Tips for Social Media Discovery & Data Preservation Pt.2
Social media can house a wealth of evidence, it’s no longer just for personal use but has since been wide-spread adopted for institutional use. Corporations and small businesses alike have taken to social media to reach a new level of connection with their networks regardless of the industry. Both on the company level and employee level, content and potential evidence is being created and shared every minute. This is more reason for litigators should consider social media discovery during their normal discovery and information governance discussions.
In part 1 of Tips for Social Media Discovery & Data Preservation we focused on defining what we mean when we’re talking about social media discovery and preservation. First we broadly covered the discovery side with different types of content that is shared on social media and the rise of ephemeral media, and then focused in on preservation with the duty to preserve and when that duty is triggered.
In this post we continue the conversation and focus in on the various legal rules that shape the ESI & data preservation landscape, the various methods of social media preservation, and considerations to keep in mind when approaching social media discovery.
Data Preservation Landscape
There are various Federal rules that speak to ESI preservation and production during discovery, one of the more direct ones is FRCP Rule 37 (e): Failure to Preserve Electronically Stored Information. Rule 37(e) states that in anticipation and conduct of litigation ESI should be preserved in a reasonable manner [1]. A common way to look at is if the information is relevant to the matter and/or loss of it would cause potential harm to the other party, then steps should be taken to preserve and produce the data.
Another rule that plays a factor in the data preservation landscape is the Federal Rules of Evidence (FRE) Rule 902: Evidence That is Self Authenticating. Rule 902 (13) & (14) cover the ability to authenticate data through methods other than forensic testimony.
FRE Rule 902 (13) Certified Records Generated by an Electronic Process or System states “A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12)”.
Followed by FRE Rule 902 (14) Certified Data Copied from an Electronic Device, Storage Medium, or File which states “Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule (902(11) or (12)” [2].
Preserving Social Media Evidence
Just as there are different methods for preserving social media housed ESI, there are different file types to store the preserved information. One of the more common is WARC, Web ARChive File Format, the Library of Congress defines it as “a method for combining multiple digital resources into an aggregate archival file together with related information. The WARC format is a revision of the Internet Archive’s ARC File Format [ARC_IA] format that has traditionally been used to store “web crawls” as sequences of content blocks harvested from the World Wide Web” [4]. Another method for preserving social media is authenticated PDF’s, these are smart PDFs that are timestamped and contain metadata.
When approaching data preservation for social media its always helpful to act swiftly and broadly. Social media evidence is more difficult to collect and often has shorten retention times due to each specific platform having their own retention policies. In addition to timing, it’s important to document thoroughly during each step of the preservation process. Through implementing clear documentation and using defensible methods of preservation you limit the potential of opposing counsel being able to question the data.
For executing the preservation, if possible it is always best to avoid using screenshots. Screenshots lack metadata and have the tendency to cut off content. Rather it is better to use a third party web-capture tool that has the ability to capture content in full including the expanded/scrolled content and also authenticate the web-capture.
The preferred method is typically direct access via custodian provided credentials. In this method a forensic examiner is provided the social media credentials by the custodian, from there the examiner logs in using the credentials and requests a full download of the data. Following the request the forensic examiner will be able to download a zip of the data to then be prepared into a eDiscovery “load” file.
When credentials are not available, another option to access the profile is via the platforms API. An API can be viewed as a backdoor into the application that is run on code. With the social media API collection approach you are limited to publicly shared data however such as shared images, videos, and externally linked content.
Social Media Discovery Considerations
As with any internet-based data collection there are different considerations to keep in mind, below are a few examples.
- Does your collection method/software prioritize capturing metadata
– IP Addresses, Timestamps, URLs, browser, operating system, etc. - Is your preserved social media data able to be authenticated
– Can your web capture technology authenticate and verify it’s captures - DIY collection vs vendor managed collection
– Are you using a third party vendor to ensure the authenticity of the data and collection, if not are you collecting in a forensically defensible manner - Does the social media app developer maintain the data, if so for how long
– User access
– IP logs
– Dates & Time
– Deletion & retention policies
References
[1] “Rule 37. Failure to Make Disclosures or to Cooperate IN Discovery; Sanctions.” Legal Information Institute, Legal Information Institute, www.law.cornell.edu/rules/frcp/rule_37.
[2] “Rule 902. Evidence That Is Self-Authenticating.” Legal Information Institute, Legal Information Institute, www.law.cornell.edu/rules/fre/rule_902.
[5] American Bar Association, www.americanbar.org/groups/gpsolo/publications/gpsolo_ereport/2020/january-2020/discovery-social-media-evidence-legal-proceedings/.