ITS 833 – INFORMATION GOVERNANCE
Chapter 13 Information Governance for Social Media
Dr. Sandra J. Reeves
Copyright@Sandra J. Reeves 2018
1
This chapter deals with Information Governance for Social Media. You see in the lower left corner the logo for the website where I acquired the theme for the Power Point slide. I chose to use more of a “cartoon” view with the two people in the lower right corner getting acquainted for two reasons. First, it is almost comedic the kinds of ridiculous things that people will post on social media sites, and second the cartoon depicts two people “getting acquainted”, which is also what happens often on social media. Going back to the first comment, not only will people make complete and utter fools of themselves on social media, they demonstrate their lack of common sense and reasoning. In addition, some people commit criminal acts and then boast about it on social media. Social media is used frequently in child custody cases to demonstrate when a parent has used such poor judgment that it does not serve in the best interest of their children for them to have custody and control over those children. Having said that, there are appropriate and positive uses for social media.
1
CHAPTER GOALS AND OBJECTIVES
Be able to discuss uses of social medial for business and government
What is Web 2.0? How is it different?
What are some categories of social media platforms? Examples of each
Give examples of tools used to archive social media
What is the difference between static and dynamic social media content
Legally what is required with regard to the capture, storage and archival of social medial content by an organization?
What are the rules for record retention of social media records?
What are the record retention guidelines for social media records?
What is enterprise social media?
What is the difference between an inward vs. outward facing social media site?
What are the ways in which social media is the same and is different from things like e-mail and IM?
What are the advantages and risks of social media in the organization?
List key social medial guidelines that all organizations should follow regardless of industry
What is meant by spoliation of evidence?
Give an overview of the best practices that are evolving for social media records
Copyright@Sandra J. Reeves 2018
2
Look at the slide above. These are the highlights from Chapter 14 that I want you to take away from the chapter.
2
Uses for Social Media in the Public and Private Sector
Corporate Use:
Create visible branding
Strengthen relations with customers
Attract new customers
Highlight and advertise their products and services
Collect information used in decision making
Copyright@Sandra J. Reeves 2018
3
Government Use:
Consult with and engage citizens
Provide services
Keep pace with fast moving events
Facilitate communication and collaboration
Improve Employee Engagement
Boost productivity and Efficiency
Internal Social Media:
Helps employees collaborate and communicate more effectively and efficiently
ALTERNATIVES FOR BUSINESS AND GOVERNMENT
In addition to private parties and individuals using social media…for good and for bad… corporations and governmental entities also use social media. Corporations use social medial in branding or in making their products and brands more visible, they use it to strengthen relationships with their customers and to attract new customers, they use it to highlight and advertise their goods and services, and to collect information.
The government also uses social media. They use it to consult with or to engage private citizens. They provide serves like online forms to the public through social media. They are better able to keep pace with fast moving or changing events often associated with natural disasters. They also use social medial to boot their productivity and efficiency.
So…there are legitimate uses of social media, although it is more abused that used properly.
But there is also an additional option for business and the governmental sector to use, other than public forms of social media. We don’t hear about this as much since it is for use inside the corporation or inside the government, but they also use a for of social media that is available only to the particular corporation or governmental unit. It is referred to as “internal” social media, and is used to assist employees to communicate and collaborate.
3
Copyright@Sandra J. Reeves 2018
4
WEB 2.0 What is it?
2nd Generation WWW. Uses new technology to allow consumers to participate, collaborate and share information online
Characterizes the change from passive web sites to interactive web sites.
Wikis
Blogs
Podcasts
Outward facing public Web vs. Inward facing Web
These changes in the use of proprietary social medial was brought about in part by the Web 2.0. Web 2.0 was coined to characterize the change from what some call “Static” web pages, which are those that aren’t interactive but which provide information to web sites that are interactive and where the user or reader participates. Think about things like Wikis or blogs that let you change the quality of the Web page through your contribution.
When Web 2.0 first came into existence it was “outward facing”, meaning that public Web services could link people around the world. But it didn’t take businesses long to figure out that they could used this same media for internal use in their organization. Businesses began to creating internally directories and networks where they deposited information on experts that was of interest or necessary for the business’s own employees. They also began to allow access to external stakeholders to use as well. Businesses hosted internal blogs or miniblogs so their own workers could share information on a topic and keep each other informed.
4
SOCIAL MEDIA PLATFORMS
Web Publishing-Platforms for creating, publishing and reuse content
Microblogs
Blogs
Wikis
Mashups
Social Networking – Platforms for interactions and collaboration between users
Tools (Face book Linked-in)
Social Bookmarks
Virtual World
Crowdsourcing
File Sharing/Storage – Platform for file sharing and host content storage
Photo Library
Storage
Content management
5
Social medial platforms can be categorized or grouped separately depending on their characteristics or nature. On the screen you see the most common categories and some example of each category. This isn’t a complete list but gives you and idea of the influence and strength of Web 2.0 If you look on page 255 at Table 13.-1 they give a more compete list of social media categories broken down by “type”. I am not so sure this is different from breaking them down by category.
One thing you can be certain of and that is that these categories will continue to grow.
Further not all social media companies will neatly fall into one specific category or another.
5
SOCIAL MEDIA IN ENTERPRISE
Outward Facing, consumer based social media is still the most popular used in enterprises today
Business is “torn” or in a quandary as to how to use it to its fullest while focusing on security
Enterprise Social Networking
Options are becoming available that includes social-media like software for the private network
Need to develop metrics
Copyright@Sandra J. Reeves 2018
6
Things like Face Book and Twitter, and LinkedIn are still the most popular consumer based technologies used today. But you have to keep in mind that these technologies were not intended with businesses in mind. The dilemma today is that businesses want to take advantage of these consumer marketed web sites but security is also an issue. What they are beginning to do is implement solutions in their organization for their inward facing sites that have similar features as the software found on the outward facing programs. This idea is often referred to as “Enterprise Social Networking”
When spending network resources, time and money it is necessary to establish social medial business objectives. For example it is counter productive to do this if it take up too much time, manpower and money. You need to establish a set of matrix that will help you determine if this is cost effective or useful.
6
Advantages of Enterprise Social Media
Being able to store large document in cloud saves assets
Better customer relations and customer service
Better able to recruit and retain high quality employees
Copyright@Sandra J. Reeves 2018
7
The advantages and the costs of this new inward facing social media still have not been explored to the fullest because the concept is so new. However we do know some of the benefits including things like asset savings. You store larger documents in the cloud rather than taking up a lot of bandwidth by sending them to all of your employees, who then save duplicate versions on their workstations. Also is the competitive advantage of being able to engage in online conversations with customers. Also, by being able to refine your operations and improve customer services makes life easier for your employees. All these things together will assist you in recruiting and retaining a better qualified, high achieving work force.
7
Social Media V. E-Mail and IM
Similar - All share the same function – shared content, communications and collaboration
Different – Reliance on in-house implementation i.e. more control – Better adaptation to specific needs
Difference – Platform where they lie – Less IG and records management problems
Difference – Policies and protocols are required to be reviewed and changed more often
Difference – Content sharing as endorsements or rejections (retweets, likes, etc)
Copyright@Sandra J. Reeves 2018
8
Social media and e-mail and instant messaging are alike in that they share the same functionality as these other communications and collaboration systems. However they are different in that they rely on a different architecture. Social media in the enterprise relies more on in-house implementation rather than on third parties, so they can get more closely what they want to satisfy their specific needs.
Also, because the do not reside outside the organization that is more susceptible to intrusion there is better records management control and greater IG control. Fewer legal challenge.
Things like e-mail are in the mature stages of their technology. So there are fewer changes in the policies and protocols. But social media is still growing and maturing and changing. So as new features are added standards will change by necessity. Things like service agreements and end user agreements will have to change.
If you think about it, social media often offers an interactive feature that can be construed as an endorsement or rejection of the content. Things like retweets and likes.
8
RISKS OF SOCIAL MEDIA
Users are unsure of the results of their actions – that is, employees may be exposing information that is not meant for public consumption
Organizations are powerless to control use of social media by employees
Lack of social media policy
Employee threats – both accidental and intentional
More far reaching impact of negative employee conduct
Copyright@Sandra J. Reeves 2018
9
Social Media is not established as reliable and mature where people always know exactly what will result from their use. For example users are unsure of who has access to their what they are doing. They don’t always know if anyone other than whom they intended can see their posts.
Another problem is that once the Jeannie is out of the bottle it can be undone. Once people begin to use forms of social medial at work, it can’t be undone. You can’t make them stop. When they try to put a stop to the use of social media once the employees have grown accustomed to it, they merely cause the employees to be more secretive .
Lack of social media policy – Sometimes organizations just expect that their email policy covers social media use as well. This thinking invites vagueness in the employees understanding of what they can and what they can’t do. It creates the potential for disaster. It can cause employees to make posts that exposes the company to litigation because the employee does not think the email policy applies. Because of the ridiculous things that employees will say and do the organization must form a policy with regard who can “post” on behalf of the organization. There must be in IG policy with regard to social media use.
Employees are your and their greatest enemy often. Either they are trained on what they can and can’t do or they don’t think the policy applies to social medial or they don’t think about the potential threat to the organization from their stupid behavior.
The impact of a stupid employee mistake is far more reaching. If an employee makes an off color joke or offense verbal statement or if they send an off-color statement or joke to another employee through email, you have a better chance of controlling, minimizing the scope of the impact, and the far reaching effect of the damage than if you said the same stupid thing using social medial which reaches a much greater audience.
9
LEGAL RISKS OF SOCIAL MEDIA POSTS
Create specific policies on when, where, from what account, and whom can post on behalf of the organization
Create a specific policy with regard to what kids of things an employees can do on the company’s behalf. What topics are they required to stay away from
Create a records management policy for social medial posts
Exposure to liability is massive –In 2013 there was over 558 million active twitter users and over 58 million posts per day.
Copyright@Sandra J. Reeves 2018
10
Twitter Statistics, Statistic Brain, www. Statisticbrain.com/twitterstatistics/(accessed May 18, 2013) estimates that there are over 554 million active twitter users and over 58 million tweets and that was in 2013. Imagine they type of liability that can be created for the organization by just a small fraction of those employees casual or thoughtless comments. The employee may be venting about his company or individuals within the company. If you have a good IG policy in place you can establish policies and guidelines and you can monitor the use of social media by your employees. While this won’t solve the problem it will minimize the risk somewhat.
Your company may not be liable for the stupid deeds of your employees if the tweet is made on the employees own personal time, using their own computer then you company have more of a defense.
Have a records management policy in place that will address the preservation of non-records and records alike
Make sure that your employees stay away from certain topics.
In short, have a policy that explains who in your organization can issue social media posts of behalf of the organization, under its company name,. When they can post and what topics their posts may be limited to. There have actually been accounts of stupid, mindless employees who have disclosed their organizations’ trade secrets using social media.
10
ARCHIVAL OF SOCIAL MEDIA - Required if used by the Organization
PUBLIC SOLUTIONS for Twitter
Jolicloud – file system approach (Facebook, Twitter, Instagam)
Slurps
Jolidrive – Ability to edit
SocialFolder – ability to save on your computer
TwInbox –MS Outlook plugin that archives Twitter
TweetTake – Archives Tweets
CONVERSION TO PDF
PDF995
PrimoPDF
Nuance Software
Copyright@Sandra J. Reeves 2018
11
PUBLIC SOLUTIONS for FaceBook
Facebook page settings
Plug-in for Foxfire browser
ArchiveFacebook – to your hard drive
SocialSafe (small fee)
PageFreezer (small fee)
Wayback Machine (small fee)
SOLUTIONS FOR LINKEDIN
SocialSafe (small fee)
PageFreezer (small fee)
Wayback Machine (small fee)
Keep in mind that if an organization is allowing its company employees to engage in Twitter and Social Media, archiving is required by law.
We have already said that some social media posts rises to the level of a record that must be preserved. But how?
There are new approaches to capture, manage and archive social media which are emerging.
Some of these options are free. Others are not.
Jolicloud was launched in 2012. It takes a filesystem approach to social media. This means that things like face book, Twitter and Instagram can be shared, sorted and searched. What Jolicloud does is to take content from social media sites (called “Slurps”) and makes it available through a web browser or a table or smartphone. Likes and retweets and favorites will be automatically saved for searching and viewing later. Can use Joli to edit and rebrand file. This platform is Jolidrive rather than just Jolicloud. There is also something that Joli does called SocialFolder that will allow you to save these tweets and likes and favorites, etc to your own computer.
11
ARCHIVAL OF SOCIAL MEDIA - Required if used by the Organization
PUBLIC SOLUTIONS for Twitter
Jolicloud – file system approach (Facebook, Twitter, Instagam)
Slurps
Jolidrive – Ability to edit
SocialFolder – ability to save on your computer
TwInbox –MS Outlook plugin that archives Twitter
TweetTake – Archives Tweets
CONVERSION TO PDF
PDF995
PrimoPDF
Nuance Software
Copyright@Sandra J. Reeves 2018
12
PUBLIC SOLUTIONS for FaceBook
Facebook page settings
Plug-in for Foxfire browser
ArchiveFacebook – to your hard drive
SocialSafe (small fee)
PageFreezer (small fee)
Wayback Machine (small fee)
SOLUTIONS FOR LINKEDIN
SocialSafe (small fee)
PageFreezer (small fee)
Wayback Machine (small fee)
There is number of third party applications that have been created to permit you to save facebook and twitter files since Facebook and twitter didn’t do this originally – TwInbox – This is a plug in for MS Outlook that lets you archive twitter posts and lets you send tweets directly from Outlook
TweetTake is a utility that archives followers and tweets posts
There are also public or free options available for FaceBook. This can be done from the Facebook page setting. There is also a plug-in for Foxfire brower Mozilla. Another for FoxFire is ArchiveFaceboook – this one archives directly to your hard drive.
SocialSafe, PageFreezer and Wayback Machine are available but aren’t free
LinkedIn posts and information –SocialSafe, PageFreezer and Wayback Machine
Remember also that the standard format for saving records is PDF. You can purchase software such as PDF995, PrimoPDF and Nuance Software to convery these social medial posts to PDF format for archival.
12
IG CONSIDERATIONS FOR SOCIAL MEDIA
Social Media Policy Guidelines
Customized for your organization
Look at standards and policies in other organizations in your industry
Expansive policies
Operational Guidelines
Boundaries for use
Consequences for Violations
New Evolving Best Practices for Social Media Governance
Industry Specific considerations
Use cross section of functional units to develop policy
Copyright@Sandra J. Reeves 2018
13
There is a book entitled “How Federal Agencies Can Effectively Manage Records Created Using Social Medial Tools:”. This book addresses building a IG policy for social media. It provides policies, guidelines and boundaries. An organizations IG policy for social media should incorporate strict policies, controls overs this and should outline guidelines for carrying this out. It should also specify what the consequences are for violating the IG policy. Patricia Franks, “How Federal Agencies can Effectively Manage Records Created Using New Social Media Tools”, IBM Center for Business and Government, San Jose State University, 2010. www.businessof government.org. That book is the source for most of the commentary herein regarding IG concerns for Social Media.
There are just now best practices evolving related to social media. We know at the very least best practices for an organization should include industry-specific considerations. To develop a set of best practices for your organization, you will want to use a cross-section committee representing all business units as well as legal, internal auditing, marketing, Finance, IT, legal, and records management
Your policy development process for IG guidelines for social medial in your organization should begini by examining the published policies in other like kind organizations. It should be based on changes in your workplace and on well established standards and guidelines in your industry.
13
Key Social Media Policy Guidelines
Specify who has authority to create social media accounts for organization
Specifies who can speak on behalf of the organization
Describes the negative impact of poorly considered posts
Draws clear distinction between personal and business use of social media
Specifies whether personal access is allowed on company site and if so what type
Underscores that employees DO NOT have a reasonable expectation of privacy
Clearly states what is allowed on organization’s behalf and what is forbidden
Instructs to always avoid engaging in company confidential and controversial conversations
Encourages/requires employees to include standard disclaimer that their view is not shared by organization
Forbids use of profanity and encourages use of professional business tone
Outlines clear punishment and negative actions for violating policy
Draws clear rules about the use of the company’s name and/or its logo
Copyright@Sandra J. Reeves 2018
14
While the IG policy guidelines for social media use in your organization will be customized to fit your organization, there are a few things that should be included regardless of your industry of company. They would include:
Specify who has authority to create social media accounts for organization
Specifies who can speak on behalf of the organization
Describes the negative impact of poorly considered posts
Draws clear distinction between personal and business use of social media
Specifies whether personal access is allowed on company site and if so what type
Underscores that employees DO NOT have a reasonable expectation of privacy
Clearly states what is allowed on organization’s behalf and what is forbidden
Instructs to always avoid engaging in company confidential and controversial conversations
Encourages/requires employees to include standard disclaimer that their view is not shared by organization
Forbids use of profanity and encourages use of professional business tone
Outlines clear punishment and negative actions for violating policy
Draws clear rules about the use of the company’s name and/or its logo
14
RECORDS MANAGEMENT AND LITIGATION CONCERNS
REMEMBER! Legal requirements trumps all other concerns
U.S. Corporations are required to preserve social media including its metadata and associated linked content, FRCP 34
Not all social media posts are “records”.
All social media posts are electronically stored information
Social media posts are ALL discoverable
Must have legally defensible records retention policy in place
Must store metadata, hyperlinks, and the external content – in its native form
Copyright@Sandra J. Reeves 2018
15
Preserve post, metadata, hyperlink and external native data in real time
Use Application Programming Interfaces (APIs) to capture the contents in real time
Static (example, Facebook Profile) and Dynamic social media content (example, Facebook “like”– Capture dynamic in real time
All social media posts that meets record status should be moved to a repository in an electronic records management system application
Rules for Electronic Records Management should be applied
Remember in prior chapters we said that legal considerations trumps all others! And according to the Federal Rules Of Civil Procedure 34 if a US corporation uses social media, then it must preserve those records since the opposing party in litigation may request any designated documents or ESI. This is the same for social media. Remember also that it is a form of electronically stored information (ESI).
While not all social media may be classified as a record, it is all discoverable.
If a company uses social media and makes a conscious decision not to archive it then there could be punishment and penalties for “spoliation of evidence”
The Records Management department must keep in mind that the social media posts include more than just the post – it includes the metadata and hyperlinks. Not only are you required to preserve the social media and its metadata, but you also have to preserve the external content to which it is linked via hyperlink, and it must be preserved in its native form.
15
RECORDS MANAGEMENT AND LITIGATION CONCERNS
REMEMBER! Legal requirements trumps all other concerns
U.S. Corporations are required to preserve social media including its metadata and associated linked content, FRCP 34
Not all social media posts are “records”.
All social media posts are electronically stored information
Social media posts are ALL discoverable
Must have legally defensible records retention policy in place
Must store metadata, hyperlinks, and the external content – in its native form
Copyright@Sandra J. Reeves 2018
16
Preserve post, metadata, hyperlink and external native data in real time
Use Application Programming Interfaces (APIs) to capture the contents in real time
Static (example, Facebook Profile) and Dynamic social media content (example, Facebook “like”– Capture dynamic in real time
All social media posts that meets record status should be moved to a repository in an electronic records management system application
Rules for Electronic Records Management should be applied
You should use a technique that preserves the required information in real time since it is capable of being altered.
Social media content can be classified as static or dynamic. Things like FaceBook profiles and blog posts are static. That means that they can be captured before being posted to the Web. Things like blog comments and endorsements such as “likes” or “favorites” are examples of dynamic content. You need to capture dynamic content in real time because it is subject to change.
This helps you to fight a legal accusation that you have engaged in spoliation of evidence should the social media information become corrupted or deleted.
Any social media post that meets the status should be moved to a repository for records management system. You should apply the same rules of records management that you apply to other forms of electronic records.
16
ERM SYSTEM RULES TO APPLY TO SOCIAL MEDIA RECORDS THAT QUALIFY AS A RECORD
Mark it as read-on
Protect it from tampering
File it against organization’s taxonomy for categorization
Mark record as vital record
Assign disposal rules to record
Freeze or unfreeze disposal rule for the record
Apply access and security controls to the record
Execute disposal processing (an administrative function)
Maintain organizational/historical metadata
Provide a history/audit trail
Copyright@Sandra J. Reeves 2018
17
If the social media post meets the criteria of a record you need to move it to a records repository and apply the same ERM system rules that you would to any other electronic record
Those rules are listed below:
Mark it as read-on
Protect it from tampering
File it against organization’s taxonomy for categorization
Mark record as vital record
Assign disposal rules to record
Freeze or unfreeze disposal rule for the record
Apply access and security controls to the record
Execute disposal processing (an administrative function)
Maintain organizational/historical metadata
Provide a history/audit trail
17
RECORD RETENTION GUIDELINES FOR SOCIAL MEDIA RECORDS
Make Record Threashold determination- Look at content. Is it a record by your own organizational definition of a record?
Apply existing Records Retention Schedules if they apply-inIf you already have a records retention schedule for similar records (example, e-mail) apply the same schedule unless there is a legal reason not to.
Apply basic content management principles-focus on capturing all related content for the post including associated conversation threads and metadata for context and for legal discovery
Risk avoidance in content creation – Emphasize to employees that if they put it out there it may be discoverable, and at the end of its life it is nearly impossible to completely destroy all evidence of it.
Copyright@Sandra J. Reeves 2018
18
Assume the social media document has been classified as a record and the business records rules for retention have been applied. What would be some of the basic guidelines that you should apply?
Once the record has been flagged, look at it. Make a threashold determination of whether it is a record by your own organization’s definition of a record.
You may have to consult your legal department to make that determination.
Apply existing retention schedules if they apply. It your company already has a records retention schedule for similar things like email then apply the same retention schedule unless there is a legal reason not to.
Apply basic content management principles – Focus on capturing all related content for social media posts including conversation threads and associated metadata that may be required for legal discovery. Make sure that they are complete and can be understood in the proper context.
Risk avoidance in content creation – Make sure your employees know that if they put it out there in the form of social media that it will create a risk for your company. Encourage them not to when it is avoidable. Make sure they know that even at the end of its life when it can be legally destroyed it is nearly impossible to destroy all evidence of it.
18
BEST PRACTICES FOR MANAGING SOCIAL MEDIA RECORDS
Identify social media records during the social media planning stage – If someone in the organization is proposing a new initiative complete forms to indicate if new records are created
Promote cross-functional communications – Include representatives from different functional areas
Require consultation in policy development – Get feedback from stakeholders
Establish clear rules and responsibilities-make sure everyone knows the expectations, what is expected of each user, their responsibilities and establish who is accountable to whom
Utilize content management principles-management of content should be a part of the ECM software implementation
Implement RM Functionality-make sure ECM or RM software includes a function to enable records retention, disposition, legal holds and release of legal holds
Control the content
Capture Content in real time
Champion search capabilities
Train!!!!
Copyright@Sandra J. Reeves 2018
19
Best practices for managing social media are just now evolving. A few that have emerged and been accepted and adopted are as follows:
Identify social media records during the social media planning stage- There should be a form to be completed in the organization of a new record will be created by a new initiative. Document this in the planning state
Promote cross-functional communications – Use people from different functional units
Require consultation in policy development-Besides the social media team from cross-functional areas, enlist input from the stakeholders
Establish clear rules and responsibilities- lay out clear expectations and responsibilities and lines of accountability
Utilize content management principles-Management of the social media content should fall under the ECM software implementation
Implement RM Functionality-Make sure that the software for ECM or ERM has a feature that enables records retention, disposition, legal holds, and lifting of holds
Control the content
Capture Content in real time
Champion search capabilities
Train!!!!
19
BEST PRACTICES FOR MANAGING SOCIAL MEDIA RECORDS…continued
Control the content- have a monitoring mechanism in place to manage content before it gets published to the Web
Capture Content in real time-can more easily prove it is authentic from a legal perspective
Champion search capabilities-The technology that captures and preserves the content and metadata must have the capability to search
Train!!!!- You must train users and make sure they are aware of the implications of social medial posting
Copyright@Sandra J. Reeves 2018
20
Control the content-There should be guidelines and monitoring mechanisms in place to control and manage content before it gets published to the web
Capture Content in real time-by doing this you can more easily prove from a legal perspective that the content has not been altered, or that it is authentic
Champion search capabilities- you must make sure that your software that captures will also have the capability to search
Train!!!!-Your employees must be trained to understand fully the consequences and impact of their social media posts and to know what they can do and what they can’t
20
The End
Copyright@Sandra J. Reeves 2018
21
21