Electronic Data Records Law | How to Win E-Discovery

Subpoena Facebook

Locating Social Network Legal Evidence

[See latest update 2014 on how to get subpoena results.]

If you seek to cause Facebook to disclose the content of communications to or from a Facebook user, remember that the user's home or business email account may contain much of the information you seek.  (The same goes for LinkedIn, Foursquare, Yelp, Skype, Groupon or online dating sites and services.)

The email account may contain some of the messages the user posted on Facebook.  Facebook allows a user to submit, via email, updates for publication on his or her Facebook Wall.  See my records management discussion about the Facebook-update-by-email feature.

Further, Facebook often emails a user with notices about and/or copies of content of messages posted by others for the benefit of the user.  For example, here is a screenshot of an email from Facebook:
















Hence, the user’s email account may contain the content and date/time of many desired Facebook messages, even those messages (ESI*) that have been deleted from Facebook.  

 

Records on Cell Phones

Another place to look for Facebook notices and content may be SMS records on the user’s cell phone. Facebook can be configured to send certain notices (with copies of FB message content) to the user’s SMS account. The types of notices that FB sends to SMS are not as numerous as the types that FB may send to electronic mail.

  Service Providers Resist

Normally, when handed a civil subpoena, such as in a divorce, infidelity or child custody investigation, a service provider like Facebook (or Hotmail or Google ) will resist disclosing the content of a user’s communications unless and until the user consents.  A common rationale cited for resistance is that the content is protected under the Stored Communications Act.

Compelling User to Cooperate

Often, law will compel the user to consent to the service provider releasing records of communications. Some recent cases have been compelling users to turn over, to their adversaries, their social media user ID and password.

Metadata and other Non-Message Content Data

See practical discussion on the retetion and disclosure of text and other messages by service providers.  Service providers may see a distinction between the content of messages and metadata about the messages, such as time of transmission.  Some service providers believe they can be compelled to turn over meta data but not message content.

An emerging class of social media services (Foursquare.com, Yelp, Gowalla) collect and store not just messages, but also  location information.  John was at the burger joint on May 11, 6:33pm, and at the ball park May 12 at 7:07pm.  This data will be the target of subpoenas.  The degree to which service providers will resist the subpoenas remains to be seen.

–Benjamin Wright

Mr. Wright teaches data law at the SANS Institute.  

*What is "ESI"?  ESI means electronically stored information.  It is a legal term of art applying to electronic information that is desired for legal purposes such as a lawsuit or an investigation.

See related post on deception in investigations on Facebook  and other social networks.

Related article: How to record what you see on Facebook or other online media.

Update 2013:  Facebook sent an SMS text to my phone telling me it will begin sending me a steady stream of text messages regarding FB activities of my friends and me . . . unless I opt out.  So the default at FB (at least for a user like me) is to send lots of text messages to my phone that refer to activity in my FB world.

Update:  Send a preservation letter to the subject of an investigation.

Electronic Mail Storage In-House or In the Cloud

E-mail Archive Economics

How expensive is it to store many terabytes of enterprise email so they are available for survey, eDiscovery, investigations, internal control and purposes of institutional memory?  The raw cost of data storage is dropping, so is it not cheap to retain lots of email?

I explored this topic in an email exchange with Dennis Vlasich, Director of the IT Department at the municipality of Fontana, California.  Following is our conversation.  

I started by pointing Dennis to my earlier post suggesting "content addressable storage" for inexpensive retention of large volumes of e-mail.  

DENNIS replied: “It [the earlier post] is basically a standard storage vendor's sales pitch and we have a SAN that can accommodate terabytes of ‘cheap’ storage.  You have to factor in the rack space, power and HVAC requirements to keep the storage system running and I can assure you that because such technology [content addressable storage] is less expensive, its MTBF [mean time between failures] will be much shorter than other forms of storage, so what happens when it crashes?  The bottom line is cost versus benefit versus risk.”  [Update:  Greg Smith of Messaging Architects responds to Dennis' comment.]

To which BEN said: “As a lawyer, here's what I don't understand.  I use Yahoo as my business email provider.  I pay Yahoo a paltry $20 a year for this email service, and Yahoo provides me unlimited storage.  Unlimited.  And since I pay for my service, Yahoo does not attach ads to my email. I store on Yahoo all my business e-mail (including attachments) dating back to 2004.  (I also back it up in zip files I download onto a local hard drive.)  The economics suggest that storage costs -- including all the infrastructure and management -- are just not a big deal to Yahoo.  Why can't an in-house IT department at a mid-sized enterprise get anywhere close to the same economics that Yahoo (or AOL or Hotmail) gets?”

Then DENNIS said: “Yahoo probably restricts the size of your attachments to 1MB and your mail client (probably not Outlook) does not have the search and archiving capabilities of an Exchange/Outlook environment.  I don't know what your SLA [service level agreement] is with them, but I would guess they aren't guaranteeing that all your email will be available forever.

"The City of Los Angeles just switched from an in-house mail system (using Groupwise) to Google's gmail for 30,000 users.  Google charges $50 per year per user for up to 250 gigabyte of disk space, however they do not have any archiving capabilities yet.  

“Google, Yahoo, and other large providers are using data center technologies on a massive scale that brings the cost per MB down below what those of us in smaller shops can come even close to. The big problem they have is security.  Google had to guarantee LA to use dedicated servers and storage for all their email so it wouldn't co-mingle with their other customers, and for $7.5MM Google said OK.  Most of the rest of us cannot negotiate on that scale.

“The administration overhead for managed disk space is quite high because it requires routine backups with take time and resources which all cost money.”

BEN responded: “My attachments, both incoming and outgoing, are limited to 20MB, which is reasonably large.  The mail client I use is Yahoo's web mail page.  It provides quite a few search capabilities.  I have my 'archives' arranged as large chronological zip folders on my local hard drive. Still, Yahoo stores a full copy of all my emails back to 2004.”

DENNIS: “[Regarding the 1MB attachment limit] I guess I was thinking of the free version [of Yahoo mail].  It's been a while since I looked at those kinds of mail services. We're looking seriously at Google Apps with gmail (waiting to see how things work for LA).  The 250GB limit might be a problem for some of our users, but I figure by the time we're ready to move, there will be more space available or they will have an archiving feature.”

Update July 2010:  The General Services Administration has certified Google Apps as qualified for use by government agencies.  Typically, a US government implementation of Google Apps would keep data on servers in the continental US.

–-Benjamin Wright.    A senior instructor at the SANS Institute, Mr. Wright regularly serves as a public speaker at lunch and dinner meetings for local professional groups, such as IIA and ARMA.