Digital Investigations

Frederick S. Lane

Great Prairie Area Education Association

Des Moines, IA6 April 2016

How Big Is Your Footprint?• Status Updates• Uploaded Photos and Videos• Texts and Chats• Browser Activity• Internet Searches• IP Address Activity• Media Access Control Address• What Search Engines Say About You

…

• Virtually Every Investigation Will Have a Social Media and/or Digital Component

• 25% of Law Enforcement Officers Use Social Media Daily for Investigations

• 76% Have Cited Social Media Evidence in an Affidavit of Probable Cause

Social Media Investigations

• Immediacy• Authenticity (If Verified)• Often Visual• Multi-Faceted• Difficult to Delete

Completely• Speed Is Still of the Essence

Value of Social Media Data

Admissibility of Public Posts• Public Social Media Posts Analogous to

Garbage Bags• California v. Greenwood, 486 U.S. 35

(1988)• No Reasonable Expectation of Privacy• Still Must Meet Standards for Admissibility• Relevance• Authenticity (Can Be Extrinsically Shown)• Lack of Prejudice and Probative Value• Best Evidence Rule

Access to Private Social Media

• The “Right to Privacy” Is the Right to Control Use of Data

• Privacy Settings Are an Attempt to Control Use

• Social Media Is Inherently NOT Private

• Primary Tool: Subpoena• Warrentless Production May Be

Available Under the Stored Communication Act after 180 Days

Potential Problems• Electronic Data “Susceptible to

Fabrication and Manipulation”• Is “Liking” or “Checking In” a

Statement?• Is social media activity an “admission”

or illustration of “state of mind”?• Undercover Investigations Are a Gray

Area• Volume of Material Is Staggering• Potential for Overreach

• IP Addresses Used to Connect to Service

• Dates and Times of Connections• May or May Not Include Actual

User Name• Leads to Physical Address• But Not Necessarily to

Perpetrator

The Power of the Subpoena

A Digital Investigation• Review of Logs for IP Address• 172.16.254.1

• Look Up IP Address in Public Records• Ask ISP for Name/Address of Subscriber• Obtain a Search Warrant• Search and Seize Electronic Devices

from Home• Conduct Computer Forensics on All

Relevant Devices

Digital Investigations

Frederick S. Lane

Great Prairie Area Education Association

Des Moines, IA6 April 2016