Digital footprints remain forever

By Resolve Editor Kate Tilley

Once it’s on the internet, it stays there. The internet doesn’t forget, and it doesn’t forgive.

Geoffrey Campey, principal of Social Media Evidence Experts (SMEE), sources digital evidence and turns “social media data into legally persuasive evidence” or “technobabble into legalese”.

He told an AILA webinar that time and money were all it took to find information on the web, even if it was purportedly hidden or removed.

Mr Campey combines tech and legal skills and has qualifications in both fields. A self-professed “nerd since the age of 11”, he studied law but decided it “wasn’t for me”.

Instead he works in digital forensics, providing expert evidence in court cases by following digital footprints – the trails we leave behind when we use electronic devices.

Footprint forever

He cited an example of a claimant who alleged various spine and shoulder injuries. SMEE found vision of the Australian-based claimant skydiving above the manmade Palm Island off the Dubai coast. Identifying the date, they found that, only six months after the alleged injuries occurred, he could travel to the United Arab Emirates and go skydiving.

“People don’t understand how the internet works. Your digital footprint can’t be wiped away, it’s there forever. It can be challenging” to find, but it’s there, Mr Campey said.

Even if people are conscious of security and privacy when posting about themselves, others may post about them and they have little control.

While social media sites are “valuable sources”, SMEE also searches the surface web, the deep web and the dark net.

On the surface net, they can access anything a search engine can, including news websites, property searches and online adverts.

On the deep web, data is controlled via usernames and passwords. “To get beyond the front page, you need to acknowledge how you will use the information and probably pay for it.” It includes bulletin boards, many of which operate on the opensource phpBB platform.

The dark web contains tradeable data and there are legal and ethical considerations about using it. Mr Campey says 80% of data is from unprotected sources that has been leaked, through human error or laziness, as opposed to being breached or stolen.

Metadata critical

He says data collection is generally done poorly, for example someone takes a screenshot and creates a PDF. “But that misses the context. We look for the metadata.” For example, in the case of the “injured” skydiver, the date on which the video was filmed was critical to the case.

Metadata shows the time a post was created, in what time zone, using what device, and the geographical coordinates of the device. Former Prime Minister Tony Abbott’s analogy for metadata was: “It’s not the content of the letter, but what’s on the envelope.”

Mr Campey said forensic collection of online data was the application of scientific knowledge to legal problems. Evidence had to be in the same state when presented in court as it was when collected, preserving its provenance.

“We generate metadata as we collect evidence so we can verify to a court how and when we did it and how it’s been stored subsequently.”

In response to an audience question, Mr Campey said there were “absolutely” examples of digital evidence showing someone had been falsely accused. Evidence always needs interpretation. “Data can be a sword or a shield, or both at the same time.”

Specialised tools

In defamation cases, SMEE can show how and when something was posted, how many people it reached, and what it looked like before it was subsequently deleted.

SMEE uses a wide range of specialised, licensed tools to help with its detection work. While many open-source tools are available, and many insurers use them, Mr Campey says SSME does not. They are “not stable enterprise-grade applications”, require constant upgrades, and corporate IT departments fear them because of the potential to infect networks.

Mr Campey says much of the industry does desktop surveillance or uses potentially intrusive physical surveillance. Digital forensics can assist with targeting surveillance sites. “Online data is circumstantial evidence and needs to be corroborated with other evidence.”

Forensic online investigations require highly trained people who can document their work in varied formats, be ethically compliant and use legally defensible methods.

Mr Campey said courts were becoming more familiar with the data and “willing to entertain it”.

Court support

Justice Kelly Rees in Michael Burke v MetLife Insurance Ltd NSWSC 177 (2019), said a series of Facebook posts, viewed over seven years “in parallel with [former police officer] Mr Burke’s self-reporting of PTSD symptoms to doctors, [show] the wide disparity between how Mr Burke appeared on the outside and how he said he felt on the inside.

“On occasion, the Facebook posts and, to a lesser extent, the surveillance, showed Mr Burke undertaking activities which he said he could not. While there are dangers in placing too much weight on this material, it should not be rejected out of hand. It all forms part of the factual matrix.”

In another case involving a former police officer, Gavan v FSS Trustee Corp NSWSC 667 (2019), Justice Julie Ward, President of the NSW Appeal Court, allowed the insurer MetLife to gain access to Roslyn Gavan’s private Facebook posts.

She said: “Documents obtained from the publicly available content of Ms Gavan’s Facebook account clearly give cause to believe that there will be documents on her private account that will shed light (whether in support or otherwise) of her claims as to the severity of her [PTSD] symptoms over the relevant period. [While] the notice to produce calls for documents over a lengthy period, it is reasonable to expect that if there were to have been improvement (or deterioration) of Ms Gavan’s mental condition and symptoms over this period of time, then this would be reflected in her Facebook account.”

CJ Ward said MetLife had “established a legitimate forensic purpose” and the request was neither “too broad nor a fishing expedition”.