Did a Printout of a Facebook Stories Archive Become the Basis for an Alleged Parole Violation?

Last week I expressed my dismay over a recent development in one of the cases I've been following.

A man who had just been released from pretrial detention was returned to custody. The allegation: He violated the terms of his parole by visiting the Facebook page of the person who filed a complaint that, four years later, resulted in a "time served" agreement.

As I reported last week, Facebook does not track who visits a user's profile, timeline, pictures or posts. My reporting then asked a simple question: How could someone be returned to custody over activity that the platform itself says it does not track?

Within an hour of hitting the publish button on that story, I received an email from the FOIA officer at the municipal police agency where the complainant filed the report.

It contained a link to the responding officer's body-camera footage.

I was surprised by the speedy turnaround.

Then I watched the footage.

What it revealed left my head spinning.

And it led to a new question:

What's the protocol for reviewing digital evidence in an alleged parole violation?

As I reported last week, based on the records I reviewed, the parole revocation process was initiated before investigators reviewed the responding officer's body-camera footage or the alleged "screenshot proof" that the accused person violated a no contact order by visiting the social media page of a person protected by a court order.

The amount of time spent evaluating the screenshot during the hour-long interaction between the complainant and the responding patrol officer raises questions about the protocol for examining alleged digital evidence.

Complainant: "He went on my Facebook. That's considered stalking."

Officer: "When did he do that?"

Complainant: "This morning."

Officer: "From where?"

Complainant: "From his phone, I guess."

Officer: "How do you know he was on your Facebook?"

Complainant: "Because I printed out him looking at my page.... That was this morning. I screenshotted it and now when I look on my Facebook page it's no longer popping up."

Officer: "So this occurred this morning?"

Complainant: "Right."

After spending roughly thirty seconds looking at the printout, the officer began typing the complainant's account into a laptop inside his squad car.

To be fair, the officer did ask several follow-up questions. But by the twenty-first minute of the encounter he appeared to have reached a conclusion before any independent review of the alleged digital evidence is apparent in the body-camera footage.

"He violated the order of protection," the officer said. "He committed a crime."

But the image itself tells a different story.

Although portions of the recording were redacted, reviewing the footage frame by frame allowed me to capture several still images of the document as it was handled during the encounter.

The document's layout immediately caught my attention.

As I explained last week, Facebook does not tell users who has viewed their profile, timeline or posts.

But last spring, Meta began rolling out a feature that allows users to see who viewed their Facebook Stories—short photo, video or text collections that disappear after 24 hours.

Although Stories disappear from public view, Facebook preserves them in a private Stories archive, where the viewer list remains attached to each archived Story.

The printout shown in the body-camera footage is consistent with that archive. It displays a series of Story thumbnails followed by profile icons and screen names associated with people who viewed those Stories while they were live.

The accused person's screen name appears in the viewer list and is identified as a "non-follower."

That phrase may sound ominous, but on Facebook it often is not. A "non-follower" is simply someone who viewed a public Story without following the creator's account. That person could be a friend, family member, casual acquaintance, or someone who discovered the Story through Facebook's recommendations or because another user shared it. By itself, the designation "non-follower" does not suggest suspicious or prohibited activity.

In fact, Meta routinely recommends public Stories to people who do not follow a creator's account in an effort to expand reach and engagement. Many content creators actively monitor Story viewer lists because they provide insight into audience reach, including views from people who do not already follow their accounts.

"The question raised by this investigation is not simply whether the printout is authentic. It is whether it has been correctly interpreted."

One characteristic of the archived viewer list stood out during my review. Based on Facebook documentation, story archives don't display when a story was originally published. So, someone reviewing only a printout could assume it documented a recent viewing rather than an archived Story.

But the content depicted in the thumbnails may help investigators determine when the Story was originally published. In this case, the Story in the printout appears to have been published many months—and perhaps years—before the conflict between the parties, based on my earlier reporting on this case.

Another detail caught my attention.

The complainant told police the viewing had occurred that morning.

But the profile picture displayed beside the accused person's screen name appears to match an earlier Facebook profile picture—not the new one he began using in the weeks after his release from pre-trial detention.

Rather than rely solely on a paper printout, the next logical investigative step would be to obtain the original digital image. Examining the file's metadata could establish when the screenshot itself was created. Reviewing the complainant's Stories archive could also help determine when the Story depicted in the printout was originally published.

Based on the records I have reviewed, I found no indication that investigators collected the printout as evidence, obtained the original digital image, or examined its metadata.

Likewise, I found no indication that investigators consulted Meta, requested technical assistance, or sought a digital forensic review before relying on the material during the parole revocation process.

Whether these observations ultimately confirm or refute the allegation is a question that should be answered through digital evidence—not assumption.

But they do raise important questions about how social media evidence is interpreted during parole investigations and whether investigators have the tools—or believe they need the tools—to evaluate alleged digital evidence.

My reporting now focuses on several questions:

• Why wasn't the original digital image collected and its metadata reviewed?
• Why wasn't the complainant's Stories archive examined?
• Why didn't investigators consult Meta's documentation or anyone with digital forensic expertise before relying on the printout?
• What standards, if any, govern the evaluation of alleged social media evidence during Illinois parole investigations?

I have part of an answer.

I submitted a FOIA request seeking:

"All guidance, training, or written standards Illinois parole agents and the Prisoner Review Board use when evaluating digital evidence."

The Prisoner Review Board responded:

"Please be advised that after conducting a reasonable search, the Prisoner Review Board located no records responsive to your request. Additionally, regarding your request concerning parole agents, please note that parole agents are employed by the Illinois Department of Corrections, not the Prisoner Review Board. The Prisoner Review Board cannot speak on behalf of the Illinois Department of Corrections' trainings and standards."

In other words, the agency responsible for deciding parole violations says it has no records describing how digital evidence should be evaluated and directed my request to the Illinois Department of Corrections.

These questions matter beyond this one case.

As courts, parole agencies and law enforcement increasingly rely on digital evidence to evaluate alleged no-contact violations, understanding what a social media record actually represents is just as important as obtaining it in the first place.

The difference between a historical archive and evidence of current online activity may determine whether a person's liberty is preserved—or taken away.

My reporting isn't over. If you were conducting this investigation, what records would you request next?