How Do You Authenticate Social Media Evidence?

The ubiquitous prevalence of social media is undeniable. Facebook, YouTube, Twitter, Instagram, Reddit, TikTok, LinkedIn, and Pinterest, to name just a few, have billions of daily users. Aside from individual users, law and business now participate in this same rich web of social media. Social media’s impact on society, as recent and significant current events serve to illustrate, will continue to play a role for years to come.

When it comes to the law, parties have an obligation to preserve evidence that is potentially discoverable in litigation. Attorneys may be responsible for their client's actions. In most jurisdictions, this duty arises when the party knows or should know of the potential litigation. As technology and social media platforms continue to evolve, a multitude of new types and sources of electronically stored information (ESI), which may be relevant to litigation, will arise. Complying with the duty to preserve evidence in the face of dynamic social media sites can be challenging. Nonetheless, when litigation arises advocates must be prudent about utilizing proper protocol, procedures, and professionals to preserve all relevant evidence, including that housed on social media websites.

Given the rich volumes of information social media provides, attorneys now regularly ask for social media in litigation discovery requests, preservation notices, and interrogatories. The preservation and presentation of social media data as evidence at trial, however, may require more thoughtfulness than one may realize.

You may be asking: “Why can’t I take a screenshot and print it?” The answer is perhaps best articulated by the Third Circuit, who emphasized “the great ease with which a social media account may be falsified or a legitimate account may be accessed by an impostor.” United States v. Browne, 834 F.3d 403 (3d. Cir. 2016). Federal courts, under F.R.E 901, requires that the social media evidence have identifying information, including a web address, and may also require additional authentication such as testimony from a witness with personal knowledge. F.R.E 901(b) also permits the use of digital forensic experts to authenticate the information from social media.

Because courts may reject printed pages or screenshots because they can be tampered with or edited, another important consideration for the authentication of social media is the chain of custody of the evidence. Forensic artifacts, namely metadata, and the integrity of the collection process are key when dealing with social media data. By retaining a forensic expert, the following steps can be taken to ensure authenticity: (1) the evidence will be collected without altering it; (2) the acquired data can be documented and matched as identical to the source, and; (3) the examination and analysis are performed in an accountable and repeatable manner. These authentication requirements often necessitate advanced tools, which are specifically adapted for collecting, searching, indexing, preserving, and authenticating social media evidence.

While many state courts have differing standards, generally speaking courts have trended toward leniency in the admission of social media evidence, but certainly not self-authenticating. In Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012), the court ruled introducing sufficient facts to persuade a reasonable juror that the evidence was created by the person who the proponent alleges created the post. (See also State of New Jersey v. Terri Hannah, 448 N.J. Super. 78 (App. Div. 2016) “We need not create a new test for social media postings… we apply our traditional rules of authentication…”).

Another important consideration is spoliation.  Deleting or taking down social media posts can certainly lead to spoliation concerns. Additionally, certain methods of copying data can alter the metadata, which courts have held are part of the document. See, e.g.  Leidig v. BuzzFeed, Inc. 1:16-cv-00642 (S.D.N.Y. Dec. 19, 2017). Online information is dynamic and continuously changing. Using hash technology, forensic examiners can create a “fingerprint” of a document, webpage, or other data, that can be compared to demonstrate the authenticity of the replicated data. Any changes would result in a different hash value. 

Without the proper knowledge, skills, and a digital forensic investigator on your side, you are potentially at a disadvantage against those who will use the best of technology and techniques. It is our job as forensic professionals to continue to stay ahead of the curve when it comes to understanding social media platforms.

At Capsicum, we capture web pages and applications in a forensically sound manner, which is defensible in a court of law. Finding, preserving, and collecting social media evidence often requires forensic skills, as well as an understanding of the laws that govern its collection and use. It is important for investigators to be aware of the possibilities and limitations of social media forensics. We are certified forensic experts who have significant experience documenting and collecting data from social media websites.

About Capsicum Group:

Capsicum was founded in 2000 within the law firm of Pepper Hamilton, LLP. (now Troutman Pepper Hamilton Sanders LLP.) Charged with providing technology consulting support to their clients, we soon realized that the need to understand, collection, and forensically analyze digital data went far beyond what we were handling: We began our journey as general technologist, but quickly became specialists in digital forensics.

Our areas of expertise soon evolved and expanded into forensic investigations, cybersecurity, discovery, electronic and paper recovery, security, regulatory compliance, and incident response retainers. In 2002, Capsicum became an independent consulting company that focuses on these core services. Employing high-caliber experts and a unique understanding of data, technology, and the law, we support organizations that need technological proficiency to run their companies when they come face-to-face with difficult tech, legal, and regulatory situations. Capsicum is located in Philadelphia, PA; New York, NY; Fort Lauderdale, FL; Dallas, TX; and Los Angeles, CA.