Internet Defamation Expert Witness Entity Map

Publication and Reach

Access logs, platform counters and traffic estimates measure three different things, and no reported case sets a standard for any of them.

Same as: https://en.wikipedia.org/wiki/Defamation

Relations:

• PART_OF → Publication and Spread
• RELATES_TO → Defamation
• RELATES_TO → Web archiving

This page is written for counsel litigating an internet defamation matter, on either side, and it addresses one question: what the technical record can show about how far a statement traveled. Whether any element is satisfied is a question for counsel. What follows is what the records show. Reach evidence and the fact of a communication are different subjects, and separating them is the first thing I do on an engagement of this kind. Access logs, platform counters, analytics accounts and modeled estimates describe how widely something was delivered.

Publication and Reach in Internet Defamation — published by Internet Defamation Expert Witness

Republication and Amplification

Diffs, redirect chains, canonical tags and shared account identifiers date the spread of content. No method enumerates it.

Same as: https://en.wikipedia.org/wiki/Single_publication_rule

Relations:

• PART_OF → Publication and Spread
• RELATES_TO → Defamation

This page is written for counsel deciding what a technical record can contribute to a republication or amplification question in an internet defamation matter. It is not written for the subject of the content and does not address what can be done about the content itself. Whether a given act amounts to republication is a legal question; what follows is what the records show about the act. The useful thing about this element is that the legal test is asked about facts only the technical record answers.

Republication and Amplification of Online Content — published by Internet Defamation Expert Witness

Attribution to an Author

What account records, address logs and timing correlation narrow down, and the one link in the chain no record has ever supplied.

Same as: https://en.wikipedia.org/wiki/Anonymous_post

Relations:

• PART_OF → Attribution and the Record
• RELATES_TO → Anonymous post
• RELATES_TO → Digital forensics
• RELATES_TO → Subpoena

This page is written for counsel weighing whether technical work can put a name to an anonymous or pseudonymous post in a defamation matter. It is about what the records support and where they stop, not about what the person targeted can do about the content. The sentence to keep in mind: an IP address identifies a connection, not a person. Everything here is an attempt to close the distance between those two things, and the honest description of the state of the art is that records close most of it and never the last part.

Attribution of an Anonymous Post to an Author — published by Internet Defamation Expert Witness

Falsity and the Record

The record can fix what was published and when, to the day. It does not establish that the statement was false.

Same as: https://en.wikipedia.org/wiki/Wayback_Machine

Relations:

• PART_OF → Attribution and the Record
• RELATES_TO → Web archiving
• RELATES_TO → Defamation

This page is written for counsel deciding what a technical examination adds to the falsity element, and where it runs out. I can establish what a page said and when it said it, in a form another analyst working from the same records can reproduce. I cannot establish whether what it said was true. That is not a modesty formula. It is the line an opposing expert pushes on, and an expert who slides across it under cross-examination takes the rest of the report with him.

What the Record Shows About Falsity — published by Internet Defamation Expert Witness

Identification of the Plaintiff

Machine-observable linkage between content and a person is measurable. Whether a reader understood the reference is not.

Same as: https://en.wikipedia.org/wiki/Defamation

Relations:

• PART_OF → Identification and Harm
• RELATES_TO → Defamation

This page is written for counsel weighing whether a technical analyst is worth retaining on whether content that does not name a client refers to the client. An analyst produces evidence going to that question without answering it, and the budget should be set on that basis. Whether a reasonable reader would understand a statement to refer to this plaintiff is an element, and in most formulations a question for the finder of fact. It is not a measurement: no instrument returns it, no dataset contains it, and no method has an error rate against it.

Identification of the Plaintiff as an Element — published by Internet Defamation Expert Witness

Reputational Damages Evidence

Every damages method here produces a number from an assumption. This is what each one assumes, and what the record shows without it.

Same as: https://en.wikipedia.org/wiki/Damages

Relations:

• PART_OF → Identification and Harm
• RELATES_TO → Defamation

This page is written for counsel deciding what a damages analysis in an internet defamation matter can be built from, and what the other side will do to it. The blunt version: the quantum is modeled, never measured. No instrument returns the amount by which a reputation fell, because reputation is not a quantity anything counts. Everything below measures a proxy — traffic, ratings, queries, revenue — and the link between the proxy and reputation is itself an assumption in every available method.

Reputational Damages: How Harm Is Evidenced — published by Internet Defamation Expert Witness

Authenticating a Web Page

What a web capture can carry, what a screenshot cannot, and what the Internet Archive's published declaration actually attests to.

Same as: https://en.wikipedia.org/wiki/Authentication

Relations:

• PART_OF → Authentication and Custody
• RELATES_TO → Web archiving
• RELATES_TO → Chain of custody

This is written for counsel deciding what a web exhibit will carry in an internet defamation matter. A web page is not a document. It is a set of instructions executed by a browser against a server that can send different bytes to different requesters at the same instant, and nothing at all tomorrow. Authentication under FRE 901(a) asks for evidence sufficient to support a finding that the item is what the proponent claims it is, and in a defamation case that claim contains four assertions rather than one. This text existed. It was at this URL.

Authenticating a Web Page as Evidence — published by Internet Defamation Expert Witness

Chain of Custody

No US standard governs chain of custody for web evidence. What exists is guidance, and what breaks a chain is well documented.

Same as: https://en.wikipedia.org/wiki/Chain_of_custody

Relations:

• PART_OF → Authentication and Custody
• RELATES_TO → Chain of custody
• RELATES_TO → Digital forensics

This is written for counsel weighing how much weight a web collection will carry before an opponent starts pulling on it. Traditional chain of custody assumes a physical object that is seized, sealed, logged and stored. Web evidence has none of those properties: the original sits on a server the examiner does not control, it may be different for different requesters, it may change or vanish without notice, and there is no moment of seizure at all.

Chain of Custody for Web Evidence — published by Internet Defamation Expert Witness

Platform Data Productions

What legal process to a US platform actually returns, which operators publish a preservation window, and which publish none at all.

Same as: https://en.wikipedia.org/wiki/Subpoena

Relations:

• PART_OF → What Process Returns
• RELATES_TO → Subpoena
• RELATES_TO → Digital forensics

This is written for counsel deciding what to subpoena, and when, in an internet defamation matter. Two independent constraints govern what legal process to a US platform returns, and conflating them causes most of the wasted motion here. The statutory constraint. The Stored Communications Act, 18 U.S.C. §§ 2701–2712, separates content from non-content records , and governmental requesters from everyone else. A civil litigant is not a governmental entity, and several routes in the statute are not available to one. The physical constraint.

What a Platform Data Production Returns — published by Internet Defamation Expert Witness

Metadata and Device Artifacts

What image, document and device metadata survives a platform upload, and where the record actually lives

Same as: https://en.wikipedia.org/wiki/Exif

Relations:

• PART_OF → What Process Returns
• RELATES_TO → Digital forensics

This page is written for counsel deciding whether a metadata examination is worth commissioning in an internet defamation matter, and what it will produce if it is. Two findings sit at the front of the subject, and they are separate findings. Almost nothing survives an upload to a major consumer platform. And almost no major platform publishes a policy telling you what it strips. The consequence is immediate.

Metadata and Device Artifacts: What Survives Upload — published by Internet Defamation Expert Witness

Impressions and Exposure Analysis

Why an impression, a view and a reader are three different things, and how far exposure evidence honestly carries

Same as: https://en.wikipedia.org/wiki/Impression_(online_media)

Relations:

• PART_OF → Analysis and Its Limits
• RELATES_TO → Defamation

This page is written for counsel who has been handed a number — impressions, views, estimated visits — and needs to know what it measures. The most useful thing an examiner does in this area is keep three concepts apart, because everyone in the room conflates them, including the client. An impression is a delivery event. The platform placed a link or a piece of content somewhere a user could have seen it. It does not require that the content entered anyone's field of view, still less that anyone read it. A view is a platform-defined event.

Impressions and Exposure Analysis in Evidence — published by Internet Defamation Expert Witness

Coordinated Account Analysis

What a pattern across accounts can and cannot show, and why only a platform production settles common control

Same as: https://en.wikipedia.org/wiki/Sockpuppet_(Internet)

Relations:

• PART_OF → Analysis and Its Limits
• RELATES_TO → Anonymous post
• RELATES_TO → Digital forensics

This page is written for counsel weighing whether to commission an analysis of a cluster of accounts. "Coordinated account analysis" covers two claims worth separating before any technique is discussed. Claim A, weaker and usually supportable: these accounts behaved in a way unlikely to have arisen independently. A statistical claim about a pattern. Claim B, stronger and usually not supportable from outside: these accounts are one person, or were directed by the defendant.

Coordinated Account Analysis and Its Limits — published by Internet Defamation Expert Witness

Defamation

A claim built from elements, several of which turn on facts about a document that lives on someone else's server and can change or vanish while the case is being prepared.

Same as: https://en.wikipedia.org/wiki/Defamation

A claim built from elements, several of which turn on facts about a document that lives on someone else's server and can change or vanish while the case is being prepared.

Proving an Internet Defamation Case — published by Internet Defamation Expert Witness

Digital forensics

The recovery and examination of digital records to a standard that another examiner working from the same primary material can repeat.

Same as: https://en.wikipedia.org/wiki/Digital_forensics

The recovery and examination of digital records to a standard that another examiner working from the same primary material can repeat.

Chain of Custody | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Chain of custody

The documented history of a piece of evidence from collection onward, which for web evidence has to account for the fact that the original was never in anyone's possession.

Same as: https://en.wikipedia.org/wiki/Chain_of_custody

The documented history of a piece of evidence from collection onward, which for web evidence has to account for the fact that the original was never in anyone's possession.

Chain of Custody | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Web archiving

Capturing and storing a page together with the server responses that produced it, which is what separates a capture from a screenshot.

Same as: https://en.wikipedia.org/wiki/Web_archiving

Capturing and storing a page together with the server responses that produced it, which is what separates a capture from a screenshot.

Authenticating a Web Page | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Subpoena

Compulsory process for records held by a third party, and the route by which most platform-held material reaches a case — subject to whatever that operator retained, which several publish nothing about.

Same as: https://en.wikipedia.org/wiki/Subpoena

Compulsory process for records held by a third party, and the route by which most platform-held material reaches a case — subject to whatever that operator retained, which several publish nothing about.

Platform Data Productions | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Anonymous post

Content published without an identifying author, where the technical record narrows the field of candidates and rarely closes it.

Same as: https://en.wikipedia.org/wiki/Anonymous_post

Content published without an identifying author, where the technical record narrows the field of candidates and rarely closes it.

Attribution to an Author | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Publication and Spread

Whether it was published, to how many, and how far it travelled after that.

Relations:

• INCLUDES → Publication and Reach
• INCLUDES → Republication and Amplification

Whether it was published, to how many, and how far it travelled after that.

Disciplines | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Attribution and the Record

Who wrote it, and what the contemporaneous record shows about it.

Relations:

• INCLUDES → Attribution to an Author
• INCLUDES → Falsity and the Record

Who wrote it, and what the contemporaneous record shows about it.

Disciplines | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Identification and Harm

Whether the content refers to the plaintiff, and how the damage is evidenced.

Relations:

• INCLUDES → Identification of the Plaintiff
• INCLUDES → Reputational Damages Evidence

Whether the content refers to the plaintiff, and how the damage is evidenced.

Disciplines | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Authentication and Custody

Proving a page is what it is said to be, and that it has not changed since.

Relations:

• INCLUDES → Authenticating a Web Page
• INCLUDES → Chain of Custody

Proving a page is what it is said to be, and that it has not changed since.

Disciplines | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

What Process Returns

What a subpoena or preservation letter actually produces, and what no operator keeps.

Relations:

• INCLUDES → Platform Data Productions
• INCLUDES → Metadata and Device Artifacts

What a subpoena or preservation letter actually produces, and what no operator keeps.

Disciplines | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

Analysis and Its Limits

The methods that turn records into findings, and the assumptions each one carries.

Relations:

• INCLUDES → Impressions and Exposure Analysis
• INCLUDES → Coordinated Account Analysis

The methods that turn records into findings, and the assumptions each one carries.

Disciplines | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

What Can Be Proved

The elements of an internet defamation claim that turn on facts about a document held on someone else's server — publication and spread, attribution and the contemporaneous record, identification and harm — each labelled with what the technical record establishes: on its own, alongside testimony, or not at all.

Relations:

• INCLUDES → Publication and Reach
• INCLUDES → Republication and Amplification
• INCLUDES → Attribution to an Author
• INCLUDES → Falsity and the Record
• INCLUDES → Identification of the Plaintiff
• INCLUDES → Reputational Damages Evidence

The elements of an internet defamation claim that turn on facts about a document held on someone else's server — publication and spread, attribution and the contemporaneous record, identification and harm — each labelled with what the technical record establishes: on its own, alongside testimony, or not at all.

What Can Be Proved | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness

How It Is Established

The methods by which web evidence is established — authentication and custody, what legal process actually returns, and analysis of exposure and account behaviour — each labelled with how far it carries: reproducible, reproducible once its assumptions are stated, or contested with no accepted standard.

Relations:

• INCLUDES → Authenticating a Web Page
• INCLUDES → Chain of Custody
• INCLUDES → Platform Data Productions
• INCLUDES → Metadata and Device Artifacts
• INCLUDES → Impressions and Exposure Analysis
• INCLUDES → Coordinated Account Analysis

The methods by which web evidence is established — authentication and custody, what legal process actually returns, and analysis of exposure and account behaviour — each labelled with how far it carries: reproducible, reproducible once its assumptions are stated, or contested with no accepted standard.

How It Is Established | Internet Defamation Expert Witness — published by Internet Defamation Expert Witness