Breaking the Bad News: Facebook’s New Messages & E-Discovery

This is the third in our series of posts on Facebook’s updated messages system. In our two previous articles we introduced New Messages and discussed the main changes which it introduces. In this post we will look at the emails generated by New Messages and the difficulties which will arise in relation to electronic discovery.

A radically different view of email

Facebook users who are switched to the new Messages system will receive a Facebook.com email address based on their choice of Facebook username, for example a username of MarkZ would give an email address of MarkZ@Facebook.com. New Messages will generate email messages when a user communicates with another Facebook user who is offline and when an email address is entered as the recipient of a Facebook message. Facebook users can also receive external emails via their Facebook.com email address, with emails being delivered to the Facebook messages inbox.

At a basic level this description might seem similar to Gmail, Hotmail or other web-based email systems: users compose and receive messages via their browser. However, New Messages represents a radically different view of email which will present issues for current e-discovery processes and technology. For example, a typical email has one or more recipients in the “To” header and may have optional “cc” and “bcc” headers indicating additional recipients. A Facebook.com email uses a distinctly different format and has no concept of “cc” or “bcc”, instead using a single recipient line which can mix email addresses and Facebook usernames.

The second key omission you will notice when looking at a Facebook.com email is the lack of a typical subject line. An email generated by a person-to-person Facebook conversation will have a subject similar to “Conversation with John Smith” while a group conversation will be labelled “Conversation with John Smith and others”, highlighting the person who started the thread. When composing a new Facebook message there is no option to specify a message subject and when an external email is received the original subject line is moved into the body of the message. These differences may make it more difficult to group or de-duplicate Facebook.com messages in e-discovery and also have the effect of removing key contextual information.

The lack of a subject line highlights a further key difference between Facebook emails and traditional email: the heavy emphasis on conversations as integrated threads rather than groups of distinct emails. For example, when replying to a Facebook.com email there is no ability to selectively reply: if an original email is sent to 5 Facebook users an email reply will be sent to the same 5 users, it is not possible for example to reply to just 2 of those users. It is also possible for new Facebook users to be added to an existing thread, after which all subsequent messages will be delivered to that new participant. Based on this unique threading system it may be unclear to external correspondents exactly who will receive their reply.

Collecting evidence from New Messages

For some digital evidence professionals Facebook New Messages will be a boon, providing a new source of data which documents informal interactions in a highly (albeit unusually) structured format. In particular the fact that Facebook users can exchange documents and other attachments via New Messages will be beneficial in many cases. Unfortunately exploiting this evidence will first require an appropriate method of collecting New Messages data as evidence.

We will address separately the many issues we have found with Facebook’s “Download your Data” tool, a feature which many have suggested is tailor-made for evidence collection. For now it is sufficient to note that the data download tool was significantly flawed before the launch of New Messages, with key items of data omitted or incorrectly recorded in the exported zip file. After testing the data download tool on Facebook accounts which have been switched to New Messages our concerns have increased: in essence the exported data is dangerously incomplete and renders the tool completely unsuitable for evidence collection.

To give just one example of the issues with Facebook’s data download function, if a user has switched to New Messages and has exchanged messages using the new system their exported data will omit all Facebook chat messages. More worryingly, if two users have exchanged Facebook messages and then one of the users sends an email to the other users Facebook email or adds an email address to the conversation, the entire conversation will be omitted from the data export. As such, the new system is effectively a remote control for causing messages to be omitted from the export tool. Consider a scenario where two colleagues have corresponded using old-style Facebook messages in a conversation which subsequently becomes relevant to litigation or a disciplinary matter. Either party to the conversation could prevent the other from exporting the contentious messages by responding to the previous thread using an email address.

In addition to these issues with the official Facebook data download tool there is currently no facility to download messages via IMAP, POP3 or other common email interfaces. Although these interfaces are far from ideal for collecting email from web-based mail systems they would offer at least a stop-gap method for collecting Facebook messages for electronic discovery. Facebook have stated that IMAP support is under consideration but at this time there is no easy method to preserve or collect data within New Messages.

New Messages, old assumptions

New Messages fundamentally changes the way users interact on Facebook. For digital evidence or legal professionals who have previously worked with Facebook evidence this means a wholesale breaking of old assumptions. Many professionals will be unaware for example that Facebook users can now exchange attachments, a change which makes an enormous difference to the risk model around Facebook Messages. As noted above, the email element of New Messages also differs significantly from more traditional webmail systems which may lead to difficulties.

In investigating Internet email many investigators rely on the ability to view the internal email headers which represent the path taken by a message between various email servers, details of the email systems involved, important timestamps associated with a message, etc. In the New Messages investigators will find it difficult or impossible to view the headers for emails received using Facebook: at present there seems to be no method to view headers.

Experienced investigators will also be disappointed, though perhaps not surprised, to find that Facebook do not include details of the sending computer in the headers of email sent using New Messages. This feature of traditional webmail systems such as Hotmail and Yahoo! Mail greatly simplifies email investigations; however it is understandable that Facebook would omit this feature given the current interest in online privacy.

Finally one key assumption which must now be reset is that an organization which blocks Facebook has removed the risk associated with Facebook messages. Despite blocking access to Facebook from their network or company-issued devices organizations will now find that staff are interacting with Facebook friends and engaging in group conversations via email using Facebook.com email addresses. The enhancements to Facebook’s email experience make it possible to engage far more fully via email and will increase the need to address Facebook content as evidence in litigation or disciplinary matters.

Next Up

Thankfully Facebook’s new system is not without benefits for e-discovery and digital investigations, therefore our next post in this series will highlight some of the positive points. Between now and then we would appreciate your thoughts on New Messages in the comment box below or via Twitter (@CernamOwen or @CernamKaren).

Facebook Messages Seminar

We know that many digital evidence and legal professionals have questions regarding New Messages and the use of Facebook content as evidence so on Tuesday June 21st we are holding a lunchtime seminar at NovaUCD to address exactly these issues. At this event we will discuss the key changes introduced by New Messages; what it looks like and how it works; the evidential challenges and opportunities; and finally the prospects for Facebook Messages in terms of widespread adoption.

For more information, check out our blog post about the seminar or register here.