IQ Legal TrainingBerkeley Lifford Hall Accountancy Services

Home > Articles > 2019 archive

Using social media to disrupt a family law narrative

Byron James, barrister, Expatriate Law (United Arab Emirates) examines a Norwich Pharmacal order and its potential application within family law cases.

Byron James
 barrister, Expatriate Law (United Arab Emirates)

Every time you log onto any form of social media, your every action is recorded; every social media interaction is therefore adding to the huge amount of data held about you by a corporate third party.

This can be very useful for a family lawyer, who may wish to use said social media platform to establish a person's location at a particular time or the information that they have stored online. Of great assistance in such a situation is a Norwich Pharmacal order, which is essentially a third party disclosure order against a party who has unwittingly been involved in the commission of a criminal offence; for the family lawyer, this brings into play child abduction, breaching orders or a failure to comply with the duty of full and frank disclosure in financial remedy proceedings, et al.

Contained herein is a worked example, based upon the facts and judgment from the Applause Store1 case, using the activity log Facebook holds in respect of each profile to prove whether a particular individual (Mrs Jones) created a fake Facebook profile (of Mr Smith) or not. It is hoped that the information from this simplified worked example can then be put to wider use, applying the same principles to the wide-ranging possibilities within family law cases.

Facebook: a general introduction

1. Facebook users create 'profiles' for themselves, in which they may include as much personal information as they wish. Facebook enables them to adjust the privacy settings of their profile so that (for example) they may permit general access or restrict access to those whom they accept as 'friends'.

2. The concept of a 'friend' has a special sense in Facebook, for it includes all those who make a request to be accepted as a friend and whose request is accepted by the user. The 'friends' are listed on the user's profile. Profiles will contain a 'timeline' on which those permitted access may post messages which can be read by those who have access to the profile, and will contain links to any 'groups' to which the user belongs. 'Groups' are Facebook pages which may be set up by users, notionally, it appears, as a resource which may be visited by any Facebook user interested in the group's subject matter.

The question to be determined: Is Mrs Jones responsible for putting up the false profile of Mr Smith?

The facts
3. Mr Smith himself started using Facebook in December 2016.

4. A new Facebook profile was created in the name of Mr Smith during the evening of 19th June 2017. It contained private material and a photograph of him. The false profile contained information as to Mr Smith's sexual orientation, his relationship status, his birthday, and his political and religious views. Not all this information was accurate, and the profile was not set up by Mr Smith.

5. It was on 4th July 2017 that Mr Smith discovered the false profile.

Norwich Pharmacal order and disclosure from Facebook
10. On 1st August 2017 Mr Smith obtained a Norwich Pharmacal order from the High Court in England against Facebook Inc for disclosure of the registration data provided by the user responsible for creating the false material, including email addresses, and the IP addresses of all computers used to access Facebook by the owner of those email addresses.

11. Facebook Inc provided Mr Smith with evidence showing that the profile was created on a computer using an IP address linked to the residential address of Mrs Jones, on the evening of 19th June 2017, and that the group was created on a computer using that same IP address on the afternoon of 20th June 2017.

12. All the relevant activity was conducted from that IP address using three Facebook user identity numbers, one of which was Mrs Jones', one of which was that of her husband Mr Jones, and the third of which was a profile in the name of Mr Smith.

13. There were only two computers which could have used that IP address: Mrs Jones' desktop computer, which was kept in the study of her flat, and the laptop computer belonging to her husband Mr Jones, which Mrs Jones often used.

14. Both computers used a wireless router to connect to the internet, and the router employed the IP address which Facebook disclosed.

Facebook activity log

15. A composite activity log for Mrs Jones' IP address was then compiled by Mr Smith from the material disclosed by Facebook. Initially this was not so immediately
accessible to the layman and used Pacific time (Facebook being based in California).

16. The activity log shows all the activity on Facebook on 19th June from Mrs Jones' IP address.

17. Before 4.35pm on 19th June, only Mr Jones accessed Facebook from Mrs Jones' IP address. 

18. The first column gives date and time in BST; the second, headed 'Script', gives the page or section on Facebook being accessed; the third, 'Scriptget', shows the activity being undertaken; and the fourth shows the name of the person whose Facebook user identity is being employed (not necessarily the same as the name of the actual user). 

19. What the activity log appears to show is a sequence of activity using the Facebook user identities of Mr Jones, Mrs Jones and a "'Mr Smith". There are no occasions when the log shows an overlap of times suggestive of the concurrent use of both computers in Mrs Jones' flat.

The relevant usage as shown by the activity log

20. Mrs Jones' usage started at 4.35pm. From then until 4.48pm on 19th June a user using Mrs Jones' Facebook identity was accessing Facebook. It can be seen from the activity log that this user appears to have looked at Mrs Jones' own profile and searched for three people (Mr X Red, Mr Y Blue and Mr Z Green). By "searched for them": what appear on the activity log (under the column 'script', which shows the Facebook page being viewed) are the letters 's.php', and (under the column 'scriptget', which shows any parameters passed to the script) 'q=[firstname]+[secondname]. So, in the case of Z Green, the log shows 'q=Z+Green'. Asked about these entries in the log, Mrs Jones accepts that they showed her searching for the three people, and that she had indeed done so. 

21. Mrs Jones came back onto Facebook from 5.03 until 5.20pm. She searched for three people: Mr White, Mrs Black and Miss Grey. The user activity log shows that Mrs Jones accessed the profiles of each of these people, including their photographs. The activity log shows that in particular she spent one minute and fifty-six seconds on the profile picture page of Mr White. At 17.16.34 BST the log shows her blocking Miss Grey, the girlfriend of Mr Black: the column 'scriptget' shows a formulation which includes Miss Grey's name and the word 'block'. 

22. She logged off Facebook at 5.20pm and came back online at 5.33, remaining on Facebook under her own user identity until 5.40pm. The next entry in the log did not occur until 9.04pm, over three hours later.

Later events on 19th June

23. Mrs Jones' says that at about 6pm on the evening of 19th June she met up with two friends from work at a local Hampstead bar, the Bar Rhumba. She stayed in the bar for perhaps two hours, after which Mr Jones joined them with two friends of his. The party now consisted of six people, all of whom she either knew or had been introduced to that evening.

24. At around 8pm, they all left the bar and walked back to her flat. Somehow, Mrs Jones says, four 'strangers' came back to the flat with the party, making ten people in all. 'Strangers', in inverted commas, is how she herself describes them. She could not recall specifically inviting them, nor did she know who had invited them, but she did not recollect wondering why they were there. She did not usually invite strangers back to her flat, although she claimed that she had done so before.

25. It does not appear that Mrs Jones spoke to them much, if at all, during the evening, for she was on the patio with her friends most of the time, talking and using Mr Jones' laptop computer to access Facebook. Mr Jones was in the living room with his friends, whilst the 'strangers' were at the kitchen end of the living room, around the dining room table, and in the kitchen itself.

26. There were therefore at least three separate groups of people at the gathering, although – given the size of the flat – they were not very far apart, and there was some degree of intermingling between the 'strangers' and Mr Jones' group. Mr Jones did not pay them much attention, and thought that he would not have noticed if one had disappeared for an hour. They were not behaving suspiciously.

27. At some point in the evening, Mr Jones went to bed. He says this would have been at around 10pm. At this time, Mr Jones' friends decided to leave, and did in fact leave about 20 minutes later. Mrs Jones' remained in the living room and patio, and continued talking and drinking. Mrs Jones came to bed 45 minutes later.

28. Mrs Jones accepts that she was the user up to 9.24pm. After that point, she regarded it as possible that she accessed Facebook at times until 10.35pm, although denied most of the individual instances stated above. She absolutely denies accessing Facebook under the name Mr Smith, whether to create the false profile or to search for her own name. That could only have been the work of one of the strangers, using the desktop computer in the study, where Facebook was left open.

The Facebook activity log of 19th June

29. The activity log shows that a user employing Mrs Jones' identity logged on to Facebook again at 9.04pm, perhaps an hour into the party. Mrs Jones accepts this was her. During that session, she searched for several people and looked at their profiles (all clear from the activity log) and read a message from Mr Yellow. The activity log shows the content of the message, the time spent typing or remaining on the page, it shows letters typed and then deleted and any messages sent in response.  She then logged off under the user name Mrs Jones at 9.24.50pm.

30. At 9.25.31pm, a computer at Mrs Jones' IP address accessed Facebook again. The last entry for that session is timed at 9.28.49. At 9.33.44, the computer again accessed Facebook, but this time under the user name "Mr Smith", with a new user identity number. That time coincides precisely with the moment when, as is not disputed, the false profile of Mr Smith appeared on Facebook. On the screenshot of the false profile, under the date June 19, the words appear: 'Mr Smith joined Facebook. 9.33pm'. 

31. To register for Facebook you have to provide the details of the user and an email address. The user is then sent an email, which contains a link on which they click to complete registration. The time between 9.25.31pm and 9.33.44pm would provide sufficient time for the creation of the false profile in the name of Mr Smith, and waiting for the validatory email to come through. It is clear that during this period (between three and eight minutes) the false profile was created and, from the IP address, that it was done so on a computer at Mrs Jones' flat. That computer was either the laptop which Mrs Jones was using, or it was the desktop in the study/spare bedroom. 

32. If it was not Mrs Jones' doing, the profile must have been created by someone else at the party, presumably one of the 'strangers', and the process must have been commenced 41 seconds, at most, after she herself left Facebook. The coincidence of timing is telling.

33. At 9.42.54pm, the user identity changed on the log. Facebook was now accessed by a user who employed the username 'Mrs Jones'. The activity log shows that at 9.44.28pm the user calling himself or herself Mr Smith logged back on to Facebook. This could be explained by the profile being 'switched' so that two computers were in use simultaneously and both accessing Facebook. 

34. The false Mr Smith logged back on at 9.44.28pm. As is clear from the screenshot of the false profile, 9.44pm is the exact moment when Mr Smith is shown as having joined Facebook's London network. Moreover, in under a minute the user had searched for Mrs Jones' profile. The last entry for that session is timed at 9.46.21.

35. Twenty-eight seconds later, the log shows a user accessing Facebook under Mrs Jones' user name. The user searched for Mr Green, for whom a search had been made at 9.17.01pm during the last session in which Mrs Jones accepted that she had been the user.

36. At 9.48.12pm, the pseudo 'Mr Smith' is shown to have logged on again. This time, the activity log shows the user searching for the genuine profile of Mr Smith, a photograph on that profile being accessed and added to the false profile of Mr Smith. 

37. At 10.07.38, the log shows that the fake Mr Smith user was logged on again, and immediately searched for Mrs Jones and three people who are all known to be friends of Mrs Jones. Thirty seconds after the last entry on the Mr Smith session, at 10.11.51pm, the Mrs Jones user logged on.

Proving Mrs Jones created the profile

37. The challenge with trying to ascertain forensically (and prove) whether a particular person is responsible for a specific aspect of computer usage is that even if one can identify the particular piece of hardware used for this purpose, you still need to prove that said particular person used the particular hardware for said purpose.

38. In the above case, the relevant usage is clearly the work of one person. Nothing in the data points to any other interpretation. This will not always be the case. Sometimes the Court will have to decide a narrative, as they do currently, simply based upon which witnesses they believe, a system far less than perfect. The underlying data still performs a useful purpose however as it creates the possibility for contradiction and implausibility in the narratives provided.

39. For example, Mrs Jones' explanation for the Facebook usage on 19th June is, in all likelihood, implausible: it is an unlikely proposition that on 19th June a complete and random stranger, visiting Mrs Jones' small flat for the first time, should first have gone into Mrs Jones' study and started using her computer, without permission, over a period of about an hour, without being observed, should then have created a false Facebook profile about someone Mrs Jones knew well and searched from that profile for a number of people known to Mrs Jones. If it was not a stranger who was responsible for this usage, the person responsible can only have been Mrs Jones.

40. It is possible, though unlikely, that a stranger might have got away unnoticed with making an hour's unauthorised use of the relevant computer in a small and crowded flat; it is possible, though unlikely, that he or she would have been in possession of the detailed information which appears on the false profile and unlikely that he or she, having created the profile, would then spend many further minutes using the new profile to search for a number of individuals whom he or she would have been unlikely to have known.  This is a good example of using the precise timing and nature of the social media interaction to render yet more implausible the narrative provided by Mrs Jones.

41. The above worked example therefore demonstrates how one can disprove a narrative using the data held by a social media company regarding the particular activity undertaken at specific times. The data provided undermines the narrative given by Mrs Jones; it creates numerous incidents of implausibility in the story she is telling, and not just a single incident that could be dismissed as coincidence.

42. There are numerous ways that the data held about clients, voluntarily given to these third parties on a regular, probably daily, basis can be used to disrupt a narrative provided by them. This could be a narrative pertaining to their financial position, their precise location at a given time, where they have abducted a child to or whether they confided something to someone that is of relevance. This huge store of information is available to practitioners, and possibly not long before it is a routine resource for the Court. 


1 Applause Store v Productions Ltd & Firsht v Raphael [2008] EWHC 1781 (QB)