Sep 22, 2015

By Kristen Cooney and Leeza Garber, Esq.

In late August of this year, a New York judge ordered a party in a heated custody battle to turn over her private Facebook posts as potential evidence. Arguing that the social media posts could prove that only one parent was the actual caregiver, the judge is now considering whether the evidence is necessary as a means of illustrating that the mother travels frequently and is unavailable. The final determination regarding the Facebook posts will be made later this month.

Social media has quickly become a target for litigators in many areas, as judges across the United States are allowing Facebook posts, LinkedIn connections, Twitter feeds and Google Map entries to be utilized as evidence. It is no wonder, as there are 1.49 billion monthly active Facebook users as of June 2015, 500 million Tweets sent out on Twitter every day, and 300 million Instagram users. The cases involving social media evidence span the gamut, from proving that a claimant seeking damages for emotional distress and loss of enjoyment of life is in fact showcasing drinking with friends and partying with family members on Facebook, to evidencing that a badly-injured accident victim is in fact posting pictures of his new, intense workout routine, to finding that a plaintiff most likely did slip-and-fall in a dimly-lit restaurant because its website highlights the candlelight atmosphere. Facebook alone has received 14,274 requests from U.S. law enforcement agencies from July-December of 2014 regarding its users. This does not mean that counsel may go on a fishing expedition through a party’s social media profile, but if the requested information may reasonably lead to the discovery of admissible evidence – that profile picture may be admitted.

Thus it comes as no surprise that, with more and more regularity, Capsicum’s team of experts is being asked to address social media outlets in our forensic preservation, collection and analysis efforts. The cases that Capsicum encounters run the full spectrum from contentious divorce battles to personal injury disputes to employment matters involving disgruntled current and former employees. With many situations, social media evidence is not only relevant but a key component to substantiating the attorney’s position and prevailing in court.

For example, Capsicum was engaged to investigate allegations against a pair of university security guards who were suspected of inappropriate communications and visits with students during their work hours. Capsicum experts analyzed social media chat logs and profiles in order to find evidence of wrongdoing during the relevant timeframe. Our experts examined the guards’ social media user profiles and analyzed several campus computers that the guards were known to utilize. While some of the social media was publically available due to the guards’ profile settings, other information had to be forensically retrieved from the computers of interest. In an ideal situation, one would have the user of interest’s login credentials in order to capture both the public and private portions of a social media profile. However, as expected, it is not a widely common practice that an adversary will provide this information willingly and allow easy access to the treasure trove of information their client’s social media account most likely contains.

Typically, there are two key places that social media data may reside: (1) within residual data found on the user’s computer, cellphone, and/or tablet, or (2) within the user’s social media online platform which is only accessible via the World Wide Web. The good news is that Capsicum has the tools to access both of these valuable repositories. Just like with traditional digital forensic investigations, searches of unallocated space (unused space on a hard drive, which may contain deleted file information from previous use) may be fruitful in uncovering fragments of social media activity on the user’s device and can be authenticated fairly easily. But when it comes to accessing this data via the Web, traditional processes and procedures do not necessarily apply.

Social media data can be valuable to an investigation for many reasons. One may access and piece together communication patterns, pictures, video, relationship data, location information and time of user activity. These puzzle pieces all speak to a person’s credibility, character, behavior, activities and state of mind which can be essential in an investigation and in the courtroom. This procedure is exactly what Capsicum experts carried out in the example of the security guards, by comparing social media data, including time stamps and geo-tags, to the guards’ falsified “beat” logs. The social media data allowed the prosecuting attorneys to paint a damning picture of the security guards and their activities.

The collection of impermanent, transient, and cloud-based data is difficult to accomplish, preserve, and authenticate. However, there are several industry-standard tools that offer both website capturing functionality in addition to MD5 hashing capabilities in order to ensure that the social media data captured is a true match to the data archived. In this way, the social media data collection is defensible and can be authenticated. There is no comparison to providing a printout of a Facebook profile page versus social media evidence that has been preserved in a defensible, forensically-sound manner. In fact, courts have held that simple printouts of social media profiles are not adequately authenticated.

While courts weigh many factors in admitting social media evidence (relevance, hearsay, etc.), authentication is still one of the biggest hurdles to admissibility. Authentication requires proof that the matter in question is what its proponent claims it to be. Furthermore, attorneys must be able to illustrate whether the social media account owner actually created (posted, tweeted, uploaded, shared) the content at issue. Depending upon the circumstances, a digital forensic investigation may allow the determination of when a particular post (photograph, tweet, comment) was made to a social media account, and also identify the specific device (phone, tablet, laptop) from which the content was uploaded. For the social media evidence from the security guard case, Capsicum provided authenticated profile data captures and MD5 hash values for every device. Correlating the social media evidence’s time and date information with the security guards’ handwritten logs was crucial in their final termination from their jobs.

Chances are that your next case will not involve rogue security guards – but social media will more likely than not be integral to your matter – be it as evidence, background, or a research resource. It is becoming ever more important to collect and preserve social media data in a timely and properly authenticated manner. Social media evidence has increasingly become the lynchpin in a well-fought case.