Unlocking the Power of Authentic Social Media Evidence: The Role of Investigation and Advanced Forensic Tools

Imagine for a moment that you need to gather evidence from someone’s Facebook or Twitter account for an investigation. The individual has posted something incredibly incriminating, which could significantly aid your case. However, there’s a high likelihood that they’ll realise their mistake and delete the post. The evidence could vanish at any moment, so swift action is essential.

What do you do?

If you’d simply take a screenshot, you’re not alone. Numerous claimants, investigators, regulators, and even legal experts resort to taking screenshots. This is primarily because it appears to be the straightforward solution to a complex issue. There are very few ways to preserve a digital copy of a social media post that exists solely within an online platform. While you can effortlessly create a copy of a Word, Excel, PDF, audio, or video file, social media posts lack this option.

But, Do You Have the Metadata?

A screenshot might appear to be a rather refined solution to the problem. However, while this approach enables you to capture whatever is on screen, it introduces its own challenge. Because a screenshot converts a social media post into a simple JPEG, it removes the metadata and renders authentication impossible.

Metadata provides information about digital data, essentially functioning as data about data. For a social media post, this would encompass details about the author of the post, the message type, post date and time, versions, links (un-shortened), location, likes, and comments.

Without this metadata, there’s no way to prove that your JPEG copy accurately represents the original content posted on the social media platform. All you have is an image that could have been manipulated using Photoshop or other methods – something that neither a court nor your opposing counsel will be satisfied with.

Investigation using Social Media Evidence

While it has taken some time for courts and the legal sector to grasp the dynamic and real-time nature of social media content, screenshots are increasingly regarded with scepticism. Submitting a screenshot as evidence, once a relatively common practice, is now becoming a risky strategy that could jeopardise a case.

One example is Moroccanoil v. Marc Anthony Cosmetics. This case, argued in front of a federal district court, revolved around trademark infringement and unfair competition concerning the word “Moroccanoil”. Moroccanoil (the company) had registered the word with the United States Patent and Trademark Office (USPTO). Marc Anthony Cosmetics contended that the terms “Moroccanoil” and “Moroccan oil” were used interchangeably by consumers as generic terms, and therefore Moroccanoil couldn’t trademark it.

To support their argument, Marc Anthony submitted screenshots of a Facebook page demonstrating how customers used these words. Regrettably, the court ruled that the Facebook content couldn’t be admitted into evidence, as there was no way to prove that the screenshots were an exact copy of what existed on the live Facebook site. In other words, the screenshots couldn’t be authenticated.

United States v. Vayner

Another example is United States v. Vayner. During the trial, a printout of a page on VK.com (a Russian site similar to Facebook) was entered into evidence. The defendant’s legal team objected, arguing that the page hadn’t been properly authenticated and that there was no proof that this was, in fact, his page.

The court concurred, and the evidence was deemed inadmissible. However, a district court later overruled this decision, asserting that it was reasonable to assume that the page belonged to the defendant.

Nonetheless, the story didn’t end there. The U.S. Court of Appeals for the Second Circuit again overturned the ruling, maintaining that there was no way to verify the authenticity of the evidence. The court stated that “the mere fact that a page with [the defendant’s] name and photograph happened to exist on the Internet at the time of [the investigator’s] testimony does not permit a reasonable conclusion that this page was created by the defendant or on his behalf.”

Cases like Moroccanoil v. Marc Anthony Cosmetics and United States v. Vayner highlight the significance of proper collection and authentication methods. Simple printouts and screenshots are insufficient.

The Sedona Conference & Social Media

Another esteemed legal entity advocating for a more sophisticated approach to social media is the Sedona Conference.

The Sedona Conference is a research and educational institute devoted to the advanced study of law and policy. It focuses on areas such as antitrust law, complex litigation, intellectual property rights, and data security and privacy law.

One of its key publications is The Sedona Conference Primer on Social Media, which received a second edition in 2019. The preface of the latest version explains the reason for its creation: “The need for an updated Primer was essential given significant advances in social media technology since we published the first edition of The Sedona Conference Primer on Social Media in December 2012. The proliferation of messaging technology and its usage—on traditional social media platforms and in mobile messaging applications—have created preservation, production, and evidentiary challenges that counsel should learn to recognise and address.”

As expected The Sedona Conference specifically discusses the use of screenshots and other static images in its social media primer. The document states that: “Some practitioners resort to capturing static images of social media data (i.e., screen shots and PDF images) as a means of preservation, with courts often permitting the use of such evidence at trial. Printing out social media data has its evidentiary limitations, as a static image does not capture the metadata of the image, other than whatever information may be viewable as part of the screenshot.

As a result static images may result in an incomplete and inaccurate data capture that is difficult to authenticate, except on the basis of the personal knowledge of a witness. Social media may also contain data and content, such as video, that cannot be properly collected in the form of static images. In addition, social media outlets use different interfaces to display content, further complicating efforts to create standardised snapshots. Any such collection will most likely be a visual representation that does not include metadata, logging data, or other information that would allow the content to be easily navigated and used.”

In summary, a screenshot has three problems. Firstly, and most importantly, it lacks the hash values and metadata required to prove authenticity. Secondly, it lacks context and offers no real understanding of how social media content is structured or presented. Lastly, it cannot capture related video content that is likely necessary to comprehend the purpose and context of a post.

The Automated & Defensible Alternative to Screenshots

So, if screenshots aren’t the solution for social media evidence collection, what is? The Sedona Conference highlights the value of turning to vendors capable of providing dynamic capture with metadata. “Vendors have developed technology to allow certain content to be collected in a way that preserves the content and captures various metadata fields associated with social media data. Properly captured, these metadata fields can assist with establishing the chain of custody and authentication. They can also help to facilitate more accurate and efficient data processing and review.”