Social networking like Twitter is becoming more popular as a medium of communication for official, business or professional messages. Should these messages be recorded? Often the answer is yes.
California attorney Laura Meier has written an article* saying it is becoming more common for local governments to use Facebook and other social networking media to interact with citizens. An example (not cited by Ms. Meier) is City of Westerville, Ohio. Ms. Meier suspects that public records/ open meetings / sunshine laws could require governments to record much of this communication. These laws generally help citizens monitor the actions of their government and audit for misuse of public resources.
The Florida Attorney General opined that presumably most of the Facebook communications created by a Florida city government would be public records that should be retained according to official schedules for public records.
Update: See new post on how to record Facebook messages for official business.
Private enterprises are using Facebook to transact business. (Soon they may be using Google Buzz too.) A vendor named Worklight offers software that provides a “secure corporate overlay for Facebook,” claiming its product allows enterprise employees to interact via Facebook, while ensuring that sensitive information does not leak to outsiders. Worklight suggests one way to use Facebook (using its secure software) in a private company would be to approve purchasing transactions. Manager Sally for instance might use Facebook to authorize clerk Bill to spend $10,000. The enterprise would need to make and keep a virtual record of such authorization for purposes of internal control.
I am not aware of any vendor yet selling software to help an enterprise record activity in a public social networking environment like Facebook. (Vendors, note the market opportunity here.) One of my fellow instructors at the SANS Institute, Kevin Johnson, says that Facebook publishes APIs that a third-party vendor might use to make such software. (Kevin is a contributor to Social Media Security.)
Until a vendor makes a product for recording Facebook, how is an enterprise to record it? One not-so-convenient way is “print screen.”
I prefer not discouraging enterprises like municipal governments from using effective technology to fulfill their mission. As they assess the difficulty of recording Facebook, they should remember that records management has never been perfect. Paper records were easy to mishandle and lose.
Mr. Wright teaches eDiscovery and data security law at the SANS Institute.
* D. Derleth, L. Meier, R. Moin, "Social Networking Sites: Legal Issues for Public Agencies and Public Officials to Consider," The Public Law Journal, vol. 32, no. 4, Fall 2009. Another issue Ms. Meier raises is whether information posted on a social media site could put a city on notice of a hazardous condition, which the city is obligated to address, even though the city does not have staff dedicated to monitoring the site sufficiently to understand the notice and act on it.