Gathering tweets from a different place in time

There is no debate that social media has altered our lives both professionally and personally. Even if you don't have a Facebook account or are not an avid Tweeter, chances are that a picture of you is on someone's site or you've read a tweet or two. Are you on LinkedIn or have you ever used Yelp? If yes, then you are a user of social media. Social media sites can be a treasure trove of potential evidence. Lawyers can scour public Facebook pages to find pictures of individuals hiking the Himalayas when they are supposedly too injured to work. Instagram photos of an accident scene may be the only existing visual evidence. These examples would be great finds, but what is the best way to find and preserve evidence on social media sites? The best way is certainly subjective and up for debate. A lawyer may believe that looking at each photograph, post, poke and message is the best and only way. He or she may be correct and that may work when you are reviewing a social media site for one person, but what about for a hundred? In the past few years a number of software products have come on the marketplace to aid in the identification and preservation of social media evidence. Some of these applications allow one to copy the contents of someone's publically available Facebook account. Once copied, the information can be indexed and searched, which can greatly speed up any review efforts (especially for 100 Facebook accounts). More important, one would have a copy of the information available or publicly visible on that date in the event someone removes data from a site or changes their privacy settings. Other applications take advantage of unique features within social media sites. As an example let's use Twitter. Twitter has a geolocation function that when enabled "allows you to selectively add location information to your tweets," according to Twitter's website. This feature is turned off by default and users must enable it to take advantage of its benefits. The only benefit I see is a huge source of evidence and not just evidence in the present, but the past. Think of it as Dr. Emmett Brown loaning you his DeLorean. It is possible to identify a region on a map and retrieve all the tweets that occurred in that location going back a number of days. One can also set the application to capture current and future tweets in a given location (no it can't predict the future). How does it work? Think of Google maps. Now picture in your mind a square around any area - country, state, county, city or building. The tweets (along with photos and links) from the defined area are collected and indexed for later review or simple preservation. We have been asked by clients to collect tweets from an intersection where an accident occurred. Initially they wanted us to search hash tags (#) on Twitter for any evidence related to the incident. When that didn't yield the results they were looking for we used the geolocation feature of the software. We "drew" a square around the intersection and immediately we were presented with photographs of the incident along with tweets from angry commuters who were stuck in traffic, all related to an accident that occurred two days prior. This was a watershed moment for me with respect to how attorneys and others could benefit from this software. Whether they know it or not, people are crowdsourcing evidence that can be used in lawsuits or criminal cases. Personal injury attorneys could use this technology to gather tweets from accident scenes. Criminal defense attorneys could use it to find additional witnesses, evidence or photographs of a crime scene. In an effort to prevent crime, law enforcement agencies could proactively monitor tweets in a neighborhood or at a festival. Or police could capture tweets from the past. I wonder if this technology is being used right now in Ferguson, Missouri. What tweets or photos could have been identified at the site of the initial shooting? Governments could monitor geopolitical hotspots. Who knows when a tweet may reveal the location of a journalist who has been taken prisoner by some radical group? Schools could use the software to monitor buildings in an effort to make parents feel safer. Corporations could monitor their workplaces to ensure their employees or others aren't leaking company secrets (or that they are actually working and not tweeting all day). OK, this is starting to sound a bit Orwellian. But the fact is that it is all possible, and the possibilities are plentiful. What ways can you think of to use this technology for your clients and your practice? ----- Peter Coons is a senior vice president at D4, providing eDiscovery and digital forensics consulting services to clients. Peter is a Certified Information Systems Security Professional (CISSP), an EnCase Certified Examiner (EnCE), an Access Data Certified Examiner (ACE), and a Certified Computer Examiner (CCE). He belongs to various digital investigation and information security based organizations. Peter holds a master's degree in Digital Forensics Management from Champlain College and a bachelor's degree in Economics from the State University of New York at Oneonta. Published: Thu, Aug 28, 2014