Investigations Archives

Social Media Defamation

Social media in many ways is still the wild, wild west. It is a lawless environment in which many people have been harmed by reckless comments. Over the last year, we have seen several cases in which one person was harassing another person in social media.

How common is online harassment? During a January 2020 survey it was found that 44 percent of internet users had personally experienced any kind of online harassment with 28 percent of respondents reporting to having experienced severe forms of online harassment such as physical threats, sexual harassment, stalking and sustained harassment.

What is Considered Defamation?

According to the Electronic Frontier Foundation (which has a great web page on online defamation law), there are three elements that must be shown during a defamation claim:

The statement has to be false
It has to be communicated (published) to someone other than the person being defamed
It has to be about the plaintiff and have the potential to harm their reputation

Written defamation is considered to be libel. Verbal defamation is considered to be slander.

For a statement to meet the legal definition of defamation, it has to be a false statement by a third party. Additionally, it needs to be intended to do serious harm to a person’s reputation. It has to be done “without fault”. You must be able to show someone was acting irresponsibly when making the statement.

Examples of Social Media Defamation

HG.org legal resources outlines social media defamation examples as follows. “Not every untrue or unkind statement is actionable. However, many statements are. For example, if you accused a person on social media of abusing his or her spouse or children, such a statement would likely be considered defamatory if it were not true. Even if an individual posts information that is partially true and partially false, he or she can be found liable for defamation. For example, a person may claim that an individual was fired for harassment. The individual may have been fired but not for harassment. The court may find defamation still existed despite some truth to the statement.“

Steps to Dealing with Social Media Defamation

Most businesses are monitoring online content through social media and the web. Most individuals are not. You may not even be aware of someone posting negative information unless an associate tells you about it. On the other hand, you may be very aware because the person has set out to harrass you online.

Do not respond. This is hard to do. Responding hastily can just make the situation worse.
Capture the evidence. Take screenshots as soon as you can in order to collect the posts. This will at least provide you with a good point of reference if things get worse.
The next step is to either hire a Private Investigator or an Attorney. Getting legal help is very important if it doesn’t look like this is going away. Either will be able to conduct some research on the perpetrator. You may not be the only one this is happening to. Legal help will also be able to authenticate the online evidence should it go to court at any point in time. An Attorney may be able to provide you with a Cease and Desist Letter.
Notify the social media company. Check out the resource pages. You may be able to report this.

Always be careful. This is especially true if the person lives near you. Exercise caution until you get it resolved.

Can I Venmo You the Money?

You just enjoyed a nice dinner out with a few friends and are ready to pay. You reach in and notice you forgot your credit card. Your friend pays for dinner, but instead of waiting to pay him back you easily whip out your phone, head to your Venmo app, and send your friend money with ease.

What is Venmo?

Venmo is an app that is owned by PayPal with over 52 million users, as of 2020. This person-to-person app allows you to easily send or receive money from friends, family, or co-workers. Simply click on the “Pay or Request” button, type in your friend’s email, phone number, or username. You can also scan a QR code from the app if your friend is nearby. Venmo is also free when you link your bank account to the app. What is not to love? This app has some incredible advantages and unfortunately a few disadvantages…

Privacy Entanglements

Venmo requires you to write out or choose an emoji to describe your payment before you can submit it. While this is a clever way to keep track of your payments, there are significant privacy concerns involved.

The Payment app reveals a massive number of private details about a user’s life by default.
Transactions you make are viewable on a public feed unless you change the settings to make them visible to just the party involved or only to your friends.
The amount of money sent or received is never public, but there is a text, emoji, and time stamp visible on all transactions.
Publicly viewed transactions are shared with third parties. Venmo’s privacy policy states that is shares user data “for everyday business purposes, for marketing purposes, for joint marketing with other companies.”

Not only is privacy an issue when it comes to third party sharing but what about all the “other” individuals out there, including your friends, that can see who you are paying and what you are doing?

The Dark Side of Venmo

From stalking, identifying cheaters, even buying or selling of drugs, it has all been seen and reported on over the years. One of the most alarming stories that has hit mainstream media recently is one of a national security risk. Buzzfeed News identified Joe Biden’s Venmo account, and sadly enough it was public. Once they identified that the account was truly our President’s, they quickly notified The White House.

“On Friday, following a passing mention in the New York Times that the President had sent his grandchildren money on Venmo, BuzzFeed News searched for the president’s account using only a combination of the app’s built-in search tool and public friends feature.

In the process, BuzzFeed News found nearly a dozen Biden family members and mapped out a social web that encompasses not only the first family, but a wide network of people around them, including the president’s children, grandchildren, senior White House officials, and all of their contacts on Venmo.” -Buzzfeed News

After this story was published, a Venmo spokesperson told BuzzFeed News: “The safety and privacy of all Venmo users and their information is always a top priority, and we take this responsibility very seriously. Customers always have the ability to make their transactions private and determine their own privacy settings in the app. We’re consistently evolving and strengthening the privacy measures for all Venmo users to continue to provide a safe, secure place to send and spend money.”

From celebrities being stalked through Venmo, and now our President’s private information being so very public by default, will the lines of privacy forever be tangled with Venmo? Time will tell.

Chain of Custody & Digital Evidence

Digital evidence has become more and more relevant for most civil and criminal investigations. Developing your OSINT skills is ongoing and understanding where it is all headed is just as important. It is an ever changing area, with new social media platforms sprouting up all the time.

When conducting online research on a person of interest for your investigation, it is important to develop a solid strategy. Once you begin gathering information, a clear chain of custody must be obtained with anything you find online. Additionally, authentication of social media posts or profiles are becoming more and more important to a case.

“We need all videos extracted and the subject’s social media profile captured and preserved.”
Recent client request

We are getting more and more requests like this every week. When a suspect or person of interest gets legal council, they may be advised to delete all their social media. That is why time is so important and it is becoming more important to start with online investigations before you do anything else. Many attorneys and PI’s have learned the hard way that what is here today, may be gone tomorrow. Understanding the differences in digital evidence can set your Private Investigation firm apart from the others.

The purpose of this blog post it to explain some of the differences in the capture of online evidence.

Screenshot Digital Evidence

Most of the time your OSINT discovery process is centered around a specific strategy and focus. The gathering of online information, its chain of custody, and your final report can and should contain screenshots and corresponding URLS. However, what if the Instagram post or video is just the digital evidence you were looking for? What if you know your attorney client is going to need this in the deposition, civil or even criminal case? It is times like this where a screenshot is not enough. Taking that extra step can be very valuable.

Social Media posts may not only be deleted or turned off, but they can also be edited. The post you see today may not be the same post you saw during your online investigation. Unless you have preserved the original post, you may not be ale to prove what was originally said.

For social media and web page evidence to be valid and accepted according to the Federal Rules of Evidence:

Original source code of the social media message, blog or webpage must be collected

Metadata must be collected

Digital signatures and timestamps must be placed on the data to provide evidence of data integrity & authenticity

Data should be prepared in EDRM-XML for easy processing & analysis in eDiscovery systems

Preserving the Digital Evidence

*Establishing a valid chain of custody means being able to show where the evidence has been, who has handled, and its condition at all times, in order to establish that there has been no alteration or tampering of the evidence prior to the time it is presented to the court. With respect to web pages and social media accounts, then, this means that the party propounding the evidence must establish:

When the record was originally produced;
That the record is an accurate recording of the webpage in question;
That the record was not subject to alteration from the time it was collected until the time it is presented in court.

Using the correct tool instantly generates a forensic report using a forensic SHA256 hash, and HTML source code. It means that your online preservations contain key identifying Metadata such as the timestamp, the URL, the IP address, the date, and the time of capture, using a certified Stratum-1 atomic clock in compliance with the eSign Act.

As a result, you can capture the evidence you need at the moment you need it, with the assurance that when you do, you are collecting evidence which contains the necessary hallmarks of authenticity that courts are increasingly seeking.

(*Web Preserver), This is the software we use at eChatter when we need to preserve digital evidence for our clients.

Web Scrapping

Can a website be scrapped or archived? Yes and It may surprise you to know just how often it is used. Web archiving tends to concentrate more on the look and feel of a website or profile. The Wayback Machine (a.k.a. archive.org), is designed for web archiving. They explain their company this way, “The Internet Archive, a 501(c)(3) non-profit, is building a digital library of Internet sites and other cultural artifacts in digital form.” It is like an online library of websites. ( As an aside, it is also a great way to check if a person of interest worked for a certain business years ago, as they may have been featured on the website).

Web scrapping is more focused on textual data. The most crucial step for initiating a web scraping project is to select a tool to fit your research needs. There a tons of them out there to choose from. It is important to remember that the collection of data, while publicly available, is still a collection produced by others. Depending on the case, be aware of the potential privacy and security implications and proceed with caution.

Web scrapping can be used for price monitoring, lead generation, marketing and research. The complexity of many websites makes it difficult to scrape data unless you know code. Software applications make this task easy for anyone and is not dependent on skills.

Example of a Preserved Post

The post below is a great example of what is captured during the preservation of a post. The key components are the URL, Timestamp (when the post was discovered), Hash, and Signature.

An entire profile of a person of interest can be over 100 pages and is captured in PDF report format.

By: Kathy Doering.

Kathy is President of eChatter, and is McAfee certified in OSINT and is a certified Social Media Intelligence Analyst (SMIA). Kathy also serves as president of The Global Social Media Research Association.

The Online Personality of Your Subject

Is the online personality of a person different from their in person personality? I recently watched a documentary on Netflix called, “Crime Scene: The Vanishing at the Cecil Hotel.” The docuseries is about a Canadian college student, Elisa Lam, who was a guest of the hotel in 2013. She disappeared and was missing for a period of time around some very unusual circumstances. I won’t tell you anymore, in case you want to watch it.

Her Tumblr account was an open book. Tumblr is a social media platform that was very popular during this time frame. Elisa Lam used it like a diary and in the documentary it is explained in detail what was obtained from the scrubbing of that open source information (OSINT). Her personality came through loud and clear through analyzing her social media posts.

Online Personality

When it comes to pulling online activity from social media, blogs, forums, etc. on your person of interest, personality plays an important role. Everyone in the investigation’s field knows that a person who is narcissistic for example, will provide you with a treasure of information online. In some cases, perhaps even more than you might need.

But what about all those people in between? People approach social media differently and there are many factors to be considered.

Two Major Personality Differences

One would think that an introvert would be non-social but that is not necessarily true. Consider some actors or comedians. Most seem like extraverts by the way they conduct themselves publicly. However, when interviewed, many of them say they are more introverted.

What are some common traits of Introverts?

Introverts in social media care about their privacy.
They tend to only accept friend requests from people they know.
They really don’t care about the number of “likes”.
Most likely unaware of friend requests.
Will unfollow or delete you.

What are some common traits of extraverts?

Extraverts don’t worry about their privacy.
They are more inclined to accept invitations from people they don’t know.
Extraverts care very much about the “likes” & shares.
They do pay attention to friend requests.
Most will keep all of their connections close.

From a psychology point of view we can take a look at “Introvert vs. Extrovert: A Look at the Spectrum and Psychology. The article points out the following. “How extroverted we are can have a huge bearing on our day-to-day life across a multitude of contexts and it’s important to note that there’s no ‘better’ level of extroversion/introversion – both ends of the spectrum have their advantages and disadvantages but by understanding where we fall on the scale we can address areas in which we’re perhaps lacking.”

Personality predicts what people do on social media.

A large body of research on social media use and personality has focused on the Big 5 personality traits, the most widely accepted trait theory. When people are asked to rate how much different traits characterize them, those traits cluster into five groups:

Extraversion: Sociability and feeling energized by interactions with others
Agreeableness: Warmth, cooperativeness, and a desire to get along with others
Conscientiousness: Being practical, organized, and hard-working
Openness: Creativity, intellectualism, and openness to new experiences
Neuroticism: Moodiness and anxiety

Knowing and understanding some of this may be of help in your next investigation. It is well worth it to take a look at your subject’s online activity to reveal glimpses into their personality.

Leave No Stone Unturned in Online Discovery

Conducting online discovery research on a person or business of interest should always begin with a strategy. Using critical thinking and formatting your search around your case will save you a great deal of time and effort.

When beginning research on a subject you want to start by capturing the data that you know to be true. Many background software platforms will supply you with the basic information. Taking a good look at this information will help you determine which data points are worth using in your online research. From there you will need to do a lot more digging to discover what may be available online.

Usernames can be a rich source of information and most people use several. Especially those who are active in social media.

UserNames For Discovery

User names have been extraordinarily helpful when hunting open source intelligence online. The trouble is you may not always know the subject’s user name right away.

Since most people are creatures of habit, you can start by using whatever email addresses you have. Try a few of those to start off. Knowing an email address such as sdparty@yahoo.com for example, try sdparty or @sdparty in a standard search. Next when you start to dig into social media, pay attention to what user names they use there as well and use them to search further.

Little by little, you can discover additional sites using this method than you even knew existed. The example above was discovered based on a single user name.

Most people have user names across multiple sites. So, you may also want to use variances of the user names and/or email addresses as well. It may be as easy as placing the username in a Google or Bing search. I like to use quotes when searching by search engine to filter results.

Lastly, do a contextual evaluation of the username. It is human nature to use things that are unique to you when creating user names. You may be able to identify a cultural emphasis used or even the approximate age of the person by examining the username.

Gaming Communities

An often overlooked area is searching through gaming communities. They too are great resources for checking usernames, especially if your subject is younger.

Xbox: https://www.xboxgamertag.com/search/usnername
PSN: https://psnprofiles.com/username
Twitch: https://www.twitch.tv/username
Minecraft: https://namemc.com/name/username

When conducting online research, there is no single tool that will give you everything you need. It takes using a little bit of everything. That is where training comes in and continued education. In social media specifically, what is here today may be gone tomorrow.