Can Facebook Deleted Posts be Retrieved?

ORIGINAL INQUIRY: An attorney in a capital case is seeking to impeach a witness through Facebook messages that the writer subsequently deleted.  Can anyone suggest some method, by subpoena or other request to Facebook, through some tech magic or otherwise, to secure these records?

RESPONSES

Here in Massachusetts we run into this issue a great deal. Facebook, along with most other sites, refuses to honor subpoena's generated by the State Courts on the part of defendant's, although they will honor such subpoena's generated by the District Attorney and law enforcement, arguing that they are protected under Federal Law. To that end, we have sometimes been successful in arguing to the judge that Facebook will honor a subpoena from the District Attorney's Office, and, as such, ask the judge to compel the District Attorney's Office to issue a subpoena for the records and when they receive them, turn them over to defense counsel.

From: joseph maggiacomo III [mailto:jmaggiacomoiii@yahoo.com]

In a recent case handled by our office, the Government provided us with a complete record of our client's Facebook account, which included indications of whether messages were deleted from Facebook and the content of those messages.  Facebook provided this information in response to a Search Warrant.  Attached are the attachments to those search warrants specifying precisely the property to be searched (Facebook headquarters at Menlo Park, California) and the items to be seized, which included any deleted information still available to Facebook.  For the most part, Facebook was fully responsive to that search warrant.

               Perhaps the language contained in these attachments may be helpful in drafting a subpoena or discovery demand.  At the very least, I know firsthand that Facebook does indeed keep deleted messages (and even pictures).

(See attached file: Sample Facebook Warrant Attachments.pdf)

David Espiritu

Paralegal

Federal Defender

Middle District of Florida

201 S. Orange Ave., Suite 300

Orlando, Florida  32801

(407) 648-6338 ext. 182

Ben Wolff [mailto:ben.b.wolff@gmail.com]

Unfortunately, it is exceedingly difficult to obtain the content of facebook messages without a release by at least one party to the communication, under the federal stored communications privacy act (18 usc 2701 et seq.).  Basically, in the absence of a release, the content of any internet posting (as opposed to subscriber and IP address info) can only be released pursuant to a search warrant (although certain other information may also be released pursuant to a court order sought on behalf of a governmental entity). see also https://www.facebook.com/safety/groups/law/guidelines/

I am an attorney with the Georgia Capital Defender's office. I am in and have been for some time a battle with Facebook over obtaining account data. I will be happy to tell you what I have done and the hurdles I have had to overcome.

Feel free to give me a call. My cell number is 770-315-8368.

Crystal H. Bice

Trial Attorney

Georgia Capital Defender's Office

104 Marietta Street, NW - Suite 600

Atlanta, Ga. 30303

(404) 739-5169

I believe that there is an argument that when Facebook will only respond to a search warrant, you can have the court order the prosecutor to get those records – or else risk dismissal.  Although the first attached motion and memo is on a slightly different context (federal court and investigative documents), the cases cited would support this argument.  The last document attached, a juvenile case, supports this point – that judge ruled that if the government did not assist the defendant in getting facebook records, the court might dismiss the case. 

Facebook doesn't maintain deleted posts in their system.  They do maintain backups in case of catastrophic loss of the site, as most major companies do, but they are rotating backups and I do not believe you'll get anything from 2 years ago.

If you have a Computer Forensic Examiner you work with, talk to that person.  It is not impossible to get back the posts from whichever device was used to post or delete them, since accessing them creates a copy on the device itself, but each device handles deleted files differently and therefore, each device would have different chances of success.  I will say, from having done hundreds of examinations myself, that if the post was accessed from a smart phone, it's much harder to get the content back.

A computer has more unallocated space where deleted things can be found, but 2 years is a challenge for sure.

Here is a good bit of info for attorneys going forward, Facebook makes an "archive" available to each user, but each user must actually create it by invoking the archive function.

In the drop down settings tab from main page,  Click Settings:

Once you get to the General Settings Page, look at the bottom under the General Account Settings section and you'll see "download a copy of your archive"

Click that link, put in password and Facebook will create an archive in a ZIP file of all the account data, including content of messages.   If you have litigation pending, including criminal litigation,  notice the other side to preserve Facebook and other Social Media content and  provide them instructions so no one can claim they didn't know how to do it.  In most cases I am involved with we try to do that immediately since it's been our experience prosecutors are informing witnesses and complainants of the dangers of social media posts….happened just the other day when an alleged victim whose already been caught altering photos, posted on her Facebook page that she was told to delete, gave her FB friends notice, then a few hour later, deleted it. 

IN your notice to preserve, put in a sentence to provide proof they have complied (I'm not a lawyer so you guys are on your own on that part).

Know that doesn't quite help your immediate need, but maybe someone else will get some useful info out of that.

If I can help, let me know.

You can contact them here:

Please contact Facebook, Inc. online or by mail at:

Facebook, Inc.
1601 Willow Road
Menlo Park, CA 94025

Good Luck.

Brian K. Ingram, Owner

Consulting Investigation Services

Tx. License: A-08429

PO Box 2097 Waxahachie, Texas 75168

972-937-3938 Ofc

469-548-9224 Fax

www.cispi.net

Computer/Mobile Device Forensic Examiner, Internet/eBusiness Investigations,

Email Tracing, Major Case Criminal Defense, Catastrophic Event Investigations

Texas Association of Licensed Investigators: At-Large Director

Intellenet

I can tell you if this case coincides with something the police need as well, the deleted information is available through Facebook.

There was a criminal case I was involved in where the Police did a search warrant on a Facebook account two years ago looking for deleted emails and Facebook turned them over to the Police. I reviewed the data myself and it destroyed any possibility of an alternative defense.

Lance Sloves

"Voted Top 3 Computer Forensic Firms in Dallas by the Texas Lawyer 2010 and 2012"

Lance Sloves

Computer Forensic Services, Inc.

Consulting, Evidence Collections, Analysis and Investigations

2807 Allen St #743

Dallas, Texas 75204

TX Investigators License # A11665

Certified Computer Examiner (CCE) #282

Certified CelleBrite UFED Mobile Device Examiner

Member International Society of Forensic Computer Examiners

Tel: 214-306-6470

Mobile: 214-498-5666

Fax: 214-306-6470

http://www.cfsiusa.com

From: Mary Conn [mailto:mary@maryconnlaw.com]
Sent: Friday, August 14, 2015 9:37 AM
To: Barry Baker Sipe <bbaker_s@hotmail.com>; Eric M. Freedman <Eric.M.Freedman@hofstra.edu>
Subject: RE: attachments please: Re: [HABEAS-L] Facebook Subpoena Issues - Responses Received to Query

These are received yesterday from Angela Krueger <AKrueger@co.tulare.ca.us>:

I missed your original query.  This is the motion plus attachments that I have used to try to get Facebook stuff.  (I believe Stored Communications Act shouldnt apply to Facebook because of data-mining, and there are fed cases that support that.)  But I have had no luck getting stuff from Facebook directly; I have had some luck getting info directly thru SDTs from the user.  (I know your messages are deleted, but you may want to consider SDT'ing info directly from user to establish that Facebook is sole source of info...)  I have attached my SDT to the user.  (And an application to preserve facebook info...)  I have also attached a note re the admissibility of Facebook postings if you have screen shots or whatnot of the posts...

The idea that you have to go thru the DA to get the stuff just pisses me off...

Regards,

Angie

Mary Elizabeth Conn, Attorney at Law

AV  Preeminent Rated - Martindale Hubbell Peer Review Ratings

AVVO 10.0 Superb Rating

Mary E. Conn & Associates

440 Louisiana St., Suite 200

Houston, Texas 77002

(713)357-4190

55 River St. Suite 100

Santa Cruz, California 95060

(831)234-7279

www.maryconnlaw.com

mary@maryconnlaw.com

From: Barry Baker Sipe [mailto:bbaker_s@hotmail.com]
Sent: Friday, August 14, 2015 8:14 AM
To: Eric M. Freedman <Eric.M.Freedman@hofstra.edu>; Mary Conn <mary@maryconnlaw.com>
Subject: attachments please: Re: [HABEAS-L] Facebook Subpoena Issues - Responses Received to Query

Hi,

May I please have the briefs and cases which were attachments to whoever it was that responded as follows:

"I believe that there is an argument that when Facebook will only respond to a search warrant, you can have the court order the prosecutor to get those records – or else risk dismissal.  Although the first attached motion and memo is on a slightly different context (federal court and investigative documents), the cases cited would support this argument.  The last document attached, a juvenile case, supports this point – that judge ruled that if the government did not assist the defendant in getting facebook records, the court might dismiss the case.”

In addition, may I please have the following attachments:

In a recent case handled by our office, the Government provided us with a complete record of our client's Facebook account, which included indications of whether messages were deleted from Facebook and the content of those messages.  Facebook provided this information in response to a Search Warrant.  Attached are the attachments to those search warrants specifying precisely the property to be searched (Facebook headquarters at Menlo Park, California) and the items to be seized, which included any deleted information still available to Facebook.  For the most part, Facebook was fully responsive to that search warrant.

               Perhaps the language contained in these attachments may be helpful in drafting a subpoena or discovery demand.  At the very least, I know firsthand that Facebook does indeed keep deleted messages (and even pictures).

From: Stephen Whelihan - PCRX [mailto:WhelihanS@mail.maricopa.gov]
Sent: Thursday, August 13, 2015 6:08 PM
To: habeas-l <HABEAS-L@LISTSERV2.HOFSTRA.EDU>; Eric M. Freedman <Eric.M.Freedman@hofstra.edu>
Subject: RE: Facebook Subpoena Issues - Responses Received to Query

I did not respond, because I have no specific knowledge, but here is how I would approach the problem if my prosecutor will not or cannot get it for me:

Facebook is a corporation.  Corporations are required to have an address where process can be served.  I believe for Facebook it would be at their headquarters (Menlo Park California?).  A court with jurisdiction over that geography can order a subpoena duces tecum or an order to show cause why the records should not be produced.  (a court in Sacramento?).  Apparently Facebook will ignore court orders outside the jurisdiction unless it is for the prosecutor. 

In order to get the order from the court in California to order facebook to turn over the records, since I do not practice in that jurisdiction, I would resort to the Uniform Act to Secure the Attendance of Witnesses from without the State.  In Arizona it is ARS 13-4091.  I believe virtually all states have a comparable statute.

The procedure involves getting a certificate from the court with jurisdiction over the criminal case and filing it in the court with jurisdiction over the witness with an application for a subpoena.  That court may then order the appearance of the witness (i.e. the custodian of records for Facebook) to either com to Arizona testify (and bring the records) at the criminal trial or in the alternative to produce the records or to show why they should not be compelled to do so.  This would involve help from a lawyer in the jurisdiction as well as a process server to serve the court’s orders.

I imagine the Facebook lawyers will have plenty of arguments why they should not be compelled to do so, so there would probably be argument to make at the hearing on the order to show cause in California, but I think that is the way to compel production of the records. 

  

From: habeas-l [mailto:HABEAS-L@LI

Cell Phone Tower Evidence is Junk Science

On May 28th, Lisa Marie Roberts, of Portland, Oregon, was released from prison after serving nine and a half years for a murder she didn’t commit. A key piece of overturned evidence was cell-phone records that allegedly put her at the scene.

Roberts pleaded guilty to manslaughter in 2004, after her court-appointed attorney persuaded her that she had no hope of acquittal. The state’s attorney had told him that phone records had put Roberts at the scene of the crime, and, to her lawyer, that was almost as damning as DNA. But he was wrong, as are many other attorneys, prosecutors, judges, and juries, who overestimate the precision of cell-phone location records. Rather than pinpoint a suspect’s whereabouts, cell-tower records can put someone within an area of several hundred square miles or, in a congested urban area, several square miles. Yet years of prosecutions and plea bargains have been based on a misunderstanding of how cell networks operate. No one knows how often this occurs, but each year police make more than a million requests for cell-phone records. “We think the whole paradigm is absolutely flawed at every level, and shouldn’t be used in the courtroom,” Michael Cherry, the C.E.O. of Cherry Biometrics, a consulting firm in Falls Church, Virginia, told me. “This whole thing is junk science, a farce.”

The paradigm is the assumption that, when you make a call on your cell phone, it automatically routes to the nearest cell tower, and that by capturing those records police can determine where you made a call—and thus where you were—at a particular time. That, he explained, is not how the system works.

When you hit “send” on your cell phone, a complicated series of events takes place that is governed by algorithms and proprietary software, not just by the location of the cell tower. First, your cell phone sends out a radio-frequency signal to the towers within a radius of up to roughly twenty miles—or fewer, in urban areas—depending on the topography and atmospheric conditions. A regional switching center detects the signal and determines whether to accept the call. There are hundreds of such regional centers across the country.

The switching center determines the destination of your call and connects to the land lines that will take it to cell towers near the destination. Almost simultaneously, the software “decides” which of half a dozen towers in your area you’ll connect with. The selection is determined by load-management software that incorporates dozens of factors, including signal strength, atmospheric conditions, and maintenance schedules. The system is so fluid that you could sit at your desk, make five successive cell calls and connect to five different towers. During a conversation, your signal could be switched from one tower to the next; you’ll also be “handed off” to another tower if you travel outside your coverage area while you’re speaking. Designed for business and not tracking, call-detail records provide the kind of information that helps cell companies manage their networks, not track phones.

If I make a cell call from Kenmore Square, in my home town of Boston, you might think that I’m connecting to a cell site a few hundred feet away. But, if I’m standing near Fenway Park during a Red Sox game, with thousands of fans making calls and sending texts, that tower may have reached its capacity. Hypothetically, the system might send me to the next site, which might also be at capacity or down for maintenance, or to the next site, or the next. The switching center may look for all sorts of factors, most of which are proprietary to the company’s software. The only thing that you can say with confidence is that I have connected to a cell site somewhere within a radius of roughly twenty miles.

Aaron Romano, a Connecticut lawyer who says that he has seen many cases involving cell records, has done a series of calculations to show how imprecise these locations can be. If you suppose that a cell tower has picked up a signal from ten miles away, you’re looking at a circle with a radius of ten miles, which has an area of three hundred and fourteen square miles. Cell-tower coverage is divided into sectors. Most towers have three directional antennae, each of which covers one third of the circle. Including that factor gives you a sector of 104.67 square miles. “That’s a huge area,” Romano said. “So how can anyone say, with any degree of certainty, that a handset was at the scene of the crime?”

Some technologies can locate you precisely. If you carry an iPhone, you’re also carrying a G.P.S. transmitter, which links to a ground station and then to several satellites, which can find your location to within fifty to a hundred feet. You enable the G.P.S. when you use certain software, such as Google Maps. Similarly, if you make an emergency 911 call, your company will use three towers to triangulate your location; if you’re using a smartphone, it will use G.P.S. to pinpoint where you are. If you’re the target of an ongoing investigation and law-enforcement agencies want to track you, they can ask a phone company to “ping” your phone in real time. (They also use that technique when trying to find a kidnapping victim.) Those methods are not what’s captured by phone-company cell-tower records of the sort that helped put Roberts in prison.

When investigating a crime that occurred in the past, police tend to have two options: seize the G.P.S. chip and download the locations, or obtain the cell records. Wednesday’s Supreme Court decision made it mandatory for police to obtain warrants before searching the cell phones of people they arrest. But the case law on getting cell-tower information is split. In most jurisdictions, police can obtain your call-detail records without a warrant. The disparity in requirements between the two could encourage police to rely increasingly on call-detail records, Hanni Fakhoury, a staff attorney for the Electronic Frontier Foundation, said.

Put another way, if I’m making a cell-phone call from my couch and someone commits a murder in a bar half a mile away, my cell records may serve as corroborating evidence that I took part in the crime. That might be true if I’d claimed to be in another state at the time, but those records cannot place me next to the body. What they don’t show is the precise location of a cell phone. Yet prosecutors often present those records as if they were DNA.

A few years ago, the F.B.I. established a unit specializing in cell records, called C.A.S.T. (Cellular Analysis and Surveillance Team), with the mission of analyzing cell-location evidence. The Bureau declined requests for an interview, but C.A.S.T. agents in recent cases have asserted a different theory of how cell networks operate. Testifying at a trial for murder and robbery in Florida in June, 2013, Special Agent David Magnuson said that the instant a call is received or placed, it’s the phone that decides which tower to go to—not the software that adjusts network load—and that, “ninety-nine per cent of the time, it’s the closest tower.” Although he conceded that cell records can be imprecise, he described them as “like a historical digital fingerprint.”

He added that the F.B.I. checks its information by doing periodic “drive tests,” in which it measures radio-frequency information emitted by cell towers to see if the coverage area agrees with its models. Independent experts I spoke to called this testimony into question—both the accuracy of the estimates and the validity of the drive tests. Conditions are so changeable that, even if a drive test confirms the model on a particular day, it may not on another, and certainly not on a day years in the past. It’s a probabilistic statement, not a scientific one.

In 2012, the U.S. District Court for the Northern District of Illinois ruled that an F.B.I. agent could not testify about the location of a defendant’s cell phone because the analyses did not rise to the level of trusted, replicable science. Other courts have found for the defendant after the defense attorney discredited the prosecution’s expert witness.

Lisa Marie Roberts’s original lawyer wasn’t one of them. There were reasons to suspect her: she had a tumultuous, sometimes violent relationship with the victim, Jerri Williams. Cell records showed that at 10:27 on the morning of the murder, Roberts’s phone connected to a tower within 3.4 miles of Kelley Point Park, where Williams’s body was discovered. Her attorney felt that was enough to convict her.

But she was making that call while driving a red pickup truck more than eight miles away, as confirmed by a witness. The system had simply routed her call through the tower near the park. It also emerged that new DNA evidence placed another suspect, a man, at the crime scene. And another piece of evidence helped: moments earlier, Roberts had received another call that came through a different site. The two towers were 1.3 miles apart. She could not have traveled that distance in the forty seconds between the calls. And so her cell records, in a sense, helped to save her.

Courtesy of the NEW YORKER

Posted by DOUGLAS STARR

Seminar Proceeds Benefit Innocence Project of Florida

Thanks so much for sending the checks collected at the training presented by Sarasota FACDL and Adam Tebrugge. We greatly appreciate you all thinking of us and supporting our work in this way. The donations from the seminar total $1,355.00. You have made a difference in the lives of the men and women who are innocent and imprisoned.

With the profits from the seminar, the total raised is $1,793.90. Please extend our sincere appreciation to Adam and each member of the Sarasota Chapter of FACDL. We are grateful for the support of individuals and organizations, such as FACDL, that share our vision of correcting miscarriages of justice and help us lock the truth in wrongful conviction cases.

Sincerely,

Jackie Pugh
Development Coordinator
Innocence Project of Florida, Inc. 

Lecture: Ethically Defending Forensic Science Cases: Daubert DNA and Beyond

Powerpoint presentation for lecture by Adam Tebrugge on May 23rd, 2014:

SEMINAR AGENDA: Ethically Litigating Forensic Science Cases: Daubert, DNA and Beyond

SEMINAR  May 23, 2014

Title: ETHICALLY LITIGATING FORENSIC SCIENCE CASES

           DAUBERT, DNA and BEYOND

Presented by: The Sarasota Chapter of the Florida Association of Criminal Defense 

                            Lawyers

Location:       Holiday Inn  Sarasota Bradenton Airport

12:00 – 12:30   Registration/Networking

12:30 -  1:00     Lunch served

1:00 – 1:10:      The Innocence Project of Florida (Derek Byrd)

 1:10  - 2:00        Ethics : Discussion of Rules. Regulating Fla. Bar Rule 4-1.1

                               Adam Tebrugge

2:00  -- 2:10        Break

2:10- 3:00           Daubert: Changes to Florida law of Expert Witnesses

                               Chris Cosden

3:00 – 3:10         Break

3:10 -  4:00      Understanding DNA: Discovery and Litigation

                             Adam Tebrugge

4:00 – 4:30       Resources Available to Attorneys

4:30 – 6:00        Social

Seminar: Ethically Litigating Forensic Science Cases--Daubert, DNA and Beyond

Good blog about juries

A good blog about juries is found at this link: