Social media investigations: what a proper online search looks like, and how posts can affect employment decisions

A lot of workplace trouble shows up online before it shows up at work. A threat posted at midnight. A group chat where coworkers mock a colleague. A screenshot of a confidential price list. Photos from a beach the same week someone is out on leave for a back injury. As part of its workplace investigations, Crawford Law conducts social media and internet investigations, because safety and security are essential to your workplace, and because the record online is often the clearest record there is.

Done right, a social media investigation answers a specific question with evidence that will hold its shape. Done wrong, it turns into snooping, creates a new legal problem, or produces screenshots nobody can authenticate.

When online conduct matters at work

• Threats and safety. Statements about violence, weapons, or self-harm, or a fixation on a coworker, need prompt attention. Employers have a general duty to keep the workplace free of recognized hazards, and warning signs often appear online first.
• Harassment between coworkers. Harassment does not stop at the office door. Posts, messages, and group chats aimed at a coworker can contribute to a hostile work environment the company is expected to address.
• Leaks and competition. Confidential information posted publicly, a side business competing for your customers, or a former employee soliciting clients in breach of an agreement. See non-competes and trade secrets and conflicts of interest.
• Leave and injury claims. Activity that contradicts a claimed restriction can matter, but it has to be read carefully. A photo of someone at a concert does not prove they could do their job, and conclusions drawn too quickly look like retaliation.
• Statements about the company. False statements of fact about the business, its people, or its products can be defamation.
• Conduct that reflects on the job. Public posts that are racist, threatening, or harassing can affect customers, coworkers, and the company’s reputation, and can support discipline under a clear, consistently applied policy.

The legal lines a proper search respects

• Public only. A proper search looks at what is publicly available. It does not ask employees for passwords, does not log into anyone’s account, and does not use a fake profile or a friend’s login to get behind privacy settings. Accessing private accounts without authorization can violate the federal Stored Communications Act, and deception creates its own problems, including for lawyers, who may not make false statements or contact a represented person directly.
• Protected activity. Employees have a federally protected right to talk with each other about pay, schedules, safety, and how they are treated, including on social media, and even when they are harsh about it. A post that is concerted complaint about working conditions is not grounds for discipline just because it is unflattering.
• Protected characteristics. Social media reveals religion, pregnancy, health, age, family plans, and political views. Once a decision-maker sees them, it is harder to show they played no part. A proper search filters: the investigator reports what is relevant to the question and leaves the rest out.
• Third-party vendors. If an outside company compiles social media reports on applicants or employees, the Fair Credit Reporting Act can apply, with its consent and notice steps. A narrower federal exception covers investigations of suspected workplace misconduct, with its own conditions, including a summary to the employee after any adverse action.
• Consistency. Searching one person’s accounts and not another’s in the same situation invites a claim that the search itself was discriminatory or retaliatory.

What a proper social media and internet search looks like

1. A defined question. “Did this employee post the threat the complaint describes?” is an investigation. “Let’s see what she is up to” is not. Scope keeps the search relevant, proportionate, and defensible.
2. The right sources. Public social media and messaging content that was shared with the company, news and court records, business filings for a suspected side business, professional licensing boards, and public review sites, depending on the question.
3. Careful capture. Each item is preserved with its full URL, the date and time it was captured, the account and profile it came from, and enough surrounding context to show what it means. Capture tools that record page source and metadata are better than a phone screenshot, and the original is never edited.
4. Authentication. Accounts can be fake, shared, hacked, or impersonated. A good investigator ties the account to the person through more than a name and a profile picture, and notes what remains uncertain. Evidence that cannot be authenticated is hard to use before an agency, an arbitrator, or a court.
5. A filtered report. The decision-maker gets the relevant findings, with sources and capture records, not a dossier of someone’s personal life.
6. The interview still matters. Online evidence is usually where the questions start, not where they end. The employee gets a chance to respond, as in any effective workplace investigation.

When safety is at stake

A credible threat is not a normal investigation. Act first on safety: notify security and law enforcement when there is an immediate risk, decide on interim steps such as paid leave or restricted access, and preserve the evidence as you go. A threat assessment looks at the whole picture, including the words, the context, any fixation on a person or place, and changes in behavior, and the response should follow the facts rather than a reflex. Document each decision and the reason for it.

Turning findings into decisions

A social media finding supports a decision when it is authenticated, relevant to a policy the employee knew about, and handled the same way it has been handled before. Before acting, check it against the questions in any good discipline decision: what exactly did the person do, which rule does it violate, what have you done in similar cases, and does anything about the post make it protected activity? A short written policy on social media, confidential information, and off-duty conduct that affects the workplace, reviewed for NLRA compliance, makes these decisions far easier.

How Crawford Law can help

Social media and internet investigations are part of Crawford Law’s workplace investigation practice: scoped to the complaint, limited to public information, captured and documented so the evidence holds up to scrutiny, and filtered so decision-makers see what is relevant and nothing more. The firm can also review your social media policy, train the people who handle these issues, and help when an online threat needs a fast, measured response. Start with a free call.