image courtesy of Wikimedia Commons user “Szater”
Investigators: You may not have a “spirit animal” or know much about rodentology, but the best investigators I know are experts at “ferreting out” needed information.
As it happens, the analogy to this lithe, highly intelligent carnivorous mini-weasel is particularly apt when it comes to professional digital forensics and to ensuring the capture, ongoing collection, and presentation of relevant in-depth social network data. With their long, lean build, and inquisitive nature, ferrets are very well equipped for getting down circuitous holes and chasing elusive critters out of their burrows–just like us persistent investigators.
In part one of this series, we’ll be looking at how, on our journeys down those burrows, we may be neglecting to retrieve (or lacking the best tools to retrieve) crucial nuggets that could make a real difference in the case at hand.
Following a Digital Trail
Take a look at your current caseload. You may be researching, helping litigate, or otherwise investigating in a criminal defense, civil, workplace, insurance, or fraud case. Regardless of your caseload’s makeup, you hopefully know that digital evidence is now a factor in every case.
With our highly surveilled, connected, and electronically-mediated environments, one would be hard-pressed to find a case where digital evidence didn’t play some role. You may have a sense of this growth in your own work if you’ve been in practice since the fax machine (remember fax machines?), but most of us don’t fully understand the full scope of the phenomenon.
The folks who track data proliferation globally, IDC, found in their recent study (and their archive of past years’ installments of the study) that 2.8 zettabytes of data were created and replicated in 2012.
Most of us don’t have a good sense of what 2.8ZB is, exactly. Take a look at that nice little 4-inch terabyte USB back-up drive sitting on your desk. Yes, that one. Don’t unplug it! (You’ll interrupt that crucial backup.)
Now, multiply it in your mind by about 3 billion. If you lined those disks up, they would stretch 110,479.6 miles, or wrap around the equator more than 4 times.
[quote align=”center” color=”#999999″]There are more places than ever where data relevant to our case could be hiding. [/quote]
By comparison, in 2005, there were about 130 exabytes of data created or replicated on all the computers and computing devices worldwide. Today the figure is 22 times larger than that. In 2020, it’s expected to rise to 40 ZB, or 315 times larger than it was in 2005.
Certainly much of that data is junk. But the point is that now, there are more places than ever where data relevant to our case could be hiding. So as thorough and diligent as we professionals are, there’s likely to be more digital evidence out there we’ve not yet uncovered.
In my experience, many of those sources can be one or more of a panoply of social media services.
Unfortunately, discovery standards and professional norms regarding investigation of social media are still somewhat lacking in the breadth and depth necessary to establish reliable benchmarks for how to adequately capture and present all the available information. Those efforts need to take into account the new realities of the social networking landscape and why social media now plays a larger role in our investigations.
More Users, More Data
More people than ever before are spending more time using more social media services for more kinds of sharing than ever before. (A recent mylife.com infographic details this.) Kids, octogenarians, and yes, even pets, can leave a long trail of potentially useful data.
Now, investigators are using that data in more ways than ever.
The number of services in use–and the total number of users–have both grown tremendously in recent years, as seen on Wikipedia’s (not complete but huge) list of social network sites. There’s a handful of services that stand out, and there are some you might never have heard of, despite their having millions of users. Facebook and Twitter, of course, are the biggest players.
Right behind Facebook and Twitter is a true giant of social media data: YouTube. Videos hosted on YouTube may even have been entered as evidence in some of your cases. Statistics were recently released, however, which completely blew away my estimates of its ubiquitousness:
[list type=”check”]
- More than 1 billion unique users visit YouTube each month.
- Over 4 billion hours of video are watched each month on YouTube.
- 72 hours of video are uploaded to YouTube every minute.
- In 2011, YouTube had more than 1 trillion views, or around 140 views for every person on Earth.
- Traffic from mobile devices tripled in 2011, with people now watching one billion views a day on YouTube mobile.
[/list]
Emerging Networks
These giants will likely continue to dominate the social media landscape for some time to come, but diligence in this field demands we pay attention to a host of others, and as much as possible, stay up-to-date on emerging players.
The importance of this strategy was underscored recently in an article by Ryan Holmes, CEO of the social media management company Hootsuite. He pointed to the rocketing growth of Instagram, which went from a million users in December 2010 to 100 million users and 58 photo uploads per second just 24 months later.
Holmes looked at seven up-and-coming social networks which could be the next Instagram. That’s interesting enough for its own sake, but for our purposes, they show how sources of potentially useful evidence crop up in the space of months, not over the course of years. And what’s striking is how few of us are familiar with them them.
The seven sites Holmes pointed to were:
[list type=”check”]
- Pheed, a photo and video monetizing site;
- Thumb, a personalized crowdsourcing tool;
- Medium, an invitation-only social network;
- Conversations, a real-time collaboration tool by Hootsuite;
- Chirpify, a tool for purchasing via Twitter;
- Flayvr, an elegant photosharing platform;
- Chirp, a proximity message and photo sharing app.
[/list]
Investigators: Have you used or at least visited one of these seven services? Two? Five? All seven?
For most of us, the answer is no. What this shows us is that when deciding what social media to search for possible evidence in a case, it’s getting to the point where it’s not enough to simply check out the top sites to see if perhaps our subject has an account on one. Instead, as much as possible, we need take any practical steps to start with the subjects themselves and, through our investigation, determine what (if any) social network sites they may subscribe to.
In the Courtroom
A growing number of civil and criminal court cases involve social media evidence in some way. Some have even hinged on it. E-Discovery experts studying this closely over the last few years found 689 state and federal court cases during 2010 and 2011, which they believe represent a fraction of cases that in some way directly involved social media evidence (not counting all the cases where social media was merely mentioned or brought up in passing but didn’t play a central role).
Then last year, we see an explosion. During just the first half of 2012, they found another 320 cases filed nationwide. (See X1 Discovery’s list of social media-related cases.)
If you’re not looking closely into social media as a central source of information for workplace investigations, you could be doing your client a real disservice by ignoring a huge pool of potentially useful data. Whether you tease out just a “like,” find some comments on the page of a contact, or uncover many pages of ranting, social media data of all kinds can have a crucial impact.
Jessica Miller-Merrell’s compilation of terminations and firings related to social media activities goes back to 2002 and underscores how essential these investigations can be in any workplace case you may be working.
Investigators may not need to be as concerned with legal privacy issues as attorneys, but there are a few important details to keep in mind when conducting thorough social media investigations:
1. Do not delete the evidence.
First, as was sharply illustrated in the case of Lester vs. Allied Concrete, an attorney or his agent can’t advise a client to “clean up” or delete the client’s social media postings or accounts. This is called spoliation of evidence and it could cost you dearly.
2. Observe privacy laws.
Second, there are some complex issues surrounding access that employers may or may not have to an employee’s social networking content–postings that are password-protected may be covered by federal privacy laws. Do your due diligence and work with legal counsel to establish boundaries and guidelines on any workplace investigations.
3. Restrict your search to information that’s publicly available.
Third, conduct your investigation in a way that is transparent and strictly legal. Here’s how I phrase this to clients when they ask about what I can and cannot access: The methods and tools I use only capture and index publicly available information from social network sites and any publicly available web postings.
I do not use any pretexting, subterfuge, password cracking, social engineering, or otherwise unethical means to gain access to protected material. (The ethics of these practices are still unfolding in the world of online investigations, but another personal rule for me is “better safe than totally screwed.”)
Depending on the particulars of your case, you may indeed be able to capture, index, and prepare privately protected material, using the login credentials provided by a cooperating client or witness (provided that client or witness signs an authorization for release of information). But you’ll need to proceed very carefully and work closely with an attorney when treading into these murky legal waters.
In the next segment, we’ll be peeling back the layers of social media investigations, looking more closely at lessons from recent cases, and why screenshots are just not good enough.
About the Author:
Eli Rosenblatt is an investigator, CFE, and forensics expert in Portland, Oregon. He owns Eli Rosenblatt Investigations and Core Service, LLC and has, quite possibly, the best-designed business card in all the world.