Want to Be My Friend? Social Media, E-Discovery & Ethics

Want to Be My Friend? Social Media, E-Discovery & Ethics A comprehensive guide to case law, discovery challenges and ethical concerns associated with social media An Altegrity Company

2 Introduction 3 An Analysis of Social Media in Civil and Criminal Case Law 4 E-Discovery Considerations: Preservation through Production 6 Managing Social Media to Reduce Risk 8 Ethical Issues Associated with Social Media Use 1 Kroll Ontrack Inc. provides services in the areas of electronic discovery and litigation support. Additionally, we sometimes provide educational materials relating to developments in the law in such areas. Such educational information is not a substitute or the same as legal advice. Kroll Ontrack is not a law firm and Kroll Ontrack employees are not authorized to act as attorneys. The information provided by Kroll Ontrack is general information and should not be construed as or relied upon as legal advice to be applied to any specific factual situation. Any use of Kroll Ontrack information does not create or constitute an attorney-client relationship between Kroll Ontrack or any of its employees or other person associated with Kroll Ontrack and a user of Kroll Ontrack information. As the law differs in each legal jurisdiction and may be interpreted or applied differently depending on your location or situation, the Kroll Ontrack information or use thereof is not a substitute for the advice of a lawyer.

Introduction In the popular 2011 movie The Social Network, Eduardo Saverin (co-founder of Facebook) becomes ecstatic when a fellow classmate tells him to Facebook me. The Academy Award winning movie chronicles the rise of Facebook, which has significantly altered the landscape of human interaction. Indeed, according to statistics published by the Nielsen Co. in August 2010, Americans spent 22.7 percent of their time online using social networking sites and blogs as of June 2010, representing a 43 percent increase from June 2009. 1 People are increasingly turning to social networking sites to conduct their day-to-day communications, outpacing other mediums such as text messaging and email. Social networking is no longer relegated to personal communications either; businesses are increasingly turning to sites such as Twitter, Facebook and LinkedIn to market their products and strengthen their relationships with consumers as these mediums provide a valuable conduit to young and emerging markets. 2 The benefits of social media use are numerous, but jumping on the social network bandwagon is not without risk. These sites are quickly becoming evidence gold mines (for better or worse) and are an essential location to search for data in investigations and litigation. The most valuable evidence is often found among communications, and the informal nature of social networking sites fosters particularly candid interactions that have made them increasingly attractive targets in litigation. To an even greater extent than what is seen in email, people will often post information in a quick Twitter post or Facebook status that they would never put in a printed, signed letter. Avoidance of this topic is no longer an option social networking is not going away. In fact, 80 percent of Fortune Global 100 companies use some form of social media. 3 Instead, corporations and law firms must arm themselves with the necessary knowledge to allow them to approach this subject in an educated, appropriate and defensible manner. This article will present a comprehensive guide to social media, including recent case law, ethics considerations, electronic discovery best practices and tips for managing social media effectively to reduce discovery risks. This whitepaper presents a comprehensive guide to social media with the objective of addressing the following areas:»» Civil and Criminal Case Law»» E-Discovery Considerations»» Smart Management to Reduce Risk»» Ethical Issues 1 http://blog.nielsen.com/nielsenwire/online_mobile/what-americans-do-online-social-media-and-gamesdominate-activity/. Last Accessed April 1, 2011. Gartner also predicts that social media will replace e-mail as the dominant form of communication by 2014. Gartner Predicts Social Networking to Overtake E-Mail. Computerworld.com, July 8, 2010. 2 A 2009 study reports that consumers are 2.8 times more likely to search for a brand if they are exposed to it via social networking sites such as Twitter, Facebook and YouTube. GroupM Search, comscore, The Influenced: Social Media, Search and the Interplay of Consideration and Consumption, October 2009. Available at http:// www.searchfuel.com/2009/10/search-marketing-social-media-interplay/ (last accessed April 1, 2011). 3 Burson-Marstellar Fortune 100 Social Media Study, the Burson-Marsteller Blog. February 2010. 2

An Analysis of Social Media in Civil and Criminal Case Law Before delving into the specific topics affecting corporations and law firms today in terms of managing, preserving, collecting, reviewing and producing social media data, it is important to understand why organizations and practitioners should care about the growing impact of social networking sites. Social media provides valuable information including messages, status updates and photos that can be useful in establishing timelines and alibis along with proving or disproving a person s claims. Social media provides valuable information including messages, status updates and photos that can be useful in establishing timelines and alibis along with proving or disproving a person s claims. The use of this evidence began more prominently in the criminal arena where several courts have allowed the admittance of social network evidence, including profile names, content and photos. 4 Over the past few years, social media evidence use has also been gaining ground in the civil arena of both state and federal courts, although case law remains relatively inconsistent. The driving issue behind social media evidence disputes in this context is the distinction between public and private information. Most courts thus far have considered even private material to be within the scope of discovery provided it is relevant to the matter. For instance, the New York State Supreme Court rejected the plaintiff s privacy argument following the defendant s request for current and historical data both public and private from the plaintiff s MySpace and Facebook accounts. In so holding, the court noted that privacy is no longer grounded in reasonable expectations, but rather in some theoretical protocol better known as wishful thinking. 5 The Court of Common Pleas for Jefferson County, Pennsylvania, also denied a request for social network site privilege, citing language on Facebook and MySpace regarding the possibility of disclosure. 6 The court ordered the plaintiff to preserve existing information and provide user names and passwords to defendants counsel. Citing both of the above opinions, the Court of Common Pleas for Northumberland County, Pennsylvania, also determined that an individual who voluntarily posts pictures and information on social websites does so with the intention of sharing and thus cannot later claim any expectation of privacy. 7 Finding a reasonable likelihood that additional relevant information existed on the non-public portions of the plaintiff s Facebook and MySpace accounts, the court ordered the plaintiff to provide all passwords and user names to the defendant and preserve all existing information. At the federal level, the Southern District of Indiana ordered production of social networking site profiles and other communications from Facebook and MySpace accounts, including postings, pictures, blogs, messages, personal information and lists of friends. 8 The court denied the party s privacy claim barring the need for production where the party placed the emotional health of the particular claimants at issue, stating Facebook is not used as a means by which account holders carry on monologues with themselves. Another federal case from the Middle District of Pennsylvania also addressed the issue of social media access by opposing counsel, finding a limited number of photographs and postings that reflected the plaintiff continued to ride motorcycles, hunt and even ride a mule were relevant under Fed.R.Civ.P. 26 and warranted an order for further production. 9 4 See People v. Liceaga, 2009 WL 186229 (Mich. Ct. App. Jan. 27, 2009) (Prosecution sought to admit photographs discovered on the defendant s MySpace profile of himself displaying a gang sign and the gun allegedly used to shoot the victim as evidence of intent); United States v. Villanueva, 2009 WL 455127 (11th Cir. Feb. 25, 2009) (Court found that post-conviction photos discovered on the defendant s MySpace page of the defendant holding a semi-automatic gun with a loaded clip after the defendant had been convicted of a violent felony could be used as evidence to enhance sentencing). But see, Griffin v. State, 2011 WL 1586683 (Md. Apr. 28, 2011) (Court overturned murder conviction finding the authentication of MySpace profile evidence based upon a picture, birth date and residence location alone provided an inadequate foundation). 5 Romano v. Steelcase Inc., 907 N.Y.S.2d 650 (Sept. 21, 2010). 6 McMillen v. Hummingbird Speedway, Inc., No. 113-2010 CD (C.P. Jefferson Sept. 9, 2010). 7 Zimmerman v. Weis Markets, Inc., No. CV-09-1535 (C.P. Northumberland May 19, 2011). 8 270 F.R.D. 430 (S.D. Indiana 2010). 3 9 Offenback v. L.M. Bowman, Inc., 2011 WL 2491371 (M.D. Pa. June 22, 2011).

As demonstrated by these cases, the overall trend of the judiciary seems to be moving toward greater permissiveness for e-discovery with regard to social media, as well as a strong likelihood that privacy concerns will be outweighed by the weight and relevance of the information. While there has yet to be a consistent, uniform standard, corporations and counsel alike must anticipate and plan for requests for information from these popular communication mediums. E-Discovery Considerations: Preservation through Production Although case law related to requests for social media site content is still developing, Gartner predicts that [b]y the year 2013, 50 percent of all companies will have been asked to produce material from social media websites for e-discovery. 10 Companies and counsel should begin preparing themselves for responding to requests for this data now, rather than waiting for the firestorm to begin. Preservation It is important to recognize that since data from social media is generally discoverable, all the discovery obligations apply, including the duty to preserve, which falls on the named parties to the matter. However, social media evidence presents several challenging scenarios to the preservation picture, including the fact that the data changes frequently, is stored on third party servers and is often blocked by security and privacy settings. Further, few technologies if any are available to assist with social media preservation. Based on these factors, timing is absolutely critical for the proper preservation of social media evidence. Counsel or the corporation should act immediately to capture data in a defensible manner once content is identified as relevant to the litigation. By the year 2013, 50 percent of all companies will have been asked to produce material from social media websites for e-discovery. Collection Collecting social media data presents significant challenges as well. Other than what might be located in browser cache files, social media data is retained solely by the social media service provider. If you try to collect the data without the consent of the owner, your actions may violate federal (and state) wiretapping laws. 11 Investigators should use caution and careful recordkeeping to ensure compliance when accessing social media data. Efforts should be undertaken to either obtain the user s consent or acquire a court order. In cases where a profile owner cooperates with an investigation, the investigator can obtain an authorized password, use it to access and collect the data, and then change the password following the collection. There, the investigator has full access and control over everything on the owner s site, whether it is viewable by the entire public or not. However, it is important to remember that courts will not allow friending under false pretenses, meaning investigators cannot represent themselves as a friend in order to gain access and surreptitiously collect data. In contrast to email, server or hard drive collections, collecting social media data is akin to existing web collection practices. The collection may be conducted using manual screen capturing, individual page captures or web crawlers. However, as is the case with other data collection scenarios, it is advisable to avoid using self-collection methods. 12 Self-collections raise several risks including using the 10 Gartner, Social Media Governance: An Ounce of Prevention, December 17, 2010. 11 United States Code, Wire and Electronic Communications Interception and Interception of Oral Communications, 18 U.S.C. 2510-2522. 4

wrong third-party collection software, possibility of damaging, deleting or missing data, not adhering to proper data collection procedures and changing metadata or overwriting files. Although there is no preferred tool or solution for social media collection, Facebook now offers a feature called Download Your Information which allows a user to download his or her own content and store it in a zip file. 13 This process, however, raises serious questions regarding chain of custody, metadata preservation, etc. Thus, it is always smarter to consult and use an outside expert when attempting to collect this data. Review Although social media data is receiving increased attention regarding the preservation and collection stages of the e-discovery process, relatively few cases thus far have discussed the processing and loading of this data into a review tool. For the few cases that have involved social media at this point, many times the data is packaged as an Alternative Load File. This allows for the data to be easily processed and posted to a review tool. One complexity faced in processing this data to make it available for review is the arrangement of the collected material. Are there families that need to be maintained? Should each user s collection be one document or multiple documents? How do you collect information such as videos from YouTube? Many tools only support audio from videos not the actual video. It is important to discuss with your service provider what their recommendations are in terms of structuring the collection and processing course of action to allow for the most seamless review possible. Production As demonstrated by recent case law, courts are beginning to order the production of social media in response to discovery requests. These cases usually entail the user of the social media site producing the data, not the social media companies. However, a substantial issue that may affect the production of social networking site content is the applicability of the Stored Communications Act (SCA). 14 Congress passed the SCA in 1986 as part of the Electronic Communications Privacy Act. Case law relating to social media production and the SCA is scarce; however, the Central District of California determined that with respect to private messages, social networking sites acted as both Electronic Communication Service and Remote Computing Service providers, and that the SCA thus prohibited the disclosure of privately stored information. 15 The court remanded to the trial court for further investigation to determine the plaintiff s privacy settings and the extent of access allowed to his Facebook wall and MySpace comments. 12 See Green v. Blitz, 2011 WL 806011 (E.D. Tex. Mar. 1, 2011). In this case, the defendant assigned responsibility of the data collection to a manager who later described himself about as computer illiterate as they get. The court determined that [a]ny competent electronic discovery effort would have located this email. The email referenced by the court had the words Flame Arrester in the subject line of the email and included the person in charge of collecting documents for discovery. The flame arrester feature of the product in question was the major issue in this case, hence why the court seemed almost baffled that the collection efforts did not include a simple words search for this term in important custodians email boxes. Although the court declined to reopen the case, it ordered the defendant to pay $250,000 in civil contempt sanctions. Additionally, the court imposed a purging sanction of $500,000, extinguishable if the defendant furnished a copy of the order to every plaintiff in every lawsuit proceeding against it for the past two years. Finally, the court ordered the defendant to file a copy of the order with its first pleading or filing in all new lawsuits for the next five years. 13 In testing these programs, Kroll Ontrack discovered that Facebook did not allow for an accurate collection of a Facebook account. The URL for a Facebook account is not unique to each individual account. Thus, the web crawling programs begin collecting the login screen of Facebook and the different links found on that page. The Adobe Acrobat Professional program seemed to work the best since Internet Explorer is used to run the program. However, there were still issues with navigating links and collecting the information. 5

To conclude the discussion on e-discovery-related concerns regarding social media, it is important to note that social media is stored everywhere and is always changing. Many individuals who use social media also do so from multiple devices both employer-issued and personal. What if that device is the individual s own property and not the company s? What if the device is the individual s but used during company time or on company property? This can present difficult legal and ethical problems that unfortunately have not yet benefitted from case law guidance. However, several courts have ruled that email sent using company-issued equipment is discoverable and accessible by the company. 16 Perhaps social media will continue to trend in that direction. Managing Social Media to Reduce Risk Companies are increasingly turning to social media to advance brand awareness, conduct market research, develop unique campaigns and connect with the individual consumer. According to the Social Media in Business Census 2011, 78 percent of the 2010 census respondents disagreed that social media was simply hype. Rather, the majority of companies surveyed saw demonstrated value in using the medium to drive business and customer relations. 17 However, as highlighted throughout this whitepaper, social media raises numerous discovery concerns in addition to security risks and can create potential nightmares for organizations. In its Social Media Governance: An Ounce of Prevention publication, Gartner advises against banning social media, except in a small percentage of cases where faced with security risks or clear regulation. 18 To highlight the regulatory issue, several regulatory groups, such as the Financial Industry Regulatory Authority (FINRA), have issued notices that communication through social media sites must be retained as required by the pertinent regulations. FINRA issued Regulatory Notice 10-06 in January 2010 following the organization of a social networking task force to discuss how social media can be used for business purposes without sacrificing investor protection. Every firm that intends to communicate, or permit its associated persons to communicate, through social media sites must first ensure that it can retain records of those communications as required by Rules 17a-3 and 17a-4 under the Securities Exchange Act of 1934 and NASD Rule 3110. SEC and FINRA rules require that for record retention purposes, 14 Stored Communications Act, 18 U.S.C. 2701 et seq. (1986) prohibits Electronic Communication Service (ECS) and Remote Computing Service (RCS) providers from knowingly divulging the contents of a communication they store unless the divulgence is to an intended recipient of such communication or express permission from the sender is obtained. 15 Crispin v. Audigier, Inc., 2010 WL 2293238 (C.D. Cal. May 26, 2010). Note, as of press time, no further rulings from this case have been issued. 16 See In re Royce Homes, LP, 2011 WL 873428 (Bkrtcy. S.D. Tex. Mar. 11, 2011) (Court found the company s Electronic Communications Policy explicitly and straightforwardly banned confidential communications and ordered production of personal emails sent over company systems); Holmes v. Petrovich Dev. Co., LLC, 2011 WL 117230 (Cal. App. 3 Dist. Jan. 13, 2011) (Court analogized the usage of an employer s communication systems to consulting an attorney in the employer s conference rooms, in a loud voice, with the door open, yet unreasonably expecting that the conversation overheard and determined privilege did not apply to employee use of employer s systems); Alamar Ranch, LLC v. County of Boise, 2009 WL 3669741 (D. Idaho Nov. 2, 2009) ( It is unreasonable for any employee in this technological age to believe her communications via work-issued equipment and email addresses would be confidential and not subject to monitoring. ). But see Stengart v. Loving Care Agency, 2010 WL 1189458 (N.J. Mar. 30, 2010) (Court balanced enforceability of company s policy with the delicacy of attorney-client privilege and determined emails sent on workissued laptop via employee s personal Yahoo account should remain privilege-protected). 17 Cyance, Social Media in Business Census 2011. Available at, http://www.cyance.com/rsc/2011cyanceid MSocialMediaCensus.pdf. Last accessed, August 16, 2011. 6

the content of the communication is determinative and a broker-dealer must retain those electronic communications that relate to its business as such. The Regulatory Notice also addresses blogs and several other considerations regarding social media. 19 For companies that are subject to strict regulatory requirements, the need to create a policy governing social media should be readily apparent. However, this is an important step for all companies as the reality remains that it is nearly impossible to completely ban social networking site use. The majority of employees today have a smartphone which allows them to access these sites without being subject to the corporate firewall. The best defense is for companies to proactively set policies regarding use of social media in the workplace, as courts are likely to give them significant deference. 20 When developing a corporate social media policy, it is important to remember that no one size fits all. Company usage policies should disclose the organization s no-privacy policy with regard to social media-based records and assert the company s right to monitor social networking conducted by its employees during the workday or while using company-issued equipment and accounts. The policy must be disseminated, understood and easily accessible to employees, with updates made when pertinent. When developing a corporate social media policy, it is important to remember that no one size fits all. Companies can certainly use each other s policies as guidance, but any social media policy should ultimately reflect the corporate culture and any pertinent industry regulations. Further, the company policy should be intertwined with the company s data security protocol. Remind employees that they should not reveal any nonpublic information in any forum, including social networking sites and other discussion boards. This may require restricting access with a firewall, although unfortunately, that may not always be enough. Ethical Issues Associated with Social Media Use The use of social networking sites and blogs also creates the potential for ethical violations or disciplinary action for misconduct, and raises confidentiality, integrity and propriety issues. Recently the American Bar Association (ABA) Commission on Ethics 20/20 published an ethics opinion for comment raising the ethical issues presented when lawyers (or their investigators) make the request for access to profiles of adverse parties or witnesses without clearly indicating the purpose for the request or by being deceptive. The Commission is currently considering what guidance it should offer to lawyers who want to use social networking sites to gather this information. 21 A few state bar associations have also taken steps to address social media, particularly with regard to the issue of false friending. The New York State Bar 18 Published December 17, 2010. Available for purchase at: http://www.gartner.com/displaydocument?ref=c lientfriendlyurl&id=1498916. 19 Financial Industry Regulatory Authority, Regulatory Notice 10-06. Available at, http://www.finra.org/web/ groups/industry/@ip/@reg/@notice/documents/notices/p120779.pdf. Last accessed, August 16, 2011. 20 See Amira-Jabbar v. Travel Services, Inc., 726 F. Supp. 2d 77 (D. Puerto Rico 2010) (Employer prevailed in suit alleging the employer was responsible for offensive comments made by co-worker on Facebook during company hours, thanks in part to its efforts to remedy its social media policy following the complaint). 7

Association issued Formal Opinion 2010-2, which states: A lawyer may not attempt to gain access to a social networking website under false pretenses, either directly or through an agent. 22 However, in September 2010, Opinion 843 was released saying that a lawyer representing a client in pending litigation may access the public pages of another party s social networking website for the purpose of obtaining possible impeachment material. 23 The Philadelphia Bar Association Professional Guidance Committee issued Ethics Opinion No. 2009-02. The opinion concerned a case in which an attorney sought an advisory opinion on whether he could engage a third party by sending them a friend request in an attempt to gain access to a witness Facebook and MySpace pages for the purpose of discovering potentially impeaching information on a witness. The opinion held that an attorney must disclose his true intentions when attempting to access social media, noting other ethical rules prohibit attorneys from engaging in dishonesty, fraud, deceit or misrepresentation. 24 The San Diego County Bar also has weighed in, issuing an ethical opinion on May 24, 2011 addressing friend requests. The Legal Ethics Opinion 2011-2 concluded that the rules of ethics bar an attorney from making an ex parte friend request of a represented party. An attorney s ex parte communication to a represented party intended to elicit information about the subject matter of the representation is impermissible no matter what words are used in the communication and no matter how that communication is transmitted to the represented party. 25 These opinions are the beginning of the what not to do list for attorneys considering using social media in both their client development and advertising efforts. Further guidance may be found in various disciplinary proceedings reprimanding lawyers for discussing clients, cases and opinions toward judges via their social networking sites. For example, the Florida Bar reprimanded and fined an attorney $1,250 for violating ethics rules by writing on a courthouse blog the judge was an evil, unfair witch with an ugly, condescending attitude. 26 In so finding, the Florida Bar concluded the attorney violated five ethics rules including Rule 4-8.2(a). 27 Another example arrives from Texas, where a state trial judge in Galveston County discovered that a prosecutor who received a weeklong continuance to attend a funeral actually spent the time drinking and riding motorcycles according to daily 21 ABA Commission on Ethics 20/20 Working Group on the Implications of New Technologies, For Comment: Issues Paper Concerning Lawyers Use of Internet Based Client Development Tools. Available at, http://www. americanbar.org/content/dam/aba/migrated/ethics2020/pdfs/clientdevelopment_issuespaper.authcheckdam. pdf. Last accessed, August 16, 2011. 22 The Association of the Bar of the City of New York Committee on Professional Ethics, Formal Opinion 2010-2, Obtaining Evidence From Social Networking Websites. Available at, http://www.nycbar.org/pdf/report/ uploads/20071997-formalopinion2010-2.pdf. Last accessed, August 16, 2011. 23 New York State Bar Association, Committee on Professional Ethics, Opinion 843 (9/10/10). Available at, http://www.nysba.org/am/template.cfm?section=committee_on_standards_of_attorney_conduct_ Home&CONTENTID=43208&TEMPLATE=/CM/ContentDisplay.cfm. Last accessed, August 16, 2011. 24 The Philadelphia Bar Association Professional Guidance Committee, Opinion 2009-02 (March 2009). Available at, http://www.philadelphiabar.org/webobjects/pbareadonly.woa/contents/webserverresources/ CMSResources/Opinion_2009-2.pdf. Last accessed, August 16, 2011. 25 San Diego County Bar Association, Legal Ethics Opinion 2011-2. Available at, http://www.sdcba.org/index. cfm?pg=lec2011-2. Last accessed, August 16, 2011. 8

Facebook postings. Following this discovery, the judge reprimanded the prosecutor and denied a request for an additional month-long continuance. 28 These stories represent merely a drop in the bucket of lawyers behaving badly via social media. Counsel should follow the advice they give their clients: If you wouldn t divulge something in normal conversation with a stranger, don t share it online. Further, remember that in the world of social media, conversations live on forever, so it s especially important to practice prudent posting. Conclusion Social media is here to stay. Prudent practitioners and companies will proactively address the impact these popular sites have on discoverability, litigation, regulatory compliance and corporate management. Further, attorneys must ensure they act within the bounds of their ethical obligations when engaging in social media activities. If you are unsure how to approach this difficult issue, engage a trusted consultant today who will help you navigate the tricky waters of these virtual mediums. 26 Cassens Weis, Debra, Lawyer Agrees to Reprimand for Blog Tirade About Judge, ABA Journal (June 2008). Available at, http://www.abajournal.com/news/article/lawyer_agrees_to_reprimand_for_blog_tirade/. Last accessed, August 16, 2011. 27 Florida Rules of Professional Conduct. Rule 4-8.2 Judicial and Legal Officials. Available at, http://www. floridabar.org/divexe/rrtfb.nsf/fv/ce09bad8a9fff2bd85256bbc00556834. 28 Baldas, Tresa, Lawyers Ethical Stumbles Increase Online. The National Law Journal. Available at, http:// www.law.com/jsp/lawtechnologynews/pubarticleltn.jsp?id=1202457938246. Last accessed, August 16, 2011. 9

10

9023 Columbine Road Eden Prairie, MN 55347 800.645.3649 www.krollontrack.com Copyright 2012 Kroll Ontrack Inc. All Rights Reserved. Kroll Ontrack, Ontrack and other Kroll Ontrack brand and product names referred to herein are trademarks or registered trademarks of Kroll Ontrack Inc. and/or its parent company, Kroll Inc., in the United States and/or other countries. All other brand and product names are trademarks or registered trademarks of their respective owners. Social Media Whitepaper 022712PR