Print | Share | Reprint

M&A due diligence and the perils of social media

by contributors Kelley Parker, Justin Hamill and Nick Ramphal, Paul Weiss | Published August 14, 2012 at 1:06 PM

Social media websites that allow users to connect, communicate and share information have become an integral part of social and economic life. Parties conducting M&A-related due diligence have increasingly sought to utilize the trove of substantial and readily available information on social media websites, much of which is not commonly found or accessible via other avenues. In addition to providing a potential buyer with insight into how consumers or competitors perceive a target, information available on these websites can help to identify risks and opportunities associated with a target's business and to assess the accuracy and completeness of due diligence material. Moreover, intelligence that is valuable for integrating the target's business after closing may be gathered about the target's key executives and employees.

However, conducting due diligence through social media sites can be a risky proposition for M&A principals and advisers seeking to keep their intentions private. Digital footprints, or data about an interaction with a website that the website collects and stores, may compromise deal secrecy if exposed. Important aspects of digital footprints may be revealed, for example, where a social media website makes available easily perceptible information about the identity or activity of its users or by hackers that gain unauthorized access to the site's logs or databases. In the context of a public M&A transaction, conjecture resulting from an unmasked digital footprint may lead to frenzied trading and a speculative rise in the target's share price that compromises sensitive negotiations, while creating or exacerbating employee uncertainty and lowering productivity. Moreover, it is not difficult to imagine a scenario where such "informed" guesswork by employees, even low-level employees, leads to allegations of insider trading in circumstances similar to the recent Securities and Exchange Commission action against railroad workers who surmised a takeover of their employer from observations made on the job (see SEC v. Steffes, N.D. Ill., No. 1:10-cv-6266, 1/28/11).

A mix of technical measures and corporate policies can assist M&A principals and their advisers to mitigate the risks involved when conducting due diligence on social media sites.

First, be aware of the privacy policies and settings available on the various social media sites on which you are considering conducting due diligence and select only those sites and settings that will provide anonymity and leave no revealing or suggestive digital footprint. For example, unless visitors actively make their presence known, some social media sites have explicit policies against showing users who have viewed their profiles. However, on other social media sites, a user may be able to see a list of individuals who have recently viewed his or her profile. In order to browse anonymously, users undertaking due diligence may need to adjust the site's default privacy settings, commit to a paid subscription or forgo the opportunity to see who may have viewed their own profile.

Second, a variety of technical devices may mitigate the risk posed by a digital footprint. A buyer, for example, may "anonymize" itself by routing queries on a target through a proxy server, an intermediary that facilitates and obscures communication between the searcher and the website accessed. Anonymizing, however, may only be used to query social media sites that do not require a user to log in. Alternatively, and to the extent allowed by social media sites, a buyer may engage a third-party service provider who, for purposes of concealing the buyer's real query, may run a much broader search that would download a larger set of information than is necessary from the social media site, before performing the true search on its own servers and passing the desired result along to the buyer. Targets, on the other hand, should consider including covenants in the nondisclosure agreement restricting the buyer and its advisers from visiting social media sites for the purpose of evaluating the target or its employees, unless reasonable steps have been taken by these parties to ensure that their diligence activities, and digital footprint, remain anonymous.

Third, in order to manage risk at the enterprise level, businesses that are, or may become, active in the M&A market should establish a social media policy -- a set of rules that informs employees of limitations on their use of social media websites when they are posting information related to their employer. A social media policy may require employees to select the most stringent privacy settings to protect the transfer of confidential information and minimize their digital footprint and may place more rigorous constraints on employees who use social media to transact company-related business.

Fourth and finally, as a matter of effective corporate policy and governance, company executives, M&A principals and their advisers should always bear in mind that there is no more effective precaution against leaks, and eliminating the opportunities for insider trading, than keeping the deal team coordinated and lean with the appropriate firewalls and screens in place.

There are also potential criminal, ethical, contractual and reputational consequences associated with the misuse of social media websites. Depending on the circumstances, use of fictional accounts may be deemed deceptive and, if used by counsel, contrary to professional and ethical obligations. Such acts may also violate a website's contractual terms of use, and while still uncommon, the government has brought criminal charges, under the Computer Fraud and Abuse Act, arguing that Web postings under a fictional account constituted unauthorized access to a computer system (see United States v. Drew, 259 F.R.D. 449, 452 [C.D. Cal. 2009]). Public revelation of such misconduct also risks reputational damage, especially when undertaken by or at the behest of senior executives.

The potential discoverability of evidence relating to social media searches is a source of special concern during contentious or hostile transactions, as such evidence may impact future lawsuits and investigations. Generally, while data on temporary Internet files, search history, caches files and cookies typically are not discoverable, in New York, for example, such data may become discoverable upon a showing of "good cause" or if the evidence could provide foundational support for other admissible evidence (for example, to provide the connection between a user and a specific site).

As such, while social media sites contain a wealth of useful information, M&A principals and advisers should carefully consider which social media sites are used, and then tailor the settings of each site or adopt technologies that are most appropriate for maintaining the privacy of their due diligence efforts and minimizing their digital footprint. Establishing a social media policy, limiting the size of the deal team, carefully drafting the nondisclosure agreement and scrupulously avoiding misrepresentation are further precautions that transacting parties should undertake to mitigate the potential risks to the parties and the transaction.

Kelley Parker is a partner in the corporate department and a member of the mergers and acquisitions, media and entertainment and corporate governance groups at Paul, Weiss, Rifkind, Wharton & Garrison LLP. A partner in Paul Weiss' corporate department, Justin Hamill is a member of the mergers and acquisitions group and the private equity group. Nick Ramphal is an associate at Paul Weiss.

Share:

Telecom, Media & Technology

M&A due diligence and the perils of social media

Free preview

Meet the journalists

Movers & Shakers

Video

Coming back for more

Sectors