Social Media eDiscovery - Challenges and Solutions

Posted by Jeremy Greer | Mon, Apr 13, 2020

General Challenges With Social Media ESI

Social media is a crucial form of ESI. The average American spends 5.4 hours/day on their smartphone which is heavily influenced by social media usage. There is reasonable potential for responsive data and ESI to exist within social media. The question is – What are you looking for? This may influence the next question. Which platforms should you ask about or check? While the data potential within social media may seem so incredibly high, new research may also have us pumping the breaks.

Let’s take Twitter as an example. Pew Research Center reported that 22% of adults in the U.S. use Twitter. Out of that pool, 80% of tweets are dominated by only 10% of the user base – a small group of superusers dominating the conversation. If social media posts are believed to be potentially responsive, and the custodian in question happens to be one of these “social media super users”, this might bode well for likelihood of the requesting party finding responsive (potentially incriminating) data. In the vast majority of cases, the custodian in question may not use social media, or more commonly – they do have an account but have not posted in several or more years.

Just like companies handle information governance, individuals sometimes delete old, posts, photos and videos in response to platforms like Facebook making it very easy to “Facebook Stalk” someone – thereby viewing their public profile and flipping back to any particular year dating all the way back to when Facebook was invented in 2006. Cleansing social media is a common practice now, and just know that it drastically affects what is available for collection online. While clients have a common law duty to preserve relevant evidence, the taboo nature of social media preservation in the legal field opens up the door for spoliation. Certain social media spoliation claims can get very hazy. In Thurmond v. Bowman, No. 14-CV-6465W (W.D.N.Y. Mar. 31, 2016), the plaintiff was able to dodge spoliation claims by arguing that they simply adjusted Facebook privacy settings, hiding certain posts rather than fully deleting them.

Social media discovery seems to get ignored not only because legal professionals lack expertise, but even collections experts can be unfamiliar with the details and potential metadata available in all the different social media platforms.

 

Issue 1: It’s Not Easy To Capture Everything On Social Media With All Metadata Included

There are tools out there to capture social media. For the most part, they are built to capture an entire social media account as one page. We prefer to capture each post as an individual document with specific metadata – the most important piece of metadata being time of posting. There is no tool that captures this metadata on an individual post basis.

eDiscovery is about data – that means using all the tools at your disposal – searching metadata, filtering, sorting, using analysis tools and finding trends. All the social media platforms are different and it is a challenge in and of itself to grab the information in a reviewable format to make a defensible decision on each post.

 

Issue 2 Privacy Settings Across Platforms

In 2014 supreme court case of Riley vs California, the court ruled unanimously based on the 4th amendment that search warrants are required to search a cell phone. Courts are establishing the cell phone data and similar new age metadata ought to be protected in the same way that police cannot enter a house or a car without probable cause or a warrant.

Social media turns this all on its head. We all agree that public social media content is discoverable. Assuming a certain Facebook account was public, one could hire a third party to preserve and collect screenshots, or image an entire social media page legally without permission or knowledge from the custodian. In some cases, this type of collection tactic could be used prior to any other request for document production.

Any level of privacy setting more strict than “public” drastically changes the ease of discoverability of that post or account. Plenty of individual social media accounts are completely public, while other accounts have strict or partial privacy settings that restrict the ability to run a simple search and uncover personally identifiable information. If those privacy settings are blocking the way, then social media accounts are protected in the same way as your house, car, or cell phone. In order to gain access to data within a private Facebook account, you would need to formally request social media ESI including data hidden behind privacy controls.

In a legal sense, perhaps none of this matters since all relevant ESI is discoverable through rule 34 anyways. However, we've found that this taboo nature of social media ESI still has a grip over the legal industry and a large amount of data tends to be left out of the scope of investigation. This is essentially the equivalent of saying "If I can't find relevant ESI searching the plaintiff's public social media pages, then its not worth requesting or collecting. Data which could be hidden behind those privacy settings is more unpredictable and unknown, but it needs to be considered if there is potential to find relevant information.

To complicate this even more, privacy settings behave entirely differently across the main platforms and each present their own issues with respect to eDiscovery.

 

Facebook

Users have the option to make certain posts private, join private groups and also adjust the privacy settings on a global basis (friends only, friends of friends, public). There are several pieces of case law regarding the discoverability of Facebook content hidden behind privacy settings.

Forman v. Henkin (2018), the New York Court of Appeals ruled that “private” Facebook posts were subject to the standard rules of discovery. Forman sued Henkin after falling off a horse, and Henkin requested for full access to Forman’s private Facebook account as means to fully assess the extent of injuries. In order to find the information they were looking for, they had to ask the right questions to figure out where the relevant data could be. Facebook? Twitter? Instagram? While information on all these sites is potentially discoverable even with privacy settings turned on, there are several limiting factors which could increase the burden of seeking to uncover private social media accounts. You would need to consider the likelihood for the custodian to be a “superuser”, likelihood to find relevant information, difficulties with gaining credentials to an account, difficulties collecting social media posts with all the metadata, and general lack of compatibility between social media collection formats and document review software or ediscovery software.

 

Instagram

Instagram is an interesting one because the entire site is optimized for mobile, forcing us back into the world of collecting individual posts using simple screenshots. You can’t capture or image the entire web page all at once like you potentially could with Facebook. In terms of privacy settings, there is the option to set account entirely as private. This is a much more commonly used function on Instagram than on Facebook, mostly because Instagram is plagued with more bot accounts which will attempt to follow you. From a collection standpoint, when an Instagram account is set to private you can see that the account exists but can’t see specific photos/posts.

Instagram shares a specific feature with Snapchat called “stories”. These are a collection of photos and videos which disappear after 24 hours. In some cases, users may also post a persisting "story" (a timeline of pictures and videos) which does not disappear. This could be based on a certain theme like “Seattle”, “Los Angeles”, or “Gym”, or "Cooking”. In cases like this you may also need to consider ability to capture video, which will again force you back into a more manual collection process (screenshots or screen recordings).

 

LinkedIn

LinkedIn profiles are mostly useful for getting an overview of job history and descriptions. Keep in mind that LinkedIn is the one social media platform in which users can see who viewed their profile. This is important to note when browsing to get a sense of publicly available information on a given custodian. Anonymity may be one of several good reasons to outsource social media collection efforts.

 

Snapchat

Snapchat, is designed and marketed for allowing users to send and receive photos that disappear after viewing them. Quite the issue for ESI collection, right? There’s no real way to tell if there could be potentially relevant information here. In terms of data retainability, most Snapchat users are willfully ignorant in that they know these photos are probably stored in a secret cache somewhere by snapchat. Aside from this, snapchat acts as almost a second (or third or fourth) photo reel by using the function of “saving” a photo through snapchat. If the context of litigation required collection of personal photos, then snapchat should absolutely be considered. Photos can be saved in snapchat; snaps can be “screenshotted”. Photo reels saved in snapchat can reach equal or larger in size compared to the default iPhone “photos” app, so make sure to ask about all possible collection sources to build an accurate data map.

 

Reddit

Reddit is an up-and-coming social media site where all users stay anonymous. Users can join “subreddits” to follow and discuss worldwide posts related to anything. All accounts on Reddit are designed to be anonymous. Sites like this are going to become more popular because they provide means of expression without revealing personal information or identity. My point here is not necessarily that this type of information is worth discovering, but rather the rise of social media sites like Reddit shows that social media ESI collection is not going to get any easier as privacy settings and social media anonymity become more prominent.

 

Given all of the challenges stated in this article, you may wish to consider using a third party for ESI collection for 2 reasons.

1) Anonymity: Assuming you would like to run initial data searches on publicly available social media information, you may want to consider remaining anonymous while considering case strategy other options. Law firms and legal professionals themselves are not likely to have the expertise to search social media while ensuring anonymity. You must login to a personal (or business) account in order to perform searches on a social media platform. This alone draws many law firms towards third party collection services. If you wanted to collect social media ESI in-house, do you have someone at the firm familiar with each platform in a way that they can ensure their searches are private? If you are just browsing, make sure you don’t “like” someone’s photo from 3 years ago! If there is no one familiar with social media, you may have to hire a vendor just to run the initial searches for you and see if there is any potentially relevant information, and from which social media sites.

 

2) Defensibility: Social media is always changing. By using a third-party vendor, you ensure valid and defensible social media preservation.

 

Conclusion

Given new changes in social media privacy settings and other factors, social media is even more difficult to discover and collect. What are the chances that a particular platform contains relevant information? Although the collection aspects of social media data may require more unique solutions than traditional ESI, you can use the same high-level protocol. Take a look at the eDiscovery Checklist Manifesto for tips on identification, preservation, custodian interviews and collection.

 

If you found this article interesting, be sure to subscribe you and your team to our monthly blog distribution email. This email list is solely for blog distribution purposes and we promise to only send one email per month. To subscribe, simply scroll down and fill out the "Subscribe" form below the comment box.

Topics: Trends