An interesting judgment has been issued in the Netherlands concerning virtual items associated with the online world Runescape. According to the article on the Radio Netherlands Worldwide site:

“In a precedent-setting trial, a court in the Dutch city of Leeuwarden has ruled that stealing virtual items is theft and sentenced two teenage boys to community service.”

Setting aside the fact that the two teenage boys beat the 13 year old victim and threatened him with a knife to force him to transfer the items from his account to theirs, this is a drastic departure from how other jurisdictions have handled of cases involving virtual property.

What is also interesting is that based on this article the court determined that there was theft (citing a previous case involving the theft of electricity), but the article doesn’t specify from whom the objects were stolen. According to the Runescape Terms of Service under the heading Intellectual Property Rights:

“You agree that all intellectual property or other rights in any game character, account and items are and will remain our property.”

According to the TOS, Jagex the company that owns Runescape owns the intellectual property rights to this material, not the players, so there may have been theft, but from whom? Furthermore, what effect will this have on the real world trade of virtual items? If anyone has a copy of the judgment translated into English, I would be interested to see it.

Those individuals with an interest in Public Sector Intelligence, Corporate Intelligence or OSINT in general should check out Richard McEachin’s latest post on The Confidential Resource called “An Intelligence Revolution.” He offers some interesting insights into this evolving field.

Image evidence is routinely used in both civil and criminal cases to support some position taken by the parties in the case. Historically, this kind of information would have been supplied through some sort of active or passive surveillance but the winds of change are blowing.

With the advent of social media it’s a whole new ball game. The images and video provided on sites are regularly being admitted as evidence in court and often the information is supplied by the individuals under review (or supplied by people they know).

Over several blog postings in the future we’re going to examine what impact images and video posted on sites like YouTube, Flickr and of course (insert your favourite social networking site here) can have on a case.

Many questions arise about the use of this information, specifically in terms of Privacy, image manipulation, whether or not the information resides in the public domain, whether or not the subject themselves posted it or whether it was posted by someone else and they happened to walk into the frame. These are all issues that investigators must consider when gathering evidence of this kind.

To answer some of these issues I caught up with David T.S. Fraser, a lawyer with the firm McInnes Cooper. He is the author of the Canadian Privacy Law Blog and a specialist in the area of privacy law in Canada.

The purpose these posts is to shed light on some of the issues relating to this subject, but it is in no way to be considered legal advice. Furthermore we understand that every case is different and that in addition to obtaining competent legal advice, one must use one’s own good judgment.

Below is a summary of the short interview I did with David. Please note that the majority of the content presented here will apply to civil investigations, but I’m sure that criminal investigators may find the information useful as well.

Question 1: What are some of the circumstances where the Privacy Commissioner and in particular PIPEDA do not have jurisdiction in these types of matters?

David: My personal opinion is that civil litigation and private disputes are not subject to PIPEDA. The law is restricted to the collection, use and disclosure of personal information in connection with commercial activities. A private dispute is not commercial activity so should not be caught within PIPEDA. The Commissioner has a different view, but has concluded that if you are a plaintiff, you implicitly consent to the reasonable collection, use and disclosure connected with defending the case.

Question 2: Do you think a video on you tube might be considered “public information” based on the Section 1(e) of The Regulations Specifying Publicly Available Information for PIPEDA?

NB: For the reader’s reference Section 1(e) of the Regulations state that Publicly Available Information includes “personal information that appears in a publication, including a magazine, book or newspaper, in printed or electronic form, that is available to the public, where the individual has provided the information.”

David: The challenging thing about using the Publicly Available Information defence would be that the individual has to provide the information in the first place. You can thus argue that YouTube is a publication, but you still have to establish that the person provided the information.

What’s additionally interesting is that the Courts do not really see PIPEDA as an impediment to the admissibility of evidence in civil matters. They will ask if it’s an unreasonable invasion of privacy and a violation of PIPEDA may be helpful in determining whether there is a reasonable expectation of privacy, but I don’t think most judges will only look at PIPEDA.

It’s also worth noting the recent decision of the Ontario Superior Court of Justice on Murphy v Perger where the Court ordered that “private photos” from Facebook be provided to the defendant. I don’t think any of it would be an issue if the photos were public on any site such as YouTube.

Question 3: Imagine a hypothetical scenario of a video posted on a YouTube-like-site that captures the subject of an investigation doing something (presumably that they aught not be doing), but then other people walk into the frame who are not relevant to the issue at hand. What are some of the issues that might arise and what efforts would you suggest to avoid having the evidence rejected on the basis of privacy concerns?

David: It’s an interesting question. One of the big concerns with social networking and video/photo sharing sites, from a privacy point of view, is that individuals may have their information captured without their knowledge or consent. And in many cases, these photos/videos are not the most flattering of the individuals included.

If the photos or videos at issue are “personal”, meaning they weren’t made in connection with a commercial activity, the private sector and public sector privacy laws that we are used to dealing with would not apply. So in considering whether the evidence they provide would be admissible would depend upon whether admitting them would be prejudicial to the legitimate privacy interests of the individual or would otherwise bring the justice system into disrepute. Most of the case law deals with surveillance done by private investigators of personal injury plaintiffs and decisions about admissibility usually depend upon how the surveillance was done. For example, was there trespassing? Was it taken in a place where there was a reasonable expectation of privacy? Are there gaps in the recording? Using YouTube videos, the party wishing to use the video has no control over those factors, but the fact that the video is on the Internet visible to anyone may make it more likely to be admissible but may also throw into question the integrity of the recording.

Anyone planning to use a YouTube video would be well advised to carefully document how it was found, when it was last accessed, what URL it was at, who posted it and whether it was locked down or publicly accessible. It would also make sense to note how many times it had been viewed, if this information is available.

Question 4: Regarding Murphy v. Perger, the judge ordered that photos from the plaintiff’s Facebook page to be made discoverable by the defendant.

Also, to borrow from an over-used joke…how many “friends” does it take to make a profile public?

David: The Murphy v Perger case provides some useful guidance. As mentioned above, it appears that admissibility will often depend on whether there is a reasonable expectation of privacy with respect to the photos. In the Murphy case, the court concluded that the number of people who could view it was relevant in determining how private it was in fact. If someone chooses to make their photos private and reduce the number of people who could view them, they are explicitly communicating their desire for privacy and ultimately this will inform the expectation of privacy. (Though some might argue you should have no expectation of privacy for anything you post online.)

What is also interesting is the question of whether, regardless of the privacy expectation, the information should be produced. In any personal injury litigation, the plaintiff has an obligation to produce all relevant records, including medical records. Anyone has a strong expectation of privacy in such records, but they nevertheless have to be produced if they are relevant.

Question 5: It is possible that some of the photos of the plaintiff in Murphy v. Perger were taken by a third party, posted on Facebook by that third party and that the plaintiff was tagged in them, meaning that she may or may not have known that they photos were taken.

For arguments sake, let’s say that the subject of an investigation was video taped by one of their friends at a private party – they did not do the taping themselves. However, that subject was aware of the fact that their actions were being recorded by video or by still photo camera and was also aware that the video was going to be posted on the Internet and did not object? Would they still maintain their right to privacy in this case?

David: I expect that the reasonable expectation of privacy would be considered on a case by case basis. If the photos were taken in a private, intimate gathering the people in them would have a stronger case to argue that it was private and should be suppressed. But if the picture is at a large party, the reasonable expectation would be reduced.

If the plaintiff did not take the photo and did not post it online (and did not know it would be posted on the Internet), the fact of the photo being online would not be determinative of the expectation of privacy. After all, they did not choose to put it on the Internet. If they had been the one to put it online or knew that it would end up online, then I’d probably argue that any expectation of privacy they would have had at the event is nullified by their subsequent decision to post it online.

Question 6: Alternatively what if the subject was later made aware that the video was posted on YouTube, but did not make any efforts to have it removed and therefore left the video in the public domain?

This is relevant because we see that people post comments about videos all the time. If a person was in the video and then later made a comment about the video wherever it was posted then presumably they would know about the video’s existence and could have taken steps to have it removed.

David: I think this would also be interesting evidence of the person’s expectation of privacy. But it may also be evidence of their desire to not have this evidence out there. That would be an interesting case, since the timing may be important and the defendant may try to impute guilt or a cover-up by their attempt to remove the content.

I very much appreciate the time and insight David provided on this matter. Look for additional postings on the subject of images and video as they relate to Internet investigations in the future.

The Ottawa Business Journal (or the OBJ as we Ottawaians will often call it) is a local publication focused on business in the Ottawa area. It featured an article on the growing use and even greater possibilities of virtual worlds in business applications.

Like Editor Jim Donnelly who wrote the article I would “prefer an old fashion beer and a handshake” in many circumstances, but in the modern business and government environment where team members can be separated by thousands of miles, these three dimensional applications can make a lot of sense…with the appropriate policies, procedures and security measures in place of course.

I recommend this short article for any public or private sector individual interested in how to help “far flung” teams work more closely together through this medium.