Upcoming Webinar: May 7, 2024 @ 12:00 P.M. (ET)  |  Cultural Initiatives in Policing: Part 2 – Calgary Police Service  |  Register Today!

Serious insight for serious situations.

Serious insight for serious situations.

<< Back to all posts

When catfishing comes to work: Assessing the authenticity of social media evidence in a workplace investigation

While you’re here, you may wish to attend one of our upcoming workshops:

Assessing Credibility
25 Apr at
in Online
Who should you believe? This course is for anyone who has investigated allegations but struggled to make a finding. Learn about the science of lie detection, which approaches work and which don’t, and valuable tools to assist you in making decisions. Investigators will leave confident in making difficult credibility decisions. Participants will be provided with comprehensive materials explaining these concepts and tools to better support them in their investigative practice.
Register4 places remaining

As workplace investigators in 2020, we routinely deal with issues in investigations that relate to technology, especially social media applications¹. In any given investigation, some portion of the alleged bullying might have taken place over Facebook, or Slack messages might provide critical evidence of sexual harassment.

Given that many of us are now conducting our entire work lives online as we practice social distancing in response to the COVID-19 pandemic, we can expect to see even more investigations that involve inappropriate workplace interactions via Zoom, Slack, Microsoft Teams and the countless other technological tools that we’ve all taken up in recent weeks.

In light of our “new normal,” the guidance around social media evidence in workplace investigations provided in the recent arbitration matter Children’s Hospital of Eastern Ontario v. The Ontario Federation of Health Care Workers, L.I.U.N.A. Local 1110 ² (“C.H.E.O.”) is particularly helpful.

In this case, the grievor (a C.H.E.O. employee) was discharged after a workplace investigation concluded that he sent sexual messages to a co-worker through Facebook Messenger. He grieved his discharge and, during the resulting arbitration, the arbitrator summonsed data from Facebook that revealed that the grievor did not write the offensive messages. An unknown person set up a fake Facebook profile with his name and photo. Once this was revealed, the grievor was reinstated, but he then sought damages, arguing that the hospital’s investigation was improper and inadequate.

The arbitrator ultimately concluded that the grievor was not entitled to damages. However, the relevant questions for workplace investigators are: how should we treat social media evidence that we receive in an investigation? How far do we have to go to satisfy ourselves that this evidence is authentic?

In many cases, the authenticity of social media evidence is not in question because the creator of the evidence agrees that they authored it. However, when the alleged author of the social media evidence denies that they wrote/posted/shared the evidence in question, the C.H.E.O. case provides some issues for investigators to consider when determining authenticity:

1. Anonymous or not? In the C.H.E.O. case, the Facebook account from which the inappropriate messages were sent was in the grievor’s name and included his photo. Given this, as the arbitrator put it, “it was completely reasonable for the Hospital to make the initial inference that the grievor had sent the messages.” However, this reasonable initial inference would not be available if the messages were sent anonymously or from a Facebook account with a fake name and photo. Moreover, as the C.H.E.O. case shows, investigators should be cautious in relying on a name or a photo as their only evidence of authenticity since these can be easily faked on social media.

2. Trust, but verify. In the C.H.E.O. case, the grievor was not shown the inappropriate messages since the Hospital did not have a copy at the time he was interviewed. Instead, he was provided with a description of the contents of the messages. The arbitrator found that “[i]t would have been preferable had a further meeting been held with the grievor after the Hospital had received a copy of the messages from the complainant.” Indeed, we recommend that investigators always show social media evidence to the alleged author of that evidence, so that the alleged author can either confirm the authenticity of the evidence or so that they have the opportunity to dispute its authenticity. When the grievor in the C.H.E.O. case saw the Facebook messages during the arbitration, for example, he was able to point out differences between the writing style of the messages and his own writing style.

3. What about the other evidence? Consider whether there is any other evidence that you have already gathered in the investigation that militates for or against the authenticity of the social media evidence. In the C.H.E.O. case, for instance, the grievor admitted to sending the complainant an earlier Facebook message, in which he asked her to meet him for dinner and drinks. The arbitrator found that it was reasonable for the Hospital to conclude that this earlier message supported the inference that the grievor authored the inappropriate messages.

Unlike an arbitrator or a judge, workplace investigators can’t compel Facebook, Twitter or any other social media company to provide us with data that proves or disproves the authenticity of the social media evidence that we receive. However, as with any evidence we receive, by asking questions and considering this evidence in context, we can come to a conclusion about authenticity that is reasonable and rooted in the evidence.


Webinars: Registration is open!

Take our courses across Canada wherever you may be located, all you need is an internet connection and your computer. Click here to view our courses and register.

We recognize that people are at home and trying to find ways to stay connected and up to date on current issues. We will be making our next three webinars COMPLIMENTARY. We want you to have the tools you need to maintain a safe, healthy, and effective workplace environment.


¹ For the purposes of this blog post, I use the term “social media” broadly, to refer not only to social applications like Facebook and Instagram, but also to messenger and video-conferencing applications like Slack, Whatsapp and Zoom.

² 2020 CanLII 6444 (ON LA).