GuardTime & Cernam: Partnering for Verifiable Evidence Integrity

One of the greatest challenges in forensically handling online evidence is the unique fragility of the medium, based on the ability for a third-party to independently and remotely alter original evidence, for example where an employee is confronted with evidence in a corporate investigation. While developing the first purpose-built digital evidence system for collecting and preserving online content, Cernam saw the need for a proven third-party technology solution designed to provide secure digital timestamps and signatures.

Partnering with Guardtime means that Cernam’s Capture & Preserve system can provide independently-verifiable proof of integrity for this uniquely fragile form of evidence. Cernam C&P enables clients to collect online content in a forensically-sound manner, allowing online evidence to be relied upon in a variety of high-risk contexts such as litigation, employment disputes, corporate investigations and criminal cases.
For details on our integration of GuardTime Keyless Signatures and the benefits this offers for preserving online evidence please see the case study “Preserving Online Content as Evidence“.

Beta Testing Cernam Capture & Preserve

Cernam Capture & Preserve is a unique purpose-built solution for handling online content in a forensically-sound manner. Using Cernam C&P investigators, legal professionals and security personnel can obtain and store the entire content of a complex web page, a social networking profile, blog or message board post, or even data within a complex web application.

Our Capture & Preserve system is now entering beta testing, if you would like to participate in this beta please email info@cernam.com, call Owen O’Connor on +353 1 716 3793 or get in touch via Twitter: @CernamOE. Further details on our unique approach to online evidence will be posted on this blog over the coming weeks.

E-Discovery Ireland 2011 will be Ireland’s first e-discovery and digital evidence conference and is being held on October 6th and 7th at the Royal Marine Hotel in Dun Laoghaire.

We are currently seeking speakers and sponsors for the conference, as well as putting together a group of local practitioners to assist with the content of the conference. If you would like to submit a speaking proposal or talk to us about sponsorship options please get in touch via events@cernam.com or on the conference Twitter account @ediscovery_ie.

For initial information on the conference or to to watch for updates on speakers, registration, etc take a look at www.ediscovery.ie.

In this podcast one of our summer interns at Cernam, Kevin McGlone of Waterford Institute of Technology, discusses a recent project to spec and build a set of custom systems for bulk forensic processing.

Anyone interested in building a similar system might find the following component list useful:

• 1 * Shuttle XPC SX58H7 Pro
• 1 * Intel Core i7 970 / 3.2 GHz processor
• 4 * Kingston HyperX blu memory
• 1 * eVGA GeForce 210
• 3 * WD VelociRaptor WD4500HLHX

Building a Portable Workstation for Digital Forensics

Building a Portable Workstation for Digital Forensics by Cernam Online Evidence

Since this is our first technology-heavy podcast we would appreciate any feedback, either in the comments or via Twitter (@CernamOwen or @CernamKaren).

This 30 minute podcast was recorded on July 8th and features three of our team - Owen O’Connor, Karen Reilly and Lee Kelly - discussing Google+ as a source of digital evidence. Topics we cover include how to sign up for Google+, how “friending” works, privacy settings, the Hangout feature, mobile features, integration with other Google services, and several other subjects. You can download the podcast via Soundcloud or listen online through the player below:

Introduction to Google+ as a source of online evidence by Cernam Online Evidence

Since this is our first try at producing a podcast we would appreciate any feedback, either in the comments, via Twitter (@CernamOwen or @CernamKaren), or on Google+ if you can find us there!

Apple’s iCloud announcement came in the same week as a Forrester research report looking at the market for personal cloud services. Forrester’s research focussed on the type of service which we have referred to as online productivity services: tools for creating and sharing documents; data backup services; task and project management tools etc. Forrester estimate that the worldwide personal cloud market will be worth $12 billion by 2016, while in a blog post they go on to say:

The personal computing experience has become a major pain in the neck, as people add smartphones and tablets to the growing number of PCs they use at work and at home – more than half the US online population, about 135 million people, have the challenge of managing their content across multiple PCs and smartphones.

Forrester believes that a new computing experience is emerging, based on the personal cloud concept, that will redefine the computing experience around a user’s personal and work information, so that it’s seamlessly accessible across all of an individual’s devices.

Although Apple were arguably falling behind Google and even Microsoft due to their lack of cloud services the introduction of iCloud has immediately changed the market. Frank Gillett of Forrester even suggests that Apple now lead Google on personal cloud services (prior to a single customer going live on iCloud!) and estimates that Apple’s innovation around cloud services is “on par with the most notable startups in the personal cloud space, such as Dropbox, Box.net, and Evernote”.

What is iCloud?

Apple have sold more than 200 million “iDevices” (iPhones and iPads) around the world, with many customers owning multiple devices. Indeed, arguably Apple’s greatest success is selling essentially the same product to the same customers and scheduling upgrades so that customers buy a new smartphone or tablet every few months. In this context a major point of frustration for Apple customers has been the difficulty of synchronizing data across multiple devices, for example to avoid having music stored on one device, photographs on another and documents randomly stored on multiple devices.

Up to now Apple’s only response to this problem was “MobileMe”, a rather lacklustre service which allowed users to sync contacts, calendars and email across Apple devices. MobileMe was clearly a second-class citizen when compared to, say, iTunes and was even described by Steve Jobs as “not our finest hour”. iCloud now replaces MobileMe and fulfils the original vision, forming the centre of a users digital life and automatically syncing data across iPhones, iPads, Apple PC’s and even Windows PC’s.

iCloud: the basics

The three main features of iCloud are Documents, Photo Stream and iTunes in the cloud.

The Photo Stream feature aims to ensure a users photographs are stored on each of their Apple devices. It will do this by syncing their 1,000 most recent photos from all devices to iCloud. Photographs will then be stored on Apple’s servers for 30 days or until the user has transferred them to all of their devices. After 30 days photographs will be removed from Photo Stream, however it seems likely that users will be able to opt for ongoing storage outside of Photo Stream.

iTunes will be altered as part of iCloud so that music is synced across multiple devices. Music will be stored within iCloud and pushed to each of a users devices automatically, so for example if a user downloads a song using their iPad that song will be wirelessly synced to their iPhone as well as delivered to any Apple or Windows PC’s which are using iCloud.

iCloud data sync & backup

The third main feature of iCloud is the most important in terms of digital evidence: iCloud Documents. This feature will automatically sync documents between devices and to the iCloud file store, so for example if a document is created on an iPad it will be synced to the users iPhone and PC. Apple will provide an interface to access iCloud files when on a PC without iCloud and third-party applications will also be permitted to store documents to iCloud. Based on information to date it appears these features will be enabled by default, without the user opting in explicitly. For example Apple have said that when the user creates a document using iWorks or a similar application, the document will be automatically synced to iCloud and will then be pushed out to all the other devices associated with that Apple account.

In addition to syncing documents iCloud will include a data backup feature similar to CrashPlan or Mozy which will back up the contents of each “iDevice” to iCloud once per day. If the user later switches to an equivalent iDevice their content will be automatically downloaded. iCloud also retains the basic functionality of MobileMe, meaning email, contacts and calendar entries will be synced between devices and stored within iCloud.

iCloud: cloud computing for your grandparents

In Apple’s promotional material for iCloud two words are repeated constantly: automatic and free. Apple is positioning iCloud as an integrated suite of services whose users will not need to configure individual elements or select files to sync or ignore. Instead Apple will automatically sync their data, back it up and provide access online. Apple’s second differentiator is cost: unlike competing services, or their own MobileMe offering, iCloud will be free. Users can optionally upgrade their account to provide greater storage, beyond the 5GB provided for free, and Apple may offer additional premium features over time but the core service will be provided at no cost to all iDevice users, beginning this autumn.

Like the iPod and iPhone there is little in iCloud which is revolutionary, indeed a savvy Apple user could already gain all of the benefits today by signing up for multiple third-party services, for example CrashPlan, Box.net and Google Docs. However, just as the iPod and iPhone brought MP3 players and smartphones into the average home, iCloud will introduce personal cloud services to users who have never considered personal cloud or online productivity services.

While introducing iCloud this week Apple also announced that over 200 million iOS devices have been sold worldwide. With an enormous user base like this, which includes many millions of business users and corporate devices, the rollout of an automatic new feature such as iCloud is bound to be disruptive. Industry analyst Giles Cottle of Informa summarised the potential:

It was always going to take someone like Apple to really educate mass market consumers about the value of cloud-based services … iCloud’s integration with those 200 million devices virtually assures the success of the service; it would have to be a turkey of Ping-sized proportions to fail.

iCloud and digital evidence

Although iCloud is being positioned as a consumer service it will be provided to all users of iPhones or iPads, including company-issued devices and personally-owned devices used for business. It is likely in fact that the users who most feel the pain of data sync issues are those using multiple devices for business: e.g., a personal iPhone, personal iPad and company-issued laptop. All of these devices can now be synced to iCloud and in fact will automatically sync once the user has signed into their Apple account. Business related documents will be found on all of these devices and it is going to be very difficult for organisations to control use of iCloud.

As an indicator of the number of iPad users who store business documents on their device, consider the number of articles on the web with titles like “the top 10 iPad apps for lawyers”, “the 5 iPad apps every attorney needs” or “the best iPad apps for legal professionals”. Looking back at the launch of the original iPad one of the most frequently asked questions online was “how do I get my business docs onto my iPad” and a look around any commercial flight will make it clear how many business travellers now rely on iPads for business. In the very near future iCloud will contain the data created or transferred using these applications, meaning for example that a business document transferred to a company-owned device will potentially be synced to personal devices if the same Apple account is used.

At Cernam we have discussed numerous times the problems emerging in e-discovery due to user-led adoption of services such as Dropbox, Box.net, Google Docs, Huddle, etc. Apple’s “one cloud to rule them all” makes the risks around these services pale in comparison. iCloud will incorporate the features of those services – and more – into one product that “all just works” and, more worryingly, iCloud will apparently be turned on by default! As Steve Jobs noted in his WWDC keynote speech:

Today it is a real hassle and very frustrating to keep all your information and content up-to-date across all your devices… iCloud keeps your important information and content up to date across all your devices. All of this happens automatically and wirelessly, and because it’s integrated into our apps you don’t even need to think about it -- it all just works.

One new concern which arises with iCloud is the dependence on the Apple ID system, the single account which will now be used for access to iCloud and other Apple services. In the past some users may have casually shared their Apple ID password, for example to allow a family member access their music, with little concern for security since the password did not unlock sensitive information. With iCloud the sensitivity of these Apple credentials increases enormously and will become one of the most sensitive credentials for a typical user, perhaps alongside their Google account. Organizations will need to consider their policies on the use of personal Apple accounts on official devices or for business purposes and may need to educate staff on the importance of keeping Apple accounts secure.

The beginning of the end for the desktop computer

The long-term impact of iCloud may not be increased cloud adoption, a better user experience or increased sales of Apple products. It may be a change in mindset for Apple users who will no longer see iPhones and iPads as secondary devices, containing a subset of their data and being useful only for certain tasks. iCloud may allow users to fully rely on their model devices as a first-class device rather than as something to be used only when away from a PC.

For those of us concerned with digital evidence this may have positive and negative repercussions. On the positive side it may now be sufficient to examine a single device with iCloud enabled, or at least to de-duplicate far more aggressively across multiple synchronized devices. On the other hand we can expect wildfire adoption of iCloud within companies and even government agencies which will introduce new issues around problem leavers, theft of data and business records on personal devices.

Fundamentally iCloud will also mean that personal online data stores must be brought into scope when dealing with e-discovery and other data-intensive investigations, since business records will inevitably migrate to iCloud and over time the contents of devices may become less significant. We look forward to the challenge!

If you enjoyed this post, you might also be interested in our ongoing series on the evidential implications of Facebook’s new messaging system.

1. Facebook is now a webmail system

Our first key point regarding “New Messages” is that messages are no longer restricted to Facebook users and in fact the new features effectively make Facebook a webmail system.

As we noted yesterday the 3 largest webmail providers (Gmail, Yahoo and Hotmail) have around 800 million users - that’s 800 million combined, with the largest being Hotmail at around 360 million users. Comparing this to Facebook’s almost 700 million users makes it easy to see the potential impact of Facebook Messages which is already being actively used by 350 million users. If a majority of the existing Messages users adopt the Facebook.com email addresses provided by the new system, Facebook will become one of the world’s largest webmail providers. For this reason New Messages has been called “the Gmail killer”, however Facebook position the product as “next generation messaging” rather than directly competing with Gmail, Hotmail etc.

Within New Messages users will see all of their online interactions with friends integrated in a single mailbox, complete with a history of past interactions. By combining chat, email and SMS text messages Facebook could become the hub of online communication, particularly for those who already use Facebook throughout their day and from multiple devices. Facebook’s strategy in this regard is clear: extra features result in extra minutes per day of Facebook activity and therefore additional advertising revenue.

If New Messages proves popular it could lead certain users to gradually shift their traditional email interactions away from their current email system. More importantly, if Facebook proceed with their plans to introduce IMAP access it would be possible to access Facebook from mobile devices, from other webmail accounts or from email clients such as Outlook and Apple Mail. In this scenario it is very likely that usage of Facebook email would overtake that of legacy email accounts and eventually lead to some users retiring their Gmail or Hotmail accounts.

The implications of widespread Facebook email use would mirror the issues seen with personal web-based email accounts: employees forwarding business records to their personal address; interactions with colleagues shifting away from corporate systems; and eventually business correspondence being sent via personal accounts. In essence corporate email systems are already in competition with services such as Gmail or Hotmail and for many users the simplified minimal nature of Messages may be compelling, particularly given the strong support for mobile devices. As well as business records we can also be confident that government records and correspondence will be found within Facebook messages, as has been seen with personal webmail accounts in high-profile cases such as that of Senator John Ensign and locally here in Ireland where a government minister conducted government business via personal email.

2. Facebook now supports attachments

Up to now Facebook has not provided a way to exchange attachments, either through Facebook Messages or Chat. A user could point to documents hosted elsewhere via links but it was not possible to upload a document and transfer or view it via Facebook. With this upgrade Facebook users can now send attachments via New Messages, both internally within Facebook and externally via Facebook.com email.

Office documents such as Word, Excel and Powerpoint can be downloaded for editing or viewed directly through Office.com without the need for Office software. The use of Office.com is notable as Facebook had previously partnered with Microsoft on an equivalent but separate system, “Docs for Facebook”, which allowed users to create and share documents. The two systems are entirely separate, meaning Docs.com users will not automatically have their files transferred to Office.com.

The ability to exchange attachments greatly increases the risk that business documents will be stored within Facebook accounts, particularly with the strong features around Office documents which may lead employees to upload or email files in order to view them on a mobile device or a system without Office.

3. Facebook conversations are now logged by default

Prior to New Messages Facebook chat messages were not logged, unlike other instant messaging systems where logging can be turned on or off at the users discretion. The new Messages system integrates email, Facebook messages, Facebook chat and cellphone text messages into one social inbox with a complete record of all interactions with each contact. As a consequence Facebook is now logging chat contents by default so that they can be stored and displayed alongside messages, emails and other interactions. This greatly expands the universe of information available as evidence and brings in a far more informal communication channel which could prove valuable in litigation.

Another interesting aspect of the chat logging is the ability to add new people to an existing conversation, even if that conversation had been started by another person. After adding a new participant that person can view all of the previous messages in the conversation. This feature could be a straightforward way to provide attorneys or investigators with access to past content. In recent months we have seen several social media cases where judges or counsel have asked  parties to “friend” them on Facebook so that they can review relevant information. With New Messages this may no longer be necessary since there is no need to friend the target to view all of the previous interactions.

Finally on this issue, we have seen instances of Facebook chat conversations appearing in the New Messages system where the chat conversation occurred many months ago, prior to the introduction of New Messages. This suggests that although Facebook did not expose chat logs at that time, chat logs were being created and are now being exposed via the new interface.

4. Facebook’s “Data Download” tool is dangerously incomplete

Back in October 2010 Facebook began rolling out a new feature which allowed users to download their Facebook information. This data download tool is advertised as providing an export of all information shared via Facebook, with the data being downloaded in the form of a zip file. The download includes photo albums, events, friends, wall content, profile information and messages. Several commentators have suggested the use of this data download tool for e-discovery purposes and have suggested that this is one of the intended purposes of the tool.

Based on previous analysis we have significant concerns as to the use of this tool for e-discovery or other evidential purposes and we hope to publish details of this analysis later this month. For now however we will look briefly at the interaction of New Messages and the data download tool: in essence the news is not good, it appears that Facebook have not updated the download to work alongside the new messaging system.

With the messaging system now integrating 4 types of communication in one place you might expect that all of those communications would appear in the download. However, in our testing we have seen only one of these categories of data in the zip file: the traditional old-style Facebook Messages. Facebook emails, text messages and logged chat conversations are ignored and are not present in the download.

The image above is the profile view of a conversation between two Facebook friends. It is a mixture of Facebook Messages and Facebook Chat.	You will notice that normal Facebook Messages appear in the Data Download view on the right – the Chat Messages are completely ignored. The two views are completely different.

Based on this major omission the data download tool is now dangerously incomplete and should not be considered for e-discovery or other evidential purposes. It appears Facebook may have abandoned the development of data download since there are now several major Facebook features which are completely unsupported: New Messages, the new groups system, applications, and others.

5. That “Delete” button may not do what you expect

Our final key point relates to an issue which we have not yet been able to reproduce but which is widely reported by users of New Messages: the resurrection of previously-deleted messages. Certain users who have been switched to New Messages are re-discovering messages which they had previously deleted. These messages were previously not visible in their Facebook inbox and appeared to have been entirely deleted, however the switch to New Messages has “undeleted” them and they have now re-appeared in the new inbox. The implication of this is that Facebook had implemented a “hide” feature rather than a true delete function but again this is not something we have been able to reproduce directly in our testing.

For digital evidence professionals, attorneys or others with an interest in Facebook content as evidence, this deletion issue represent a significant opportunity. It may be possible for example to prove that a user deleted certain messages, potentially destroying evidence or selectively pruning their inbox to support a particular position. For example, in the context of an on-going lawsuit it might be possible to compare current inbox contents against a listing of the same inbox prior to the switch to New Messages, identifying messages which had been deleted previously but have now re-appeared.

Next Up

The changes to Facebook Messages are so significant and have such a potential impact on digital evidence that we have much more to write about. Further posts in this series will deal with specific challenges and advantages when dealing with Facebook.com emails as evidence and will also cover other problems caused by New Messages. We would welcome comments or questions about this material via Twitter (@CernamKaren or @CernamOwen) or in the comments section below.

Facebook Messages Seminar

We know that many digital evidence and legal professionals have questions regarding New Messages and the use of Facebook content as evidence so on Tuesday June 21st we are holding a lunchtime seminar at NovaUCD to address exactly these issues. At this event we will discuss the key changes introduced by New Messages; what it looks like and how it works; the evidential challenges and opportunities; and finally the prospects for Facebook Messages in terms of widespread adoption.

For more information, check out our blog post about the seminar or register here.

Internally, new Facebook Messages was known as Project Titan but it has also been unofficially titled “the Gmail killer”. Commenting on the new system Mark Zuckerberg has said “This is not an email killer. This is a messaging experience that includes email as one part of it”. However, he has also said that “Facebook’s system fundamentally alters the way people communicate” and in this he is correct. Email is becoming more about identity and for a lot of people, their Facebook network defines their online identity. Back in November, Facebook released some shocking statistics on the use of their previous messaging system, specifically that 350 million Facebook users were using the system and were generating a total of 4 billion messages (including Facebook chat messages) each day. To put this level of adoption and usage into perspective, the three main webmail providers (Gmail, Yahoo and Hotmail) have around 800 million users between them. Facebook’s new system therefore changes the way that 350 million people communicate in both their personal and professional lives.

In the initial release last November relatively few users received the new messaging system, however this recent expansion appears to bring in many more users and may signal a more aggressive deployment. It also represents our first chance at Cernam to try the new messaging system, which we have been tracking closely since the initial rumors and announcements. The functionality being added by Facebook will have a significant impact on digital investigations and e-discovery, beginning with the introduction of Facebook.com email addresses and also including the added support for attachments, the ability to communicate with people who non-Facebook users and the integration of email, SMS text messages and Facebook chat in one system.

Over the next few days we will post several articles to guide you through the new Messages system: what it looks like and how it works; the evidential issues and opportunities; and the prospects for Facebook Messages in terms of widespread adoption. To begin we should explain how the New Messages differs from Facebook’s previous system and look at the core features.

What is it? “Next Generation Messaging”

Facebook describe New Messages as: “Seamless, Informal, Immediate, Personal, Simple, Minimal and Short”. The new system incorporates SMS messages, email and chat to interweave all communication across all of a user’s devices. Messages is a central place where users can control all of their private communication both within and outside of Facebook. Communications are stored as conversations or threads, similar to Gmail, and a complete history of all communication a user has shared with a friend is stored on Facebook. A single thread is created for each Facebook contact, meaning threads are not based on a time period or a particular topic.

Complete conversations or individual messages can be forwarded to another user and new users can be added to a conversation so that they will receive additional messages in the conversation as well as the contents of previous messages. Complete conversations can also be deleted or archived. Facebook have modelled New Messages to appear and function more like chat than email, to the extent that some users have labelled the system “Chatmail”. There is no subject line and no options for familiar email options such as “cc” or “bcc”. Instead users can send messages simply by hitting the enter key with no further decisions required, a simplification which Facebook is highlighting as a key benefit since it reduces the number of tasks required to send a message.

One major advance brought by New Messages is that users can now send attachments through Facebook, a feature which was previously unavailable and which now allows files to be exchanged within Facebook or externally using a Facebook.com email address. Unlike other webmail providers Facebook has not detailed their mailbox or attachment size limits, instead pointing to a comment from Mark Zuckerberg who said “if you are a good user and don’t try to test the limits, you should be fine”. Facebook have also stated that they will introduce IMAP support in future which will allow access to the Facebook inbox from mobile devices as well as email clients such as Outlook, Apple Mail and Thunderbird.

See the Messages that matter - The Social Inbox

Not unlike Gmail’s “Priority Inbox”, Facebook’s New Messages ranks the importance of a piece of communication. Messages from direct friends and friends of friends will appear in your main inbox folder while messages from others will be diverted to a separate “Other” folder. Similarly the default message view highlights messages from friends so that these will always appear first in your inbox.

The first time a user receives email from a non-Facebook user the email message will appear in the “Other” folder. If a conversation is moved from the “Other” folder to the Inbox, all future conversations with that friend will appear in the inbox. Facebook users can also opt to block messages from non-friends so that these will not appear in either their inbox or “Other” folder. Finally messages can be archived which hides them from the main messages view, similar to the LinkedIn messaging system. If a new message is received in an archived conversation the entire conversation will be moved back to the active inbox.

Facebook Email

Perhaps the largest and most obvious change in the rollout of New Messages is the introduction of Facebook.com email addresses for users of the new system. Users do not need to have a Facebook email address to use Messages but must create one in order to receive messages from non Facebook users. The new email address is based on the Facebook username, e.g., username “johndoe123” would produce an email address of “mynewfbemail@facebook.com”. If a user has not yet selected a username they will be required to do so when switching to New Messages.

Facebook users and non-users alike can use a Facebook.com email address to send messages via their normal email system, for example from a corporate mail system or a webmail provider such as Gmail or Hotmail. When a Facebook user sends an email from Facebook Messages to an external email address the email is formatted as a Facebook message and includes a profile picture and a link to the relevant Facebook profile.

Send and receive Messages from your phone

If a user chooses to incorporate text messaging into their Facebook Messages the text messages they share with friends will be integrated into the Facebook conversation along with Facebook messages, Facebook chat conversations and emails. This also means that a user who is offline can send a message to a Facebook friend by texting the short code “32665”. For example, texting “msg John Doe Hello” will send the message “Hello” to a Facebook friend named John Doe. The text message will subsequently appear in the Messages conversation between the two users and if John Doe is not logged on to Facebook at the time the message may be delivered as a text message or email.

Unified Messaging – how does it actually work?

Facebook designed the new Messages system so that there is a sense of continuous conversation. The user can choose which services they want to avail of: chat, email, SMS. If the user is online, they will receive messages in real time through Facebook chat whether the sender had communicated via email, chat or SMS. If the user is not online, Facebook will choose the most appropriate option for sending the message to the user. If a user goes offline mid-conversation, the other user can continue writing their message and it will be sent as a text or email.

Next up

Over the next few days we will have further posts setting out our thoughts on Facebook’s New Messages system and some of the interesting features we have noticed. Based on what we have seen there is both good and bad news in terms of digital evidence so watch this space!

Facebook Messages Seminar

We know that many digital evidence and legal professionals have questions regarding New Messages and the use of Facebook content as evidence so on Tuesday June 21st we are holding a lunchtime seminar at NovaUCD to address exactly these issues. At this event we will discuss the key changes introduced by New Messages; what it looks like and how it works; the evidential challenges and opportunities; and finally the prospects for Facebook Messages in terms of widespread adoption.

For more information, check out our blog post about the seminar or register here.

“The use of social media such as Facebook and Twitter by employees continues to create headaches for businesses. The line between work and play is becoming increasingly blurred and leaves businesses uncertain as to how much control they can have over employee use of such media. Employment lawyers and businesses alike have been keen for some guidance from the courts as to when intervention is acceptable and the case of JD Wetherspoons PLC v Miss K C Preece does just that…” (from the Wedlake Bell website)

From our perspective this case is interesting in highlighting the benefits of clear social media policies in the workplace, as well as establishing that problem online activity occurred while the employee was working.

For anyone unfamiliar with Storify, it is a service for curating online content around specific themes or topics. We are using Storify to highlight the best references and analysis for interesting cases involving online evidence.

As a final note before you look at the Storify item, we should note that the correct caption for this case appears to be “Preece v JD Wetherspoons plc” and not “Wetherspoons PLC v Miss K C Preece” as quoted in several of the articles we reference.

To track further Storify items from Cernam you might be interested in following us at Storify or via Twitter.

Although our work spans every type of online evidence, from simple websites to complex web applications and social networking sites, we have recently worked on several interesting projects relating to online collaboration services, specifically the issues caused when end-users adopt online services for business use. To expand on our earlier blog posts around this subject and look more closely at the services being used we have prepared a brief report: “Business Records Online: Facing the Reality of End-User Adoption” (PDF).

For anyone working with digital evidence - whether in litigation, HR, corporate security or other contexts - we believe personal online repositories will be one of the key issues in 2011 and we hope our report will help you to respond. We would love to hear your comments and feedback on this report so feel free to comment below or on Twitter (@CernamOE).

Update: For those who prefer online reading over PDF files the report is now available on Scribd and embedded below.
Business Records Online - Facing the Reality of End-User Adoption

Secondly, 4 employees using one Yahoo account with the same password is not appropriate conduct in a workplace environment or elsewhere. Did one or all of these employees also use the Yahoo email account associated with the calendar?

Thirdly, the preservation of this data was handled by printing out a copy of each record - who knows whether these printouts contained all of the records or whether the database could be reconstituted from these printouts.

Also, the VA blocked the employees access to the accounts and then deleted the accounts so the actual evidence of the privacy breach is now unavailable. As with the Google Street View privacy issue, deleting the data to put an end to the privacy exposure also means the information is unavailable for other purposes.

Overall the VA has provided a tremendous example of the issues with business records stored online, in uncontrolled personal repositories, without organizational control. Unfortunately VA is far from alone in experiencing these issues, as we see in our work with clients who have similar “end-user adoption” issues.

For more information see Bob Brewin’s post VA employees tap cloud apps on their own, posing security risk on http://www.nextgov.com.