What Happens on Facebook Doesn't Stay on Facebook:

Social Media Discovery Tools

#SPEC9

Presenters

Julie Brown, Moderator

Litigation Technology Manager, Vorys, Sater, Seymour and Pease

Doug Matthews

Partner, Vorys, Sater, Seymour and Pease

Andy Keck

Director of Technology, ProFile Discovery

• Practice Areas

• Discoverability of Social Media

• Acquisition & Authentication

• Other Uses of Social Media

The Legalities of Social Media Discovery

• Employment

• Workers Compensation

• Personal Injury (products liability)

• Family Law

• Defamation/Libel

• Trade Secrets/Disclosure

• Securities

Practice Areas

• Preservation

• Ethics issues

• Scope of discovery of social media

Discoverability

• How to legally acquire social media evidence

• Establishing legally acceptable process

• Authentication of social media evidence

• Establishing e-discovery technician as an expert?

Acquisition and Authentication

• Witnesses’ Social Media

• Jurors’ Social Media?

• Judge’s Social Media?

Other Uses of Social Media

Statistics

Number of Users

Volume of Data

Social Media

The future looks bright…

• Scenario 1 – FaceBook

• Scenario 2 – LinkedIn & Twitter

• Scenario 3 – Website Capture

• Scenario 4 – High Profile, High Risk

• Scenario 5 - Webmail

Tour of E-discovery Tools and Processes

Prior to seeking formal discovery of Plaintiff’s social networking accounts, Defendant did a search and found information on Plaintiff’s public Facebook profile that was relevant to the case. Plaintiff subsequently changed her account settings, however, rendering the information inaccessible by the defendant.

Scenario 1 – Facebook Part 1

FACEBOOK Activity Log

Activity Log

The court granted Defendant’s motion to compel production of the contents of Plaintiff’s Facebook account from April 2007 through the present and ordered that the contents be uploaded to an external storage device and produced to defense counsel for review and identification of “discoverable” materials.

Scenario 1 – Facebook Part 2

Options for Collection

FACEBOOK ARCHIVE CONTENTS

FACEBOOK ARCHIVE CONTENTS

FACEBOOK ARCHIVE CONTENTS

FACEBOOK ARCHIVE CONTENTS

FACEBOOK Fields

X1

X1

X1

X1

X1 – Production Tracking

Accessed DateTime; ATTACHMENT; AUTHOR; BCC; BEGNO; ENDNO; CC; COMMENTS; COMPANY; CREATIONDATE; DOCDATE; TITLE; DOCTYPE; FOLDER; SUBJECT; FILEPATH; FROM; HEADER; MESSAGEID; KEYWORDS; PRINTDATE; MODDATE; TO; ENTRYID; TEXT

Total Discovery

Facebook – Don’t forget the local drive

Facebook Artifacts (Forensics)

Abstract

Facebook Artifacts

Location of Facebook artifacts

Tested Browsers

Plaintiff is 55 years old and is fired by employer. Employer states it was based on performance issues. Plaintiff files suit against employer for age discrimination. Plaintiff is an avid user of Twitter and LinkedIn. Employer/defendant requests a copy of plaintiff’s social media sites. Plaintiff attorney printed off all of plaintiff’s Tweets to pdf and provided a screen shot of plaintiff’s linked in page.

Scenario 2 – LinkedIn & Twitter

MHT File (Total Discovery)

MHT Files (X1)

Load Files (Total Discovery)

Load Files (Total Discovery)

Load Files (X1)

Load Files Twitter (X1)

Metadata Fields Twitter (X1)

DOCID EndDoc BegDoc BegAttach EndAttach AttachIDs family_id Md5 uri Cnctrtype Ingestionbuild

Metadata Fields Twitter (X1)

istatus; link_fetch_status; ingestion_time; x1tag; AttachCount; ParentID; x1ee_document_id; ExportPath; ContentName; ContentSize; name; #page_video; #page_md5; #page_image; #html_source; usernotes; useridentifier; handle; content; body; links; userid; dmrecipient; home_timeline; direct_message; mentions; hashtags; saved_search; list; locstream; location_geo_long; location_geo_lat; location_description; location_geo; in_reply_to_status_id; in_reply_to_screen_name; in_reply_to_user; reply; retweet_user_screen_name; retweet_user; dup_retweet; retweet_id; retweet; favorite; profile_image_url; client; date_created

Employee of company A turns in resignation and leaves to work for their competitor, company B. Employee of company B is searching the internet a few weeks later and sees information on website that was taken from company A. Company A contacts their attorney. Company A’s attorney “preserves” the competitor’s website using Adobe in preparation for litigation. Unaware that litigation is foreseeable, company B takes the information off their site.

Scenario 3 –Website Capture

Scenario 3 –Website Capture

• ISO 28500 Web ARChive (WARC) – Standard for web content collection.

• WARC standard developed by the International Internet Preservation Consortium (IIPC)

• SAS 70, ISO 27001, ITAR/EAR & ISO 9001

WARC ISO 28500

WARC FILES

Forensically sound → Files captured are stored unchanged in WARC files (ISO 28500 standard) ‣ Ability to capture dynamic content ‣ Native file collection is standard in e-discovery and regulatory compliance ‣ Integration with e-discovery and compliance tools leverages your investments in existing systems and workflows

Native Format v Image Format

Native Format v Image Format

Different Collection Methods

Types to Consider

Hanzo Load Files

Hanzo Metadata Facebook

Document ID; Group Identifier; SRCID; WARCFILE; WARCSUM; File Description; File Title; URL; File Date Created; File Date Modified; Plan; Profile; Archive Unit; Crawl Name; Extracted Text; TEXTSUM; Native Link; SHA1 HASH; File Extension; File Name; File Size

Hanzo Metadata Facebook

Hanzo PDF & Native

Attorney comes to you and requests that you begin capturing 3 websites daily in a very high profile/high risk case. The attorney is adamant about 3 things:

1. All data on the site must be captured each day.

2. The data must be admissible in court.

3. The attorney must be able to easily present this information in court.

Scenario 4 – High profile case, high risk case

High profile case, high risk case: Solutions

• Request to collect Yahoo and Gmail account.

• What tools would you use?

• What works well?

• What doesn’t work well?

Scenario 5 - Webmail

Scenario 5 - Webmail

Scenario 5 - Webmail

Scenario 5 - Webmail

Scenario 5 - Webmail

Scenario 5 - Webmail

Scenario 5 - Webmail

Scenario 5 - Webmail

Select Custodians

Collection Types

Collection Results

Collection Results File Types

Process File Types

Exception Report

Download Natives

Download Natives

Maintain Email Folder

Other Social Sites

Parting Thoughts…

• Social Media Tools

• BIA Total Discovery

• Cumulus Data - eCloud

• Hanzo

• NextPoint

• X1

• Articles

• http://www.hanzoarchives.com/learn/whitepapers/web-archiving-for-ediscovery-white-paper/

• https://www.linkedin.com/today/post/article/20140515142956-2213706-warc-this-way-e-discovery-and-the-iso-28500-standard-for-web-content-collection-and-preservation

• http://www.x1.com/products/x1_social_discovery/whitepapers.html

References

• Case Law

• Painter v. Atwood - Ethics Opinion

• EEOC v. Simply Storage

• Mailhoit v. Home Depot

• E.E.O.C. v. Original Honeybaked Ham Co. of Georgia, Inc

• Fawcett v. Altieri

• Griffin v. State

• Holter v. Wells Fargo & Co

• Howell v. Buckeye Ranch, Inc.,

• Standards

• http://www.iso.org/iso/catalogue_detail.htm?csnumber=44717

References