Privacy and Ethics For Social Media In Investigations

Employee Usernames And Passwords

Using a person's username and password to a social media site, often available due to the person's use of company computer systems, allows access to the greatest level of detailed information. This access not only reveals information hidden from the public by privacy settings, but will also allow access into private messages the individual may have sent or received.

Over the last 18 months, however, 36 states have introduced or enacted legislation that prevent employers from requesting access to employees' full profiles. As one example, Illinois amended its Right to Privacy in the Workplace Act by making it unlawful:

” for any employer to request or require any employee or prospective employee to provide any password or other related account information in order to gain access to [their] ' account or profile on a social networking website.'

In addition to the state's enforcement rights, employees and prospective employees can file suit for a violation and may receive actual damages, costs and attorneys' fees. Illinois's law does not make an exemption for internal investigations, as has some of the state legislation. See, Cal. Lab. Code '980(c)'(allowing employer access to social media accounts 'where reasonably believed to be relevant to an investigation ' provided that the social media is used solely for purposes of that investigation or a related proceeding').

Additionally, the surreptitious use of such user names and passwords, without the consent of that person, raises concerns under the Computer Fraud and Abuse Act (CFAA) and potential ethical violations.

Similar to the amalgamation of state data breach laws, each state has different standards and exemptions for employers' access to social media. Thus, at the start of an investigation, the state laws for any relevant employees should be carefully scrutinized if employers want to access, with consent, any employee's full profiles, and more often than not, such access will not be available in an internal investigation and should be avoided accordingly.

False Accounts

For some of the main social media sites, such as Facebook and LinkedIn, certain information from an individual may be hidden from the public but available to others who have asked that individual to be 'friends' or 'connections.'

Lawyers conducting internal investigations, however, should refrain from ruses often employed by law enforcement, such as creating false profiles to 'friend' a person. First, as applicable to all users, the social media sites themselves prohibit such conduct in their Terms of Use. For example, Facebook's terms of service prohibits users from providing 'any false personal information on Facebook' or doing 'anything unlawful [or] misleading.' Although courts have held that violation of a website's terms of service is not a crime under the CFAA (see, United States v. Drew (C.D. Cal. 2009)), courts have determined that such violations of terms of use can lead to civil liability. See also, Fteja v. Facebook, Inc. (S.D.N.Y. 2012).

Further, directly applicable to lawyers are the professional ethics opinions that indicate that such practices can violate ethical rules. The Professional Ethics Committee of the New York State Bar released an ethics opinion that said that although lawyers can use their real name to contact an unrepresented party through social media, lawyers 'and their agents' cannot do so 'under false pretenses to obtain evidence from a social networking website.' Formal Opinion 2010-2 (Sept. 2010). Along a similar vein, the Philadelphia Bar Association's Professional Guidance Committee issued an opinion that the same ethical rules are violated where a third party, at the request of an attorney, sends a request to connect to a witness unknown to him without telling the person the nature of the request, in order for the lawyer to ultimately gain access to that person's profile information. See, Opinion 2009-02 (March 2009).

Publicly Available Information

Based on the roadblocks outlined above, investigative counsel might decide to view only the information made public on social media by the subject. Unfortunately, this, too, is not so simple.

For example, LinkedIn offers a service that enables users to see who has viewed one's profile in the preceding 90 days. For an investigation witness represented by counsel or who might not understand the investigation, the notification that a profile was viewed could again implicate or violate professional rules. There are potential workarounds ' LinkedIn users can set their account settings to stay anonymous as to whose profiles they have viewed ' but this again requires close diligence from investigative counsel in doing such searching.

Twitter presents similar issues ' although anyone can follow anyone else's account without permission, an attorney following the account of a potential witness could again be considered to be in communication with the witness, as the witness will be aware of that follower.

Finally, social media sites have their own Terms of Use, which generally include provisions that indicate that use of the site for purposes outside the sites' intended uses (essentially, networking) will be outside of those terms of use. As discussed, a violation of the terms of use will likely not be a crime, but while these terms are admittedly vague, a violation may result in civil liability.

Conclusion

Social media, while potentially a treasure trove for an internal investigation, is not without significant legal and ethical roadblocks to full use.

William Michael Jr. is a partner and co-chair and Laura Hammargren is an associate in the white-collar defense'and compliance group of Mayer'Brown in Chicago.

'

It begins with a name ' perhaps an employee alleged to have been involved in misconduct or a suspected whistleblower. Regardless of the origin of identity, if the person is relevant to a company's internal investigation, whatever information that can be provided is power for the company, the power to make informed decisions.

Thus, the initial instinct of those conducting such investigations is to find all relevant information. Often, such individuals will have made a direct record of their employment history on LinkedIn and potentially pontificated about life, work, thoughts and deeds on Facebook. Although Twitter can, at times, be unintelligible, those tweets are additional 140-character insights into that person's potential knowledge. All it takes to find out is some quick and inexpensive Internet browsing.

Despite the allure of such a fast gathering process of candid information, counsel conducting internal investigations should curb their impulse to freely access and use social media accounts. Although the business world and legal profession are still catching up with recent technology, change is quickly being promulgated in the form of statutes, professional rules and website policies that limit such access. Investigative counsel would be well served to consult with ethics professionals about these developing rules and policies prior to the initiation of any such investigative process.

Employee Usernames And Passwords

Using a person's username and password to a social media site, often available due to the person's use of company computer systems, allows access to the greatest level of detailed information. This access not only reveals information hidden from the public by privacy settings, but will also allow access into private messages the individual may have sent or received.

Over the last 18 months, however, 36 states have introduced or enacted legislation that prevent employers from requesting access to employees' full profiles. As one example, Illinois amended its Right to Privacy in the Workplace Act by making it unlawful:

” for any employer to request or require any employee or prospective employee to provide any password or other related account information in order to gain access to [their] ' account or profile on a social networking website.'

In addition to the state's enforcement rights, employees and prospective employees can file suit for a violation and may receive actual damages, costs and attorneys' fees. Illinois's law does not make an exemption for internal investigations, as has some of the state legislation. See, Cal. Lab. Code '980(c)'(allowing employer access to social media accounts 'where reasonably believed to be relevant to an investigation ' provided that the social media is used solely for purposes of that investigation or a related proceeding').

Additionally, the surreptitious use of such user names and passwords, without the consent of that person, raises concerns under the Computer Fraud and Abuse Act (CFAA) and potential ethical violations.

Similar to the amalgamation of state data breach laws, each state has different standards and exemptions for employers' access to social media. Thus, at the start of an investigation, the state laws for any relevant employees should be carefully scrutinized if employers want to access, with consent, any employee's full profiles, and more often than not, such access will not be available in an internal investigation and should be avoided accordingly.

False Accounts

For some of the main social media sites, such as Facebook and LinkedIn, certain information from an individual may be hidden from the public but available to others who have asked that individual to be 'friends' or 'connections.'

Lawyers conducting internal investigations, however, should refrain from ruses often employed by law enforcement, such as creating false profiles to 'friend' a person. First, as applicable to all users, the social media sites themselves prohibit such conduct in their Terms of Use. For example, Facebook's terms of service prohibits users from providing 'any false personal information on Facebook' or doing 'anything unlawful [or] misleading.' Although courts have held that violation of a website's terms of service is not a crime under the CFAA (see, United States v. Drew (C.D. Cal. 2009)), courts have determined that such violations of terms of use can lead to civil liability. See also, Fteja v. Facebook, Inc. (S.D.N.Y. 2012).

Further, directly applicable to lawyers are the professional ethics opinions that indicate that such practices can violate ethical rules. The Professional Ethics Committee of the New York State Bar released an ethics opinion that said that although lawyers can use their real name to contact an unrepresented party through social media, lawyers 'and their agents' cannot do so 'under false pretenses to obtain evidence from a social networking website.' Formal Opinion 2010-2 (Sept. 2010). Along a similar vein, the Philadelphia Bar Association's Professional Guidance Committee issued an opinion that the same ethical rules are violated where a third party, at the request of an attorney, sends a request to connect to a witness unknown to him without telling the person the nature of the request, in order for the lawyer to ultimately gain access to that person's profile information. See, Opinion 2009-02 (March 2009).

Publicly Available Information

Based on the roadblocks outlined above, investigative counsel might decide to view only the information made public on social media by the subject. Unfortunately, this, too, is not so simple.

For example, LinkedIn offers a service that enables users to see who has viewed one's profile in the preceding 90 days. For an investigation witness represented by counsel or who might not understand the investigation, the notification that a profile was viewed could again implicate or violate professional rules. There are potential workarounds ' LinkedIn users can set their account settings to stay anonymous as to whose profiles they have viewed ' but this again requires close diligence from investigative counsel in doing such searching.

Twitter presents similar issues ' although anyone can follow anyone else's account without permission, an attorney following the account of a potential witness could again be considered to be in communication with the witness, as the witness will be aware of that follower.

Finally, social media sites have their own Terms of Use, which generally include provisions that indicate that use of the site for purposes outside the sites' intended uses (essentially, networking) will be outside of those terms of use. As discussed, a violation of the terms of use will likely not be a crime, but while these terms are admittedly vague, a violation may result in civil liability.

Conclusion

Social media, while potentially a treasure trove for an internal investigation, is not without significant legal and ethical roadblocks to full use.

William Michael Jr. is a partner and co-chair and Laura Hammargren is an associate in the white-collar defense'and compliance group of Mayer'Brown in Chicago.

'