The challenges of authenticating social media evidence

Correy Stephenson, The Daily Record Newswire

A MySpace post cautioning against snitching to the police. A picture on Facebook showing an allegedly injured, emotionally traumatized plaintiff dancing and enjoying herself. A Foursquare check-in putting an individual at the scene of an accident.

Evidence from social media could be essential to a case, but how do you get it in front of a jury?

“Just because a message was sent from a LinkedIn account or a post appears on Facebook, can we assume the owner wrote it or sent it?” asked David I. Schoen, a sole practitioner with offices in Alabama and New York.

Authenticating evidence from Facebook, MySpace, LinkedIn and Twitter, among other sites, is a growing issue and “it’s only going to get worse as people increasingly rely upon these types of services,” warned David Meadows, the managing director of ESI Consulting at Kroll OnTrack in Eden Prairie, Minn.

Because the judicial system generally lags behind real-world technology, courts to date have provided limited guidance for attorneys, said James A. Sherer, a partner in the Washington office of Redgrave who focuses on electronic discovery and information law.

The contents of a website are not a self-authenticating document, Sherer said, so lawyers must work through several steps to authenticate both authorship and ownership.

Attorneys must address three different issues, Meadows said: account security, account ownership and authorship of the evidence at issue.

Security
Depending on the social media site, different security options are available, and each individual handles his or her settings differently, Meadows noted.

Limited guidance on authentication

The first step, said Schoen, is to eliminate the possibility that there was unauthorized access to the account, and thereby “establish some reliability on whom the source is believed to be.”
The problem, said Meadows, is that “if anybody can access and change the information, then we can’t say for certain that Bill Smith was the person who made the post to that page.”

To address that issue, the lawyer seeking to introduce the evidence will have to establish whether the alleged content creator shared his or her password with others, allowed joint access or had a smartphone that was not password protected and permanently logged in to the Facebook app, meaning anyone could come along and post a message, for example.

Other red flags to look for are whether the account has been hacked in the past or if the person generally accessed the account from a public computer. Logging in at a coffee shop and failing to log out could allow someone else to access the page, Meadows said.

Ownership
The next step is to establish account ownership.

To do this, the attorney should request a “subscriber report” from the site, which will provide information such as the email address used to open the account and the information provided for the user’s profile.

“You want to find information that will support the idea that this profile is what it purports to be,” Sherer said, such as answers to security questions about the name of a person’s first dog or the color of their first car.

That can be tricky because although Facebook requires a real name and email address, many other sites allow the use of pseudonyms and aliases, Meadows said.

Lawyers can attempt to subpoena the information from the service provider, Schoen said, or request an affidavit or witness testimony from the site about how the account was set up and how access was gained to it.

Even if the service declines to provide the information, lawyers should still ask for it, Sherer recommended.

“It’s better to be able to tell the court that you tried,” he said.

Authorship

The final step is to authenticate the post itself.

In a perfect world, the alleged poster will admit that he wrote that tweet or posted that picture to Facebook.

But if the person denies authorship, you should look at circumstantial evidence, Meadows said. Check the IP address where the post originated from and examine the account profile and post to see if information is included that only the alleged author would know.

“The more pieces that add up that this post was authored by this person from this account, the better,” Meadows said.

Start early
Authentication efforts should begin as early as possible in a case, Sherer said.

“It starts a lot earlier than printing out a page during trial,” he said. “Start at the time the case is filed or you receive notice of the case, and focus on preservation.”

Because social media is incredibly dynamic, lawyers need to move quickly to ensure that evidence is preserved before it gets erased or changed, he cautioned.
Lawyers should also consider how to present the evidence at trial.

As with any other form of evidence, a chain of custody must be established, documenting when the page was viewed and how it was accessed.
A printed page from Facebook may provide an incomplete picture, Meadows said.

If the evidence is printed out, it should contain a date and time stamp that matches the information in an affidavit about when it was printed, Sherer said.

Be sure to include every possible comment and picture, he added. For example, if a post contains multiple comments, some of which aren’t visible, expand them to make sure they can all be seen, he said.

Otherwise, “it looks as if you are trying to hide things.”

Another approach, said Sherer, is to show the jury the evidence in its original form by pulling up the website in the courtroom.