katz points out in his blog, the same thing will hold true with mobile – usability will be key.  That is why we at X1 are so excited about the future.  X1’s user interface for search is second to none.  And, users actually rave about it.

In my days as an industry analyst, I rarely had technology users raving about the tools they were using.  And, I never ever had an enterprise search user tell me that their solution solved the challenge of finding information quickly.  The rabid users of X1 have been an eye opener for me.  In fact, an X1 customer recently polled its users and virtually every user said that X1 is easy to learn and use (no easy feat for a piece of enterprise software) and over 70% of users described their experience with X1 as very positive or positive.  Those numbers are unheard of in terms of technology satisfaction.

With what I’ve learned from my days as an analyst and in my time here at X1, I’ve come up with some ways to approach enterprise search in a way that is both IT and user-friendly.  We will share the knowledge in a webinar on October 9 at 1pm ET / 10am PT.  We’ve titled it, “Making Enterprise Search Actually Work by Putting User Experience First.”

In this “no-death-by-PowerPoint” webinar, attendees will not only learn, but actually see how to deploy enterprise search solutions in ways that make both end-users and IT departments happy.  This webinar will demonstrate both why and how to put end-user experience first.   Specifically, attendees will learn:

  • Why the human brain is the best analytical engine for business productivity search
  • How federation can save IT time, money, and headaches
  • How to best deploy search solutions in all IT infrastructures
  • How to achieve ROI on enterprise search in ways never seen in the past
  • That search can be like BASF – it can make many other technology deployments better, including VDI, SharePoint, and Enterprise Vault

I will be presenting on this webinar and will be joined by some special guests to be named later.  Come learn why search and end-user computing go hand-in-hand.

Register for the webinar here >

 

 

Leave a comment

Filed under Enterprise Search, Hybrid Search, Information Access, Information Management

Tagged as , , , , , , , , , , , , , , , , , , , , , , ,