Thank you for sharing!

Your article was successfully shared with the contacts you provided.
The recent explosion of the Internet for both personal and business use has changed the way people communicate. E-mail, instant messages, news groups, and Web pages allow people to transfer information instantly to a huge audience. Any person with an Internet connection can broadcast his or her thoughts and opinions to the world. Nowhere is this more evident than in the realm of stock message boards, where IPOs are reviewed, mergers are discussed, and investors vent opinions. Some of the more popular Web pages and services with this forum are altavista.com, ragingbull.com, AOL, etrade.com, datek.com, and yahoo.com. One of the more positive aspects of message boards is that they allow investors to gather information quickly about a company or an investment. However, the content of most message boards is not usually regulated. While most Web sites reserve the right to pull messages that are deemed inappropriate or offensive, they do not review the messages for accuracy of content. A member can post information on any topic regardless of the veracity of the statement. Some of this posted information has caused a great deal of concern for publicly traded companies. People have posted false information, both positive and negative, about companies, their trade secrets, and their executives, some of which is libelous, personal, or both. This type of information may be posted to affect stock price, out of malice or revenge, or just to reveal a secret. When information of this nature is posted, there are a number of possible actions a company can take. The first priority may be to stop further dissemination of inappropriate information. The company can request the appropriate authorities of the message board to remove the offending post. The company may also want to locate the individuals who are posting the information in order to communicate with them directly or to prosecute them, depending on the information that was posted. It can be very difficult, though, to determine the real identity of a poster. Typically, a message board user has the option to keep identifying information hidden from casual viewers. It is also common for a user to hide his or her identity from the message board itself. The only requirement for most message boards is a valid e-mail address. Other information can be easily falsified, especially by using “free” e-mail services. LAWSUITS AND SUBPOENAS In the past, the most direct way to locate a person posting a message was to file a lawsuit against “John or Jane Doe.” Using subpoena power, it is possible to electronically follow a message poster’s trail. A Web site that posts messages keeps logs of the IP (Internet protocol) address of every person who has posted a message on the message board. This IP address can be used to trace the ISP (Internet Service Provider) that issued that address. If the ISP keeps logs of its users, these logs can be used to identify the account or computer that was used to post the message. This information is usually enough to locate the person making the posts. Filing a lawsuit against an anonymous message poster may not always be the best way to proceed. Problems can arise with choosing an appropriate cause of action and finding the right jurisdiction to file the complaint. Even though libel or theft of trade secrets may be appropriate causes of action, the facts of the case may not fit. And keep in mind that the cause of action determines how damages are measured. Another potential problem is the timing of the lawsuit. While many message boards keep message information for an extended period of time, on occasion the information is deleted. If a message has been deleted from the board, which is often done if complaints about the message are filed, the information can be very difficult to retrieve, if not impossible. Also, ISP logs of traffic passing through these systems are usually kept for a finite period of time. This means that if you do not act quickly to retrieve these logs, they are erased in the normal course of business, usually 30 to 60 days. Without these logs, it is impossible to trace the message back to its source using a technological method. Even if these logs are available to be subpoenaed, people who are posting information that they know will cause retribution or investigation often take great pains to remain anonymous. One way they do this is by using public access points to the Internet, such as public libraries, universities, and Internet cafes. Even if a company is able to trace the message back to these sources, it is virtually impossible to track down a particular user. People who want to hide their trail can also use a service such as http://www.anonymizer.com/, http://www.zks.net/(Zero Knowledge), http://www.enonymous.com/, and http://www.aixs.net/, which use specialized proxy servers through which subscribers can access Web pages. These services destroy record logs of use quickly after their creation, making a later request for them useless. Another emerging issue deals with the message board’s privacy agreement with the user. Recently privacy advocates have been working to force message boards to delay compliance with a subpoena for a member’s information until the member can be contacted and given a chance to respond to the subpoena. They claim that if this procedure is not followed, the message board will be in violation of various state constitutions. However, if this procedure is followed, the suspect may be alerted prematurely, ruining the chances of using other methods to identify him as a poster of harmful information. INVESTIGATIVE TOOLS Other investigative methods that can be used to locate persons who post harmful messages regarding publicly traded stocks range from traditional gumshoe detective work to high-tech computer forensics. To help focus the investigation, the first question to ask when dealing with harmful information in message posts is: What is the motive for posting the information? Could it be revenge (employees or former employees who feel harmed), financial (short or long sellers), industrial espionage, or even boredom? Try to determine who has access to the information being posted. If the information is known only to a select group of individuals, you can narrow the focus of the investigation. Even if the information being posted is not confidential or related to trade secrets, often the text in the message holds information that can narrow the field of suspects, due to the limited number of people who could have known it. Releasing misinformation to specific targets can aid this process. Analyzing patterns of message posts can also give helpful information regarding the identity of the poster. If postings occur at regular or irregular intervals, a pattern may emerge of who could have known certain information – or benefited from releasing the information. This type of analysis can significantly reduce the number of potential suspects. Linguistic experts can help winnow the field of potential posters by examining characteristics of the writing style. The profiles these experts create can help them to determine if an individual is posting under different account names, as well as to compare writing styles of already suspect individuals. While a person releasing sensitive information may be careful with information under that identity, he or she may be less careful with identifying information for other identities. Because employees often have the closest access to sensitive information, or a greater motive to harm their company, an investigation of message posts should include a review of Internet usage of employees. Using company proxy server and firewall logs, you can track the Web pages that employees have visited and correlate this activity to the times of the message posts. If an employee posts a message during work hours through the employer network, these logs can often point to the individual. If there are a limited number of suspect employees to review, it also may be useful to install keystroke monitoring software on their office PCs. This software will make a record of all activity on a computer, regardless of whether it passes through company network security systems. However, there are potential privacy and wiretap legal issues that must be reviewed before this sort of activity is initiated. If there is no company policy regarding employee monitoring, the company may be in violation of federal and state laws. A computer investigator can perform a forensic review of an employee’s computer to try to determine if a specific computer has been used to post messages. This review may include recreating the employee’s Internet usage, recovering deleted Internet files, and performing keyword searches for information that appears in the offending messages. These methods can be effective even when the person has made an effort to cover his or her electronic tracks. A review of trading volume near the times of posting can provide evidence of a poster trying to affect stock price. If a large volume of shares has traded immediately before or after the offending postings, this can be indicative of attempts to manipulate stock prices and can raise the possibility of bringing in the Securities Exchange Commission to assist in the investigation. Another method that can prove very useful, but should be used with caution, is to attempt to identify the poster by engaging her or him in electronic communication. By convincing a poster to send e-mail or instant messages directly to an investigator through surreptitious means, you may be able to identify the geographic location, Internet Service Provider, or even the actual identity, using various investigative tools. Because it is very easy to tip one’s hand using this method, it should be done by an experienced investigator. While the traditional “John or Jane Doe” lawsuit can be useful in locating a person who has harmed a company by posting false information, the growing sophistication of Internet users and changes in the law have increased the need for other techniques. Creating a plan that takes advantage of these investigative tools will likely prove more effective than a subpoena in this type of investigation. J. Christopher Racich is director of high-tech investigations at Kroll Associates in Washington, D.C. He may be reached at [email protected].

This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.

To view this content, please continue to their sites.

Not a Lexis Advance® Subscriber?
Subscribe Now

Not a Bloomberg Law Subscriber?
Subscribe Now

Why am I seeing this?

LexisNexis® and Bloomberg Law are third party online distributors of the broad collection of current and archived versions of ALM's legal news publications. LexisNexis® and Bloomberg Law customers are able to access and use ALM's content, including content from the National Law Journal, The American Lawyer, Legaltech News, The New York Law Journal, and Corporate Counsel, as well as other sources of legal information.

For questions call 1-877-256-2472 or contact us at [email protected]


ALM Legal Publication Newsletters

Sign Up Today and Never Miss Another Story.

As part of your digital membership, you can sign up for an unlimited number of a wide range of complimentary newsletters. Visit your My Account page to make your selections. Get the timely legal news and critical analysis you cannot afford to miss. Tailored just for you. In your inbox. Every day.

Copyright © 2021 ALM Media Properties, LLC. All Rights Reserved.