Where to begin?

This guide is a part of a series that details how to collect evidence related to the misuse of technology in domestic violence, sexual assault, and stalking cases. Before proceeding, we recommend that you read A Primer for Using the Legal Systems Toolkit: Understanding & Investigating Tech Misuse, Approaches to Evidence Collection: Survivor Considerations, and Approaches to Evidence Collection: Criminal vs. Civil Systems.

 Who should use this resource?

The series is part of a Legal Systems Toolkit that includes guides to assist prosecutors, law enforcement, and civil attorneys.

IMPORTANT TIP/NOTICE FOR ADVOCATES: If you are a non-attorney survivor advocate, we strongly recommend that you do NOT gather or store evidence for survivors. You can greatly assist survivors by giving the survivor the skills to gather the evidence themselves. Your participation in the process of gathering or storing evidence can lead to you being forced to testify in court, which can undermine confidentiality protections, and negatively impact both the survivor and the integrity of your program. If you have questions, please contact Safety Net.

 The Role of Civil Attorneys

While the criminal justice system has an important role in combating the misuse of technology, many survivors of domestic violence, sexual assault, and stalking will seek out protection and support through the civil justice system. Orders of protection, custody, divorces, child protection, and support cases are just some of the ways that civil attorneys help to support survivors of domestic violence, sexual assault, and stalking, including those who experience the misuse of technology.

One of the most important roles played by civil attorneys is helping to identify and collect evidence of misuse. While the evidence may ultimately be the same in both criminal and civil cases, the availability and process of seeking evidence may look different between the two systems. This resource will help to identify some factors that are especially important for civil attorneys who may lack some of the resources available in criminal investigations.

 Steps for Collecting Digital Evidence

Digital evidence can be the difference between winning and losing a case. Unfortunately, useful evidence can be accidentally deleted, not collected properly, or not even sought out in the first place. Below, we will describe how to collect and maintain the evidence to increase its usefulness in court.

 Step 1: Identify all technology regularly used

Devices and platforms all have different settings, which means that the information that is retained and time for which that information is stored can vary considerably. Security settings are also different across the board. Therefore, in order to identify where to start looking, and to protect the information if it does exist, it is a good idea to identify what technologies are regularly used by the client. This includes devices (e.g. iPhone, Android smartphone, tablet, computer, etc.), platforms (e.g. Snapchat, Facebook, etc.), and providers (e.g. Verizon, Sprint, etc.). Obtaining this information early will help you to prioritize and triage your evidence collection.

TIP FOR WORKING WITH SURVIVORS: Meeting with an attorney can be stressful, which can impact memory. Survivors may not know what information to share or may be concerned about sharing embarrassing information. Understanding common technologies may be helpful because survivors may need to be reminded. It is worth taking the time to clearly let survivors know about your confidentiality and privilege requirements and what you will do (and not do) [MOU1] with information that is embarrassing or that the survivor may fear will make them look bad.

Step 2: Protect the data

After technologies have been identified, it is important to help the survivor to protect the data, since you may not immediately know what to look for and what may be useful. Evidence can be destroyed accidentally or by the abusive party. Many survivors of violence have shared accounts, passwords, and devices with the abusive party which could be misused to modify or delete important information. Because accidents happen, plan early on with the survivor for how to backup evidence.

 We cannot list all of the possible misuses and steps to protect all technologies, but some common things to consider are:

  • Protect against automatic deletion. Many devices and accounts have limited space and automatically delete information in order to maintain space.

  • Disconnect shared accounts if safe to do so. Many survivors share phone plans and other accounts with the abusive party.

  • Check cloud-based accounts. The “cloud” is a regular feature on many devices which automatically sync information across several devices. This can be any easy way for another person to monitor and manipulate data. Help the survivor to identify what cloud-based accounts are linked to the device, and, if possible, which accounts the abusive person may have access to.

  • Consider the potential of spyware being misused and any impact on safety and documentation. To learn more, visit our resource on spyware.

  • Update accounts with strong, safe passwords that are not easily guessed.

For other tips about privacy and security, check out our Online Privacy & Safety Tips, 12 Tips on Cell Phone Safety & Privacy, and our guide to WiFi Network Security.

IMPORTANT: Be sure to help the survivor to make a safety plan, in case the abusive person’s behavior escalates in the course of the investigation. Refer victims to a local advocate who understands tech safety, or let them know about the resources in our Survivor Toolkit at TechSafety.org.

Step 3: Inform survivors about what information will help the case

As the investigator, you are not a part of conversations between parties, which limits your knowledge of what conversations are relevant. Survivors know their situation best, however due to a lack of familiarity with the justice system, they may be unaware of what is most important for court. It is important to clearly identify what you need them to look for, including what type of information will help and what type of information may harm their case.

 It’s also helpful to discuss the importance of not withholding information they may think is irrelevant, embarrassing, or potentially problematic for their case. Explain how something that initially looks bad for the survivor may not be a problem once the court understands the context. What can cause challenges, however, is if the other side gets to the information first and you cannot prepare.

 Step 4: Explain how to document the evidence

Evidence collection is not always done in the most effective manner. As an example, many survivors will bring a screenshot of a text message, but will not include date and time stamps or the entire conversation.

 Take the time to explain what you want the survivor to do when they find relevant evidence. Should they just keep it on the device? Should they take screenshots or screencast videos? Should they call their service provider? Clear instructions will help you and their case. For information for survivors about gathering evidence, we suggest giving clients our guide to documenting technology evidence, made in collaboration with the National Council for Juvenile and Family Court Judges.

 Step 5: Keep evidence, even if it could be detrimental

If a survivor comes to you for assistance, it is likely that litigation is currently pending or will soon be pending. While it is completely appropriate to apprise a client about taking down inappropriate or harmful online information, it is against ethical standards to advise a client to destroy evidence. It is important to advise clients about appropriate ways to maintain information relevant to litigation.

 Step 6: Identify the purpose of the evidence

Before sending subpoenas, discovery demands, and/or hiring a forensic expert, take time to consider how you would like to use a given piece of evidence. In some cases, you may have to utilize tools to discover evidence, but in others you may have a piece of evidence, but not in the format that you need to introduce it into court.

 In the latter situation, take the time to determine how the evidence will most likely impact a case. The purpose of a piece of evidence will determine the formality needed to present the evidence. For instance, if you want to use a piece of evidence to negotiate a settlement or a plea, the survivor’s screenshot may be sufficient. However, if you want to introduce the evidence into court, you may need to obtain a subpoena, a warrant, or a certified copy. Locating evidence can be time consuming and you only want to go after the evidence that you need.

Step 7: Do not become a witness

Survivors of domestic violence, sexual assault, and stalking may lack life stability or immediate emotional resources due to crisis or trauma. This could mean survivors may not always be helpful in investigating their cases. It may seem easier to collect evidence yourself, but that is a mistake.

Gathering evidence for the survivor may compromise your ethical duties. For example, collecting evidence may put you into a position where you are the only person who can testify about the collection process. Therefore, you would now be a witness to the case, resulting in your inability to represent the survivor. There are many other ethical limitations regarding evidence collection, therefore a better option is to walk survivors through the steps necessary to collect the evidence themselves. Additionally, there may be a third-party who could collect the evidence and testify in court-- just make sure that the third-party is not somebody in your office.

IMPORTANT NOTE ABOUT AGREEMENTS: Frequently, parties will consent to evidence being admitted into court. It can be useful to consider communicating with the other side (if possible) about whether an agreement can be reached regarding introducing evidence. It is far easier to introduce evidence by agreement than to seek out a legal process or fight about the issue in trial.

Step 8: Use evidence the survivor can access

While some evidence may not always be admissible, it will give a better understanding of the case and of what other evidence needs to be sought.

First, look at what evidence is available on the device itself. Then, look at web-based or cloud accounts. Determining what information is available in online accounts will help you protect that information and determine what additional steps need to be taken to ensure that the evidence will be admissible in court. Ask survivors if there are any individuals who may have access to the information that you are seeking.

Attorneys have a variety of options for seeking information, including subpoenas. However, court ordered subpoenas will need to be sent to all parties and could lead to inappropriate information being released to the abusive party. If the survivor has access to information –an example is through an online account—it is usually good to review that information first to determine relevance before seeking out other more formal mechanism to get information. It can save you time and protect your client.

 Step 9: Use all available tools

Unlike criminal cases in which the abusive person’s devices can be confiscated, it can be very difficult to access information from an abusive person’s devices and accounts in a civil case. It is necessary to be creative with the resources at your disposal. 

Consider serving discovery requests and preservation letters, if available. Many civil cases do not allow for formal discovery, but courts will allow requests in some circumstances and will generally require parties to share information they intend to present in court. Making a request for discovery and for information intended to be admitted can help limit information that comes into the court and will give advance notice about evidentiary discrepancies.

 Step 10: Consider court orders and subpoenas

Many companies with useful evidence are not required to respond to civil court orders or subpoenas. It can be useful to try to seek out that information. Some companies will respond, especially if the requested information is on behalf of the owner of the account (your client).

If you are requesting your client’s information, it may be more effective to have the client write a formal request for their records. Many companies will respond to these requests, even when they will ignore a court ordered civil subpoena. It is essential that requests clearly state that they are for a certified copy for introduction into court as a business record. Without certification, it may not be possible to use the records without the testimony of a company representative.

 Step 11: Leverage other systems

Civil investigations often do not have the same options as criminal investigations. Civil cases often lack a forensic investigator, the ability to access all devices, and expansive subpoenas and warrants. However, civil attorneys often have more time with the survivor and a deeper understanding of the survivor’s life.

While both systems have limitations, there is strength in leveraging all available options on behalf of survivors. While not available in all cases, it is worthwhile to explore ways that law enforcement may be willing to share information from common investigations. As an example, if photos of text messages were taken at the scene, it may be possible to access those through appropriate channels. Let law enforcement know how you can help them on behalf of your client and discuss how the two systems can support each other. This is particularly true in jurisdictions that have integrated domestic violence courts in which criminal and civil cases involving the same parties are heard by the same judge.

Next Steps in Your Investigation

It is possible to successfully prove tech abuse cases through effective investigation and creative advocacy. For more information, see the resources in our Collecting Evidence Series. If you have further questions about investigating tech abuse cases, please contact Safety Net, and visit TechSafety.org for more information. 

© 2018 National Network to End Domestic Violence, Safety Net Project. Supported by US DOJ-OVW Grant No. 2016-TA-AX-K069. Opinions, findings, and conclusions or recommendations expressed are the authors and do not necessarily represent the views of DOJ. We update our materials frequently. Please visit TechSafety.org for the latest version of this and other materials.