Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
What Happens on Facebook Doesn't Stay on Facebook:
Social Media Discovery Tools
#SPEC9
Presenters
Julie Brown, Moderator
Litigation Technology Manager, Vorys, Sater, Seymour and Pease
Doug Matthews
Partner, Vorys, Sater, Seymour and Pease
Andy Keck
Director of Technology, ProFile Discovery
• Practice Areas
• Discoverability of Social Media
• Acquisition & Authentication
• Other Uses of Social Media
The Legalities of Social Media Discovery
• Employment
• Workers Compensation
• Personal Injury (products liability)
• Family Law
• Defamation/Libel
• Trade Secrets/Disclosure
• Securities
Practice Areas
• Preservation
• Ethics issues
• Scope of discovery of social media
Discoverability
• How to legally acquire social media evidence
• Establishing legally acceptable process
• Authentication of social media evidence
• Establishing e-discovery technician as an expert?
Acquisition and Authentication
• Witnesses’ Social Media
• Jurors’ Social Media?
• Judge’s Social Media?
Other Uses of Social Media
Statistics
Number of Users
Volume of Data
Social Media
The future looks bright…
• Scenario 1 – FaceBook
• Scenario 2 – LinkedIn & Twitter
• Scenario 3 – Website Capture
• Scenario 4 – High Profile, High Risk
• Scenario 5 - Webmail
Tour of E-discovery Tools and Processes
Prior to seeking formal discovery of Plaintiff’s social networking accounts, Defendant did a search and found information on Plaintiff’s public Facebook profile that was relevant to the case. Plaintiff subsequently changed her account settings, however, rendering the information inaccessible by the defendant.
Scenario 1 – Facebook Part 1
FACEBOOK Activity Log
Activity Log
The court granted Defendant’s motion to compel production of the contents of Plaintiff’s Facebook account from April 2007 through the present and ordered that the contents be uploaded to an external storage device and produced to defense counsel for review and identification of “discoverable” materials.
Scenario 1 – Facebook Part 2
Options for Collection
FACEBOOK ARCHIVE CONTENTS
FACEBOOK ARCHIVE CONTENTS
FACEBOOK ARCHIVE CONTENTS
FACEBOOK ARCHIVE CONTENTS
FACEBOOK Fields
X1
X1
X1
X1
X1 – Production Tracking
Accessed DateTime; ATTACHMENT; AUTHOR; BCC; BEGNO; ENDNO; CC; COMMENTS; COMPANY; CREATIONDATE; DOCDATE; TITLE; DOCTYPE; FOLDER; SUBJECT; FILEPATH; FROM; HEADER; MESSAGEID; KEYWORDS; PRINTDATE; MODDATE; TO; ENTRYID; TEXT
Total Discovery
Facebook – Don’t forget the local drive
Facebook Artifacts (Forensics)
Abstract
Facebook Artifacts
Location of Facebook artifacts
Tested Browsers
Plaintiff is 55 years old and is fired by employer. Employer states it was based on performance issues. Plaintiff files suit against employer for age discrimination. Plaintiff is an avid user of Twitter and LinkedIn. Employer/defendant requests a copy of plaintiff’s social media sites. Plaintiff attorney printed off all of plaintiff’s Tweets to pdf and provided a screen shot of plaintiff’s linked in page.
Scenario 2 – LinkedIn & Twitter
MHT File (Total Discovery)
MHT Files (X1)
Load Files (Total Discovery)
Load Files (Total Discovery)
Load Files (X1)
Load Files Twitter (X1)
Metadata Fields Twitter (X1)
DOCID EndDoc BegDoc BegAttach EndAttach AttachIDs family_id Md5 uri Cnctrtype Ingestionbuild
Metadata Fields Twitter (X1)
istatus; link_fetch_status; ingestion_time; x1tag; AttachCount; ParentID; x1ee_document_id; ExportPath; ContentName; ContentSize; name; #page_video; #page_md5; #page_image; #html_source; usernotes; useridentifier; handle; content; body; links; userid; dmrecipient; home_timeline; direct_message; mentions; hashtags; saved_search; list; locstream; location_geo_long; location_geo_lat; location_description; location_geo; in_reply_to_status_id; in_reply_to_screen_name; in_reply_to_user; reply; retweet_user_screen_name; retweet_user; dup_retweet; retweet_id; retweet; favorite; profile_image_url; client; date_created
Employee of company A turns in resignation and leaves to work for their competitor, company B. Employee of company B is searching the internet a few weeks later and sees information on website that was taken from company A. Company A contacts their attorney. Company A’s attorney “preserves” the competitor’s website using Adobe in preparation for litigation. Unaware that litigation is foreseeable, company B takes the information off their site.
Scenario 3 –Website Capture
Scenario 3 –Website Capture
• ISO 28500 Web ARChive (WARC) – Standard for web content collection.
• WARC standard developed by the International Internet Preservation Consortium (IIPC)
• SAS 70, ISO 27001, ITAR/EAR & ISO 9001
WARC ISO 28500
WARC FILES
Forensically sound → Files captured are stored unchanged in WARC files (ISO 28500 standard) ‣ Ability to capture dynamic content ‣ Native file collection is standard in e-discovery and regulatory compliance ‣ Integration with e-discovery and compliance tools leverages your investments in existing systems and workflows
Native Format v Image Format
Native Format v Image Format
Different Collection Methods
Types to Consider
Hanzo Load Files
Hanzo Metadata Facebook
Document ID; Group Identifier; SRCID; WARCFILE; WARCSUM; File Description; File Title; URL; File Date Created; File Date Modified; Plan; Profile; Archive Unit; Crawl Name; Extracted Text; TEXTSUM; Native Link; SHA1 HASH; File Extension; File Name; File Size
Hanzo Metadata Facebook
Hanzo PDF & Native
Attorney comes to you and requests that you begin capturing 3 websites daily in a very high profile/high risk case. The attorney is adamant about 3 things:
1. All data on the site must be captured each day.
2. The data must be admissible in court.
3. The attorney must be able to easily present this information in court.
Scenario 4 – High profile case, high risk case
High profile case, high risk case: Solutions
• Request to collect Yahoo and Gmail account.
• What tools would you use?
• What works well?
• What doesn’t work well?
Scenario 5 - Webmail
Scenario 5 - Webmail
Scenario 5 - Webmail
Scenario 5 - Webmail
Scenario 5 - Webmail
Scenario 5 - Webmail
Scenario 5 - Webmail
Scenario 5 - Webmail
Select Custodians
Collection Types
Collection Results
Collection Results File Types
Process File Types
Exception Report
Download Natives
Download Natives
Maintain Email Folder
Other Social Sites
Parting Thoughts…
• Social Media Tools
• BIA Total Discovery
• Cumulus Data - eCloud
• Hanzo
• NextPoint
• X1
• Articles
• http://www.hanzoarchives.com/learn/whitepapers/web-archiving-for-ediscovery-white-paper/
• https://www.linkedin.com/today/post/article/20140515142956-2213706-warc-this-way-e-discovery-and-the-iso-28500-standard-for-web-content-collection-and-preservation
• http://www.x1.com/products/x1_social_discovery/whitepapers.html
References
• Case Law
• Painter v. Atwood - Ethics Opinion
• EEOC v. Simply Storage
• Mailhoit v. Home Depot
• E.E.O.C. v. Original Honeybaked Ham Co. of Georgia, Inc
• Fawcett v. Altieri
• Griffin v. State
• Holter v. Wells Fargo & Co
• Howell v. Buckeye Ranch, Inc.,
• Standards
• http://www.iso.org/iso/catalogue_detail.htm?csnumber=44717
References