Just about everyone has some form of social media these days. At the end of Q4 2021, Facebook reported 1.9 billion active daily users, and 2.9 billion active monthly users. Add to that Instagram’s 500 million active daily users and Snapchat’s 319 million active daily users, and you have a valuable pool of information and evidence for private investigators.
There are broadly two types of information that can captured from social media, which are:
Incriminating content that subjects inadvertently upload themselves
People often post so much of their lives on social media that they may accidentally share something that incriminates them or contradicts their legal claim.
For example, a woman made an insurance claim stating that she had suffered serious injuries due to a motor vehicle accident. However, her insurance company found posts on the woman’s social media accounts of her snowboarding and scuba diving during the time she was supposed to be injured. The insurance company was then able to prove that her claim was fraudulent.
Incriminating content uploaded by third parties
Social media can still be a useful tool in investigating those who are not very active on these platforms or have a private profile. In the case of major car accidents, it is possible that a bystander will capture footage of the crash and upload it onto Facebook, Twitter or Youtube.
In 2015, a man in the US claimed that he had crashed his $60,000 Corvette whilst driving on the Interstate. It was later discovered by investigators from Youtube footage that he had actually crashed the sportscar into a barrier during a drag-race.
Tips for Using Social Media in Investigations
Consider all platforms
There are so many different platforms out there when it comes to social media. Some of the more common ones include:
As the most popular social media site, Facebook provides investigators access to an extensive range of information. Investigators can view years of posts and photos to see:
- Photos the user has posted
- What cities they have travelled to
- What cities they have lived in
- What events they have attended
- What pages they like
- What content they post on their page
- Who they interact with on their profile most frequently
- Who they are friends with
In 2012, a Burger King employee was fired after posting a picture of himself on Facebook standing in lettuce containers. Internet sleuths were able to determine the location of the photo using GPS data in the image, who then forwarded it to news outlets in the area.
This platform is very public and is more impersonal than Facebook. Users usually follow celebrities as well as their friends, and post tweets that are unflattering or things they wouldn’t want their Facebook friends to see (such as family members and professional connections). Investigators will be able to see someone’s interests, hobbies, and connections.
This platform emphasises sharing high quality, edited photos with a user’s followers. The types of information that investigators can find through a person’s Instagram includes where they have been (via geographical tagging), what they are interested in, and who they spend time with.
Other Platforms
Although the platforms mentioned above are the most common social media platforms that people use, there are many others out there. In fact, there are around 200 widely used social media sites at the moment, and limiting your investigation to only the top 2 or 3 could mean you are missing out on a lot of valuable evidence.
In 2019, a claim of serious physical injury was proven false when posts were discovered – on the fitness-oriented social media platform Strava – of runs and bike rides during the time the claimant was supposed to be injured
Obtain Evidence Legally and Ethically
As alluded to above, a person with a private profile will make it difficult for an investigator to find information on them through their social media. As a result, investigators may be tempted to engage in pretexting.
Pretexting occurs when someone tries to convince their victim to give up valuable information by using a story to fool the victim. The investigator may pretend to be an acquaintance or friend to get inside the person’s network and access information not available to the public.
However, this practice does raise legal and ethical questions. There are some states in the US that have found that “the admissibility of evidence is not affected by the means through which it is obtained,” meaning that pretexting has been deemed admissible in these states. In California though, it is illegal to “knowingly and without consent credibly impersonate another actual person through or on an Internet Website.”
To be on the safe side, it is best that your investigation only focuses on publicly available information to avoid doing the wrong thing.
Preserve all Evidence
Given the ever-changing nature of social media, posts available one day may be deleted or made private the next day. Investigators need to ensure that they properly capture and preserve all evidence they find.
This is particularly important during workplace harassment or bullying investigations. Employees who are subject to cyber bullying may bring messages or posts to their employer’s attention. If proper steps aren’t taken to preserve this evidence, these messages and posts may be deleted by the other party and it will be a case of he said she said.
Screencasts can be used to digital record a computer screen and capture words, images and the interactivity between pages. A webcast narration can also be used by the investigator to record themselves talking about what they are seeing.
Facebook has a feature which allows users to download a copy of their entire history. This is particularly useful when investigating matters months or years in the past. While some subjects may willingly hand over their Facebook histories, investigators may need to compel the subject to hand over the information in some situations.
Act Quickly
For similar reasons as above, investigators need to act quickly when gathering evidence from their subject’s social media. Once someone becomes aware that they are being investigated, it is likely that they will start deleting incriminating evidence from their social media accounts, or even delete their accounts completely. Hence, investigators should immediately capture any piece of relevant evidence that appears on their subject’s social media accounts.
Authentication
Investigators need to ensure that all evidence they collect from social media is authentic. Doing so can be as easy as asking the subject if they, in fact, made the post. However, investigators should also be wary that judges have, in the past, ruled evidence from Facebook inadmissible due to an attorney’s suggestion that their client’s account had been hacked.
Other methods of authentication include recording the IP addresses responsible for social media posts to verify who actually posted it. Investigators could also look into internet browsing history and witness testimonies to authenticate evidence. Finally, emailing posts to others or yourself can validate the time at which it was posted as well as act as a way of preserving the post.
How Polonious Can Help
Polonious has integrations with numerous OSINT sources, including Social Discovery, which focuses on social media.
Social Discovery will allow you to access comprehensive social media analytics. With one click you can generate reports that load back onto the case automatically. These reports are easy-to-consume, accurate, and can be customised to your investigation needs. You will need a Social Discovery account, paid separately from Polonious, to access this service.
To learn more about other integrations that Polonious currently offers or is working on, check out this link.
Conclusion
Social media is quickly becoming one of the most effective sources of information for investigations. However, there are a number of considerations that companies should keep in mind when conducting investigations using social media, which include using all available platforms, obtaining evidence legally and ethically, acting quickly, and preserving and authenticating all evidence. Doing so will ensure that investigations run as smoothly as possible.
Let's Get Started
Interested in learning more about how Polonious can help?
Get a free consultation or demo with one of our experts
