Although the training focuses on MySpace, Wagner says the lessons learned can easily translate to investigation of other sites. "Due to the fact that all social networking sites are based on the foundations of creating social networks, there must be some standard information fields that translate across the multiple specific sites," she explains.
Even when sites change their interfaces — the "look and feel" of the way users create and exchange information — generally this affects the users more than investigators. In other words, Wagner says "the same information just looks different."
Most of all, the course teaches investigators how to apply what they already know to the Internet. "No technology can make up for 'good old-fashioned police work,' " Wagner explains. "Investigators still need to use all the skills they use to find good evidence in the real world to find good evidence in the digital world. There is no silver bullet to do that for you. Sometimes the evidence is obvious and sometimes it's like finding a needle in a haystack, but that's where proper training comes in."
In general, the same rules of search and seizure apply to online evidence as to physical. W.R. McKenzie, a deputy district attorney in Stanislaus County (Calif.), says that information on social network sites is essentially in "plain view." "A page open to the public is not something the officer accesses without permission," he explains. Even when an officer must sign up to view profile information, as with Facebook — even if they were not previously a member — it still has no legal difference from any other signup.
However, private messages or off-site e-mails do require user permission or a court order. An officer cannot, for example, figure out a user's password in order to obtain evidence. Likewise, a warrant is necessary to get evidence directly from the site provider.
Sometimes information is not publicly available, as when users trade private messages, or only allow friends to see their profile pages. "[In that case] other methods, such as undercover work, may need to be employed," Wagner says. Legally this is slightly thornier. "In at least one state, a law enforcement officer cannot lie about his or her identity online," McKenzie says. Otherwise, officers can engage in public or private discussions without a court order because criminals give implicit permission to do so, taking the chance that the person they're talking to is not a law enforcement officer.
Evidence recovery itself can present a legal challenge. A number of tools exist to help investigators capture video, photos, and even screenshots of text. McKenzie compares them to cameras used to take pictures of crime scenes. "It could be a Nikon or a Canon," he says, "but as long as the officer can testify that what's in the picture is exactly the same as what he saw, that he knows how to use a computer and the software itself, it's defensible."
Finally, McKenzie says, officers and detectives can copy and save online evidence including conversations — but require search warrants to prove who put it on the Internet in the first place. This requires a court order. A search warrant to the social site can pinpoint the server, IP address, and other identifiers that can help police locate a suspect. Even then, police must prove a particular person inside a residence, for instance, was the one posting the messages.
All these issues are why the available tools require instruction on how to be used for evidentiary purposes, something SEARCH provides in its class. More information can be obtained at www.search.org/programs/hightech/courses/snsi.
Prevention: 'My #1 Friend is a Cop'
Reactive investigations are not the training's only focus. Although MySpace in February 2009 took the radical step of expelling 90,000 registered sex offenders from its membership rolls (following the 27,000 it banned in 2007), still more exist who haven't been caught. That's why SEARCH also emphasizes prevention through its "My #1 Friend is a Cop" program, which has police departments create their own MySpace profile pages. The idea is for young people to "friend" police, so that prospective predators — pedophiles, bullies, or other offenders — know the individual has a way to report suspicious behavior.