Imagine for a second that you need to collect evidence from someone’s Facebook or Twitter account. Like a surprising number of criminals, the person has just posted something incredibly incriminating that could really help your case. However, there’s also a good chance that they’ll come to their senses and delete the post. The evidence can disappear at any moment—so you need to act quickly.
What do you do?
If you’d simply take a screenshot, you are not alone. Many plaintiffs, investigators, regulators, and even legal professionals resort to taking screenshots. The reason for this is simple: it’s the obvious solution to a tricky problem. There simply aren’t that many ways to preserve a digital copy of a social media post that exists exclusively within an online platform. While you can simply create a copy of a Word, Excel, PDF, audio, or video file, a social media post doesn’t have that option.
Uhm, Do You Have the Metadata?
So, a screenshot can seem like a rather elegant solution to the problem. But while this approach will allow you to capture whatever’s on screen, it does introduce its own challenge. Because a screenshot is transforming a social media post into a simple JPEG, it strips it of metadata and makes it impossible to authenticate.
Metadata provides information about digital data. In other words, it’s the data about data. When it comes to a social media post, it would include information about the author of the post, the message type, post date and time, versions, links (un-shortened), location, likes, and comments. (To learn more, read our blog post, What Is Metadata? And Why Is it Important?)
Without this metadata, there is no way to prove that your JPEG copy accurately represents what was originally posted on the social media platform. All you have is an image that could have been Photoshopped or manipulated in some other way—and a court, not to mention your opposing counsel, won’t be satisfied with that.
Social Media Evidence Denied in Court
While it has taken some time for courts and the legal sector to get a handle on social media content that’s dynamic and real-time, it’s fair to say that screenshots are increasingly being viewed with suspicion. Where it was once relatively common to submit a screenshot into evidence, it’s now becoming a risky strategy that could sink a case.
Moroccanoil v. Marc Anthony Cosmetics
In Moroccanoil v. Marc Anthony Cosmetics, which was argued in front of a federal district court, the case was centered on trademark infringement and unfair competition of the word “Moroccanoil.”
Moroccanoil (the company) had registered the word with the United States Patent and Trademark Office (USPTO). Marc Anthony Cosmetics argued that the words “Moroccanoil” and “Moroccan oil” were used interchangeably by consumers as general terms, and Moroccanoil therefore couldn’t trademark it.
To support this argument, Marc Anthony submitted screenshots of a Facebook page that illustrated how customers used these words. Unfortunately, the court ruled that the Facebook content could not be entered into evidence, since there was no way to prove that the screenshots were an exact copy of what existed on the live Facebook site. In other words, there was no way to authenticate the screenshots.
United States v. Vayner
During the trial of United States v. Vayner, a printout of a page on VK.com (a Russian site similar to Facebook) was entered into evidence. The defendant's legal team objected, claiming that the page had not been properly authenticated, and that there was consequently no proof that this was in fact his page.
The court agreed and the evidence was deemed inadmissible, but this decision was later overruled by a district court who argued that it was reasonable to assume that the page belonged to the defendant.
However, the story didn’t end there. The U.S. Court of Appeals for the Second Circuit again overturned the ruling, arguing that there was no way to prove the authenticity of evidence. The court said that “the mere fact that a page with [the defendant’s] name and photograph happened to exist on the Internet at the time of [the investigator’s] testimony does not permit a reasonable conclusion that this page was created by the defendant or on his behalf.”
Edwards v. Junior State of America Foundation
In Edwards v. Junior State of America Foundation, a civil litigation matter involving the intentional destruction (spoliation) of social media evidence, the plaintiff had deleted his Facebook account resulting in lost evidence critical to the case. The court cited an affidavit submitted by an eDiscovery expert witness who noted that when Social Discovery was used to collect from the Plaintiff’s Facebook account, key evidence that existed was missing because it had been deleted by the Plaintiff prior to the collection.
As a result of the spoliation established in large part by the Social Discovery examination, the Court imposed severe evidentiary sanctions on the plaintiff, including the exclusion of evidence and claims related to the destroyed Facebook data, and adverse jury instructions.
The plaintiffs’ had sought to offer screenshots as evidence of the Facebook communications instead of the deleted native files. The court ruled that the metadata and full context of the native files were essential to satisfy the Best Evidence Rule.
The court held that screenshots were not an output that accurately reflected the substance and context of the native file, since they could not show that the messages were authentic, nor could they “be used to prove that Harper sent the Facebook Messages contained in the screenshots.” Failure to produce the native files prejudiced JSA, in part, because it deprived Defendants “of the ability to substantiate or refute the authenticity of the alleged Messages.”
In a key passage the court states:
Here, the screenshots will not suffice as an “original” because the screenshots are not an “output” that “accurately” reflect the information. Only native files can ensure authenticity. Additionally, although the Best Evidence Rule allows for an original “photograph” to prove the contents of the photograph, this does not mean that the screenshot here can be used to prove that Harper sent the Facebook Messages contained in the screenshots.
Cases like Moroccanoil v. Marc Anthony Cosmetics and United States v. Vayner underscores the importance of proper collection and authentication methods. Simple printouts and screenshots are not good enough. (To see more case examples, read our articles, Legal Lessons Learned: 5 Times Digital Evidence Was Denied in Court, and, More Legal Lessons Learned: 7 Times Social Media Evidence Was Denied in Court.)
The Sedona Conference & Social Media
Another respected legal entity that has been advocating for a more sophisticated approach to social media is the Sedona Conference.
The Sedona Conference is a research and educational institute dedicated to the advanced study of law and policy. It focuses on the areas of antitrust law, complex litigation, intellectual property rights, and data security and privacy law.
One of its seminal publications is The Sedona Conference Primer on Social Media, which received a second edition in 2019. The preface of the latest version explains the reason for its creation: “The need for an updated Primer was essential given significant advances in social media technology since we published the first edition of The Sedona Conference Primer on Social Media in December 2012. The proliferation of messaging technology and its usage—on traditional social media platforms and in mobile messaging applications—have created preservation, production, and evidentiary challenges that counsel should learn to recognize and address.”
Predictably, The Sedona Conference specifically addresses the use of screenshots and other static images in its social media primer. The document states that:
“Some practitioners resort to capturing static images of social media data (i.e., screen shots and PDF images) as a means of preservation, with courts often permitting the use of such evidence at trial. Printing out social media data has its evidentiary limitations, as a static image does not capture the metadata of the image, other than whatever information may be viewable as part of the screen shot. As a result, static images may result in an incomplete and inaccurate data capture that is hard to authenticate, except on the basis of the personal knowledge of a witness. Social media may also contain data and content, such as video, that cannot be properly collected in the form of static images. In addition, social media outlets use different interfaces to display content, further complicating efforts to create standardized snapshots. Any such collection will most likely be a visual representation that does not include metadata, logging data, or other information that would allow the content to be easily navigated and used.”
In short, a screenshot has three problems. First (and most crucially), it lacks the hash values and metadata needed to prove authenticity. Second, it lacks context and gives you no real understanding of how social media content is structured or presented. Finally, it cannot capture related video that’s likely needed to understand the purpose and context of a post.
The Automated & Defensible Alternative to Screenshots
So, if screenshots aren’t the answer to social media evidence collection, what is? The Sedona Conference highlights the value of turning to vendors that are able to provide dynamic capture with metadata. “Vendors have developed technology to allow certain content to be collected in a way that preserves the content and captures various metadata fields associated with social media data. Properly captured, these metadata fields can assist with establishing the chain of custody and authentication. They can also help to facilitate more accurate and efficient data processing and review.”
That is exactly what our WebPreserver forensic preservation tool is able to do. WebPreserver was designed to simplify online evidence capture by automating collections and providing defensible exports that can be used in court.
With WebPreserver you can:
- Collect website and social media evidence with two simple clicks
- Use bulk-capture features to collect entire websites and social media accounts
- Provide OCR PDF output for eDiscovery systems
- Quickly collect and authenticate videos from websites, YouTube, Facebook, Twitter, and Instagram
- Generate MHTML and WARC files to provide forensic ready evidence
- Maintain complete control over chain of custody
- Let WebPreserver automatically scroll through timelines and expand comments
You can also watch the video below to see WebPreserver in action:
For legal and investigative teams looking to collect social media content, WebPreserver greatly cuts down on the time and effort needed to gather this evidence. Instead of spending weeks or months taking screenshots, WebPreserver lets them automate the collection process and capture entire social media accounts with minimal effort. And unlike with screenshots, they’ll have access to authenticated records that can stand up in court.
Learn more about WebPreserver by clicking on the image below.
