Private Investigation: Finding and Using Social Media Evidence in the Courtroom By: Claude Ammons, III & William A. Monroe Tel: (877) 687-3939 Email Mr. Ammons Website: www.corinthian-group.com

As the technology continues to advance at an overwhelming pace, so does our dependency on internet based technology.

Researchers in years past would utilize manual sources such as the local library, archived court records and news publications to gather intelligence on the subject of their investigation. However, with the exponential growth of Social Media sites such as Facebook, Twitter and LinkedIn to name but a few, actionable intelligence can quickly be compiled for use as admissible evidence in court.

Private Investigators routinely peruse social media sites in an attempt to obtain subject/suspects photographs, identify and corroborate personal information in an attempt to construct a sociological and or psychological profile on their subjects/suspects.

In order to find useful intelligence through social media sites you must first understand the psychology behind it. A psychological/sociological profile is a method of gathering speculative information regarding a subject's/suspect's psychological make up and or social behavior for use in an investigation.

The key for the smart investigator is to ensure that the data collected is acquired legally and is admissible in court. A social media post has the power to provide evidence that helps you win or lose a case. Social media makes e-mail look like stone tablets due to the volume of communication by multiple parties, as well as the duplicate copies of specific posts which may be retrievable via search engine query.

SOCIAL NETWORKING SITES:

By definition, a social networking site is the interactive sharing of your personal life with others; the recipients are not limited in what they do with such knowledge.

There have been cases in which parties in a dispute have created alias social media profiles in an attempt to 'friend' the other party to get access to their social media posts. However, the obtaining of information by these means has not yet held up in court and it also violates Facebook's (and other social media sites) terms of service. IE: Creating an account under an alias, "friend" the employee under investigation and then attempt to use that information as evidence to support your case. Evidence obtained by these means will be inadmissible regardless of how damaging it may be.

Nonetheless, users who voluntarily post all pictures, personal information, etc. on social media sites such as Facebook and MySpace cannot claim they posses any reasonable expectation of privacy.

I have been a part of cases where an Attorney instructs a client to "Clean up" their social media accounts. The common mistake in the logic here is that the posts are permanently removed from the internet. They are not! People think that by deleting questionable posts and or pictures they protect themselves from that media being used against them.

Sometimes a deletion itself can influence an investigation, bringing even more attention to that which was deleted. These actions may be punished severely by the courts.

There can be very serious penalties for the destruction of evidence when a person or entity knows that their social media activity may be relevant to an ongoing law enforcement investigation and or lawsuit.

FINDING THE EVIDENCE:

Finding the "Golden Nugget" of relevant information is easier said then done. It is important that you have an investigator or researcher who has an innate ability to empathize with the person being investigated. With the various social media sites that cater to individuals whom share common hobbies, interests and professions, the Golden Nuggets of information may be available to those who are diligent.

What to look for?:

Depending on how much information you already have on your subject, here are a few important details that you may need to help you find potential evidence. The 1^st seven items are most important during the initial phases of your investigation.

1. Full name (Nick names, alias, middle name and hyphenated last names)
2. Current address or names of cities where your subject has resided
3. Date of Birth or at least their approximate age
4. Physical description (IE-Height, weight, scars, marks, tattoos, piercing, etc.)
5. Names of children, spouses and close relatives
6. Names of past and current employers
7. Vehicle types and if possible description
8. IP addresses
9. Email addresses
10. Screen names
11. 11. Avatars/Logos routinely used by their subject/suspect to accumulate an on-line paper trail.

Once you've found the social media sites that you believe your subject/suspect is affiliated with, you then conduct search engine searches using the email addresses and screen names you uncovered in your initial internet canvass.

If your subject/suspect has enabled public posts and or if their internet activity is not protected from search engine indexing, potential evidence may be readily available through various search engines. However, if these posts and or internet activity are protected from search engine indexing, then potential evidence will not be readily accessible. Obtaining this restricted information would most likely violate ethical rules and reasonable expectation of privacy rights.

Most internet savvy investigators have covert means of obtaining restricted information but it would be wise to only use this information as a lead to obtain tangible and court admissible evidence. (IE-Locating a restricted post whereby the subject states he is going to his favorite bar and the investigator then obtains video evidence of the subject drinking alcohol prior to picking up his children which could have a significant impact in a court custody case).

At the end of the day, discretion is key! You never want your subject to see you coming...

Positively Identifying/Authentification

In many cases, individual use aliases and or nick names when creating online accounts. So it is vital to some type of corroborating evidence be used to substantiate the subjects identity such as email address, user/profile name, photographs, IP addresses and other subscriber information which is generally obtained via subpoenaing the Social Media Site in question. However, obtaining subscriber information from online sites is easier said then done. But, it can be done!

USING EVIDENCE FROM SOCIAL MEDIA:

Based on a recent BRI article from attorney, Russell T. Burke there have been over 60 reported decisions from state courts where evidence was obtained from social media sites. "The Federal Rules of Civil Procedure, the Federal Rules of Evidence and most analogous state rules do not specifically address the discovery and use at trial of evidence from social networking sites." Therefore, attorneys must adhere to the standard Rules of Evidence, Discovery and past Decisions relating to ESI (Electronically Stored Information). Furthermore, the proper collection and preservation of potential evidence must also be adhered to...

Rules of Evidence:

Admissibility: There are 3 main prerequisites needed before potential electronic evidence can be considered court admissible:

1. Relevancy: Is the information you wish to consider as evidence has significant and demonstrable attributes to help prove and or disprove the fact for which is being offered.
2. Material: If an issue is important to determining the outcome of a case, the evidence offered to prove that issue is considered to be material.
3. Competent: Evidence that tends to prove that matter in dispute and is admissible.

E-Discovery:

During the E-Discovery process, you must adhere to certain criteria for identifying and preserving ESI (Electronically Stored Information) to insure that the evidence will be court admissible. Below you will find several steps important to the E-Discovery process:

• Develop an enforceable electronic records retention policy and electronic records management (ERM) program.
• Properly identify and label the ESI storage device.
• Preserve any ESI so it cannot be destroyed and or altered.
• Do not have multiple cases on your storage device.
• Filter and remove unnecessary or duplicate ESI.
• Insure that you have properly filtered and removed privileged ESI which may not be court admissible.
• After filtering the inadmissible, privileged or duplicate ESI, produce the remaining ESI content.
• If applicable, present it at trial.

Subpoenaing Social Media Site Records:

I have worked several stalking cases where obtaining subscriber information was needed from web based email sites like Yahoo, MSN and Google. The 1^st key is to have an ongoing case so that can request a subpoena. The 2^st key is knowing what to ask for and how to ask for it. Sometimes it's not what you say, but how you say it...