social media in legal investigations

Social Media in Legal Investigations

Ian Tausig, CSMIEBrian J. Kramer, CFLS

California Association of Licensed Investigators, 2016 Annual ConferenceJune 11th, 2016 – Rancho Mirage, California

Agenda

Working with counsel to identify issues in the caseIdentifying likely sources of evidenceInvestigative techniquesSocial Media ForensicsLegal and Evidentiary IssuesCase Study: Michelle Ghent v Terrence Howard

AboutIan A. Tausig, CSMIE

Ian Tausig is a licensed private investigator and the President of Tausig & Associates, a full-service professional investigation agency which specializes in providing litigation support and legal investigation services to law firms and insurance carriers throughout California. Ian is a former law enforcement professional, establishing his agency in 2013. He is a board certified Social Media Intelligence Expert, as well as a subject matter expert and court-testified expert witness in the field of social media investigative techniques, and the authenticity of social media evidence.

AboutBrian J. Kramer, CFLSBrian Kramer is certified by the California

Board of Legal Specialization as a family law specialist, has been recognized as a Super Lawyer in the practice of family law, and he is widely regarded to be one of the top divorce attorneys among his class of peers in Los Angeles. In recognition of some of the outstanding results he has secured for his clients, Brian’s family law practice has been the subject of both local and national news coverage. Most recently and notably, Brian successfully worked to vacate a large spousal support judgment against academy award nominee, actor Terrence Howard.

Introduction

• 100 million hours of video watched per day

• 1 billion users on Groups

• 80 million users on Facebook Lite

• 500 million users on Events

• 123 million events created in 2015

• 50 million small and medium sized business on Facebook Business Pages

Why social media should be reviewed in every case

Image From http://www.technewstoday.com/

IntroductionWhy social media should be reviewed in every case

January 24th, 2016 – 1 Billion individual logins on Facebook

Working with CounselWhy use social media evidence?

• Evidence of state of mind• Evidence of

communication• Evidence of time and

place• Evidence of actions• Rebuttal and Impeachment Evidence

Identifying Sources of Evidence

1. Facebook1.1 billion unique users per month

2. YouTube1 billion unique users per month

3. Twitter310 million unique users per month

4. LinkedIn255 million unique users per month

5. Pinterest255 million unique users per month

6. Google+120 million unique users per month

7. Tumblr110 million unique users per month

8. Instagram100 million unique users per month

9. Reddit85 million unique users per month

6. VK80 million unique users per month

Social Media Forensics

• Forensic Preservation and Chain of Custody• Just because it’s on the internet, the same basic principals for collecting

and storing evidentiary material applies.• Best practices for forensically preserving social media evidence include:

• Use of forensic software for preservation. Forensic software will create an audit trail and preserve relevant metadata behind preserved content.• X1 Social Discovery for social media content• WebPreserver for content outside of X1’s support social media

platforms, or websites.

• Bottom line: Screen shots, printing to PDF, or printing a paper copy is not a forensic preservation and can potentially lead to significant evidentiary challenges and authentication issues.

Authentication

• Personal knowledge - "Yes, I know that is his/her Facebook page."

• Distinctive Appearance - appearance, content, substance, internal patterns, specific indicia

• Deposition or interrogatories - "Do you maintain the Facebook account in this name?"

• Expert witness testimony - "In my opinion, this Facebook page is maintained by him/her“

• Basic Subscriber Information - Obtained from subpoena

Experts construct the integrity of a document. Utilize as many of these as possible to authenticate social media evidence:

Legal Aspects of Social Media

Statutes and Case Law

The Stored Communications Act (SCA)

Formal Discovery: Special Interrogatories, Demands for Production, and Subpoenas

Case Law, Ethics, Preservation and Authentication

California Evidence Code

• California Evidence Code 1400• Authentication of a writing means (a) the introduction of evidence sufficient to sustain a

finding that it is the writing that the proponent of the evidence claims it is or (b) the establishment of such facts by any other means provided by law.

• California Evidence Code 1552(a)• A printed representation of computer information or a computer program is presumed to

be an accurate representation of the computer information or computer program that it purports to represent. This presumption is a presumption affecting the burden of producing evidence. If a party to an action introduces evidence that a printed representation of computer information or computer program is inaccurate or unreliable, the party introducing the printed representation into evidence has the burden of proving, by a preponderance of evidence, that the printed representation is an accurate representation of the existence and content of the computer information or computer program that it purports to represent.

• California Evidence Code 352• The court in its discretion may exclude evidence if its probative value is substantially

outweighed by the probability that its admission will (a) necessitate undue consumption of time or (b) create substantial danger of undue prejudice, of confusing the issues, or of misleading the jury.

California Case Law• People v. Beckley (2010) 185 Cal.App.4th 509

• Evidence from Social Media sources must be properly authenticated.

• Also cites People v. Doggett (1948) 83 Cal.App.2d 405 that “no expert testified that the photo was not a composite or fake”

• “Such expert testimony is even more critical today to prevent the admission of manipulated images. . . . [W]ith the advent of computer software programs such as Adobe Photoshop it does not always take skill, experience, or even cognizance to alter a digital”

California Case Law• People v. Valdez (2011) 201 Cal.App.4th 1429

• Trial court admitted MySpace “printouts,” upheld on appeal

• Provided guidance on use of “specific indicia” to authenticate social media evidence

• MySpace page icon identifying the owner of the page displayed a photograph of Defendant’s face.

• Defendant’s Myspace page included greetings addressed to him by name and by relation

• Defendant’s sister left a "big brother" salutation on his MySpace page, accompanied by a user icon consisting of her photograph

• Greeting from Defendant’s sister was one of many posts by friends and by the page owner that included personal details

• Page owner's stated interests, including an interest in gangs generally and specifically, matched what the police otherwise knew of Defendant’s interests from their field contacts with him

• “The writings on the page and the photograph corroborated each other by showing a pervading interest in gang matters, rather than an anomalous gesture.”

• “Other key factors include that the evidence strongly suggested the page was Defendant’s personal site…and that the page was password protected for posting and deleting content, which tended to suggest Defendant, as the owner of the page, controlled the posted material.”

Stored Communications Act (SCA)

• SCA creates Fourth Amendment-like privacy protection for email and other digital communications (content) stored on the internet.

• Limits the ability of “electronic communications holders” to reveal content information to nongovernment entities.

18 U.S.C. §2701, et. seq

• Social media and email providers are defined as “electronic communication services” (ECS) within SCA.

Legal Requests

• Special Interrogatories

• Demands for Production (DFP)

• Subpoenas

• Alternate methods

Special Interrogatories, Demands for Production,

and Subpoenas

Subpoenas• Response by a social media platform to a criminal or civil subpoena,

requesting content is PROHIBITED by SCA. • Basic subscriber information is not protected by SCA and may be obtained

via subpoena to the platform.

• Basic subscriber information is:• Account holder’s name• Account holder’s address• Local and long distance telephone connection records, or records of

session times and durations• Length of service (including start date) and types of service utilized;• Telephone or instrument number or other subscriber number or identity,

including any temporarily assigned network address [which would include IP addresses]

• Means and source of payment for such service (including any credit card or bank account number)

Subpoenas (Continued)• Use specific, narrow verbiage in subpoenas• Identify specific user name’s and/or account numbers in the request• Party must be given notice prior to service of the subpoena • For obtaining content – SCA does NOT apply to individual parties, just the

platforms.

Demand for ProductionCCP§2031.010

• Specific, narrow verbiage

• Avoid fishing expeditions - “Any/All,“ “Complete account”

• Specific date range

• In regards to messages between parties, specify the other party

• In regards to pictures, specify pictures of who

• If already available, utilize the username/number of the account

Legal RequestsAlternate Methods

• In any formal discovery, SCA becomes a strongly controlling factor. However – SCA only controls content held by the provider, not by the party.

• Alternative: Requesting the court compel the party to consent under SCA; or compel the party to provide their login (username / password) information

• “If the court can compel Juror Number One to produce the information, it can likewise compel Juror Number One to consent to the disclosure by Facebook. The SCA has no bearing on this issue.” -Juror Number One v. Superior Court, 206 Cal. App. 4th 854, 142 Cal. Rptr. 3d 151 (Ct. App. 2012).

• A court may compel a party consent to disclosure of communications under 18 U.S.C. §2702(b)(3) - Negro v. Superior Court, 230 Cal. App. 4th 879, 179 Cal. Rptr. 3d 215 (Ct. App. 2014).

• Federal court requires a party to respond to interrogatories “requesting her to list all user names and passwords for every social media site she utilizes” - Howell v. Buckeye Ranch, Inc., No. 2:11–cv–1014, 2012 WL 5265170 (S.D. Ohio Oct. 1, 2012)

• The courts have widely disagreed on the reasonableness of these approaches, awarding sanctions against requesting parties, as they should be considered secondary or last-resort.

Ethics in Social Media InvestigationsAgent of Counsel

• Things you can do that will can your attorney / law firm clients in trouble with the State Bar:

• Attorney / Law Firm clients have professional responsibility to supervise the work of their “employees or agents” – Professional Rules of Conduct 3-110

• Communicate directly or indirectly about the subject of the representation with a party (ex-parte communication) – Professional Rules of Conduct 2-100

• Attorney sends Facebook friend requests to two high-ranking company employees of the opposing party in an action.

• SDCBA opined “[CalBar]…rules bar an attorney from making an ex parte friend request of a represented party.” – SDCBA Legal Ethics Opinion 2011-2

Private Profiles & EthicsExpectation of Privacy

• Is there a reasonable expectation of privacy on social media?• Courts are generally saying NO.

• “…material posted on a “private” Facebook page, that is accessible to a selected group of recipients but not available for viewing by the general public, is generally not privileged, nor is it protected by common law or civil law notions of privacy. Nevertheless, the Defendant does not have a generalized right to rummage at will through information that Plaintiff has limited from public view” Tompkins v. Detroit Metropolitan Airport, 278 F.R.D. 387, 388

• Juror Number One argues forced disclosure of his Facebook posts violates his privacy rights. However, Juror Number One has not shown he has any expectation of privacy in the posts -Juror Number One v. Superior Court, 206 Cal. App. 4th 854, 142 Cal. Rptr. 3d 151 (Ct. App. 2012).

Case StudyMichelle Ghent v Terrence Howard

• Parties signed a marital settlement agreement (MSA) after private mediation, the MSA was then entered as a judgment.

• Terrence filed request for order to set aside the judgment, Michelle engaged in “conduct amounting to criminal extortion or blackmail.”

Video credit: AP via YouTube


• Highly publicized 4 day trial began August 13, 2015; overseen by widely respected LA County Superior Court Family Law Judge, Hon. Thomas Trent Lewis

• First witness, Terrence’s sister Yvonne Howard. Testified that Michelle had made threats against Terrence to reveal person information about him.

• Second witness, Charles McBride, was Terrence’s business manager and accountant. McBride testified he wired “hush money” to Michelle.

• Third witness, Ian Tausig, reviewed and provided expert testimony on social media posts and private messages made to Terrence and his (now) ex-wife Mira.


• Review of 491 pages of social media postings and related evidence

• 61 pages of screenshots of Instagram posts and direct messages

• 152 pages of documents pertaining to a search warrant (and the SW return) relating to Instagram accounts.

• 86 pages of text messages exchanged between Terrence and Michelle

• 192 pages of deposition transcript, from Michelle’s deposition


• Search warrant was issued 1/15/2015 in response to a criminal investigation (stalking)

• Search warrant identified Michelle’s known Instagram account, as well as 3 others which had sent threatening messages to Terrence.

• All 3 suspect accounts were deactivated at the time of warrant service.

• Search warrant author failed to identify or include a 4th, still active suspect account, as well as a still active Twitter account.


• 61 pages of Instagram posts and direct messages reviewed

• Several posts and messages displayed specific indicia with one another, providing a reasonable belief and conclusion they were being authored by the same individual.

• Several posts and messages also included private, personal information not available in the public domain – and only known to an extremely small group of individuals – including Michelle.


• 86 pages of text messages exchanged between Terrence and Michelle

• Threats made of “pictures will all be up” and “Start googling”


• 192 pages of Michelle’s deposition transcript

• Michelle denied generally and specifically operating any of the accounts which were sending harassing and threatening messages


• On social media evidence:• 5 hours of direct testimony• 2 hours of cross-examination

• “Rebuttal expert” had experience as a network engineer. Not applicable here. He also identified his most recent employment at Robbins Brothers. (Yes, the engagement ring experts.)

• Trial preparation was CRITICAL


• Judge Lewis found the testimony and evidence regarding social media postings to be “credible” and further found “that Michelle was making Instagram and Twitter posts about Terrence”

• Ultimately, the court found Terrence “had no choice but to sign the agreement” and the Agreement as well as the judgment were set aside.

Contacts

Ian A. Tausig, CSMIETausig & Associates

1000 Paseo Camarillo, Suite 227Camarillo, CA 93010Phone: 805-293-1409Email: [email protected]://www.TausigPI.com

Brian J. Kramer, CFLSBrian J. Kramer, PC

12100 Wilshire Blvd, Suite 800Los Angeles, CA 90025Phone: 424-228-4133Email: [email protected]://www.bjkpc.com