Employees from all types of organizations, whether private or public sector, regulated or unregulated, are communicating via social media channels to conduct business, exchange information, and perform research. Now, due to the rapid adoption of social media in business, organizations and the legal community are trying to understand the preservation and production responsibilities around social media content in the context of civil litigation. This responsibility stems from the requirement that any channel through which individuals interact and express themselves may need to be reviewed for potentially relevant information in the eDiscovery.

1. Social Media and Litigation
Outlining eDiscovery Issues

2. Introduction
In the last several years, social media has evolved from a geek’s toy to For example, certain financial firms have very specific regulations prescribing
interact and connect with each other to a global phenomenon in which what communications must be captured and how those communications
individuals and organizations of all types engage for business purposes. For must be stored and for how long. Similarly, some US states have now issued
purposes of this paper, however, the scope, including the case law cited, will specific requirements for insurance organizations with regard to social
be focused on the United States. Social media is a general term which refers media. Employees of government agencies may also have legal requirements
to the use of Web-based and mobile technologies to turn communications to capture and archive specific communications based on Freedom of
between individuals and groups into interactive dialogues. Information Act or Open Document laws requiring that all business-related
content generated by government organizations be captured and made
These interactive communications are usually through such social networks available to citizens, if asked. But, social media content and actionsoften
as Facebook, LinkedIn, Twitter, and Google+ but can also be through industry extend beyond regulatory agency inquiries.
blogs, group chat rooms, and corporate-run internal sites such as Jive and
IBM Connections.
Employees from all types of organizations, whether private or public sector,
regulated or unregulated, are communicating via social media channels
to conduct business, exchange information, and perform research. In
many instances, these employees, depending on from where they are
communicating, may have regulatory responsibilities to capture those
communications and archive them for some period of time.
2 | Outlining eDiscovery Issues 3 Outlining eDiscovery Issues | 3

3. The Changing Legal Landscape Around Social Networks
Now, due to the rapid adoption of social media in business, organizations The Amended Federal Rules of Civil Procedure
and the legal community are trying to understand the preservation and In 2006, the Federal Rules of Civil Procedure (FRCP), which is the
production responsibilities around social media content in the context of civil framework that governs procedures for civil legal suits within US federal
litigation. This responsibility stems from the requirement that any channel courts, were amended to detail the requirements for the preservation and
through which individuals interact and express themselves may need to be discovery of electronically stored information (ESI). The FRCP requires each
reviewed for potentially relevant information in the eDiscovery process1. party to provide an unaltered copy (including all metadata) of all ESI that the
The unique nature of social networks has proven frustrating for judges, not disclosing party has in its possession, which is or could be deemed relevant
necessarily known for being “early adopters” of new technologies (and most to the case.4
likely not so savvy on the social media front), thus potentially lacking an in-
depth understanding of the capabilities and limitations of these technologies. Another directive of the FRCP amendments was the concept of a “litigation
This has created grey areas in eDiscovery responsibilities, especially when hold.” Also known as a “preservation order” or “legal hold,” it is a stipulation
looking at new technologies which have not been addressed by the courts requiring a company to preserve all data that may relate to a legal action
in the past. Attorneys find themselves lacking the requisite eDiscovery involving the company. This requirement was designed to ensure that all
knowledge due to the fact that law schools spend little time on the subject. data in question will be available for the discovery process prior to litigation.
Over the last several years, potentially responsive content from individuals’ An organization (and individuals) must preserve records as soon as it
and organizations’ social media accounts have become increasingly learns of pending or imminent litigation, or when litigation is reasonably
requested in civil litigation. A recent example (2010) often cited is a case anticipated. A litigation hold prevents spoliation (i.e., destruction, alteration,
involving an intellectual property infringement and contract dispute where
2
or mutilation of evidence), which can have a catastrophic impact for one
the social media sites, MySpace and Facebook, were targets of discovery. or both parties. The litigation hold order applies not only to paper-based
Another example decided in Pennsylvania in November of 2011 found that
3
documents but also to all ESI that could be relevant to the case no matter
information posted by a party on their personal Facebook page where it may be stored.
was discoverable.
When looking at the implications of social media in eDiscovery, it’s best to
review discovery law around electronic content since social media, according
to existing case law and regulatory guidelines, is considered just another form
of electronic communication to be treated no differently than email.
4 | Outlining eDiscovery Issues 5 Outlining eDiscovery Issues | 5

4. The eDiscovery and litigation hold responsibilities potentially complicate an Discovery Problems Surrounding Employee-Controlled
organization’s reach and management of case-related social media content. Social Media Accounts
These complicating factors include: Some organizations have taken the stance that an employee’s social media
assets are by default the organization’s, going so far as to tell employees
1. Social media content can be created and stored on third-party systems
when and when they can’t post to their social media accounts. Lately,
not controlled or even easily visible by the organization
courts have struck this down as being an infringement on the employee’s
2. Social media content can be deleted or altered in real-time without the rights (as long as the employee is not posting to their social media accounts
organization’s knowledge while “on the job” or from the organization’s infrastructure). In a case6
3. Social media content is often created by individuals not under the where an employer accessed and used an employee’s personal social
control of the organization media account without permission, the court cited the federal Electronic
4. Social media content can become widely distributed via a social Communications Privacy Act of 1986 to dismiss the employer’s attempt
network in a matter of seconds (loss of privilege) to quash the complaint.
In many cases, the employee, as an individual, has created the relationship Placing a litigation hold and performing Discovery of employee-owned social
with the social network, thereby excluding the employer from direct control network accounts is a major problem which organizations can address
or the ability to review the content. Because of this, the organization’s through a combination of policy, education, and technology. Effective
responsibilities in discovery are uncertain and could rely on legal case communications, training, and policies are commendable starting points
precedent or instructions from the judge. This highlights the employer’s when trying to reduce an organization’s liability. For example, a social
lack of authority to access or control this content without the employee’s media policy should be drafted, which lays out the organization’s stance
approval versus their responsibility around informing the employees around the “dos” and “don’ts” of employee access to social media sites
of litigation hold and eDiscovery requirements that could relate to the from the corporate network and during work hours. The policy should also
employee’s personal accounts. address a prohibition on the use of the organization’s content, rumor, etc., in
personal social media accounts. As part of this policy, the employees should
Many social networking sites are taking the position that without a understand that their personal social media accounts and content could be
subpoena, they will not cooperate in third-party requests for information. open to discovery by opposing counsel in the event of civil litigation, if it
Facebook, for example, maintains that, even with a subpoena, it may fight a can be demonstrated the employee had in the past conducted business or
discovery request and has done so successfully. 5 communicated work-related content through their social media accounts.
Once a policy has been finalized, employees need to be trained and
acknowledge their understanding and acceptance of it.
6 | Outlining eDiscovery Issues 7 Outlining eDiscovery Issues | 7

5. When civil litigation is anticipated, the organization must inform, in 4. Employees’ use of social media is subject to Company’s corporate
writing if possible, all potentially affected employees immediately as workplace policies
to the existence of the civil suit, the subject matter, and date ranges in 5. No illegal or inappropriate activities shall be conducted through social
question. Affected employees should be informed of their litigation hold media. If your company also forbids gaming or gambling on corporate-
responsibilities around the content in question and be reminded that the provided machines, then be sure to call this out in the social policy.
litigation hold pertains to all potentially relevant content, no matter where it Facebook, as an example, has hundreds of thousands of applications,
currently exists, including personal social networking accounts.7 many of which involve elements of gaming and gambling
Discovery Problems Surrounding Employer-Controlled 6. The escalation procedure (e.g., manager or HR) in the event
Social Media Accounts of questions
By definition, social networks are interactive and dynamic. Content can
change or be deleted instantly, which raises liability issues when it comes Included in the policy should be consideration of litigation hold and
to litigation hold and discovery of social media content. Organizations faced eDiscovery responsibilities and the technology required to meet these
with the decision of jumping into the social media ocean need to prepare objectives. Notification of these responsibilities should be made
ahead of time to both ensure the most “bang for the buck” but also to to employees.
reduce their liability of ESI spoliation and insufficient discovery response in
the event of litigation. The Grey Areas of Social Media eDiscovery
As social media eDiscovery is relatively new with very little case law on the
A social media policy should be created, reviewed, and approved by the legal matter, there remain several grey areas that do not fall neatly in one of the
department (or outside counsel). Contents of the policy could include, but is previously discussed sections. Consider, for instance, the following scenarios
not limited to, the following: and their variations, each of which will undoubtedly arise and pose new
legal questions:
1. Permissible uses of social media (including from corporate and
personal devices while on work premises). This could also include •• An employee uses his personal Facebook account from his work computer
permissible uses of social media when referencing or representing while utilizing the employer’s infrastructure (i.e., network bandwidth,
the company, regardless of the location or device utilized wireless, etc.). In addition to the expectation of privacy issues, which may
or may not be addressed in a company policy, is the company required to
2. Company reserving the right to monitor and record employees’ usage
include that Facebook account information in its response to a request for
of social media
production of documents? To what extent does it depend on the facts and
3. Consequences for breach (e.g., disciplinary action or termination) allegations of the dispute?
8 | Outlining eDiscovery Issues 9 Outlining eDiscovery Issues | 9

6. •• An employee has a LinkedIn account, which her employer pays for an Authentication of ESI
upgraded “Business” account that entitles the employee to advanced
In Lorraine v. Markel American Insurance Co., 241 F.R.D. 534
features of LinkedIn. The employee leaves the company but keeps her
(D. Md. 2007), Maryland’s own Magistrate Judge Paul W. Grimm,
LinkedIn account. Within her LinkedIn account are some connections
she cultivated while at the company. Some of those connections became a recognized authority on evidentiary issues concerning electronic
customers of the company. Does the employer continue to own the evidence, outlined issues regarding authentication of electronically
communications that took place during the employee’s tenure with the stored information, in e-mail, websites, digital photographs, computer-
company, even after the employee leaves the company? To what extent generated documents, and internet postings, etc.with respect to Rule
is this content discoverable in the event the company becomes involved 901 of the Federal Rules of Evidence:
in litigation? Does the company become liable for spoliation if it failed to
a. GENERAL PROVISION. The requirement of authentication or
include such content in a litigation hold directive?
identification as a condition precedent to admissibility is satisfied by
•• An employee has a personal Facebook account and is “Facebook
evidence sufficient to support a finding that the matter in question is
friends” with one of her colleagues. Under what circumstances are the
what its proponent claims.
communications with that friend discoverable by their employer? To what
extent does the nature of the case, the nature of the communication, or b. ILLUSTRATIONS. By way of illustration only, and not by way of
the employer’s social media usage policy affect the employer’s analysis? limitation, the following are examples of authentication or identification
Does it have a duty to obtain access to that information? Would it ever conforming with the requirements of this rule:
have a duty to protect those employees from a litigation discovery request?
1. Testimony of Witness With Knowledge. Testimony that a matter is
what it is claimed to be.
2. Distinctive Characteristics and the Like. Appearance, contents,
substance, internal patterns, or other distinctive characteristics,
taken in conjunction with circumstances.
Judge Grimm recognized that authentcating electronically stored
information presents a myriad of concerns because “technology changes
so rapidly” and is “often new to many judges.” Id. at 544. Moreover, the
“complexity” or “novelty” of electronically stored information, with its
potential for manipulation, requires greater scrutiny of “the foundational
requirements” than letters or other paper records, to bolster reliability.
11 Outlining eDiscovery Issues | 11

7. Technology Requirements for
Organizational Social Media Activity Conclusion
These are just a few examples where guidelines are not clear. It’s a Social media presents the business community with unique opportunities
still-evolving area of law, and we can expect future cases to shed more light in marketing their products and communicating with their customers
on the eDiscovery issues engendered by social media communications. and prospects. But, as new social media capabilities and services arise,
organizations will have to be prepared and able to manage that social media
To ensure smooth and defensible litigation support of organizational content like any other electronic information, especially when involved in
social media activity, technology should be considered and deployed. civil litigation. Proactively preparing for litigation hold and eDiscovery of your
social media assets is technically straightforward and relatively inexpensive,
Because of the litigation hold and eDiscovery responsibilities, especially when compared to the potential costs of destroyed electronic
organizations need to treat social media activity just like any other evidence or insufficient discovery response.
electronic communication and always be prepared to secure and
produce content under a litigation hold for long periods of time in Judges have little or no sympathy for parties to litigation not living up to
a defensible manner. their eDiscovery responsibilities. The surest way to lose a civil litigation case
is to mishandle electronic evidence, including electronic evidence that the
All social media activity on behalf of the organization should be organization should have had under control.
conducted from within the organization’s infrastructure whenever
possible. This requirement is so that activity can be monitored,
archived, and searched in a legally authenticated manner (see sidebar8)
when required.
Solutions are needed to provide social media monitoring, identity
management, and quarantine of out-of-policy content as well as controlling
access to specific features on social media sites deemed “out of bounds”
per the organization’s social media policy. Conversation and content
archiving should also be strongly considered based on litigation hold
and eDiscovery responsibilities.
12 | Outlining eDiscovery Issues 13 Outlining eDiscovery Issues | 13

8. About Actiance
Actiance provides security, management, and compliance solutions for Actiance Unified Security Gateway (USG) is the only Secure Web Gateway to
instant messaging and unified communications platforms, alongside Web combine feature and content controls of social networks with the monitoring,
2.0 and social networks. Actiance’s award-winning platform is used by more management, and security of Web 2.0 applications. Thus, applications like
than 1,600 customers - including nine of the 10 largest U.S. banks and the instant messaging can be safely accessed via URL filtering, anti-malware,
top five Canadian banks - for security, management, litigation support, and and Web anti-virus solutions. As a result, USG protects against outbound
compliance of unified communications and Web 2.0 applications. data leakage and enables compliance with industry regulations, legal
•• Security - manage and secure all Web 2.0 and real-time communications discovery requirements, and corporate policy standards.
within the organization
•• Compliance - log, archive, and retrieve IM, UC, and social media content to
meet regulatory and corporate governance requirements
•• eDiscovery - identify, capture, preserve, and collect IM, UC, and social
media content to meet litigation hold and eDiscovery requirements
•• Analytics and Reporting - gather insights on how your employees are using
and accessing Web 2.0 applications within the enterprise
Actiance Platform for Social Media Litigation Support
Actiance Socialite™ is Actiance’s security and governance solution for
References
social networks, providing granular control of Facebook, LinkedIn, and 1
Social Media and E-Discovery: New Tools and New Challenges By Nadine R. Weiskopf
Twitter. Socialite not only controls access to 200 features across social
2
Crispin v. Audigier (C.D. Cal.) (May 26, 2010)
networks but can also moderate, manage, and archive any social media
3
Largent v. Reed, Case No. 2009-1823 (C.P. Franklin Nov. 8, 2011)
traffic routed through the solution.
4
FRCP Rule 26 (a)(1)(A)(ii)
Actiance Vantage is a security and compliance solution for unified 5
Facebook GC Tells Lawyers He’s Looking for a Fight. Law.com, February 2, 2010.
http://www.law.com/jsp/article.jsp?id=1202441887703&slreturn=1&hbxlogin=1
communications and collaboration platforms, such as Microsoft Lync
and SharePoint, IBM Sametime and Connections, and Jive. From presence 6
Maremont v. Susan Fredman Design Group, 2011 U.S. Dist. LEXIS 26441 (N.D. Ill.; March 15, 2011).
and instant messaging to conferencing and voice, Vantage safely enhances 7
Lester v. Allied Concrete Co., Nos. CL08-150, CL09-223 (Va. Cir. Ct. Oct. 21, 2011)
business productivity without compromising network security. 8
Antoine Levar Griffin v. State of Maryland, No. 74, September Term 2010
14 | Outlining eDiscovery Issues 15 Outlining eDiscovery Issues | 15

9. Worldwide Headquarters EMEA Headquarters
1301 Shoreway, Suite 275 400 Thames Valley Park
Belmont, CA 94002 USA Reading, Berkshire, RG6 1PT UK
(650) 631-6300 phone +44 (0) 118 963 7469 phone
info@actiance.com emea@actiance.com
This document is for informational purposes only. Actiance makes no warranties, express or implied,
in this document.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights
under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system,
or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise),
or for any purpose, without the express written permission of Actiance, Inc.
© 2001 - 2012 Actiance, Inc. All rights reserved. Actiance and the Actiance logo are registered trademarks
of Actiance, Inc. Actiance Vantage, Unified Security Gateway, Socialite, and Insight are trademarks of
Actiance, Inc. All other trademarks are the property of their respective owners.