Archiving Social Media is Not Spy Work

Archiving Social Media is Not Spy Work

Archiving Social Media is Not Spy Work 150 150 Jason Krause

archiving social media is not spy work
We’ve all done it – gone onto Facebook to look up old flames, former friends, classmates, or ancient enemies, just to see what they’re up to. Lawyers today are going to do the same thing – often to check up on  parties in any matters they take on. That could include clients, their opposition’s clients, or even opposing counsel or judges. The public nature of most social media makes it an easy and obvious step in litigation.
But the mistake many attorneys make is thinking that social media lurking is the same thing as doing actual forensic investigations. To begin archiving social media for litigation, lawyers need to do more than print off incriminating-sounding posts they come across. We still see experienced attorneys, lawyers who understand eDiscovery in other contexts, using printouts and screenshots of social media pages as evidence in court. Just because you can spy on someone through social media does not mean you’ve done research. I recently discussed proper social media authentication with Josh Gilliland on the Legal Geeks Podcast. You can listen to our conversation below, or read on for what proper social media archiving should look like.

Authenticate Your Social Media 
Sometimes, it will be necessary to sneak a peek at someone’s public social media postings. But in actual discovery, parties need authorized access to sites to do a proper investigation. There are still a surprising number of cases where the judge basically tells the parties to hand over social media login information. This approach is often a recipe for disaster, especially in bitter family law cases where one party is easily tempted to falsify evidence.
Nextpoint’s Cloud Preservation platform works within the authentication framework of all major social media sites. For example, when a party seeks authorized access to a Facebook page, Cloud Preservation sends a Facebook message that says “Jason Krause wants to authorize Nextpoint to crawl your Facebook page.” Cloud Preservation keeps a record of when authorization is granted and manages all permissions for authorized users. (See more detail on our Support Site.)
Keeping it Legit: Archiving Social Media

At Nextpoint, we believe that archiving social media has to be forensically sound to be effective. Screenshots of social media are simply not sufficient in court because social media files consist of more than just posts. They consist of related links, videos, embedded files, and metadata, all of which is all part of the record. Archiving just a social media post is like to saving an email without the attachment.

Cloud Preservation is designed to save a lot of data — three copies of everything. That is an image of each page (as a .png file), a text file for indexing and searching the page content, and a complete copy of a page in its native format. This approach lets you review data in a convenient image format, but retain the native file and metadata should content need to be presented for litigation. In addition, the legal hold requirements for any legal or regulatory request demand that you can move data to a review platform without altering the data in any way. That can only happen if you create a complete archive of social media content like you find in Cloud Preservation.

When in Doubt- Archive It

There is still some confusing guidance for when and how much social media content should be saved for eDiscovery proposes. That is why over-preserving makes more sense than under-preserving. The emerging case law in this area has made it clear that all images, metadata, embedded content, off-site links, related posts or tweets, and anything else on a page that can help authenticate an item in discovery. In addition, user profiles, especially information from when an account was created can capture some of the most useful and incriminating evidence (that’s when users are asked to supply personal and identifying information).

Cloud Preservation

What a social media capture should look like.

Here you can see a sample social media tweet archived in Cloud Preservation. As you can see, we keep a complete record of not just the tweet, but related links and metadata. That’s because metadata is also an important part of the social media record and has proven to be instrumental to establish authentication and admissibility.

The unique public or semi-public nature of social media also means data can be collected without formal discovery. However, failure to properly authenticate social media can render it inadmissible. We believe a discovery strategy that is purpose-built to deal with the unique characteristics of social media is the only solution for social media discovery. We understand that social media seems like an easy and inviting target for ad hoc investigations. But the real work of a forensic investigation for litigation or regulatory review is going to take a more complete and defensible approach.