2018 Cyberlaw Update: E-Discovery - s and social media and other on-line evidence

Transcription

1 2018 Cyberlaw Update: E-Discovery - s and social media and other on-line evidence Presented by: Jeffrey N. Rosenthal Hunter McMahon Philadelphia, PA July 26, 2018 Introduction Jeffery N. Rosenthal Partner, Corporate Litigation Member, Privacy Class Action Defense Team Cyberlaw columnist for The Legal Intelligencer Presenter: ONE CALL AWAY TCPA CLASS ACTIONS, PBI s 24th Annual Health Law Institute (2018); TCPA CLASS ACTIONS: LESSON LEARNED FROM 2017, The Legal Intelligencer In House Counsel CLE (2017); DIALING UP DEFENSES TO TCPA CLASS ACTIONS, The Legal Intelligencer In House Counsel CLE (2016); CLASS ACTION AVOIDANCE STRATEGIES, The Legal Intelligencer In House Counsel CLE (2015) 2

2 Introduction (cont.) Hunter McMahon Director of Data Analytics at ids Consulting & Testifying Expert Background in Law, Tech & Privacy Member of The Sedona Conference, Working Groups 1 (Electronic Document Retention and Production), 6 (International Electronic Information Management, Discovery and Disclosure), and 11 (Data Security and Privacy), American Bar Association (ABA), Defense Research Institute (DRI), and the International Association of Privacy Professionals (IAPP). 3 OUTLINE I. How can a lawyer ethically collect social media evidence? II. Can lawyers advise clients to clean up their Facebook page? III. Let s Talk Data! 4

3 The Social Media Revolution 5 An Avalanche of Data Approx Billion Connected Devices Today Approx Billion Connected Devices Expected By 2025 Projected 82.5 Million Wearable Devices by 2020 The IOT is expected to produce 600 Zeta Bytes Per Year By 2020

4 Common Social Media Sites 7 Topic 1: How To Ethically Collect Social Media-Based Evidence

5 Bar Association Ethics Opinions Philadelphia Bar Association: attorneys cannot use third parties to friend witnesses on social media that a lawyer himself could not friend or contact. See Op (March 2009). 9 Bar Ass n Ethics Opinions (cont.) New York State Bar Association: lawyer may ethically view and access online profiles of another party so long as: Profile is available to all members in the network (i.e., is a public profile) and; Lawyer neither friends other party nor directs someone else to do so. See Ethics Opinion No. 843 (Sept. 10, 2010)

6 Bar Ass n Ethics Opinions (cont.) Other bar associations found Internet research by attorneys is ethical if no direct communication occurs: Formal Opinion 466, American Bar Association (April 24, 2014); Formal Opinion No. 743, New York County Lawyers Association (May 18, 2011); Formal Opinion. No , Oregon State Bar Association (Feb. 2013); and Legal Ethics Opinion No , San Diego County Bar Association (May 24, 2011). Test To Obtain Social Media Evidence Two-prong analysis for determining whether social media accounts are discoverable: First, court determines whether content in the account is material and necessary Contents are material and necessary where information contradicts or conflicts with plaintiff s alleged restrictions, disabilities, losses, and other claims. See Shackelford-Johnson v. Jamaica First Parking, LLC, 2015 N.Y. Misc. LEXIS 1913, at *7 (N.Y. Sup. Ct. Queens Cnty. Feb. 11, 2015); Brogan v. Rosenn Jenkins & Greenwald LLP, 2013 Pa. Dist. & Cnty. Dec. LEXIS 171, at *13-21 (Lacka. Cnty. 2013); see also Koken v. One Beacon Ins. Co., 911 A.2d 1021, 1025 (Pa. Commw. Ct. 2006) ( court can prohibit the discovery of matters which... would amount to a fishing expedition ).

7 Test To Obtain Social Media (cont.) Second, court balances whether production would result in a violation of account holder s privacy rights. To obtain discovery of a closed (private) social media account by Court order, party must show, with credible facts, that adversary subscriber posted information or photographs that are relevant. But see Forman v. Henkin, 93 N.E.3d 882 (N.Y. 2018) (Appellate Division erred in employing a heightened threshold for production of social media records that depended on what the account holder had chosen to share on the public portion of the account) Practice Pointers Discovery request should be narrowly-tailored in seeking only social media relating to claimed injuries from the accident. Be specific; avoid global requests for all Facebook content without any temporal limitation. Compelling disclosure of adversary s social media passwords or login credentials is generally disfavored. Brogan v. Rosenn Jenkins & Greenwald LLP, 2013 Pa. Dist. & Cnty. Dec. LEXIS 171 (Lacka. Cnty. 2013) (rejecting request for Facebook login info of a nonparty employee of defendant) But see Kelter v. Flanagan, No. 286 Civil 2017 (Monroe C.C.P. Feb. 19, 2018) (compelling log-in info to plaintiff s Instagram in auto accident case after plaintiff testified she did not use social media and was confronted with proof to the contrary. )

8 Practice Pointers (cont.) Requests for metadata or native format production must be substantially justified by the needs of the case or on evidence of spoliation. Consider consulting a third-party provider or other e-discovery vendor for collection Source: Hamilton, Donna, Bae, From Snaps to Tweets: The Craft of Social Media Discovery, Law360 (Nov. 20, 2017) And Now, A War Story 16

9 Issue: whether pilot of tow boat had been at the sticks so long he was exhausted and not alert. Expert purported to testify that, in his judgment, pilot was not on the river too long. Night before cross, expert was posting on maritime chat room (using own name) making broad, absolute statements that pilots need better protection and that alertness tracking program was substandard. Judge: Captain, I am confused; do you lie on the Internet, or do you lie in my courtroom? Authentication of Social Media Posts Consolidated criminal trial on assault/harassment charges arose from an assault of the victim at a graduation party Commonwealth v. Mangel, 181 A.3d 1154 (Pa. Super. Ct. 2018)

10 Authentication of Social Media Posts Court: social media evidence presents additional challenges because of the great ease with which a social media account may be falsified, or a legitimate account may be accessed by an imposter. Authentication of Social Media Posts Held: Social media posts/messages were not properly authenticated because testimony from an expert in computer forensics did not corroborate that defendant was the creator of the account, sender of the communications, or that he posted the photograph with a reasonable degree of certainty; mere fact that the account bore defendant s name, hometown and high school was insufficient.

11 Topic 2: Can You Ethically Instruct A Client To Clean Up Their Facebook Page? 21 Guidance From The Philadelphia Bar Association Ethics Opinion (July 2014) A lawyer may advise a client to change the privacy settings on the client s Facebook Page. A lawyer may instruct a client to make information on the social media website private, but may not instruct or permit the client to delete/destroy a relevant photo, link, text or other content, so that it no longer exists.

12 Guidance From The Philadelphia Bar Association Ethics Opinion (July 2014) A lawyer must obtain a copy of a photograph, link or other content posted by the client on the client s Facebook page in order to comply with a Request for Production or other discovery request. A lawyer must make reasonable efforts to obtain a photograph, link or other content about which the lawyer is aware if the lawyer knows or reasonably believes it has not been produced by the client. Guidance From The New York County Lawyers Association Ethics Opinion 745 (July 2, 2013) Attorneys may need to advise what clients should/should not post on social media Providing advice does not violate any ethical obligations Attorney may instruct client to use highest level of security on social media pages Attorney can ethically assist in formulating a corporate policy on social media issues

13 Removed, But Not Deleted Taking Down Information: Attorneys may advise clients on taking down or removing already existing information from social media sites, which could implicate spoliation issues if information is destroyed, rather than removed (from the public portion of a site) Substantive laws may make it an offense to destroy material to defeat its availability in a pending or reasonably foreseeable proceeding even if no specific request to reveal or produce evidence has been made 25 When Cleaning Up Gets Messy 26

14 The Case of Matthew B. Murray Former Vice President of Virginia Trial Lawyers Association Shareholder and branch manager of the Charlottesville office of Allen, Allen, Allen & Allen, P.C. Represented Plaintiff Isaiah Lester against defendant Allied Concrete for the death of his wife after a cement truck crossed the center line and tipped over the Lesters car. Lester v. Allied Concrete Co., 2011 Va. Cir. LEXIS 245 (Va. Cir. Ct. 2011). 27 Where Things Got Messy Murray instructed client, through his assistant, to clean up his Facebook account We do not want blow ups of other pics at trial so please, please clean up your Facebook and MySpace! As a result, client deleted 16 photos but all were eventually given to Allied attorneys before trial Included a picture of Lester with a beer can wearing a T-shirt that said: I hot moms Jurors told about the scrubbed photos s between Murray, the paralegal and Lester were not made available to the court until after the trial Murray attributed error to paralegal Murray later told Court he concealed out of fear a continuance would be granted 28

15 The Result: As a sanction, trial judge ordered Murray and Lester to pay $772,000 (Murray s share was $544,000) to defense lawyers. Possibly the largest ediscovery sanction penalty ever leveled directly against an attorney (Next Gen ediscovery Law & Tech Blog, Nov. 15, 2011) Slashed $8.5 million jury award VA Supreme Court reinstated full verdict in January Allied Concrete Co. v. Lester, 736 S.E.2d 699 (Va. 2013) Murray agreed to five (5) year suspension Murray resigned from his law firm on July 25, One more example Gatto v. United Air Lines, 2013 U.S. Dist. LEXIS (D.N.J. Mar. 25, 2013) Frank Gatto, baggage handler at John F. Kennedy Airport, claimed he suffered serious injuries when set of stairs used for aircraft refueling crashed into him. In July 2011, Defendants sought wall posts, comments, status updates or personal information posted or made by Gatto on Facebook or any other site from 2008 through the present. 30

16 Just The Facts Gatto agrees to provide Facebook access to defense counsel Defense counsel tries new password but account is unchanged; cannot access site Facebook notified Gatto his account was accessed by unknown IP address in New Jersey Gatto, in turn, notifies his attorney who reaches out to defense counsel (who is on vacation) Gatto agrees to download account contents and provide certification that nothing has changed 31 Just The Facts (cont.) Two weeks later, Gatto s counsel ed defense counsel to say Gatto previously deactivated account and could not reactive it Gatto claimed he deactivated account on December 16 because unknown people accessed it (claims he did not know it was defense counsel until afterward) Facebook automatically deleted data fourteen days later Lost postings would have helped refute Gatto s damages claim (showed trips taken, social activities, ebay business) 32

17 The Result: Gatto sanctioned for spoliation Magistrate Judge Steven C. Mannion rejected argument deletion was accidental Even if [Gatto] did not intend to permanently deprive the defendants of the [data he] intentionally deactivated the account [and failed] to reactive [it] within the necessary time period [causing permanent loss of evidence] that is potentially relevant to [Gatto s] damages and credibility. Defendants entitled to adverse inference instruction Judge declined to award fees: destruction did not appear motivated by fraudulent purposes or diversionary tactics ; and the loss of evidence will not cause unnecessary delay. 33 Takeaways Providing client advice on social media does not violate any ethical obligations Attorney may instruct client to use highest level of security Attorney can ethically assist in formulating a corporate policy on social media issues Removal, not deletion, is appropriate when advising clients to clean up social media Severe discovery sanctions possible 34

18 Two Things To Know: Friending witnesses or adverse parties is unethical; use discovery process to obtain online content. Advising clients to use online privacy filters is appropriate; advising clients to delete online content is not. Let s Talk Data!

19 Digital Profiles (Online!) Mobile Devices Chats (SMS/WhatsApp/Etc.) GPS (Mobile/Fitness) Internet History CRM Access VPN Access Conference Badge Records Social Media Hotel or MiFi WiFi Logs Hotel Key Card Logs Multitudes of Sources Layering for Analysis

20 Data Profiling (Overview) Data Profiling

21 Data Profiling (DITL) Questions? Contact: