As more organizations and their employees begin to use social media, and more types of social media develop, the time to act is now. As daunting as the task may seem today, it will only become increasingly difficult. Using their substantial knowledge about preserving electronic records as a base, organizations should be able to build a strategy for preserving social media, taking these 10 issues into consideration.
1. Organizations need to use social media.
From the point of view of records managers and the legal department, it would certainly be easier to simply ban social media like Twitter and Facebook. But ignoring the enthusiastic embrace of social media by millions of people is simply not a realistic approach, and marketing departments and salespeople will most certainly be clamoring in opposition of any such ban. One only needs to look at the failed efforts of dictatorial regimes to shut down social media activities in their own countries for proof of the inevitable failure of a ban.
Much like e-mail, social media is quickly becoming an essential aspect of communications and marketing within organizations. A 2010 Harvard Business Review report, “The New Conversation: Taking Social Media from Talk to Action,” reported 79% of 2,100 organizations surveyed were using or planning to use social media (58% were using it, and 21% were preparing to launch initiatives). And, according to a 2010 report by the University of Massachusetts, “The Fortune 500 and Social Media: A Longitudinal Study of Blogging, Twitter and Facebook Usage by America’s Largest Companies,” 60% of the Fortune 500 had a Twitter account with a Tweet in the 30 days previous to the survey; this is dramatically up from 35% in 2009. Fortunately, principles currently exist around how to manage social media, unlike the situation when e-mail use first began to explode.
2. Organizations need to preserve social media – and websites.
Organizations have a clear obligation to preserve and archive all social media. Federal Rules of Civil Procedure Rule 26 requires organizations to be able to produce all potentially responsive information for e-discovery purposes. According to the recently released Gartner report “Social Media Governance: An Ounce of Prevention,” by the end of 2013, half of all companies will have been asked to produce material from social media websites for e-discovery. According to the report, “… in e-discovery, there is no difference between social media and electronic or even paper artifacts. The phrase to remember is ‘if it exists, it is discoverable.’”
The leading think tank on electronic document retention, The Sedona Conference®, includes as the first principle in The Sedona Principles: Best Practices Recommendations and Principles for Addressing Electronic Document Production: Electronically stored information is potentially discoverable under Fed. R. Civ. P. 34 or its state equivalents. Organizations must properly preserve electronically stored information that can reasonably be anticipated to be relevant to litigation.
Organizations should treat social media as they would any other ESI and assume it is potentially discoverable. Under Rule 34 of the Federal Rules of Civil Procedure, litigants can request “any designated documents or electronically stored information – including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations – stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form …”
There are also regulatory requirements. Some regulatory authorities, including the United States’ Financial Industry Regulatory Authority, the Securities and Exchange Commission, and the Food and Drug Administration, require social media to be preserved. State and federal freedom of information laws may also require organizations to retain and produce social media postings, Tweets, and the like. All laws, regulations, and requirements should drive a social media archiving policy, and those policies should complement the organization’s existing records and information management protocols. Organizations should carefully consider the underlying business reasons; considering not only the reasons why they should preserve, but under what rationale there is not a need to preserve. If an organization decides not to preserve some or all of its social media, it needs to be able to point to the law or regulation that says there is no requirement to do so.
3. Social media files often involve more than posts.
Social media doesn’t exist in a vacuum. When posting on Facebook, an employee may link to a YouTube video. Or an organization’s website may hyperlink to a PDF of a white paper from another site. An archival solution has to include the original Facebook post or website record, but it also has to be able to follow and capture the YouTube link or third-party source’s white paper. An organization will need to be able to preserve embedded native files, whether those are PDF files, Word documents, Excel spreadsheets, or PowerPoint presentations. Otherwise, it’s akin to archiving e-mails without saving attachments.
4. Use APIs to capture, archive, and review data from the web.
Compared to preserving the Word files employees create and share, accurately preserving social media can be extremely complicated. It requires knowing how application programming interfaces (APIs) work. Simply stated, software programs communicate with each other through APIs. When archiving social media, consider whether the solution is actually pulling data from an API or simply taking a “screen shot” of what can be viewed in a browser. A screen shot won’t include metadata or other information that can’t be “seen,” but which may be critically important in a lawsuit or regulatory hearing. When it comes to archiving, some may think printing a file or saving to PDF using a browser’s print function will suffice. But it’s not possible to print a YouTube video or save it as a JPEG or PDF. And social media sites don’t display all of the content available in a single interface. Facebook, for example, uses an algorithm to display the content the application believes the user is most interested in.
Through Web 2.0 architecture, APIs can be accessed by outside applications. At this time, the most accurate way to preserve web data is to make use of APIs available from social media properties. Facebook, for example, has no reliable methodology for its displaying of data to individual users. The amount and types of data displayed varies greatly from session to session and from user to user. Mapping preservation applications to the Facebook API allows full access to the entire population of data for any targeted user’s Facebook profile.
5. Social media archiving solutions need to be customized.
While guidelines and suggestions exist around social media archiving, an organization can’t simply grab anthers social media archiving policy and duplicate it exactly. One size does not fit all. Facebook, Twitter, Flickr, and other types of social media have unique API structures. Archiving solutions should involve an open authorization (oAuth) approach, which provides an open standard for authorization that simplifies API. oAuth allows third-party site access to information stored with another service provider without sharing their access permissions or the full extent of their data, thus allowing organizations to preserve protected employee accounts.
Implementing a preservation strategy is not as easy as simply flipping a switch. An organization will need to make decisions about the social media data it wants to capture and preserve. It should consider an employee’s Facebook page when someone responds to a post on that page, does that response need to be included in the preservation? Or, if an organization Tweets about another organization’s business, does the organization being Tweeted about need to preserve that Tweet?