“Forensic” Twitter

I am not a lawyer and this is not legal advice (I am not qualified to give it). Be very careful about relying on this information – if I am wrong my advice might damage your case! – and always seek appropriate legal advice if you need it. Different localities will have their own laws and application of those laws. [Page updated 11 March 2017]

See further reading at end.

This post is written for people who need to keep an eye on a particular set of tweets, or information on a website. An example might be where someone says something (on Twitter) that crosses a line and may result in intervention from police, statutory bodies or some other legal body, and a case may even end up in court based on what was said on Twitter. I have no idea what type of evidence would be required to satisfy a court but here are some suggestions for capturing tweets as evidence, and their limitations.

If you’ve been blocked you can still view and save tweets by logging out, using a third party app (like Echofon for iPhone or Dabr for desktop) or creating a spare account.

Table of Contents
1. Capturing the tweets while they’re still available
• 1a. Screen capture / screenshot
• 1b. Freezepage
• 1c. Storify or embedding in a blog
• 1d. IFTTT – capturing the tweets as they’re sent
2. Capturing deleted tweets
3. What software did they use to tweet?
4. Detect changes on a website, or new information being published
5. How many followers did X have at point Y?
6. Further reading

1. Capturing the tweets while they’re still available
1a. Screen capture / screenshot

Have the tweet visible on the screen and take a screenshot. Methods for doing this depend on the device but see [Taking a screenshot] for some suggestions.

For a better picture use desktop Twitter (and include the https:// link that’s visible in the address bar). Most Twitter platforms, including desktop, will also show you who has favourited or RTed the tweet (which may be useful evidence in itself of the spread of the tweet) but you may need to note the accounts that have done this as it’s not necessarily obvious from the pictures (and they may subsequently change their picture). You can also capture some of the replies too.

Note that more people might reply to the tweet later (or favourite it, or RT it) so this process may need to be repeated periodically.

Advantages: captures the tweet as it is, even if later deleted
Limitations: because an image can be altered it may not be deemed strong enough evidence. However I think it would be a ‘not unreasonable supposition’ to believe that someone stating under oath that it is true might satisfy the courts, though see tweet below. You might be lucky and find that others have created a corroborating screenshot or other way of verifying the tweet too.

1b. Freezepage
To capture a copy of the ‘page’ on which the tweet appears (you need to use the tweet’s own address – you can find its URL in the tweet’s timestamp. Make sure you remove the S from the httpS bit of the address [update 22 March – removing the S from https:// to make it http:// may no longer be necessary, but if it gives an error message try that first]. You can create an account, or not http://www.freezepage.com/

1c. Storify or embedding in a blog
A tweet, once embedded in a Storify story or blog, will remain visible there even once deleted. It will look slightly different (you won’t be able to favourite it or RT it) but it will remain there otherwise exactly as it was.

Storify embeds: Search for the name of the person, or words in the tweet, or if you have its address use the link search to pin it down and save it in your Storify. See [How to use Storify like a pro to collect tweets] for more info.

Blog embeds: Either use the embed tweet option (previously found in the three … dots but this has been replaced with a down arrow to the right of the tweet) or, for WordPress dot com blogs (as this one) you can just use the tweet’s address and it will autoembed.

1d. IFTTT – capturing the tweets as they’re sent
The free online tool IFTTT (If This, Then That) lets you capture a copy of a ‘corpus’ (“bunch”) of tweets eg all from a particular user or all containing a hashtag. You can have them emailed to you, or you can set up a spare Twitter account to rebroadcast them, or you can have them collected in a Google Drive spreadsheet or Evernote file. I’ve not written a blog post specifically about this but the information can be gleaned from the second part of [Downloading your old Twitter faves, setting up IFTTT to capture new ones] and another post that might be useful on how to use IFTTT is [How to display Instagram pictures correctly in tweets using IFTTT].

With IFTTT you authorise it to access your own Twitter account (to let it interact with Twitter) then set up a ‘collection bin’ into which you’ll put the tweets, so you can authorise it to use Google Drive or something else. IFTTT calls the different services channels and the instructions to “if a tweet contains X send an email to Y” a recipe.

2. Capturing deleted tweets
While deleting a tweet removes it from Twitter’s public servers it is still potentially findable. If you are looking for it a short while after its deletion (I’m not sure exactly how long but it’s a matter of hours and no guarantees) you may find it via Google’s cache (see tiny green arrow in picture below, flanked by orange arrows, that is the link to find a cached copy, if available). Note that tweets that have previously been embedded in a blog post or used in a Storify story will still remain even after the tweet is deleted. Other search engines have caches too and you can see an example here http://cachedview.com/

screen-shot-2016-10-16-at-21-24-12

Other things to try if you can’t find the tweet(s) are to see if others have retweeted the text of the tweet(s) [search for words in the tweet] or a screenshot [in which case they may have included the original @handle of the person who deleted the tweet so try searching for to:handle].

I think if you’re the sort of person who knows what an API is then you might be able to do something on that front but alas this exceeds my knowledge.

3. What software did they use to tweet?
All tweets used to have a line at the bottom of them saying what software had been used to send the tweet but Twitter no longer adds this in, however many third party apps do. Echofon for iPhone will tell you how a tweet was sent. Because Echofon is used on a mobile device it’s reasonable to assume that if that was used to send the tweet the person was using a phone. If it says something like ‘Twitter for web’ then they may have tweeted from a desktop computer.

Limitations: On an iPhone it’s possible to download the Chrome browser and use Twitter’s desktop version. Tweets sent in this way will appear as ‘from desktop’ yet will have been sent by mobile phone.

4. Detect changes on a website, or new information being published
Use the change detection service and get it to send you an email if the text on a website is amended https://www.changedetection.com/, or you can set up a Google Alert to email you if a particular word or phrase appears in a newly published page on the internet https://www.google.com/alerts

5. How many followers did X have at point Y?
One of the considerations in the recent Monroe v Hopkins Twitter libel case considered how many followers the parties had at the time the relevant tweets were made. This was estimated but in some cases you’d be able to find the exact number thanks to the Internet Archive. Whether or not someone’s Twitter account has been archived will probably be fairly random (and presumably new accounts won’t be included – though you can of course manually add their page to the archive, or use Freezepage as mentioned above) – I was quite pleased to find that my page has been archived. The Internet Archive takes snapshots at particular time points, often several months apart – it’s pot luck what’s there.

The Internet Archive has taken several snapshots of my Twitter account and one, made at 14:52 on 14 Feb 2010 showed that I had 820 followers, by 3 August 2014 this had increased to 3,631. My account has had 44 snapshots taken between 23 Dec 2008 and 9 Jan 2017. Use the format https://twitter.com/USERNAME and insert it here to test an account’s history.

6. Further reading

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s