Discovery and Preservation of Social Media Evidence

The ubiquitous nature of social media has made it an unrivaled source of evidence. Particularly in the areas of criminal, personal-injury, employment, and family law, social media evidence has played a key role in countless cases. But the use of social media is not limited to these practice areas. Businesses of every size can be affected by social media – both in the duty to preserve social media content and in the desire to access relevant social media evidence in litigation.

The Duty to Preserve Social Media Evidence

Data residing on social media platforms is subject to the same duty to preserve as other types of electronically stored information (ESI). The duty to preserve is triggered when a party reasonably foresees that evidence may be relevant to issues in litigation. All evidence in a party’s “possession, custody, or control” is subject to the duty to preserve. Evidence generally is considered to be within a party’s “control” when the party has the legal authority or practical ability to access it.

As an initial matter, social media content should be included in litigation-hold notices instructing the preservation of all relevant evidence. Once the litigation-hold notice has been issued, parties have available to them a number of ways to preserve social media data, depending on the particular platform or application at issue.

Methods of Preservation

Facebook offers the ability to “Download Your Info.” With just one click of the mouse, users can download a zip file containing timeline information, posts, messages, and photos. Information that is not available by merely logging into an account also is included, such as the ads on which the user has clicked, IP addresses that are logged when the user accesses his or her Facebook account, as well as other potentially relevant information.

Twitter offers a similar, although somewhat limited, option. Twitter users can download all Tweets posted to an account by requesting a copy of the user’s Twitter “archive.” Twitter does not, however, offer users a self-serve method of obtaining other, non-public information, such as IP logs. To obtain this additional information, users must request it directly from Twitter by sending an e-mail to [email protected] with the subject line, “Request for Own Account Information.” Twitter will respond to the e-mail with further instructions.

Although these self-help methods can be an excellent start, they do not address all possible data. Therefore, it may be prudent to employ the assistance of a third-party vendor in order to ensure complete preservation. CloudPreservation and X1 Social Discovery are two examples of commercially available tools that are specifically designed for archiving and collecting social media content.

Consequences of Failing to Preserve

Regardless of the method employed, preservation of social media evidence is critically important and the consequences of failing to preserve can be significant. In the worst case, both counsel and client may be subject to sanctions for a failure to preserve relevant evidence. In the first reported decision involving sanctions in the social media context, Lester v. Allied Concrete Co., No. CL08-150 (Va. Cir. Ct. Sept. 01, 2011), aff’d, No. 120074 (Va. Ct. App. Jan. 10, 2013), the court sanctioned both the plaintiff and his counsel based, in large part, on its determination that they had engaged in spoliation of social media evidence. In that case, the lawyer told his paralegal to make sure the plaintiff “cleaned up” his Facebook page. The paralegal helped the plaintiff to deactivate his page and delete 16 pictures from his account. Although the pictures were later recovered by forensic experts, the court found that sanctions were warranted based on the misconduct.

In contrast to Lester, a federal court in New Jersey imposed a significantly less severe remedy for the removal of Facebook posts. In Katiroll Company, Inc. v. Kati Roll and Platters, Inc., No. 10-3620 (GEB) (D.N.J. Aug. 3, 2011), the court determined that the defendant committed technical spoliation when he changed his Facebook profile picture, where the picture at issue was alleged to show infringing trade dress. Because the defendant had “control” over his Facebook page, he had the duty to preserve the photos.

Because the photos were relevant to the litigation, their removal was “somewhat prejudicial” to the plaintiff. Instead of harsh monetary or evidentiary sanctions though, the court ordered a more practical-driven resolution. Specifically, the court ordered the defendant to coordinate with the plaintiff’s counsel to change the picture back to the allegedly infringing picture for a brief time during which the plaintiff could print whatever posts it believed to be relevant.

Critical to the court’s decision not to award sanctions was its finding that the plaintiff had not explicitly requested that the defendant preserve his Facebook account as evidence. The court concluded, instead, that it would not have been immediately clear to the defendant that changing his Facebook profile picture would constitute the destruction of evidence. Thus, any spoliation was unintentional. This decision supports the idea that counsel should consider issuing a litigation-hold notice to opposing parties, as well as to one’s own client.

Even inadvertent negligence for which sanctions are not warranted, can result in the loss of potentially relevant social media evidence. For example, in In re Pfizer, Inc. Securities Litigation, 288 F.R.D. 297 (S.D.N.Y. Jan. 8, 2013), the plaintiff-shareholders sought sanctions against Pfizer for failing to preserve data from “e-rooms.” The “e-rooms” were internal collaboration applications maintained by the company for use by employees in sharing documents and calendars, archiving e-mails, and communicating via discussion boards and instant messaging. Although the company had preserved (and produced) a tremendous amount of ESI, it had failed to preserve the data associated with the relevant e-rooms.

The court took issue with the scope of Pfizer’s litigation-hold measures because they did not include e-rooms. Although documents and information included in the e-rooms were likely also maintained elsewhere and had likely been preserved and produced, the deletion of the e-rooms had resulted in the loss of discoverable information concerning the manner in which the employees internally organized information.

The court found that this information was relevant because it would allow the plaintiffs to draw connections and understand the narrative of events in a way “not necessarily afforded by custodial production.” Thus, the court concluded, the company breached its duty to preserve because the scope of its litigation hold did not include the e-rooms. Sanctions, however, were not warranted because the conduct was merely negligent and the plaintiffs had not shown that any lost data was, indeed, relevant to their claims.

Preservation in a “BYOD” World

One question that remains unanswered relates to the obligation of a company to preserve the potentially relevant social media content of its employees. In Cotton v. Costco Wholesale Corp., No. 12-2731 (D. Kan. July 24, 2013), the court denied the employee-plaintiff’s motion to compel text messages sent or received by employees on their personal cell phones, finding that the employee had failed to show that the employer had any legal right to obtain the text messages. In other words, the phones and the data they contained were not in the “possession, custody, or control” of the employer. This recent discussion is one of the first of its kind and observers will have to wait to see whether the approach is adopted by other courts in cases to come.

The Discoverability of Social Media

Preservation of social media evidence, of course, is only one part of the process. Parties will want to obtain relevant social media evidence as part of their informal and formal discovery efforts. Although some courts continue to struggle with disputes involving such efforts, discovery of social media merely requires the application of basic discovery principles in a somewhat novel context.

No Reasonable Expectation of Privacy

The user’s right to privacy is commonly an issue in discovery disputes involving social media. Litigants continue to believe that messages sent and posts made on their Facebook pages are “private” and should not be subject to discovery during litigation. In support of this, litigants claim that their Facebook pages are not publicly available but, instead, are available only to a limited number of designated Facebook “friends.”

Courts consistently reject this argument, however. Instead, courts generally find that “private” is not necessarily the same as “not public.” By sharing the content with others – even if only a limited number of specially selected friends – the litigant has no reasonable expectation of privacy with respect to the shared content. Thus, the very purpose of social media – to share content with others – precludes the finding of an objectively reasonable expectation that content will remain “private.” Consequently, discoverability of social media is governed by the standard analysis and is not subject to any “social media” or “privacy” privilege.

Relevancy as the Threshold Analysis

Relevancy, therefore, becomes the focus of the discoverability analysis. Courts are wary about granting discovery of social media content where the requesting party has not identified some specific evidence tending to show that relevant information exists. However, a requesting party is only able to satisfy this burden if at least some part of producing party’s social media content is publicly available. Thus, when a litigant’s social-networking account is not publicly available, the likelihood of its discovery diminishes significantly. As more and more users understand the importance of privacy settings, the burden on the requesting party becomes more and more difficult to satisfy.

Methods of Access to Social Media Evidence

Assuming a litigant is able to meet its burden to establish the relevancy of social-networking content, the question becomes a practical one – how to obtain the sought-after information? Currently, this question has no good answer. There have been a variety of methods requested by litigants and ordered by the courts, with mixed degrees of success.

Direct Access to Social Media Accounts

One of the most intrusive methods of discovery is to permit the requesting party access to the entire account. If analogized to traditional discovery, this would be the equivalent of granting access to a litigant’s entire office merely because a relevant file is stored there. Not surprisingly, this method of “production” has not been popular with parties or with courts. 

Nevertheless, there now are several decisions in which a court has ordered a party to produce his or her login and password information to the other side in response to a discovery request. One of these decisions, Largent v. Reed, No. 2009-1823 (Pa. C.C.P. Nov. 8, 2011), illustrates some of the procedural challenges that can result. 

In Largent, the court ordered the plaintiff to turn over her Facebook login information to defense counsel within 14 days of the date of the order. Defense counsel then would have 21 days to “inspect [the plaintiff’s] profile.” After that period, the plaintiff could change her password to prevent any further access to her account by defense counsel. Although the order specifically identified the defendant’s lawyer as the only party who would be given the login information, it did not specify whether the defendant was permitted to view the account’s contents once the attorney had logged in. 

Another case involving the exchange of login information resulted in more serious and permanent harm. In Gatto v. United Airlines, Inc., No. 10-1090-ES-SCM (D.N.J. Mar. 25, 2013), the plaintiff voluntarily provided his Facebook password to the defendants’ counsel during a settlement conference facilitated by the court. When the defendants’ attorney later logged into the account and printed portions of the plaintiff’s profile page as previously agreed, Facebook sent an automated message to the plaintiff, alerting him that his account had been accessed from an unauthorized ISP address. 

The plaintiff attempted to deactivate the account but deleted it instead. As a result, all of the data associated with the account was automatically and permanently deleted 14 days later. The court found that the plaintiff had failed to preserve relevant evidence and granted the defendants’ request for an adverse-inference instruction as a sanction. 

Not all courts have endorsed the idea of direct access to a party’s social media account. One court went so far as to hold that a blanket request for login information is per se unreasonable. In Trail v. Lesko, No. GD-10-017249 (Pa. C.C.P. July 3, 2012), both sides sought to obtain Facebook posts and pictures from the other. Neither complied and both parties filed motions seeking to compel the other to turn over its Facebook password and username. 

The court explained that a party is not entitled to free-reign access to the non-public social-networking posts of an opposing party merely because he asks the court for it. “To enable a party to roam around in an adversary’s Facebook account would result in the party to gain access to a great deal of information that has nothing to do with the litigation and [] cause embarrassment if viewed by persons who are not ‘Friends.’” 

One court went even further. In Chauvin v. State Farm Mutual Automobile Insurance Company, No. 10-11735, 2011 U.S. Dist. LEXIS 121600 (S.D. Mich. Oct. 20, 2011), the court affirmed an award of sanctions against the defendant due to its motion to compel production of the plaintiff's Facebook password. The court upheld the decision of the magistrate judge, who had concluded that the content the defendant sought to discover was available “through less intrusive, less annoying and less speculative means,” even if relevant. Furthermore, there was no indication that granting access to the account would be reasonably calculated to lead to discovery of admissible information. Thus, the motion to compel warranted an award of sanctions. 

In Camera Review

In an effort to guard against overly broad disclosure of a party’s social media information, some courts have conducted an in camera review prior to production. For example, in Offenback v. Bowman, a No. 1:10-cv-1789, 2011 U.S. Dist. LEXIS 66432 (M.D. Pa. June 22, 2011), the magistrate judge conducted an in camera review of the plaintiff’s Facebook account and ordered the production of a “small segment” of the account as relevant to the plaintiff’s physical condition. 

In Douglas v. Riverwalk Grill, LLC, No. 11-15230, 2012 U.S. Dist. LEXIS 120538 (E.D. Mich. Aug. 24, 2012), the court ordered the plaintiff to provide the contents for in camera review. After conducting its review of “literally thousands of entries,” the court noted that “majority of the issues bear absolutely no relevance” to the case. In particular, the court found that the only entries that could be considered discoverable were those written by the plaintiff, which could be in the form of “comments” he made on another’s post or updates to his own “status.” The court identified the specific entries it had determined were discoverable. 

Many courts, understandably, have been less than enthusiastic about the idea of doing the parties’ burdensome discovery work. For example, in Tomkins v. Detroit Metropolitan Airport, 278 F.R.D. 387 (E.D. Mich. 2012), the court declined the parties’ suggestion that it conduct an in camera review, explaining that “such review is ordinarily utilized only when necessary to resolve disputes concerning privilege; it is rarely used to determine relevance.” 

At least one court has agreed to “friend” a litigant for the purpose of conducting an in camera review of the litigant’s Facebook page. In Barnes v. CUS Nashville, LLC, No. 3:09-cv-00764, 2011 U.S. Dist. LEXIS 143892 (M.D. Tenn. June 3, 2010), the magistrate judge offered to expedite the parties’ discovery dispute by creating a Facebook account and then “friending” two individuals “for the sole purpose of reviewing photographs and related comments in camera.” The judge then would “properly review and disseminate any relevant information to the parties . . . [and would] then close Facebook account.” 

Attorneys’ Eyes Only

In Thompson v. Autoliv ASP, Inc., No. 2:09-cv-01375 (D. Nev. June 20, 2012), the defendant obtained information from the plaintiff’s publicly available social-networking profiles that was relevant to the case, but asserted that the plaintiff had since changed her account settings to prevent the defendant from further access and had failed to produce (or had produced in overly-redacted form) information from these profiles in response to the defendant’s formal discovery requests. 

The defendant sought to have the court conduct an in camera review of the profiles in their entirety to determine whether the plaintiff’s discovery responses were complete. Instead, the court ordered the plaintiff to provide the requested information to the defendant’s counsel for an attorney’s-eyes-only review for the limited purpose of identifying whether information had been improperly withheld from production. The defendant’s counsel was instructed that it could not use the information for any other purpose without a further ruling by the court. 

Third-Party Subpoenas

While the discoverability analysis is a product of the common law, there is at least one statute relevant to the discussion. The Stored Communications Act (SCA) limits the ability of Internet-service providers to voluntarily disclose information about their customers and subscribers. Although providers may disclose electronic communications with the consent of the subscriber, the SCA does not contain an exception for disclosure pursuant to civil discovery subpoena. The application of the SCA to discovery of communications stored on social-networking sites has produced mixed results. 

Providers, including Facebook, take the position that the SCA prohibits them from disclosing social media contents, even by subpoena. From Facebook’s website:

Federal law prohibits Facebook from disclosing “user content (such as messages, Wall (timeline) posts, photos, etc.), in response to a civil subpoena. Specifically, the Stored Communications Act, 18 U.S.C. § 2701 et seq., prohibits Facebook from disclosing the contents of an account to any non-governmental entity pursuant to a subpoena or court order. 

One of the earliest cases to address the issue, Crispin v. Christian Audigier, Inc., 717 F. Supp. 2d 965 (C.D. Cal. 2010), concluded that the SCA prohibited a social-networking site from producing a user’s account contents in response to a civil discovery subpoena. In that case, the defendants served subpoenas on several third parties, including Facebook and MySpace, seeking communications between the plaintiff and another individual. The plaintiff moved to quash the subpoenas. 

The court held that plaintiff had standing to bring the motion, explaining that “an individual has a personal right in information in his or her profile and inbox on a social-networking site and his or her webmail inbox in the same way that an individual has a personal right in employment and bank records.” Moreover, the court determined that the providers were electronic communication service (ECS) providers under the SCA and were thus prohibited from disclosing information contained in “electronic storage.” 

The SCA does not override a party’s obligation to produce relevant ESI, though. To the contrary, a party must produce information that is within its possession, custody, or control. Thus, a court can compel a party to execute an authorization for the release of social media content. With an executed authorization, a properly issued subpoena, and, in most cases, a reasonably small payment for associated costs, litigants can obtain all information related to a user’s social media account. 

Lessons Learned

Although the world of social media and other new technology continues to present novel questions, the answers are often derived by applying a “pre-Facebook” analysis. For example, businesses understand that they have an obligation to preserve potentially relevant evidence. Social media evidence is no different and should be preserved in the same way as paper documents and emails. 

Similarly, parties in litigation are entitled to discovery of all relevant, non-privileged information. Thus, social media content is subject to discovery, despite the privacy settings imposed by the account user. Nevertheless, only relevant information must be produced and it is the responsibility of counsel to make the relevancy determination.

Parties and counsel are well advised to adjust their thinking so that social media becomes just another type of ESI. And, like emails and other forms of electronic data, social media must be preserved and is subject to discovery if relevant to the dispute.