Managing Data Breach Communication on The Social Web
RIM On The Social Side
1. Natalie Alesi
www.legalerswelcome.com
RIM on the Social Side nataliebethalesi@gmail.com
2. Definition: Social media includes web-
based and mobile technologies used to
turn communication into interactive
dialogue. …Social media is media for
social interaction as a super-set beyond
social communication. Enabled by
ubiquitously accessible and scalable
communication techniques, social media
has substantially changed the way
organizations, communities, and
individuals communicate.
6. Founded 2003 Founded 2006
150 million members 845 million members
NYSE Symbol “LNKD” IPO filed Feb. 1, 2012
47.6 million unique 138.9 million unique
monthly visitors monthly visitors
Founded 2006 Founded 2011
300 million members 100 million members
300 million tweets/day In one day, G+ became
1.6 billion search most popular free
queries/day iPhone app
10. ABA Model Rules 1.1 requires lawyers to be competent in representation of their clients.
Comment 6: Lawyers “should keep abreast of changes in the law and it’s practice”
12. I-Med Pharma v. Biomatrix (D.N.J 2011)
ediscovery case highlighting importance of knowing your clients computer system
13. Munster v. Groce (Ind. App 2005)
lawyers duty to Google as part of due diligence
14. Dubios v. Butler (Fl. App 2005)
Lawyers duty to use Internet resources as part of due diligence, not to use methods that have
gone “the way of the horse and buggy and the eight track stereo.”
15. Largent v. Reed, Case No. 2009-1823 (C.P. Franklin Nov. 8, 2011)
Pennsylvania court recently ruled that information posted by a party on their personal Facebook
page is discoverable and ordered the plaintiff to provide their user name and password to
enable the production of the information.
16. State of Connecticut vs. Eleck, 2011 WL 3278663 (Conn.App. 2011)
highlights the importance of employing best practices technology to collect, preserve and
produce social media evidence.
17.
18. NEW YORK STATE BAR ASSOCIATION Committee on Professional Ethics Opinion # 843
(09/10/2010)
Q: May a lawyer view and access the Facebook or MySpace pages of a party other than his or
her client in pending litigation in order to secure information about that party for use in the
lawsuit, including impeachment material, if the lawyer does not “friend” the party and instead
relies on public pages posted by the party that are accessible to all members in the network?
A: A lawyer who represents a client in a pending litigation, and who has access to the Facebook
or MySpace network used by another party in litigation, may access and review the public social
network pages of that party to search for potential impeachment material. As long as the
lawyer does not "friend" the other party or direct a third person to do so, accessing the social
network pages of the party will not violate Rule 8.4 (prohibiting deceptive or misleading
conduct), Rule 4.1 (prohibiting false statements of fact or law), or Rule 5.3(b)(1) (imposing
responsibility on lawyers for unethical conduct by nonlawyers acting at their direction).
http://www.nysba.org/AM/Template.cfm?Section=Ethics_Opinions&TEMPLA
TE=/CM/ContentDisplay.cfm&CONTENTID=43208
19. 689 State and Federal Cases
Involved social media evidence
Myspace/Facebook = Criminal
Twitter/LinkedIn = Corporate Trade, secret theft, copyright,
trademark
22. Phone Dog vs. Noah Kravitz
Sample Social Media Policy Template
http://www.jaffepr.com/about-us/industry-insight/white-papers/social-media-policy-template
23.
24.
25.
26. Upcoming Webinar
Social Media eDiscovery Case Study &
Applicable Best Practices March 28th 2012
1 – 2 pm ET
http://www.d4discovery.com/2012/03/webinar-social-media-ediscovery-case-
study-applicable-best-practices/
27. Actionable Items
Understand social media privacy
Research software for preservation and archiving
of social media information
Understand your firms social media policy / be on
the social media policy committee
Create accounts on social media sites so you
understand
Know where information is stored/devices where information
is stored in your firm with your attorneys
Educate attorneys to think about where client information may be
stored (in the cloud, servers, devices, etc.)
Adopt standards for how to use electronically stored
information, including social media.
Know Recent Social Media Cases
(http://x1discovery.com/social_media_cases.html)
28. RIM and eDiscovery Social Resources
Twitter LinkedIn Groups Blogs of Interest
@ediscoverygroup ARMA International
@nextpointmike RIM Professionals blog.x1discovery.com/
@exterro eDiscovery www.digitalreefinc.com/blog/
@nextpoint Women in eDiscovery www.d4discovery.com/
@IEDiscovery Men in dDiscovery e-discoveryserviceblog/
@LitSuppGuru eDiscovery Networking Group www.mofo.com/sociallyaware/
@eDiscJournal eDiscovery Plain and Simple www.sociallyawareblog.com/
@ComplexD LegalIT e-Disc
@GlobalEDDGroup Electronic Discovery Professionals
@bowtielaw Enterprise eDiscovery in the Cloud
@nextpointlab The Electronic Discovery Reference Model
@d4discovery
30. Law Firms and Social Media
FACT: Washington Post
20 percent of law firms have a full-time social media specialist
on staff, and about 40 percent said blogging and social
networking initiatives have helped the firm land new work.
there is new exploitation of these media for communication that will ultimately give rise to discoverableinformation and the subject matter of litigation
defendants hired an expert to conduct a keyword search of plaintiff’s computer network, servers, and related storage devices. Per the court's order, plaintiff was to produce the results of the examination. There were more than 50 search terms, and many were also run in French. Moreover, “the search was not limited to targeted document custodians or relevant time periods. Indeed, the search was not even limited to active files.” The search was instead run “across all data on the computer system” including unallocated space. Unsurprisingly, the results were voluminous, returning 64,382,929 hits in unallocated space alone which represented approximately 95 million pages of data.Following a telephonic hearing, the Magistrate Judge entered an order permitting plaintiff to withhold data found in the unallocated space and allowing defendants to seek reimbursement for the costs incurred in extracting and searching that data. Among other things, the order was based on findings that the burden of the review would outweigh any potential benefit and that the likelihood of finding relevant, admissible evidence was “minimal.”
in a recent Indiana decision, the court was incredulous that the plaintiff failed to “Google” themissing defendant (Joe Groce) as part of his due diligence process. The court stated, “We do note that thereis no evidence in this case of a public records or Internet search for Groce…to find him. In fact, we [the judge]discovered, upon entering ‘Joe Groce Indiana’ into the Google™ search engine, an address for Groce thatdiffered from either address used in this case, as well as an apparent obituary for Groce’s mother that listednumerous surviving relatives who might have known his whereabouts.” The court upheld the defendant’sclaim of insufficient service of process and affirmed the dismissal of the case. Munster v. Groce, 829 N.E.2d 52(Ind. App. 2005) available at http://caselaw.lp.findlaw.com/data2/indianastatecases/app/06080501mpb.pdf.
the court noted that the investigative technique of merely calling directory assistanceto find a missing defendant
The case arose out of a chain-reaction automobile vs. motorcycle accident from which the plaintiffs allegedly suffered serious and permanent physical and mental injuries. However, the Facebook public timeline page of one of the plaintiffs featured content that contradicted her claims of serious injury, including several photographs showing her enjoying life with her family and a status update about going to the gym. Based upon this information, Defendant moved to compel disclosure of Plaintiff’s Facebook username and password. The ruling determined that no social media privacy privilege exists: “No court has recognized such a privilege, and neither will we.” Information on Facebook is shared with third parties and, thus, there is no reasonable expectation of privacy in such information. As Judge Walsh explained, “[o]nly the uninitiated or foolish could believe that Facebook is an online lockbox of secrets.”
In this case, defendant Robert Eleck sought to admit Facebook evidence at trial that would have impeached a prosecution witness, Simone Judway. Judway denied authorship of the Facebook messages in question, claiming someone must have hacked her account, even though the evidence revealed that the hacking occurred after the subject messages were sent. The court determined that Eleck, who offered only a simple printout of the Facebook items, failed to adequately authenticate the data, ruling that “it was incumbent on the defendant, as the proponent, to advance other foundational proof to authenticate that the proffered messages did, in fact, come from Judway and not simply from her Facebook account.” The court cited precedent cases where emails, chat logs and texts were properly admitted based upon their supporting and unique metadata and other circumstantial evidence that provide “identifying characteristics.” See, e.g. United States v. Siddiqui, 235 F.3d1318, 1322-23 (11th Cir.2000) (e-mails properly authenticated when they included defendant’s e-mail address, the reply function automatically dialed defendant’s e-mail address as sender, messages contained factual details known to defendant, messages included defendant’s 625*625 nickname, and other metadata.) Dickens v. State, 175 Md.App. 231, 927 A.2d 32, 36-38 (2007) (threatening text messages received by victim on cell phone were properly authenticated when circumstantial evidence provided adequate proof message was sent by defendant); In re F.P., 878 A.2d91, 93-95 (Pa.Super.Ct.2005) (instant messages properly authenticated through circumstantial evidence including screen names and context of messages and surrounding circumstances).When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court.
Storing records, electronically, and retention policies…
The crux of the lawsuit is that Kravitz was paid as a product reviewer and video blogger for PhoneDog from April 2006 through October 2010, and that this position included posting tweets on a Twitter account called @PhoneDog_Noah. After Kravitz left PhoneDog, he changed the name of the account to @noahkravitz, and kept its followers instead of relinquishing the account and its followers over to PhoneDog as was requested of him. On November 28, 2011, the complaint survived a motion to dismiss filed by Kravitz with the magistrate judge allowing the claims for misappropriation of trade secrets and conversion to stand, and giving PhoneDog leave to file amended claims for intentional interference with prospective economic advantage and negligent interference with prospective economic advantage. On the tortious interference claims, the court held that PhoneDog failed to allege how Kravitz continuing to use the Twitter account in his own name disrupted the purported relationships between PhoneDog and the Twitter users, or how it resulted in economic harm – two essential elements for these claims.