Best Practices for Managing Electronic Evidence

Investigations: Don’t Lose Sight of the Basics

These days, attorneys and in-house legal departments can easily get caught up in the electronic evidence frenzy and in their rush to embrace the ever-evolving world of electronic evidence, they may find themselves expending significant resources on digital collection and authentication procedures. They’d do well to remember that many of the challenges attorneys and courts have faced with respect to old-fashioned physical evidence are no different from those they face with electronic evidence.

These days, many attorneys and in-house legal departments are finding themselves ensnared in the electronic evidence frenzy. And in their rush to stay abreast of the ever-evolving world of electronic evidence, these legal professionals often expend significant time, resources and money on digital collection and authentication procedures — measures that often prove entirely unnecessary. Because while there is undoubtedly a unique set of issues associated with electronic evidence (Where do you collect it from? How do you collect?), at the end of the day, electronic evidence is still evidence. Accordingly, many of the concerns associated with electronic evidence (How do you ensure it is admissible? Is there any way to keep it out of a case?) are no different than the challenges attorneys and courts have tackled for years with respect to old-fashioned physical evidence. Indeed, as one court aptly remarked in addressing electronic communication authentication concerns, “the same uncertainties exist with traditional written documents. A signature can be forged; a letter can be typed on another’s typewriter; distinct letterhead stationery can be copied or stolen.” In re F.P., 878 A.2d 91, 95 (Pa. Super. Ct. 2005). So while legal professionals cannot simply ignore the onslaught of electronic evidence issues, they should not lose sight of the basics in navigating them.

Perhaps the most challenging issue associated with electronic evidence is identifying the variety of sources from where it can be obtained. For example, beyond the more traditional e-mails, text messages and social media accounts, attorneys must now also consider those less-trodden electronic sources (at least in the world of litigation) that might contain useful information, such as voice-activated products (Siri, Google Home) and activity trackers (Fitbits). That said, while seeking Fitbit data may be valuable in defending against a plaintiff’s claim of severe disability, the same data would likely have no relevance in defending a gender discrimination claim. And given that irrelevant evidence — electronic or otherwise — generally will not be admissible in court, attorneys should carefully evaluate all of the claims in a case to determine whether seeking these less traditional (and less accessible) types of electronic evidence would be a waste of unnecessary resources and costs.

With respect to easily and publicly assessable electronic content, however, law firms and in-house legal departments should generally strive to conduct, as a matter of course, early investigations regarding the individuals involved in your case (your investigation should not be limited to the opposing party; you should also know what is out there about your own client). Performing internet research early in a case — prior to formal discovery — can be of tremendous value to your case. For example, if you wait until discovery to ask a party to identify all of his or her social media accounts/usernames/blogs/etc., thereby alerting the party of your intent to search, you run the risk of the party simply disregarding their legal and ethical obligations and deleting content perceived as harmful to his or her case. While deleted content may sometimes be recoverable, more often than not (especially in the case of social media content), some of it will not be recoverable, even with costly forensic assistance. And you would have no reason or basis to bring a spoliation claim if content or accounts are deleted before you even knew they existed. The takeaway here is to ensure that you perform your informal internet discovery as early as possible.

Notably, you do not need an expensive service or software to conduct your initial investigations. You can start with a simple Google search of the individual and follow up with other common search engines like Yahoo and Bing, and even less common search engines, such as DuckDuckGo and WolframAlpha. Your goal of these initial searches should be to identify as many usernames, social media accounts, e-mails, blogs, etc. an individual maintains. And because many individuals use pseudonyms for social media accounts and the like, your initial investigation should also take advantage of the free basic search features offered by sites like Pipl.com, which will often return a list of usernames that have been associated with an individual. Similarly, you can use the free search features offered by sites such as FamilyTreeNow.com to identify names associated with an individual, possible relatives and associated people and (an often very long!) history of addresses linked to an individual. In addition, subsequently searching for the social media accounts of the individual’s family and friends may be useful in tracking down other accounts and/or usernames utilized by the individual you are investigating (these friends and family members could later become potential witnesses in support of any authentication and/or spoliation issues that could arise).

Once you have identified and browsed through an individual’s publicly available web content (private web content — such as information that only an individual’s Facebook “friends” can see — will always require consent from the individual),[1] your next steps will likely depend upon not only what you are finding, but also how you will want to use the electronic evidence you are finding, your available resources and the limitations and issues associated with the plethora of search and extraction tools and services currently out there.

For example, if there appears to be a significant amount of relevant content on various social media platforms or various accounts associated with an individual, or if you need to search through voluminous social media content for a number of different users, the X1 Social Discovery tool is a useful option for collecting and archiving all the social media and web-based content associated with a particular individual. As the content is collected and archived, you can then perform comprehensive searches through X1, based on fields such as keywords and date ranges, and then capture relevant content and its associated metadata. But because X1’s package of capabilities and features is so extensive and complex, X1 users require a fairly high amount of training (indeed, the company offers a three-day training course at its headquarters in California). Because storage can also be an issue, as there can be multiple terabytes involved in a single case, some firms and companies outsource the social media searching to a vendor that sets up X1 and runs all the specified searches.

On the other hand, if your initial internet research reveals that the individual does not have many social media accounts or is not a heavy social media user, the X1 search and capture tool is probably unnecessary. In that case, the better approach may be to continue with your free browsing and searches (many social media sites have their own halfway decent search tools) and utilize a tool such as Page Vault to capture any relevant content you identify. Although you can have Page Vault perform the web capturing for you, the more cost-effective method is usually purchasing the company’s “do-it-yourself” software. Once installed, you can simply click the “capture” button when you see potentially relevant content (similar to taking a screenshot). Similar to the capture services of X1, the Page Vault program will turn your screen capture into a PDF and create a PDF cover page that includes metadata and other pertinent information often missing from a simple screenshot. One upside of installing the Page Vault software, as compared to X1, is that the captures are made and stored in a cloud-based site hosted on Amazon, so you do not have to use local storage space. But unlike X1, Page Vault is not designed to search through web-based content; it simply provides a “beefed up” screenshot.

But simply utilizing web capture services to collect metadata is in no way a guarantee when it comes to authentication and admissibility of the captured web content. Indeed, notwithstanding the various web capture services and companies out there and the warnings about the dangers of using a mere screenshot, screenshots are often all you need. For example, even without metadata, if a witness affirmatively identifies a screenshot of her Facebook post — either in a deposition or in response to a request for admission, for example — then the screenshot would likely come in like any other traditional document (assuming you overcome any relevancy or hearsay issues). And if the witness disavows the Facebook post, claiming someone hacked her account — just like a witness can disavow her signature on a physical contract or a letter — having the metadata associated with the post will only get you so far. Its use would be limited to demonstrating only that you have an accurate copy of what appeared on the internet — the metadata would not prove that what you captured from the internet is what it purports to be (e.g., a Facebook post by the witness).

Accordingly, just like authenticating traditional evidence absent testimony from a witness with knowledge, you must be prepared to use a different mode of authentication, such as gathering distinctive characteristics to connect the witness to the captured web content (like the post’s use of certain emojis or fonts that the witness has admitted to commonly using in other posts). So long as you can present evidence of authenticity, the general trend is for courts to admit the evidence and let the jury make the final determination on whether the evidence is authentic. And the more facts you have connecting the witness to the electronic evidence, the better your chances that the jury will find the witness untrustworthy.

Similarly, if you find yourself in the position of defending against some damaging web content authored by your client, exercise caution in disputing the authenticity. If the offering party brings in enough circumstantial evidence linking the electronic content to your client, you run the risk of your client looking untrustworthy. So just like you would handle any other type of damaging evidence, you will likely be better served by focusing on how to deflect the harm of the electronic evidence and relying on relevancy and hearsay, rather than authenticity, objections.

In the end, navigating through the vast amount of information and warnings out there about electronic evidence can be overwhelming and downright stressful. And while attorneys and in-house legal departments should certainly take advantage of the many services and tools now available to assist with electronic evidence, they should give themselves the occasional reminder that sometimes, revisiting the basic rules of evidence is all that is necessary.

[1] Attorneys should be extremely wary of trying to “friend” or otherwise follow an individual to gain access to the individual’s private content. Conduct such as creating and using fake social media accounts to perform searches or connect with individuals, or even using the attorney’s own personal social media account to connect with represented individuals, can constitute ethical violations.