web preservation Archives

Social Media Defamation

Social media in many ways is still the wild, wild west. It is a lawless environment in which many people have been harmed by reckless comments. Over the last year, we have seen several cases in which one person was harassing another person in social media.

How common is online harassment? During a January 2020 survey it was found that 44 percent of internet users had personally experienced any kind of online harassment with 28 percent of respondents reporting to having experienced severe forms of online harassment such as physical threats, sexual harassment, stalking and sustained harassment.

What is Considered Defamation?

According to the Electronic Frontier Foundation (which has a great web page on online defamation law), there are three elements that must be shown during a defamation claim:

The statement has to be false
It has to be communicated (published) to someone other than the person being defamed
It has to be about the plaintiff and have the potential to harm their reputation

Written defamation is considered to be libel. Verbal defamation is considered to be slander.

For a statement to meet the legal definition of defamation, it has to be a false statement by a third party. Additionally, it needs to be intended to do serious harm to a person’s reputation. It has to be done “without fault”. You must be able to show someone was acting irresponsibly when making the statement.

Examples of Social Media Defamation

HG.org legal resources outlines social media defamation examples as follows. “Not every untrue or unkind statement is actionable. However, many statements are. For example, if you accused a person on social media of abusing his or her spouse or children, such a statement would likely be considered defamatory if it were not true. Even if an individual posts information that is partially true and partially false, he or she can be found liable for defamation. For example, a person may claim that an individual was fired for harassment. The individual may have been fired but not for harassment. The court may find defamation still existed despite some truth to the statement.“

Steps to Dealing with Social Media Defamation

Most businesses are monitoring online content through social media and the web. Most individuals are not. You may not even be aware of someone posting negative information unless an associate tells you about it. On the other hand, you may be very aware because the person has set out to harrass you online.

Do not respond. This is hard to do. Responding hastily can just make the situation worse.
Capture the evidence. Take screenshots as soon as you can in order to collect the posts. This will at least provide you with a good point of reference if things get worse.
The next step is to either hire a Private Investigator or an Attorney. Getting legal help is very important if it doesn’t look like this is going away. Either will be able to conduct some research on the perpetrator. You may not be the only one this is happening to. Legal help will also be able to authenticate the online evidence should it go to court at any point in time. An Attorney may be able to provide you with a Cease and Desist Letter.
Notify the social media company. Check out the resource pages. You may be able to report this.

Always be careful. This is especially true if the person lives near you. Exercise caution until you get it resolved.

Chain of Custody & Digital Evidence

Digital evidence has become more and more relevant for most civil and criminal investigations. Developing your OSINT skills is ongoing and understanding where it is all headed is just as important. It is an ever changing area, with new social media platforms sprouting up all the time.

When conducting online research on a person of interest for your investigation, it is important to develop a solid strategy. Once you begin gathering information, a clear chain of custody must be obtained with anything you find online. Additionally, authentication of social media posts or profiles are becoming more and more important to a case.

“We need all videos extracted and the subject’s social media profile captured and preserved.”
Recent client request

We are getting more and more requests like this every week. When a suspect or person of interest gets legal council, they may be advised to delete all their social media. That is why time is so important and it is becoming more important to start with online investigations before you do anything else. Many attorneys and PI’s have learned the hard way that what is here today, may be gone tomorrow. Understanding the differences in digital evidence can set your Private Investigation firm apart from the others.

The purpose of this blog post it to explain some of the differences in the capture of online evidence.

Screenshot Digital Evidence

Most of the time your OSINT discovery process is centered around a specific strategy and focus. The gathering of online information, its chain of custody, and your final report can and should contain screenshots and corresponding URLS. However, what if the Instagram post or video is just the digital evidence you were looking for? What if you know your attorney client is going to need this in the deposition, civil or even criminal case? It is times like this where a screenshot is not enough. Taking that extra step can be very valuable.

Social Media posts may not only be deleted or turned off, but they can also be edited. The post you see today may not be the same post you saw during your online investigation. Unless you have preserved the original post, you may not be ale to prove what was originally said.

For social media and web page evidence to be valid and accepted according to the Federal Rules of Evidence:

Original source code of the social media message, blog or webpage must be collected

Metadata must be collected

Digital signatures and timestamps must be placed on the data to provide evidence of data integrity & authenticity

Data should be prepared in EDRM-XML for easy processing & analysis in eDiscovery systems

Preserving the Digital Evidence

*Establishing a valid chain of custody means being able to show where the evidence has been, who has handled, and its condition at all times, in order to establish that there has been no alteration or tampering of the evidence prior to the time it is presented to the court. With respect to web pages and social media accounts, then, this means that the party propounding the evidence must establish:

When the record was originally produced;
That the record is an accurate recording of the webpage in question;
That the record was not subject to alteration from the time it was collected until the time it is presented in court.

Using the correct tool instantly generates a forensic report using a forensic SHA256 hash, and HTML source code. It means that your online preservations contain key identifying Metadata such as the timestamp, the URL, the IP address, the date, and the time of capture, using a certified Stratum-1 atomic clock in compliance with the eSign Act.

As a result, you can capture the evidence you need at the moment you need it, with the assurance that when you do, you are collecting evidence which contains the necessary hallmarks of authenticity that courts are increasingly seeking.

(*Web Preserver), This is the software we use at eChatter when we need to preserve digital evidence for our clients.

Web Scrapping

Can a website be scrapped or archived? Yes and It may surprise you to know just how often it is used. Web archiving tends to concentrate more on the look and feel of a website or profile. The Wayback Machine (a.k.a. archive.org), is designed for web archiving. They explain their company this way, “The Internet Archive, a 501(c)(3) non-profit, is building a digital library of Internet sites and other cultural artifacts in digital form.” It is like an online library of websites. ( As an aside, it is also a great way to check if a person of interest worked for a certain business years ago, as they may have been featured on the website).

Web scrapping is more focused on textual data. The most crucial step for initiating a web scraping project is to select a tool to fit your research needs. There a tons of them out there to choose from. It is important to remember that the collection of data, while publicly available, is still a collection produced by others. Depending on the case, be aware of the potential privacy and security implications and proceed with caution.

Web scrapping can be used for price monitoring, lead generation, marketing and research. The complexity of many websites makes it difficult to scrape data unless you know code. Software applications make this task easy for anyone and is not dependent on skills.

Example of a Preserved Post

The post below is a great example of what is captured during the preservation of a post. The key components are the URL, Timestamp (when the post was discovered), Hash, and Signature.

An entire profile of a person of interest can be over 100 pages and is captured in PDF report format.

By: Kathy Doering.

Kathy is President of eChatter, and is McAfee certified in OSINT and is a certified Social Media Intelligence Analyst (SMIA). Kathy also serves as president of The Global Social Media Research Association.

The Importance of Preserving Social Media Evidence

Social media has changed the way we communicate and live. We feel the need to document our entire life, from our child’s first day of school, to details of our family vacation, and even what we ate for dinner. Most of us assume our posts are completely innocent, but nowadays social media has become an extraordinary source of evidence. Our digital footprint grows daily with every photo posted, status updated and video shared. These footprints are hard to erase.

Yesterday’s status update can easily become evidence in future litigation. This is especially true in criminal, family, personal injury and employment law. The practice of law and the ability to access information relevant to a case has been noticeably impacted by the internet. Furthermore, the rise of social media has given everyone with an internet connection the ability to receive, send, and store information in numerous formats.

So how does this storage and sharing of information on personal social media accounts can play out in a legal case?

Private Posts Are Not Always Private

Social media users utilize their privacy settings in different ways. Some people may have private Instagram and Facebook accounts but a public Twitter account. Or they may have a private Facebook account and public Instagram. Different platforms allow users to fine tune exactly what they want other followers, users, or browsers to see.

But just how much privacy do you actually have? Limiting a photograph you post to a specific audience is more private than making it public. But do you really have an expectation of privacy when you post to hundreds of “friends”, even with your privacy settings activated?

Police in Jacksonville, Florida, utilized social media in an investigation called Operation Rap Up. Numerous alleged gang members were arrested for illegally possessing weapons, which is prohibited for people with felony records in the state. The sheriff told media that at least some of the evidence had come from YouTube videos posted by the accused.

More and more, police are increasingly turning to the internet to gather evidence about suspects, and this material is being used in civil suits, ranging from divorces to personal injury claims. If you file suit claiming that an injury sidelined you from professionally playing basketball, yet later post pictures of yourself shooting hoops, as the defense argued in a recent New York case, the court will more than likely give the opposition access to your devices for more potential evidence.

There are numerous methods of capturing this evidence.

1) Print
When police, lawyers, or investigators observe something on social media in real time, they capture it immediately. There’s always a chance posts, photos, and tweets will be deleted so grab them while you have the chance. By printing the web page or social media post, you have a date and time stamp in case the evidence is deleted.

2) Screenshot
A better method of preserving social media evidence is to capture a screenshot or screen picture. Essentially, you’re using software to take a photo of what’s viewable on the display.

3) Software and tools built to preserve

While printing or saving a screenshot preserves what you see, screenshots lack the behind-the-scenes information (called metadata) that’s embedded into the webpage or post. Police, investigators, and the like can now utilize software built specifically for collecting and preserving online and social media content. These tools log the accurate visual representation of the content as well as all available metadata such as date, time, location, poster’s IP address and browser used. All content can be digitally signed and time-stamped in satisfaction of the legal requirements for submitting digital content as evidence.

As people increasingly share their lives online, the incredible amount of content will continue to grow and often be relevant to litigation. And most courts are happy to allow this evidence. Judges have been generally receptive to granting law enforcement warrants to obtain social media records to use against them for an arrest or in an existing case against them. Facebook maintains a portal for law enforcement to request evidence associated with an official investigation. Twitter has codified a detailed set of guidelines for law enforcement requesting and obtaining such evidence. YouTube, Google, and WhatsApp have done the same.