Kevin Ian Schmidt

As every moment of people’s lives—both inconsequential and monumental—have spread onto Facebook, Twitter, Instagram, LinkedIn, SnapChat, TikTok, and other platforms, a record has been created of comings and goings, personal opinions and piques, that can be a trove during investigations.

First off, What is a Social Media Investigation?

A social media investigation looks into the social media posts, status updates, photos, and conversations of an individual. You might require a social media investigation for a court case, custody battle, or as part of a background investigation. This can be used as evidence in court cases to support alibis and provide supplementary evidence, for risk assessment, and for active monitoring.

What you’re searching for will depend on the investigation.

For the average court case, social media can be searched to establish a foundation of character, verify, or disqualify an alibi, and find supporting evidence. This includes looking at the location tags for Facebook, Twitter, and Instagram posts, verifying that the posts were original, and identifying what other individuals associated with the case are involved. For some investigations, like for crimes against minors, alerts and searches can be set up for specific search terms, and it can be discovered what type and age of individuals the person is interacting with.

For a domestic investigation, you might search for photos of your partner that support your suspicions of infidelity, or check the location data on posts on Twitter to verify he or she is where they say they are. Internet messaging, Facebook messages, and Twitter direct messages can also indicate whether or not the individual is staying faithful.

A custody case can involve looking at photos posted across platforms to identify who the individual is associating with. Twitter posts could indicate whether the individual is suited and trustworthy for retaining custody, and a Tumblr investigation can reveal the individual’s priorities, thoughts, and intentions.

Any case involving possible drug use can mean searching for photographs and posts across platforms that would indicate potential drug use, as well as a search for Tumblr posts of images or comments, reblogs, that support drug use. This type of investigation includes searching and setting up alerts for specific terms relating to drug use. In some cases, a sting can be set up to see if, through internet messaging services, the individual is dealing or affiliated with a dealer.

Check Out: 5 Myths about Employee Theft

 

When it comes to mining social media for potential evidence, content can broadly be divided into two categories:

• Incriminating content that subjects inadvertently upload themselves: People are so used to sharing their activities on social media, that they’ll occasionally share something that incriminates them, or contradicts their legal claim, without thinking. For example, an insurance fraudster who claimed that a vehicle accident had left her severely debilitated was outed when investigators found photos of her snowboarding and scuba-diving on her social media accounts.
• Incriminating content uploaded by third parties: Just because someone isn’t very active on social media—or their privacy settings don’t allow outsiders to see much on their accounts—doesn’t mean that you can’t use social media to find useful evidence. In the case of a major car crash, for instance, it’s very possible that a bystander uploaded footage of the accident to Twitter, Facebook, or YouTube. One great example is a 2015  case, during which a man claimed that he’d wrecked his $60,000 Corvette while driving on the Interstate. Unfortunately for him, investigators found YouTube footage of the sportscar being crashed into a barrier during a drag-racing event.

 

So, now we have talked about WHAT a social media investigation consists of, let’s talk about if you SHOULD or CAN do a social media investigation.

Social media postings may also constitute evidence or provide leads to potential witnesses. For example, many of the far-right agitators behind the 2017 Unite the Right rally in Charlottesville, Virginia openly coordinated their mayhem online. A number of their posts appear in the complaint against them and will likely be entered into evidence at trial.

Social Media Investigation Findings as Evidence

Wall posts, status updates, photos, check-ins and tweets have all been used as evidence in workplace investigations. In the Zimmerman v. Weis Markets Inc. case, Zimmerman was an employee of a subcontractor of Weis Markets and was seeking damages for an injury that occurred at work. Zimmerman claimed that an accident seriously and permanently impaired his health.  Weis Markets reviewed the public portions of Zimmerman’s Facebook and MySpace pages, and felt that there might be some additional information to refute the damage claims in the private sections of his profile.

On the public portions of his profile, the company found photos of Zimmerman engaging in some of his favorite activities after the accident took place at work. They knew the photos were from after the accident because his scar from the accident was visible in the pictures.

The court decided that Zimmerman had to hand over his passwords and login information to the counsel for Weis Markets so that they could access the private sections of his Facebook and MySpace accounts. The opinion released by the court said:

Zimmerman voluntarily posted all of the pictures and information on his Facebook and MySpace sites to share with other users of these social network sites, and he cannot now claim he possesses any reasonable expectation of privacy to prevent Weis Markets from access to such information.

Below are a few key cases involving social media as evidence.

• State v. Eleck
• Rene v. State
• Bland v. Roberts
• Thompson v. Autoliv Asp, Inc.
• Richards v. Hertz
• State v. Tienda
• Tompkins v. Detroit Metropolitan Airport

 

One of the biggest hurdles to social media becoming a staple in the courtroom has been provability. Most courts require metadata and MD5 hash values for evidentiary validation and to establish chain of custody, applying Rule 901(b)(4) of the U.S. Federal Rule of Evidence (see Lorraine v. Markel American Insurance Company or State v. Tienda).

Metadata –

Metadata can be a laundry list of items, including unified resource identifier, item type, parent item, thread id, recipients, created time, updated time, link, comments, and picture url, to name a few.

MD5 Hash Value –

MD5 hash value is a one-way cryptographic hash function that is used to verify data integrity. It is a 32 character hexadecimal string of numbers and letters that has a 1.7 undecillion (that’s 36 zeros) chance of being replicated . In layman terms, the chances of the MD5 hash being replicated are about the same as someone winning the powerball 32 times in a row.

Courts have rejected simple printouts of social media posts, citing inadequate authentication (see State of Connecticut v. Eleck). As an extension of provability through MD5 hash values and metadata, we can also provide expert testimony to validate evidence.

 

What Employers Need to Consider

You won’t always be granted permission to obtain login information and passwords from an employee under investigation. Be aware of the Patterson v. Turner Construction Company to remind employers that their requests must be “made in the right kind of case, at the right stage of the case, and have the right scope.”

Employers also have to be careful about how they access information posted on an employee’s social media profile. Attorneys and investigators cannot misrepresent who they are in order to get access to join their opposition’s private social media network. For example, you cannot create an account under an alias, “friend” the employee under investigation and then expect to use that information to support your case – the evidence won’t be admissible.

Principle: an investigator is almost always prohibited from using misrepresentation or dissemblance to obtain information, and it is evident that this injunction applies to social media investigations. In New York, as in most states, conduct involving dishonesty, fraud, deceit, or misrepresentation is prohibited under NY Rules of Professional Conduct, Rule 8.4 (c). Further, it is axiomatic that lawyers may not violate the rights of third parties when obtaining evidence. Most jurisdictions have adopted ABA Model Rule 8.4(a), stating that an investigator’s unethical acts may be imputed to the attorney. Even in states that have not explicitly adopted it, there is “substantial case law that supports the proposition that the duty of an attorney. . . not to deceive extends beyond the courtroom.”

Bar associations have also addressed the question of how investigators may contact people on social media. The New York City Bar Association says investigators may contact unrepresented parties without violating ethical rules provided that there are no overt misrepresentations. The San Diego County Bar Association takes a stricter view, requiring that even where contact or “friending” may be otherwise proper, an attorney should not make contact with an individual without disclosing that she is an attorney and the purpose of the contact. When investigating in different jurisdictions—and keeping in mind that most social media companies are headquartered in California—it is wise to adopt the more restrictive guidance.

Advice for Using Social Media During a Fraud Investigation

Of course, near-constant content creation has a major downside: because of the sheer amount of social media content out there, finding that crucial piece of evidence isn’t always easy. For this reason, social media investigation has become its own specialized field, and in order to use it effectively, you have to be systematic in your approach.

With that in mind, here are five tactics to use when collecting social media content as evidence during a fraud investigation:

• Consider all the platforms: When it comes to looking for online evidence, Facebook and Instagram tend to be the most useful platforms, but there are many others worth considering. In fact, there are around 200 widely-used social media sites at the moment, so if you’re limiting your investigation to the top two, or three, you could be missing out on crucial evidence. Just consider the December 2019 case, during which a claim of serious physical injury was proved false with posts of a 10-mile run and a 20-mile bike ride on the fitness-oriented social media platform Strava.
• Use tools to find online profiles: A simple Google search remains a good way of finding a particular individual’s online profiles, but other excellent tools also exist. Search tools like Pipl, Peoplefinders, PeekYou, and Classmates can all be used to identify social media profiles. If you have an image and would like to see where it appears online, TinEye is another great tool.
• Always obtain evidence ethically and legally: It’s important to stay on the right side of the law. While law enforcement might sometimes be able to create fake social media profiles to investigate suspects, law firms and fraud investigators don’t have that same freedom. And even API tools that were once very useful for collecting social media evidence are now creating severe preservation challenges thanks to privacy concerns. So, when collecting social media evidence, focus only on content that you can view and capture legally—and use a browser-based evidence tool to collect it.          
• Consider someone’s social connections: While an individual being investigated might be clever enough to utilize strict social media privacy settings and refrain from posting incriminating content, they probably won’t be able to keep all their activities hidden. As mentioned earlier, a bystander might upload an incriminating video to YouTube. Similarly, someone’s friends, family, roommates, team mates, or colleagues might also post useful images and information. Because of this, it’s worth exploring the accounts of people in an individual’s social circle, as well as any pages belonging to an employer, association, sports team, etc.
• Make sure evidence is defensible: Collecting incriminating evidence is only half the battle—legal teams also need to be able to convince other parties of the information’s authenticity. While taking a simple screenshot might seem like a quick and easy way of collecting evidence, it’s all too easy for the person under investigation (or their legal

Five Tips for Effective Social Media Investigation

1.  Google And Bing Are Your Friends

Never underestimate the power of your favorite search engine. Many people don’t realize how much information is available about almost everyone via the internet. Simply searching your subjects name might uncover surprising results.

Another easy search engine technique is reverse image search. Sometimes an image search reveals social media accounts, online dating profiles, employers, personal blogs, and a wealth of other resources. Use critical thinking when evaluating the results as some phishers, scammers, and catfishers steal people’s pictures to use to build false profiles.

2. Look Your Subject Up On Social Media

Social media offers hints to a subject’s location, lifestyle, and interests. According to Pew Research, 48% of social media users report finding each channels privacy settings difficult or confusing. As a result, many leave some or all of their information public. A public social media profile is one of the first visits for any investigator.

Even when the subject uses privacy settings, there may still be publicly posted information on major channels like Facebook and Instagram. Facebook’s graph search may uncover unexpected gems as many people allow the public to see photographs they are tagged in. Insurance investigators, divorce attorneys, potential employers, and debt collectors have all uncovered valuable information and evidence of a subject’s lifestyle and character simply through casual, candid photographs posted on Facebook, Snapchat, or Instagram.

Savvy investigators also look at less personal social media accounts such as Pinterest. Even though users are less likely to post telling, personal details, these channels can indicate location and interests.

Check Out: External Theft – Shoplifting

3. Look at Your Subject’s Friends’ Accounts

Many people allow friends of their friends to see even private details. Also, sometimes friends with public profiles may comment on photographs, location check-ins, or status updates from friends with private accounts.

A recent study uncovered that nearly 50% of all social media users accept friend requests from strangers. Be aware that many social networks forbid false profiles.

4. Take Screenshots To Preserve The Evidence

Since social media posts are ephemeral, your subject may remove embarrassing or incriminating content. Savvy investigators keep a record of these posts including a screenshot. Be sure to track important details about the posts you uncover and find a way to preserve and archive any valuable information.

5. Try Social Listening Tools

Social listening tools help businesses with marketing and customer service purposes. Some of these same social listening tools have investigative applications. It would be prohibitively time-consuming to constantly search Google, Bing, and each social network for new updates on your subject. However, you can automate some of this using social listening tools.

 

 

As investigators, we spend a great deal of time on these platforms reviewing information posted by and about the subjects of our investigations. Modern social media platforms can be a tremendously useful resource. The reason for this is simple: a lot of us are active on social media these days—and we tend to share more than less. At the end of Q1 2020, Facebook reported 1.73 billion daily active users and 2.6 billion monthly active users, with around half of all social media site visits in the United States going to Facebook. Add Instagram’s 500-million daily active users—not to mention the 500 hours of video uploaded to YouTube every minute!—and you’re left with a lot of potential digital evidence.