In the past, it’s been common for people to dismiss social media as being utilized primarily by Generation Z youth only but that isn’t the case. Social media has become engrained in how people network, communicate, and socialize outside of traditional communication methods such as calls, emails, and texts.
Another reason social media has been ignored by litigators is that it’s been viewed as an inconvenience to collect and produce, both for the forensic examiner and custodian on the receiving end of the collection. While in earlier years this may have been more true, in today’s legal landscape there are various ways to effectively preserve, authenticate, and produce social media ESI in a defensible manner.
So what exactly is social media?
According to Merriam-Webster, social media is defined as “forms of electronic communication (such as websites for social networking and microblogging) through which users create online communities to share information, ideas, personal messages, and other content (such as videos)”[1] . For this blog post, we are specifically going to be focusing both on the overall social media landscape as well as the social media platforms that fill the space.
It is also important to note the rise of ephemeral content in social media platforms. In recent years social media platforms such as Instagram, Facebook, SnapChat, and TikTok to name a few have rolled out ephemeral content. This is content that is only viewable for a temporary period of time before it disappears. This commonly takes the form of “stories” which are rich media like videos and images with a 24-hour timer on them, once the 24-hour period is up the media is no longer publicly viewable. The same goes for live videos, once the livestream is over the stream is no longer available unless the original creator shares the recording of the livestream.
In one of our past posts we covered the “Top 10 Social Media Platforms Ranked by Monthly Annual Users“, since then these platforms have still held true to take up a dominant portion of the social media space.
What type of content is typically shared on social media?
Naturally, the type of content shared on social media is dependent on both the individual creator as well as the platform. As you’ve probably noticed, different social media platforms serve different audiences and objectives. For example take Instagram and LinkedIn, while LinkedIn is primarily for business networking and professionals, Instagram is more of a creative outlet for personal expression.
However, there are some common types of content that is shared across all platforms (given the platforms capabilities i.e. livestream, stories, etc.) to be aware of.
- User created posts
- User interactions: likes, shares, reactions
- Comments and replies
- Direct messages
- Images
- Videos
- Image & video stories
- Livestreams
- Testimonials & reviews
- Links to external content
- User profile content
The Duty to Preserve Social Media
When it comes to preserving social media data, the burden falls on the party that the social media ESI has been requested from. The National Center for State Courts puts it as “The responsibility to preserve—like the duty to produce—rests in the first instance with the party from whom the ESI is sought” [2]. They go on to state that the duty to preserve extends to all relevant ESI. That seems to be a common understanding when it comes to social media discovery, if it is relevant to the case then it should be preserved and collected.
Litigators should look at social media discovery through the same lenses that they look at email and mobile device collections. Social media discovery should be considered throughout data mapping and information governance stages as it holds an important role in the overall scope of ESI.
Triggers for Social Media Preservation
The triggers for social media preservation are the same as those for other forms of ESI. If there is an anticipation or awareness of upcoming litigation then the duty to preserve is present [3]. It’s important to note that this can be before a legal hold notice or lawsuit is even filed.
When thinking about what to preserve, it’s best practice to preserve social media evidence promptly and thoroughly. This should also be done with a priority of capturing metadata and preserving in a verifiable way. This means using software and tools that are specifically designed for social media preservation to make sure you are creating archives of the full content rather than screenshots that might be missing metadata or have cropped part of the message.
During the preservation, good areas to look preserve range from posts, messages, attachments, media, and contacts, to IP logs, user access logs, and timestamped entries.
ESI & Data Preservation Legal Rules for Social MEdia
Social media can house a wealth of evidence, it’s no longer just for personal use but has since been wide-spread adopted for institutional use. Corporations and small businesses alike have taken to social media to reach a new level of connection with their networks regardless of the industry.
Both on the company level and employee level, content and potential evidence is being created and shared every minute. This is more reason for litigators should consider social media discovery during their normal discovery and information governance discussions.
Below, we continue the conversation and focus in on the various legal rules that shape the ESI & data preservation landscape, the various methods of social media preservation, and considerations to keep in mind when approaching social media discovery.
Federal Rules in the Data Preservation Landscape
There are various Federal rules that speak to ESI preservation and production during discovery, one of the more direct ones is FRCP Rule 37 (e): Failure to Preserve Electronically Stored Information. Rule 37(e) states that in anticipation and conduct of litigation ESI should be preserved in a reasonable manner [7]. A common way to look at is if the information is relevant to the matter and/or loss of it would cause potential harm to the other party, then steps should be taken to preserve and produce the data.
Another rule that plays a factor in the data preservation landscape is the Federal Rules of Evidence (FRE) Rule 902: Evidence That is Self Authenticating. Rule 902 (13) & (14) cover the ability to authenticate data through methods other than forensic testimony.
FRE Rule 902 (13) Certified Records Generated by an Electronic Process or System states “A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12)”.
Followed by FRE Rule 902 (14) Certified Data Copied from an Electronic Device, Storage Medium, or File which states “Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule (902(11) or (12)” [5].
Methods for Storing preserved Social Media Evidence
Just as there are different methods for preserving social media housed ESI, there are different file types to store the preserved information. One of the more common is WARC, Web ARChive File Format, the Library of Congress defines it as “a method for combining multiple digital resources into an aggregate archival file together with related information.
The WARC format is a revision of the Internet Archive’s ARC File Format [ARC_IA] format that has traditionally been used to store “web crawls” as sequences of content blocks harvested from the World Wide Web” [4]. Another method for preserving social media is authenticated PDF’s, these are smart PDFs that are timestamped and contain metadata.
note Shortened Retention Time Policies
When approaching data preservation for social media its always helpful to act swiftly and broadly. Social media evidence is more difficult to collect and often has shorten retention times due to each specific platform having their own retention policies.
In addition to timing, it’s important to document thoroughly during each step of the preservation process. Through implementing clear documentation and using defensible methods of preservation you limit the potential of opposing counsel being able to question the data.
Avoid Using Screenshots without Meta-Data
For executing the preservation, if possible it is always best to avoid using screenshots. Screenshots lack metadata and have the tendency to cut off content. Rather it is better to use a third party web-capture tool that has the ability to capture content in full including the expanded/scrolled content and also authenticate the web-capture.
Access Directly via Custodian
The preferred method is typically direct access via custodian provided credentials. In this method a forensic examiner is provided the social media credentials by the custodian, from there the examiner logs in using the credentials and requests a full download of the data.
Following the request the forensic examiner will be able to download a zip of the data to then be prepared into a eDiscovery “load” file.
When credentials are not available, another option to access the profile is via the platforms API. An API can be viewed as a backdoor into the application that is run on code. With the social media API collection approach you are limited to publicly shared data however such as shared images, videos, and externally linked content.
Social Media Discovery Considerations
As with any internet-based data collection there are different considerations to keep in mind, below are a few examples.
- Does your collection method/software prioritize capturing metadata
– IP Addresses, Timestamps, URLs, browser, operating system, etc. - Is your preserved social media data able to be authenticated
– Can your web capture technology authenticate and verify it’s captures - DIY collection vs vendor managed collection
– Are you using a third party vendor to ensure the authenticity of the data and collection, if not are you collecting in a forensically defensible manner - Does the social media app developer maintain the data, if so for how long
– User access
– IP logs
– Dates & Time
– Deletion & retention policies
References
[1] “Social Media.” Merriam-Webster, Merriam-Webster, www.merriam-webster.com/dictionary/social%20media.
[2] “Appendix E: Best Practices for Courts and Parties Regarding Electronic Discovery in State Courts” Civil Justice Initiative – National Center for State Courts, https://www.ncsc.org/__data/assets/pdf_file/0018/25722/ncsc-cji-appendices-e.pdf.
[3] “Data Preservation – Basics of e-Discovery Guide.” Exterro, www.exterro.com/basics-of-e-discovery/data-preservation.
[4] “Rule 37. Failure to Make Disclosures or to Cooperate IN Discovery; Sanctions.” Legal Information Institute, Legal Information Institute, www.law.cornell.edu/rules/frcp/rule_37.
[5] “Rule 902. Evidence That Is Self-Authenticating.” Legal Information Institute, Legal Information Institute, www.law.cornell.edu/rules/fre/rule_902.
[8] American Bar Association, www.americanbar.org/groups/gpsolo/publications/gpsolo_ereport/2020/january-2020/discovery-social-media-evidence-legal-proceedings/.
