Somuchdata: How Upcoming FRE 902 Amendments Will Impact Data Collection and Authentication

NAPABA Conference

#SoMuchData: How Upcoming FRE 902 Amendments Will Impact Data Collection and Authentication

Panelists: Moderator: Rishi Chhatwal, AT&T Services, Inc. Erica Yen,, Reed Smith LLP Melissa DeHonney, Novo Nordisk, Inc. Hon. Paul Grimm, U.S. District Court, Dist. of Md. Keiko Sugisaka, Maslon LLP

November 3, 2017 Today’s Agenda

• Overview: How is this topic relevant to my practice? • Current vs. Amended Rule of Evidence 902(13) and (14) • Benefits and Limitations of New Rules • Expected Impact and Application in Legal Practice • Audience Q&A

2 Reed Smith LLP #SoMuchData in The Zettabyte Era

• Size of the digital universe will double every 2 years at least • 50-fold growth from 2010-2020

Data Never Sleeps 4.0, Domo.com (June 28, 2016) 3 Reed Smith LLP #SoMuchData Used as Evidence in Court Cases

4 Reed Smith LLP Federal Rule of Evidence 902(13) & (14) – Current Status

Evidence Rules Evidence Rules Committee Electronic Committee Expected Effective recommends Standing Evidence recommends issuance Date Committee send to Judicial Symposium for public comment) (Dec. 1, 2017 ) (April 2014) (Spring 2015) Conference (March 2016)

Evidence Rules Standing Supreme Court adopts Committee drafts Committee recommendation and amendment and approves transmits to Congress notes (Fall 2014) (June 2015) (April 2017)

Best Practices Manual Review by Public Comments Supreme Court 2014 2015 2016 2017 “Retroactive” effect for digital evidence properly collected prior to 12/1/17 5 Reed Smith LLP Current Federal Rule of Evidence 902

• Rule 902. Evidence that is Self-Authenticating • Examples of evidence that are self- authenticating: • Records kept in the ordinary course of business and certified • Official government publications or certified public records • Sealed and/or notarized documents • Published newspapers and periodicals • Rule 902 is routinely relied on by trial attorneys in civil and criminal matters

6 Reed Smith LLP Evolution and Purpose of Amendments

Evidence Rules Standing Supreme Court adopts Committee drafts Committee recommendation and amendment and approves transmits to Congress notes (Fall 2014) (June 2015) (April 2017)

Best Practices Manual Review by Public Comments Supreme Court 2014 2015 2016 2017 “Retroactive” effect for digital evidence properly collected prior to 12/1/17 7 Reed Smith LLP Need for Amendments to F.R.E. 902 • Challenges with Different Data Formats and Sources • Emails • Text Messages • Voicemails • Instant Messages • Websites • Social Media

8 Reed Smith LLP Self-Authenticating Evidence Under the New Amendments

• Rule 902(13): • Rule 902(14): • A record generated by an • Data copied from an electronic process or electronic device, storage system that produces an medium, or file, if accurate result authenticated by a process of digital identification

• as shown by a certification of a qualified person • notice requirements

9 Reed Smith LLP Federal Rule of Evidence 902(13) and (14) – Certification Requirements • Written affidavit by “qualified person”

10 Reed Smith LLP Certification Requirements Referenced in New Amendments

• Rule 902. Evidence that is Self-Authenticating • (11) Certified Domestic Records of a Regularly Conducted Activity. • (12) Certified Foreign Records of a Regularly Conducted Activity.

• Rule 803. Exceptions to the Rule Against Hearsay • (6) Records of a Regularly Conducted Activity. A record of an act, event, condition, opinion, or diagnosis…

11 Reed Smith LLP Notice Requirements Referenced in New Amendments • Notice Requirement of Rule 902(11) • Before the trial or hearing • Reasonable written notice of the intent to offer the record • Record and certification available for inspection • Provide fair opportunity to challenge

12 Reed Smith LLP Committee Note to FRE 902(14) – Process of Identification • Hash identification and hash values • Accounts for future technology “other than comparison of hash value” that could provide “other reliable means of identification”

13 Reed Smith LLP Limitations of 902(13) and (14)

• Rule only addresses authentication of the evidence • Does not establish accuracy • Does not establish relevance • Does not establish ownership or control • Does not overcome any hearsay objection

14 Reed Smith LLP Limitations of 902(13) and (14) • Example: A party wishes to introduce an internet web page into evidence • The certification will be sufficient to establish (absent advance objections by the opposing party), that the web page is what the proponent says – a particular web page that was posted at a particular time. • The certification will not be sufficient to establish that the substance of the message on the web page is accurate.

15 Reed Smith LLP Admissibility of Electronic Evidence

• Lorraine v. Markel American Ins. Co., 241 F.R.D. 534 (D. Md. May 4, 2007) • In dispute about insurance claim for yacht damage from lightning, both sides’ summary judgment motions were dismissed because each side attached emails without authentication

16 Reed Smith LLP Benefits of 902(13) and (14)

• Eliminates need for a separate authentication • Allows easier authentication of electronic evidence • Reduces expense

17 Reed Smith LLP Application of Evidence Rule 902(13)

Example: Windows registry database used to prove that USB device was connected to a computer in hypothetical civil or criminal case

Compare: • Without Rule 902(13) • With Rule 902(13)

18 Reed Smith LLP Application of Evidence Rule 902(14) Example: Four text messages sent from Suspect to #1 to Suspect #2 in conspiracy to commit bank robbery Compare: • Without Rule 902(14) • With Rule 902(14)

19 Reed Smith LLP Challenges to Authenticity • Shifts burden for raising authenticity issues • “…may require technical information about the system or process at issue, including possibly retaining a forensic technical expert at trial.” • “Parties can determine in advance of trial whether a real challenge to authenticity will be made, and can then plan accordingly.

20 Reed Smith LLP Expected Impact of Rules 902(13) and (14)

• Will ESI collection practitioners (service providers, in-house counsel, law enforcement) see increased utilization? • More certifications, less testimony? • Fewer challenges to authenticity? • New basis for challenging authenticity? • Affect best practices for handling data? • Should we expect state courts to adopt similar rules?

21 Reed Smith LLP Questions?

Thank You!

22 Reed Smith LLP Authentication of Social Media Evidence

Honorable Paul W. Grimm† Lisa Yurwit Bergstrom†† Melissa M. O’Toole-Loureiro†††

Abstract The authentication of social media evidence has become a prevalent issue in litigation today, creating much confusion and disarray for attorneys and judges. By exploring the current inconsistencies among courts’ decisions, this Article demonstrates the importance of the interplay between Federal Rules of Evidence 901, 104(a), 104(b), and 401—all essential rules for determining the admissibility and authentication of social media evidence. Most importantly, this Article concludes by offering valuable and practical suggestions for attorneys to authenticate social media evidence successfully.

Introduction

Ramon Stoppelenburg traveled around the world for nearly two years, visiting eighteen countries in which he “personally met some 10,000 people on the road, slept in 500 different beds, ate some 1,500 meals[,] and had some 600 showers,” without spending any money.1 Instead, his blog, Let-Me-Stay-For-A-Day.com, fueled his travels.2 He spent time each evening updating the blog, encouraging people to invite him to stay

† B.A. (1973), University of California; J.D. (1976), University of New Mexico School of Law. Paul W. Grimm is a District Judge serving on the United States District Court for the District of Maryland. In September 2009, the Chief Justice of the United States appointed Judge Grimm to serve as a member of the Advisory Committee for the Federal Rules of Civil Procedure. Judge Grimm also chairs the Advisory Committee’s Discovery Subcommittee. †† B.A. (1998), Amherst College; J.D. (2008), University of Baltimore School of Law. Ms. Bergstrom is a law clerk in Judge Grimm’s office. ††† B.A. (2008), University of Maryland; J.D. (2012), University of Baltimore School of Law. Ms. O’Toole-Loureiro is a law clerk in Judge Grimm’s office. The views expressed in this Article are those of the authors and not the United States District Court for the District of Maryland. 1 Ramon Stoppelenburg, LET-ME-STAY-FOR-A-DAY.COM, http://www.letmestayfor aday.com (last visited June 2, 2013). 2 Id. 434 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 at their houses in exchange for having him blog about his experiences with them.3 He accepted donations from companies (plane tickets, clothes, mobile services) in exchange for providing advertising space and shout-outs on his website.4 Essentially, through online communications, Stoppelenburg bartered time, entertainment, and publicity for all of his travel expenses,5 and he was featured as the Wikipedia “Leisure example” of social media usage.6 “Social media,” a relatively new term dating back only to 2004, is defined as “forms of electronic communications (as websites for social networking and microblogging) through which users create online communities to share information, ideas, personal messages, and other content (as videos).”7 Social media allows individuals and organizations to use the Internet to create and exchange “User Generated Content” that is “continuously modified by all users in a participatory and collaborative fashion.”8 Content is user generated if it (1) is “published either on a publicly accessible website or on a social networking site accessible to a selected group of people,” as opposed to e-mailed; (2) “show[s] a certain amount of creative effort,” rising above republication of existing content; and (3) is “created outside of professional routines and practices” such that it was not intended for a “commercial market.”9 Social media offers individuals opportunities for interactions with others and further offers companies and organizations opportunities to advertise their products or services.10

3 Id. 4 Id.; Ramon Stoppelenburg, W IKIPEDIA, http://en.wikipedia.org/wiki/Ramon_ Stoppelenburg (last modified Mar. 17, 2013, 8:14 PM). 5 See Stoppelenburg, supra note 1. 6 See Social Media, W IKIPEDIA, http://en.wikipedia.org/wiki/Social_media (last visited Sept. 21, 2011); see also W IKIPEDIA, supra note 4. 7 Definition of Social Media, MERRIAM-W EBSTER, http://www.merriam-webster .com/dictionary/social%20media# (last visited June 2, 2013). 8 Andreas M. Kaplan & Michael Haenlein, Users of the World, Unite! The Chal- lenges and Opportunities of Social Media, 53 BUS. HORIZONS 59, 61 (2010). 9 Id. 10 See id. at 64 (“Virtual social worlds offer a multitude of opportunities for companies in marketing (advertising/communication, virtual product sales/v-Commerce, marketing research), and human resource and internal process management . . . .”). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 435

The better-known forms of social media include weblogs, social networking sites, content communities, collaborative projects or “wikis,” and virtual worlds.11 Weblogs, commonly called “blogs,” are reincarna- tions of what once were known as “personal web pages” and “usually display date-stamped entries in reverse chronological order.”12 Blogs typically provide either “commentary or news on a particular subject” or personal accounts of the blogger’s life, and “[t]he ability for readers to leave comments in an interactive format is an important part of many blogs.”13 On microblogs, such as Twitter, users post and read “tweets”— very brief “text-based posts . . . displayed on the author’s profile page and delivered to the author’s subscribers.”14 Content communities enable users to share media content such as videos on YouTube and photographs on Flickr, and collaborative projects such as Wikipedia “enable the joint and simultaneous creation of content by many end-users.”15 Virtual worlds, which include social worlds such as Second Life and game worlds such as World of Warcraft, “replicate a three-dimensional environment in which users can appear in the form of personalized avatars and interact with each other as they would in real life.”16 “Social networking” is the term for “building online communities of people who share interests or activities, or who are interested in exploring the interests and activities of others.”17 Social networking encompasses using sites such as Facebook and MySpace to “keep in touch” and “to have a presence on the web without needing to build a website” and using “business-oriented social networking site[s]” such as LinkedIn “for professional networking.”18 Through social networking sites, users may “creat[e] personal information profiles, invit[e] friends and colleagues

11 Id. at 62-64. 12 Id. at 63. 13 U.S. JUDICIAL CONFERENCE COMM. ON CODES OF CONDUCT, RESOURCE PACKET FOR DEVELOPING GUIDELINES ON USE OF SOCIAL MEDIA BY JUDICIAL EMPLOYEES, 10- 11 (2010) [hereinafter RESOURCE PACKET], available at http://www.uscourts.gov/ uscourts/RulesAndPolicies/conduct/SocialMediaLayout.pdf. 14 Id. at 11. 15 Kaplan & Haenlein, supra note 8, at 62-63. 16 Id. at 64. 17 RESOURCE PACKET, supra note 13, at 9. 18 Id. at 9-10. 436 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 to have access to those profiles” and, in some instances, communicate by posting information on their own profiles and allowing others to do the same, including “sending e-mails and instant messages between each other.”19 In the past, Stoppelenburg’s approach to social media during his travels may have seemed extreme—a hyperbole of the average person’s or business’s social media usage. Yet, “participation in social computing is now a daily fact of life for more than 400 million people,” and “[u]ntil recently, most Internet users were mere ‘consumers’ of content; now many are creating their own content and interacting with other users.”20 For example, Facebook’s Chief Executive Officer, Mark Zuckerberg, recently announced that “more than one billion people” worldwide are now using Facebook each month—approximately “one out of every [seven] people on the planet.”21 Moreover, the Pew Research Center reports that 66% of all adults with Internet access use various “social media platforms such as Facebook, Twitter, MySpace[,] or LinkedIn.”22 While young adults remain “the heaviest users of social networking” (86% reported in 2010), “[s]ocial networking use among [I]nternet users ages 50 and older . . . nearly doubled” in 2010.23 The increasing prevalence of social media use amongst all demographics caught the attention of the 2012 Presidential candidates, President Barack Obama and Governor Mitt Romney.24 Their respective campaign staffs used social networking and social media to connect with voters at unprece-

19 Kaplan & Haenlein, supra note 8, at 63. 20 RESOURCE PACKET, supra note 13, at 5. 21 Aaron Smith et al., Facebook Reaches One Billion Users, CNNMONEY (Oct. 4, 2012, 9:50 AM), http://money.cnn.com/2012/10/04/technology/facebook-billion-users/ index.html?hpt=hp_bn5 (internal quotation marks omitted). 22 Aaron Smith, Why Americans Use Social Media, PEW INTERNET, 2 (Nov. 14, 2011), http://pewinternet.org/~/media//Files/Reports/2011/Why%20Americans%20 Use%20Social%20Media.pdf. 23 Mary Madden, Older Adults and Social Media, PEW INTERNET, 2 (Aug. 27, 2010), http://pewinternet.org/~/media//Files/Reports/2010/Pew%20Internet%20-%20 Older%20Adults%20and%20Social%20Media.pdf. 24 See Jenna Wortham, Winning Social Media Votes, N.Y. TIM ES, Oct. 8, 2012, at B1, available at 2012 WLNR 21297954 (“Campaigns of Pres[.] Obama and Mitt Romney are pursuing online audiences with new intensity; seeking out votes from citizens, particularly younger ones . . . .”). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 437 dented levels throughout the campaign.25 They just might be onto something: during the October 3, 2012 presidential debate, Twitter users posted 10.3 million tweets in a mere ninety minutes.26 After Governor Romney mentioned “Big Bird,” the star of the popular children’s show Sesame Street, during the debate, 17,000 tweets per minute appeared referencing Big Bird and 10,000 tweets per minute referenced PBS, the channel hosting the show.27 Social media is ubiquitous, and it is here to stay. The base elements of Stoppelenburg’s social media use were the same: he reached out to others; he communicated frequently; he made “friends”; he documented his activities; and his site provided advertising space.28 More importantly, his considerations of the legal implications of his blogging may be akin to the average person’s thoughts on how social media could play a role in a possible future lawsuit or criminal case— negligible, at best. The possibilities, however, are endless. Social media usage has formed the basis for lawsuits and criminal prosecutions. For example, a former prosecutor now faces felony charges due to an allegedly threatening rant he posted on Facebook about his former employer,29 and an NBA referee recently sued the Associated Press and a sports writer for defamation, claiming that the writer’s Twitter message harmed “his professional reputation” as a referee and “led to a disciplinary investiga- tion by the NBA.”30 Moreover, printouts of electronic files from social media websites—especially blog and social networking websites—are increasingly relevant to many areas of litigation, ranging from criminal

25 See id.; see also Jenna Wortham, Campaigns Use Social Media to Lure Younger Voters, N.Y.TIM ES.COM (Oct. 7, 2012), http://www.nytimes.com/2012/10/08/ technology/campaigns-use-social-media-to-lure-younger-voters.html?amp&_r=0. 26 Catherine Clifford, What You Can Learn About Social Media from Big Bird, ENTREPRENEUR.COM (Oct. 8, 2012, 4:50 PM EST), http://www.nbcnews.com/id/ 49334469#.UZPxVrvLi9s. 27 Id. 28 See Stoppelenburg, supra note 1. 29 Louis Hansen, Ex-Norfolk Prosecutor Charged over Facebook Posts, PILOTONLINE.COM (July 27, 2012), http://hamptonroads.com.nyud.net/2012/07/ exnorfolk-prosecutor-charged-after-facebook-post. 30 Associated Press, Bill Spooner Sues AP Writer over Tweet, ESPN (Mar. 15, 2011, 6:30 PM), http://sports.espn.go.com/nba/news/story?id=6218678. 438 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 cases31 to personal injury cases32 and even employment discrimination.33 Attorneys frequently seek relevant social media content in discovery, and the content is often subject to a civil litigant’s common law duty to preserve evidence relevant to a foreseeable lawsuit.34 One should expect social media evidence to be offered in any litigation that involves the state of mind, intent, or motives of the parties. Jurors, attorneys, and even judges may use social media in conjunction with a case.35 In short, lawyers and judges who lament the explosion of social media use and the evidentiary challenges social media presents when offered as evidence need to, in the vernacular of any teenaged Facebook user, just get over it. This Article is intended to help them to do just that. Here, we focus on the authentication of social media evidence at civil and criminal trials.36 Part I discusses the case law to date. In Part II, we discuss the factors governing the authentication of social media evidence. Part III provides a checklist to assist lawyers and judges in analyzing authentication issues relating to social media. The focus of this Article is the authentication of social media evidence, rather than the broader subject of its overall admissibility. The oft-cited

31 See generally, e.g., State v. Gurney, No. CR-2009-4017, 2010 WL 3830832 (Me. Super. Ct. July 12, 2010) (order denying motions to suppress evidence, including evidence contained on the defendant’s Facebook account). 32 See generally, e.g., Romano v. Steelcase Inc., 907 N.Y.S.2d 650 (N.Y. Sup. Ct. 2010) (order in personal injury case granting defendant’s motion for access to plaintiff’s Facebook and MySpace accounts). 33 See generally, e.g., Equal Emp’t Opportunity Comm’n v. Simply Storage Mgmt., LLC, 270 F.R.D. 430 (S.D. Ind. 2010) (order ruling on discovery issues, including whether the plaintiffs had to produce their MySpace and Facebook profiles). 34 See, e.g., Victor Stanley, Inc. v. Creative Pipe, Inc., 269 F.R.D. 497, 521 (D. Md. 2010) (order granting in part and denying in part plaintiff’s motion for sanctions against defendant for spoliation of electronically stored evidence) (“The common law imposes the obligation to preserve evidence from the moment that litigation is reasonably anticipated.”). 35 See generally, e.g., Veremis v. Gratiot Place, LLC, No. 07-63269-NI-3, 2010 WL 6826665 (Mich. Cir. Ct. Dec. 29, 2010) (order denying defendant’s motion for judgment notwithstanding the verdict or in the alternative a new trail where the defendant argued that one of the jurors had Facebook “friended” the plaintiffs during the trial). 36 Our analysis will focus on the Federal Rules of Evidence, but most states have identical or similar requirements in their rules of evidence. References to “Rule” refer to the Federal Rules of Evidence unless otherwise noted. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 439 case Lorraine v. Markel American Insurance Co.37 identifies and discusses all of the issues a court may need to consider in determining admissibility of digital evidence, which include relevance, authenticity, hearsay, the original writing rule, and probative value as compared with possible unfair prejudice.38 While there are multiple evidentiary issues that affect the admissibility of any electronic evidence, the greatest challenge is how to authenticate digital evidence. That is where we will focus.39 This Article focuses on Federal Rule of Evidence 901, which deals with authentication,40 as well as Federal Rules of Evidence 104(a) and 104(b)—rules that are rarely discussed yet are inextricably intertwined with Rule 901 and greatly impact the authentication of social media evidence.41 In a nutshell, Rule 901(a) establishes the requirement of authentication or identification as a condition precedent to the admissibility of nontestimonial evidence.42 Rule 901(b) identifies ten nonexclusive examples of how authentication can be accomplished, many of which are tailor-made for use in authenticating social media evidence.43 Rule 104(a) works in tandem with Rule 901(a) because it establishes the responsibility of the trial judge to make preliminary determinations regarding the admissibility of evidence.44 Authenticity is one of those preliminary determinations.45 Rule 104(b), perhaps the most enigmatic evidence rule, can be especially important in the process of authenticating social media and other digital evidence. Rule 104(b), often referred to as the “conditional relevance rule,” applies during the authentication

37 241 F.R.D. 534 (D. Md. 2007). 38 Lorraine, 241 F.R.D. at 538. 39 See id. at 541-62 (discussing authenticating electronically stored information); Paul W. Grimm et al., Back to the Future: Lorraine v. Markel American Insurance Co. and New Findings on the Admissibility of Electronically Stored Information, 42 AKRON L. REV. 357, 366-96 (2009) (offering a broader analysis of authentication). 40 See FED. R. EVID. 901. 41 See FED. R. EVID. 104(a)-(b). 42 See FED. R. EVID. 901(a). 43 See FED. R. EVID. 901(b). 44 See Grimm et al., supra note 39, at 363-64. 45 See FED. R. EVID. 901 advisory committee’s note to subdivision (a). 440 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 process when there is a dispute of fact regarding whether an exhibit is authentic—such as when the proponent of the evidence offers facts to establish authenticity that would be sufficient to persuade a reasonable jury by a preponderance of the evidence that the exhibit is authentic, but at the same time, the party seeking to exclude the evidence offers other evidence that could persuade a reasonable jury that the exhibit is not authentic.46 When this situation occurs, the trial judge cannot determine authentication as a preliminary matter under Rule 104(a) because there is a genuine dispute of fact that must be resolved before a final determination may be made.47 For example, an exhibit determined to be inauthentic is irrelevant because an inauthentic document has no tendency whatso- ever to make a material fact to the litigation more or less probable, and therefore, that exhibit should be excluded.48 Rule 104(b) allocates to the ultimate fact finder—the jury in all nonbench trials—the responsibility to resolve disputes of fact, which include genuine factual disputes regarding the authenticity of digital evidence.49 This Article examines the dynamic between Rules 104(a), 104(b), and 901 as they relate to the authentication of social media evidence. Courts that have decided issues regarding authenticity of social media have not demonstrated sufficient appreciation of these rules and their operation. Of most concern, a number of courts that excluded social media evidence have done so based on the courts’ own speculative concerns regarding the reliability of social media evidence and not because the party opposing introduction of the evidence introduced other evidence to raise a genuine dispute about authenticity. Finally, this Article considers the rare case to date where the opponent of the evidence showed—through facts rather than conjecture—that the evidence may be inauthentic, resulting in the issue being given to the jury for ultimate resolution without any discussion of Rule 104(b)—the very rule which allows the jury to do so.

46 See Grimm et al., supra note 39, at 364-66; see also FED. R. EVID. 104(b). 47 See FED. R. EVID. 104 advisory committee’s note to subdivision (b). 48 See FED. R. EVID. 401 (defining relevant evidence); see FED. R. EVID. 402 (“Irrelevant evidence is not admissible.”). 49 See FED. R. EVID. 104 advisory committee’s note to subdivision (b). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 441

I. Existing Case Law (Clear as Mud)

At present, the cases that address the authentication and admissibility of social media evidence—typically photographs and postings on MySpace and Facebook pages—unfortunately arrive at widely disparate outcomes. One line of cases sets an unnecessarily high bar for the admissibility of social media evidence by not admitting the exhibit unless the court definitively determines that the evidence is authentic. Another line of cases takes a different tact, determining the admissibility of social media evidence based on whether there was sufficient evidence of authenticity for a reasonable jury to conclude that the evidence was authentic. Perhaps the most comprehensive case in the first line is Griffin v. State,50 involving a homicide. In Griffin, the State offered printouts from the defendant’s girlfriend’s MySpace profile, on which the statement “FREE BOOZY [defendant’s nickname]!!!! JUST REMEMBER SNITCHES GET STITCHES!! U KNOW WHO YOU ARE!!” appeared, to show that the girlfriend, Ms. Barber, had threatened another State witness prior to trial by posting that warning on her profile.51 Outside the jury’s presence, the State only offered testimony from its lead investigator in an “attempt[] to authenticate the pages, as belonging to Ms. Barber.”52 The investigator testified that he knew it was the girlfriend’s page “‘[t]hrough the photograph of her and Boozy on the front, through the reference to Boozy, [] the reference [to] the children, and [] her birth date indicated on the [printout].’”53 Counsel for the defense objected to the evidence “because the State could not sufficiently establish a ‘connection’ between the profile and posting and Ms. Barber.”54 The trial court admitted the printouts.55 The defendant was convicted and he appealed.56

50 19 A.3d 415 (Md. 2011). 51 Griffin, 19 A.3d at 418 (quoting Ms. Barber’s MySpace profile) (internal quotation marks omitted). 52 Id. 53 Id. (alterations in original) (quoting Sergeant Cook’s testimony). 54 Id. 55 Id. at 417, 419. 56 Id. at 417. 442 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

On appeal, the defendant alleged that the printouts were inadmissible because they were not properly authenticated.57 The Maryland Court of Special Appeals noted the lack of Maryland precedent and “scant case law from other jurisdictions” regarding the authentication of social media evidence and, specifically, the “authentication of a printout from a MySpace or Facebook profile.”58 The court also noted that, in many jurisdictions, chat logs may be authenticated by either party to the conversation59 or through circumstantial evidence and context such as special code words or phrases unique to those engaging in the communication.60 Observing that “social networking profiles contain information posted by someone with the correct user name and password,”61 the court acknowledged the differences between a printout of a “pseudonymous social networking profile” and “real time” instant messages between site members and recognized the “concern that someone other than the alleged author may have accessed the account and posted the message in question.”62 Nonetheless, the court regarded “decisions as to authentication of evidence from chat rooms, instant messages, text messages, and other electronic communications . . . instructive to the extent that they address the matter of authentication of pseudonymous electronic messages based on content and context.”63 The court referenced the “inherent nature” of social networking websites as encouraging users to individualize their profile by posting various forms of identifying personal information such as “profile pictures or descriptions of . . . physical appearances, personal background information, and lifestyles.”64 The court analyzed the content and context of the posting at issue and found that the circumstantial evidence of the user’s birthdate, a photo-

57 Id. 58 Griffin v. State, 995 A.2d 791, 799, 804 (Md. Ct. Spec. App. 2010), rev’d, 19 A.3d 415 (Md. 2011). 59 See, e.g., FED. R. EVID. 901(b)(1) (stating that testimony by a witness with knowledge is sufficient to satisfy the authentication requirement). 60 Griffin, 995 A.2d at 805 (quoting State v. Bell, 882 N.E.2d 502, 512 (Ohio Ct. Com. Pl. 2008)); see, e.g., FED. R. EVID. 901(b)(4) (stating that distinctive characteristics may satisfy the authentication requirement). 61 Griffin, 995 A.2d at 805. 62 Id. at 805-06 (internal quotation marks omitted). 63 Id. at 806. 64 Id. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 443 graph of the user with the defendant “in an embrace,” multiple references to the defendant’s nickname, and a reference to the user’s children sufficient to authenticate the printout and therefore admit the document into evidence.65 The Court of Appeals reversed and remanded,66 holding that

the picture of Ms. Barber, coupled with her birth date and location, were not sufficient “distinctive characteristics” on a MySpace profile to authenticate its printout [pursuant to Md. Rule 5-901, which is materially similar to Federal Rule of Evidence 901], given the prospect that someone other than Ms. Barber could have not only created the site, but also posted the “snitches get stitches” comment.67

Quoting Lorraine v. Markel American Insurance Co.,68 the court stated that “the ‘requirement of authentication or identification as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims,’ to insure trustworthiness.”69 The court continued, “[A]uthenticating electronically stored information presents a myriad of concerns because ‘technology changes so rapidly[,]’ . . . is ‘often new to many judges,’” and “requires greater scrutiny of ‘the foundational requirements’ than letters or other paper records, to bolster reliability.”70 The court observed that “[t]he identity of who generated the profile may be confounding, because ‘a person observing the online profile of a user with whom the observer is unacquainted has no idea whether the profile is legitimate,’”71 and with “relative ease,” a person “can create a fictitious account and masquerade under another person’s name or can gain access to another’s account by obtaining the user’s username and password.”72

65 Id. at 797, 806. 66 Griffin, 19 A.3d at 418. 67 Id. at 424. 68 241 F.R.D. 534 (D. Md. 2007). 69 Griffin, 19 A.3d at 423 (quoting Lorraine, 241 F.R.D. at 541-44). 70 Id. (quoting Lorraine, 241 F.R.D. at 543-44). 71 Id. at 421 (quoting Nathan Petrashek, The Fourth Amendment and the Brave New World of Online Social Networking, 93 MARQ. L. REV. 1495, 1499 n.16 (2010)). 72 Id. (citing David Hector Montes, Living Our Lives Online: The Privacy Implications of Online Social Networking, 5 ISJLP 507, 508 (2009)). 444 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

Considering “[t]he potential for abuse and manipulation of a social networking site by someone other than its purported creator and/or user,” the court concluded that a printout from a social media site “requires a greater degree of authentication than merely identifying the date of birth of the creator and her visage in a photograph on the site” to determine that the person whose birthday is listed and whose photograph appears on the site is both the creator of the site and the person who wrote the posting.73 The court identified proper means to authenticate printouts of postings on social media sites as follows: (1) “ask the purported creator if she indeed created the profile and also if she added the posting in question”; (2) “search the computer of the person who allegedly created the profile and posting and examine the computer’s internet history and hard drive to determine whether that computer was used to originate the social networking profile and posting in question”; and (3) “obtain information directly from the social networking website that links the establishment of the profile to the person who allegedly created it and also links the posting sought to be introduced to the person who initiated it.”74 The dissent stated that, given the investigator’s testimony and the website’s contents, “a reasonable juror could conclude . . . that the redacted printed pages of the MySpace profile contained information posted by Ms. Barber,” and “‘a document is properly authenticated if a reasonable juror could find in favor of authenticity.’”75 Judge Harrell, writing for the dissent, noted that “‘[i]n a jury trial, the judge need not be personally satisfied, by even a preponderance of the evidence, that the proffered item is authentic; the judge must find the authentication requirement met, if a reasonable jury could find the evidence to be what its proponent claims it to be.’”76 He further observed that, while the majority concerned itself with the possibility that “someone other than Ms. Barber could access or create the account and post the threatening message,” the facts on the record “suggest[ed] no motive to do so,” and

73 Id. at 423-24. 74 Id. at 427-28. 75 Id. at 429 (Harrell, J., dissenting) (emphasis omitted) (quoting United States v. Gagliardi, 506 F.3d 140, 151 (2d Cir. 2007)). 76 Id. at 429 n.2 (quoting 6A LYNN MCLAIN, MARYLAND EVIDENCE: STATE AND FEDERAL § 901:1 (2d ed. 2001)). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 445 therefore, “[t]he potentialities that are of concern to the Majority Opinion are fit subjects for cross-examination or rebuttal testimony and go properly to the weight the fact-finder may give the print-outs.”77 Relying on Griffin, the court in Commonwealth v. Wallick78 held that a photograph is insufficient to authenticate a MySpace page because “[t]he fact that there are photographs of [an individual] on [a] particular webpage does nothing to indicate who created or maintained the page. . . . . [T]hey merely offer evidence that the person who did maintain the MySpace page had access to photographs of Defendant.”79 The court concluded that the photographs offered by the Commonwealth “from [Defendant’s] alleged MySpace page . . . for purposes of authenticating the MySpace page”80 were not relevant and therefore were inadmissible.81 Similarly, in Commonwealth v. Williams,82 a witness testified that the defendant’s brother had the MySpace screen name “doit4it” and had a photo of himself on his MySpace page.83 The witness said that the defendant’s brother—using the screen name “doit4it”—contacted her through four instant messages on her MySpace page to tell her “not to testify against the defendant or to claim a lack of memory about the events at her apartment the night of the murder” with which the defendant was charged.84 Over the defendant’s objection, the trial court admitted the witness’s testimony about the messages, although it did not admit printouts of the MySpace page.85 The appellate court analogized the MySpace messages to a phone call, stating that “a witness’s testimony that he or she has received an incoming call from a person claiming to be ‘A,’ without more, is insufficient evidence to admit the call as a conversation with ‘A.’”86 Noting that the

77 Id. at 429-30. 78 No. CP-67-CR-5884-2010 (Pa. Ct. Com. Pl. Oct. 2011). 79 Wallick, No. CP-67-CR-5884-2010, slip. op. at 10-11. 80 Id. at 9. 81 Id. at 11. 82 926 N.E.2d 1162 (Mass. 2010). 83 Williams, 926 N.E.2d at 1172. 84 Id. at 1165, 1172. 85 Id. at 1171 & n.9. 86 Id. at 1172 (citing Commonwealth v. Hartford, 194 N.E.2d 401 (Mass. 1963)). 446 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

State did not offer any evidence about “how secure such a Web page is, who can access a MySpace Web page, whether codes are needed for such access, etc.,” the court held that the trial court should not have admitted testimony about the messages because the State failed to lay an adequate foundation to authenticate the MySpace messages.87 The court concluded that “while the foundational testimony established that the messages were sent by someone with access to [the defendant’s brother’s] MySpace Web page, it did not identify the person who actually sent the communication.”88 The court added that there also was no “expert testimony that no one other than [the defendant’s brother] could communicate from that Web page.”89 Likewise, in People v. Beckley,90 Beckley’s girlfriend testified that she associated with gang members.91 To rebut this testimony, the prosecution offered into evidence a photograph of the girlfriend displaying a gang hand signal; a detective “testified that he downloaded the photograph from Beckley’s home page on the internet website MySpace.”92 Beckley and his codefendants objected that the photograph “had not been authenticated,” but the trial court admitted the evidence.93 The jury returned a guilty verdict.94 On appeal, the California Court of Appeal held that “the prosecution’s failure to authenticate a photograph . . . downloaded from [an] internet web site[] should have barred [the photograph’s] admission.”95 The appellate court reasoned that “the record does not contain . . . evidence sufficient to sustain a finding that it is the photograph that the prosecution claims it is, namely, an accurate depiction of [the girlfriend] actually flashing a gang sign” even though appellants “conceded that the face in the MySpace photograph was [the girlfriend’s].”96 The court noted that

87 Id. at 1172-73. 88 Id. 89 Id. at 1173. 90 110 Cal. Rptr. 3d 362 (Ct. App. 2010). 91 Beckley, 110 Cal. Rptr. 3d at 365. 92 Id. at 365-66. 93 Id. at 366. 94 Id. at 364. 95 Id. 96 Id. at 366. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 447

“no expert testified that the picture was not a ‘composite’ or ‘faked’ photograph,” and “digital photographs can be changed to produce false images.”97 Nonetheless, the Beckley court concluded that the admission of the evidence was harmless error.98 The Connecticut Appellate Court reached a similar conclusion in State v. Eleck.99 There, the defendant offered into evidence printouts of Facebook messages he allegedly received from a State witness.100 Through his own testimony to authenticate the printouts, the defendant showed that (1) “he downloaded and printed the exchange of messages directly from his own computer”; (2) “he recognized the user name, ‘Simone Danielle,’ as belonging to [the State witness]”; (3) “the ‘Simone Danielle’ profile contained photographs and other entries identifying [the State witness] as the holder of that account”; and (4) “when [the defendant] logged in to his Facebook account after the previous day’s testimony, user ‘Simone Danielle’ had removed him from her list of Facebook ‘friends.’”101 The State witness claimed that, although the messages did come from her account, her account was hacked, and she was unable to access it for some time.102 The trial court ruled that the messages were inadmissible; the defendant did not provide enough circumstantial evidence to prove who sent the Facebook messages, such that the messages lacked a sufficient foundation for authentication.103 The appellate court affirmed104 and explained,

97 Id.; see also People v. Lenihan, 911 N.Y.S.2d 588, 591-93 (N.Y. Sup. Ct. 2010) (affirming trial court’s ruling that defendant could not use photographs printed from MySpace to cross-examine two witnesses because, “[i]n light of the ability to ‘photo shop,’ edit photographs on the computer, defendant could not authenticate the photographs,” and “[d]efendant did not know who took these photographs or posted them on ‘Myspace’”). 98 Beckley, 110 Cal. Rptr. 3d at 364. But see United States v. Phaknikone, 605 F.3d 1099, 1101-06 (11th Cir. 2010) (affirming trial court’s admission of photographs from a MySpace page, which the court admitted after “the government laid the foundation for the MySpace evidence by showing the photographs, profile page, and subscriber report to [a witness who knew Phaknikone], who identified Phaknikone as the person pictured” and “through the testimony of an employee of MySpace”). 99 23 A.3d 818, 821-25 (Conn. App. Ct. 2011). 100 Eleck, 23 A.3d at 820. 101 Id. at 820-21. 102 Id. at 820. 103 See id. 104 Id. at 824-25. 448 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

The need for authentication arises in this context because an electronic communication, such as a Facebook message, an e-mail or a cell phone text message, could be generated by someone other than the named sender. This is true even with respect to accounts requiring a unique user name and password, given that account holders frequently remain logged in to their accounts while leaving their computers and cell phones unattended. Additionally, passwords and website security are subject to compromise by hackers. Consequently, proving only that a message came from a particular account, without further authenticating evidence, has been held to be inadequate proof of authorship.105

The court further explained that “[a]n electronic document may continue to be authenticated by traditional means such as the direct testimony of the purported author or circumstantial evidence of ‘distinctive characteristics’ in the document that identify the author.”106 These cases follow earlier decisions that revealed courts’ skepticism about website contents and their reluctance to admit printouts from the Internet. For example, in St. Clair v. Johnny’s Oyster & Shrimp, Inc.,107 the plaintiff offered a printout from the U.S. Coast Guard’s online vessel database to support the plaintiff’s claim that the defendant owned the vessel involved in the accident with plaintiff.108 The defendant moved for dismissal, arguing the plaintiff’s evidence was insufficient to show that the defendant owned the vessel.109 The court granted the motion, stating,

Plaintiff’s electronic “evidence” is totally insufficient to withstand Defen- dant’s Motion to Dismiss. While some look to the Internet as an innovative

105 Id. at 822. 106 Id. at 823; see also United States v. Jackson, 208 F.3d 633, 637-38 (7th Cir. 2000) (affirming the trial court’s exclusion of evidence defendant offered in the form of postings from the websites of white supremacist groups in which the groups “gloat about the Jackson case [and] take credit for the [acts for which Jackson was indicted]”; reasoning in part that the defendant failed to lay an appropriate foundation to authenticate the printouts because she did not demonstrate that the postings “actually were posted by the groups, as opposed to being slipped onto the groups’ web sites by Jackson herself, who was a skilled computer user”). 107 76 F. Supp. 2d 773 (S.D. Tex. 1999) (order conditionally denying defendant’s motion to dismiss). 108 St. Clair, 76 F. Supp. 2d at 774. 109 Id. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 449

vehicle for communication, the Court continues to warily and wearily view it largely as one large catalyst for rumor, innuendo, and misinformation. So as to not mince words, the Court reiterates that this so-called Web provides no way of verifying the authenticity of the alleged contentions that Plaintiff wishes to rely upon in his Response to Defendant’s Motion. There is no way Plaintiff can overcome the presumption that the information he discovered on the Internet is inherently untrustworthy. Anyone can put anything on the Internet. No web-site is monitored for accuracy and nothing contained therein is under oath or even subject to independent verification absent underlying documentation. Moreover, the Court holds no illusions that hackers can adulterate the content on any web-site from any location at any time. For these reasons, any evidence procured off the Internet is adequate for almost nothing, even under the most liberal interpretation of the hearsay exception rules found in Fed. R. [Evid.] 807.110

In the other line of cases, as noted, courts more appropriately evaluated whether there was sufficient evidence of authenticity for a reasonable jury to conclude that the evidence was authentic in order to determine the admissibility of social media evidence. One example is Tienda v. State.111 At Tienda’s trial on murder charges, the State offered into evidence several MySpace pages from three MySpace accounts allegedly belonging to Tienda.112 The victim’s sister, who directed the State to the pages, was the “sponsoring witness for these MySpace accounts,” and a detective testified about typical gang usage of social media.113 Each account stated that it was “created by a ‘Ron Mr. T’” or Tienda’s well-known nickname, “‘Smiley Face,’” and that the account owner lived in Dallas, or “‘D TOWN,’” where Tienda lived.114 The accounts were registered to e-mail addresses with Tienda’s name or nickname in them.115 One account included a heading reading “‘RIP [the victim]’” above a link to the song that was played at the victim’s funeral.116 The accounts linked to photographs of someone who “at least resembled” Tienda; instant messages between the account owner

110 Id. at 774-75. 111 358 S.W.3d 633 (Tex. Crim. App. 2012). 112 Tienda, 358 S.W.3d at 634-35. 113 Id. at 635-36. 114 Id. at 634-35. 115 Id. at 635. 116 Id. 450 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 and others referenced details surrounding the murder in question and mentioned that the account owner was placed on electronic monitoring.117 Tienda repeatedly objected, and his counsel “elicited testimony regarding the ease with which a person could create a MySpace page in someone else’s name and then send messages, purportedly written by the person reflected in the profile picture, without their approval” as well as testimony that the detective did not know how MySpace accounts were created.118 Nonetheless, the trial court admitted the evidence, which the State referenced repeatedly in closing argument.119 Tienda was convicted of murder.120 Tienda appealed, contending that it was error for the trial court to admit the MySpace evidence.121 Relying on the Maryland Court of Special Appeals’ opinion in Griffin v. State,122 the intermediate appellate court concluded that the Texas trial court did not err in admitting the evidence.123 The court of criminal appeals recognized that the Maryland Court of Appeals reversed Griffin,124 and it noted,

That an email on its face purports to come from a certain person’s email address, that the respondent in an internet chat room dialogue purports to identify himself, or that a text message emanates from a cell phone number assigned to the purported author—none of these circumstances, without more, has typically been regarded as sufficient to support a finding of authenticity.125

The Court of Criminal Appeals of Texas nonetheless affirmed the intermediate appellate court, reasoning that “there [were] far more circumstantial indicia of authenticity in [Tienda] than in Griffin.”126

117 Id. at 635-36. 118 Id. at 636. 119 Id. at 634, 636. 120 Id. at 636. 121 Id. at 637. 122 Griffin v. State, 995 A.2d 791, 799 (Md. Ct. Spec. App. 2010), rev’d, 19 A.3d 415 (Md. 2011). 123 Tienda, 358 S.W.3d at 637 & n.7. 124 Id. (citing Griffin v. State, 19 A.3d 415 (Md. 2011)). 125 Id. at 641-42. 126 Id. at 647. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 451

Relying on Lorraine v. Markel American Insurance Co.,127 the court stated that, “as with the authentication of any kind of proffered evidence, the best or most appropriate method for authenticating electronic evidence will often depend upon the nature of the evidence and the circumstances of the particular case.”128 The court concluded that there was “ample circumstantial evidence—taken as a whole with all of the individual, particular details considered in combination—to support a finding that the MySpace pages belonged to the appellant and that he created and maintained them.”129 Thus, the Court of Criminal Appeals of Texas concluded that the trial court did not abuse its discretion in admitting the pages.130 The court stated that whether Tienda’s MySpace page had been fabricated was an “alternate scenario whose likelihood and weight the jury was entitled to assess.”131 In State v. Assi,132 after noting that “[t]he trial court need not ‘determine whether the evidence is authentic, but only whether evidence exists from which the jury could reasonably conclude that the evidence is authentic,’”133 the appellate court concluded that “the State presented sufficient evidence at trial from which the jury could reasonably conclude [that] Defendant [Assi] was the subject of the MySpace page associated with the username profile ‘Flaco.’”134 At Assi’s trial for attempted second-degree murder of a former gang member, the trial court admitted a detective’s testimony about Assi’s MySpace page and “photographs of [Assi] taken from his MySpace page.”135 The photos showed guns, Assi “posing with guns,” and Assi “‘throwing up gang signs.’”136 Follow- ing a guilty verdict, Assi appealed, arguing that the MySpace photos

127 241 F.R.D. 534 (D. Md. 2007). 128 Tienda, 358 S.W.3d at 639. 129 Id. at 645. 130 Id. at 647. 131 Id. at 646 (emphasis added). 132 No. 1 CA-CR 10-0900, 2012 WL 3580488 (Ariz. Ct. App. Aug. 21, 2012). 133 Assi, 2012 WL 3580488, at *3 (quoting State v. Damper, 225 P.3d 1148, 1152 (Ariz. Ct. App. 2010)). 134 Id. (emphasis added). 135 Id. at *2. 136 Id. at *3. 452 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 lacked a proper foundation.137 The appellate court catalogued the evidence offered to authenticate the MySpace page as Assi’s:

Defendant was known to gang unit officers as Flaco and as a member of PBS. Defendant was the only documented PBS member in police gang records who went by the nickname “Flaco,” and two other gang members who were in the Nissan at the time of the shooting . . . testified that Defendant was a member of PBS and went by the nickname Flaco. When Defendant was arrested, he admitted to being a member of PBS and that his nickname was Flaco. Defendant’s father also testified that Defendant had a MySpace page and he had seen the photographs in Exhibits 20, 21, and 22 on Defendant’s MySpace page.138

The court also stated that, because “[t]he State introduced the MySpace information for identification purposes,” there was a sufficient foundation that the page was actually created by Assi.139 Similarly, in People v. Valdez,140 the trial court admitted MySpace printouts to “(1) corroborat[e] a victim’s statement to investigators shortly after the first shooting that the victim recognized Valdez from the MySpace site and (2) as foundation for [the prosecution’s gang expert’s] . . . testimony” that Valdez was a gang member.141 The jury found Valdez guilty on various counts,142 and Valdez appealed, arguing, inter alia, that the court should not have admitted the MySpace printouts because they were not authenticated.143 The appellate court observed that Valdez’s photo appeared as the “owner of the [MySpace] page,” postings on the page referred to him by his first name, his sister referred to him as her brother, and personal details in postings by the owner and others “matched what the police otherwise knew of Valdez’s interests.”144 The court stated that, “[a]lthough Valdez was free to argue otherwise to the jury, a reasonable trier of fact could conclude from the posting of

137 Id. at *2-3. 138 Id. at *3. 139 Id. at *4. 140 135 Cal. Rptr. 3d 628 (Ct. App. 2011). 141 Valdez, 135 Cal. Rptr. 3d at 632. 142 Id. at 630. 143 Id. at 632. 144 Id. at 633. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 453 personal photographs, communications, and other details that the MySpace page belonged to him.”145 Thus, noting that there only has to be “‘a sufficient showing of authenticity of the writing to permit the trier of fact to find that it is authentic,’”146 the appellate court concluded that “the prosecution met its initial burden to support its claim the MySpace site belonged to Valdez, and that the photographs and other content at the page were not falsified but accurately depicted what they purported to show.”147 Additionally, the court stated that “the trial court could conclude that particular items on the page, including a photograph of Valdez forming a gang signal with his right hand, met the threshold required for the jury to determine their authenticity” because “[t]he contents of a document may authenticate it,” and other “consistent, mutually- reinforcing content on the page helped authenticate the photograph and writings.”148 The appellate court distinguished People v. Beckley,149 in which the court found a website photograph to be insufficiently authenticated because “‘[a]nyone can put anything on the Internet.’”150 The Valdez court noted that in the case before it—unlike Beckley—there was “evidence of the password requirement for posting and deleting content” and “pervasive consistency of the content of the page, filled with personal photographs, communications, and other details tending together to identify and show owner-management of a page devoted to gang-related interests.”151 Additionally, the court reasoned that, “unlike other authority on which Valdez relie[d], nothing suggested he had a personal enemy with a motive to implicate Valdez in future gang crimes by creating an entire site or individual postings on it.”152

145 Id. (emphasis added). 146 Id. at 632-33 (emphasis added) (quoting CAL. EVID. CODE § 1400 (West, Westlaw through 2012 Reg. Sess.)). 147 Id. 148 Id. at 633-34. 149 110 Cal. Rptr. 3d 362 (Ct. App. 2010); see supra text accompanying notes 91- 98. 150 Valdez, 135 Cal. Rptr. 3d at 634 (alteration in original) (quoting Beckley, 110 Cal. Rptr. 3d at 367). 151 Id. 152 Id. 454 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

In People v. Clevenstine,153 the State offered into evidence a computer disk containing instant messages exchanged on MySpace between the defendant and his victims whom he allegedly raped.154 The defendant objected, alleging that the evidence “had not been properly authenticated.”155 The trial court admitted the evidence, the jury returned a guilty finding, and the defendant appealed.156 The appellate court affirmed, holding that there was “ample authentication for admission of this evidence.”157 The appellate court noted that

both victims testified that they had engaged in instant messaging about sexual activities with defendant through the social networking site MySpace, an investigator from the computer crime unit of the State Police related that he had retrieved such conversations from the hard drive of the computer used by the victims, a legal compliance officer for MySpace explained that the messages on the computer disk had been exchanged by users of accounts created by defendant and the victims, and defendant’s wife recalled the sexually explicit conversations she viewed in defendant’s MySpace account while on their computer.158

The court acknowledged “it was possible that someone else accessed his MySpace account and sent messages under his user name” but determined that the trial court “properly concluded that, under the facts of this case, the likelihood of such a scenario presented a factual issue for the jury.”159 Other cases in which the courts have admitted evidence for the jury to determine its authenticity include Manuel v. State160 and In re T.T.161

153 891 N.Y.S.2d 511 (N.Y. App. Div. 2009). 154 Clevenstine, 891 N.Y.S.2d at 513-14. 155 Id. at 514. 156 Id. at 513-14. 157 Id. at 514. 158 Id. 159 Id. (emphasis added). 160 357 S.W.3d 66, 75, 79-82 (Tex. Ct. App. 2011) (relying on FED. R. EVID. 901(b)(4) and the reply-letter doctrine to conclude that the trial court properly admitted electronic communications that Manuel allegedly sent via MySpace and Facebook because “a reasonable fact finder could find that [Manuel] sent the electronic communications attributed to him by the State and depicted in the challenged exhibits” (emphasis added)). 161 228 S.W.3d 312, 321-22 (Tex. Ct. App. 2007) (admitting a MySpace webpage as evidence against a father in termination of parental rights case after the father 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 455

II. Determining the Authenticity of Social Media Evidence

Broadly speaking, the cases that address the admissibility of social media evidence tend to fall into two categories. In the first category, courts expressed skepticism about admitting social media evidence162 or a website printout163 because the proponent failed to introduce evidence that affirmatively disproved the possibility that someone other than the alleged creator of the evidence created or manipulated it.164 Simply put, the possibility that the evidence may have been created by someone other than its putative creator—even in the absence of any evidence that in fact this happened—appears to have been sufficient for these courts to exclude the evidence.165 In contrast, in the second category of cases, the courts

“admitted that he had a webpage on ‘myspace.com’” but “claimed not to know about the contents of the webpage”; reasoning that “[t]here was sufficient evidence for the jury reasonably to conclude that [the father] set up the webpage” because (1) the man who the father alleged created the page testified that “he did not set up and knew nothing about any webpage that [the father] had on ‘myspace.com,’” (2) the mother testified that the father “had been unfaithful to her,” and (3) the contents of the page included a photograph of the father, identified him as single, and included “the statement, ‘I don’t want kids’” (emphasis added)). 162 See generally United States v. Jackson, 208 F.3d 633 (7th Cir. 2000); State v. Eleck, 23 A.3d 818 (Conn. App. Ct. 2011); Commonwealth v. Wallick, No. CP-67-CR- 5884-2010 (Pa. Ct. Com. Pl. Oct. 2011); People v. Beckley, 110 Cal. Rptr. 3d 362 (Ct. App. 2010); Griffin v. State, 995 A.2d 791 (Md. Ct. Spec. App. 2010), rev’d, 19 A.3d 415 (Md. 2011); Commonwealth v. Williams, 926 N.E.2d 1162 (Mass. 2010); People v. Lenihan, 911 N.Y.S.2d 588 (N.Y. Sup. Ct. 2010). 163 See St. Clair v. Johnny’s Oyster & Shrimp, Inc., 76 F. Supp. 2d 773 (S.D. Tex. 1999) (order conditionally denying defendant’s motion to dismiss). 164 Curiously, in United States v. Jackson, although the court ultimately concluded that Jackson did not sufficiently authenticate the social media evidence she offered because she failed to show that the postings “actually were posted by the groups, as opposed to being slipped onto the groups’ web sites by Jackson herself, who was a skilled computer user,” the court also scoffed at the Government’s argument that “Jackson concocted these documents and posted them on the supremacists’ web sites in an attempt to cover up her crimes”—calling it a “novel theory” under which “defense evidence should be excluded whenever the prosecution pronounces it phony.” 208 F.3d 633, 637-38 (7th Cir. 2000). Moreover, the court acknowledged that “[s]orting truth from fiction, of course, is for the jury.” Id. at 637. 165 See State v. Eleck, 23 A.3d 818, 822-25 (Conn. App. Ct. 2011) (printout of instant message from defendant’s Facebook page not properly authenticated where there was no assurance that defendant’s account was not hacked); Commonwealth v. 456 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 concluded that all the proponent had to do to authenticate social media evidence was to introduce sufficient facts—generally by any of the methods identified by Rule 901(b) (and state evidence rules equivalents) to persuade a reasonable juror that the evidence was created by the person who the proponent alleged created the evidence.166 Once the proponent produces sufficient evidence to convince a reasonable juror that the social media evidence is authentic, the burden of production shifts to the party objecting to the introduction of the evidence as inauthentic to prove facts demonstrating that the putative creator did not create the evidence.167 If this is done, assuming that a reasonable juror could find for either the proponent of the evidence or for the party objecting to the evidence, it is appropriate for the trial judge to admit the evidence conditionally and to allow the jury to determine whether to accept or reject the evidence. The approach adopted by the second category of cases is better reasoned, as it affords appropriate deference to the interplay between the evidence rules that govern the admissibility of social media evidence: Rule 104(a) and (b),168 Rule 901,169 and Rule 401.170 The cases that approach the authentication of social media evidence as a determination based on whether there is sufficient evidence for a reasonable jury to conclude that the evidence is authentic are not introducing a new concept. Rather, courts historically considered admissibility of all documentary evidence on a continuum, in which clearly authentic evidence is admitted, clearly inauthentic evidence is excluded,

Williams, 926 N.E.2d 1162, 1171-73 (Mass. 2010) (message not properly authenticated, even though it came from purported sender’s MySpace page, because “there is no testimony (from [the recipient] or another) regarding how secure such a Web page is, who can access a MySpace Web page, whether codes are needed for such access, etc.,” and also no testimony circumstantially to “identify the person who actually sent the communication”). 166 See generally State v. Assi, No. 1 CA-CR 10-0900, 2012 WL 3580488 (Ariz. Ct. App. Aug. 21, 2012); People v. Valdez, 135 Cal. Rptr. 3d 628 (Ct. App. 2011); People v. Clevenstine, 891 N.Y.S.2d 511 (N.Y. App. Div. 2009); Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012); Manuel v. State, 357 S.W.3d 66 (Tex. Ct. App. 2011); In re T.T., 228 S.W.3d 312 (Tex. Ct. App. 2007). 167 See Tienda, 358 S.W.3d at 642-47 (where the defendant was unable to disprove evidence of his MySpace profiles). 168 FED. R. EVID. 104(a)-(b) (preliminary rulings on admissibility of evidence). 169 FED. R. EVID. 901 (authentication). 170 FED. R. EVID. 401 (relevance). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 457 and everything in between is conditionally relevant and admitted for the jury to determine its authenticity.171 The United States District Court for the District of Maryland outlined this approach for electronic evidence in Lorraine v. Markel American Insurance Co.172 There, the court comprehensively discussed “the evidentiary issues associated with the admissibility of electronically generated and stored evidence,” including the judge-jury relationship addressed by Rule 104 and authentication under Rules 901 and 902173 in an analysis that the Griffin v. State court acknowledged but did not apply to authentication of social media site contents.174 The Lorraine court noted that the authentication requirement “‘as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.’”175 It explained that “[t]his is not a particularly high barrier to overcome,” as “[a] party seeking to admit an exhibit need only make a prima facie showing that it is what he or she claims it to be,”176 and “‘[t]he court need not find that the evidence is necessarily what the proponent claims, but only that there is sufficient evidence that the jury might ultimately do so.’”177 Indeed, the “requirement of authentication or identification is the paradigm of a preliminary question.”178 In the vast majority of cases, when the proponent of documentary or similar evidence—whether digital or hard copy—offers the exhibit into evidence, there either is no authenticity objection at all or a formalistic objection that the foundation offered was inadequate because of an asserted failure to produce evidence that would fit within one of the methods of authentication illustrated in Rule 901(b) or Rule 902. Seldom does the objecting party offer a competing version of facts that would

171 See Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 538-39 (D. Md. 2007). 172 241 F.R.D. 534 (D. Md. 2007). 173 Lorraine, 241 F.R.D. at 537-54. 174 19 A.3d 415, 422-24, 427-28 (Md. 2011). 175 241 F.R.D. at 541-42 (quoting FED. R. EVID. 901(a)). 176 Lorraine, 241 F.R.D. at 542 (citing 5 JACK B. W EINSTEIN & MARGARET A. BERGER, W EINSTEIN’S FEDERAL EVIDENCE § 901.02[3] (Joseph M. McLaughlin ed., 2d ed. 1997)). 177 Id. (quoting United States v. Safavian, 435 F. Supp. 2d 36, 38 (D.D.C. 2006)). 178 1 JACK B. W EINSTEIN & MARGARET A. BERGER, W EINSTEIN’S FEDERAL EVIDENCE § 104.30[3] (Joseph M. McLaughlin ed., 2d ed. 2012). 458 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 rebut those offered by the proponent to show that the exhibit is what the proponent contends it is. When all that the objecting party offers is speculation or conjecture about who, other than the putative creator, “could” have created the evidence, such questions are properly left to the jury in determining how much weight, if any, to give to the evidence— provided that the trial judge is convinced that the proponent has met the relatively low threshold required by Rule 901(a) of producing facts that would be sufficient for a reasonable jury to conclude that the evidence was created by the putative creator. In these circumstances, it is the trial judge’s decision whether the evidence is authentic pursuant to Rule 104(a). Only in the comparatively less frequent case where the proponent of the evidence proves facts sufficient to justify a jury’s conclusion that the evidence is authentic, and the opponent proves facts that also would justify a reasonable jury in reaching the opposite conclusion does the judge not have the final say about the admissibility of the evidence. In such an instance, the court is faced with a conditional relevance issue under Rule 104(b). When a conditional relevance issue arises, the proper action for the trial judge to take is to conditionally admit the evidence and instruct the jurors that if they agree with the proponent, they may consider the evidence, giving it the weight they think it deserves. If they side with the opponent, however, they should not consider the evidence. When there is plausible evidence of both authenticity and inauthenticity, the trial judge should not exclude the evidence. State v. Eleck179 illu- strates the frequent misunderstanding of this confusing rule. In Eleck, the defendant offered into evidence printed Facebook messages between the defendant and a State witness.180 The proponent testified he had downloaded and printed the exhibit.181 The messages in question came from an account owned by the State witness based on the facts that the defendant “recognized the user name . . . as belonging to [the State witness],” the account “contained photographs and other entries identifying [the State witness] as the holder of that account,” and the account owner “removed [the defendant] from her list of Facebook

179 23 A.3d 818 (Conn. App. Ct. 2011). 180 Eleck, 23 A.3d at 820. 181 Id. at 821. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 459

‘friends’” after she testified that she had not communicated with him.182 The opponent provided the State witness’s testimony that her account was hacked, and she was unable to access her account for some time.183 The case presents an instance where there was plausible evidence supporting either authentication or a failure to authenticate.184 Thus, the evidence should have been admitted conditionally for the jury to determine its relevance.185 The court excluded it, however, reasoning that the defendant failed to provide enough circumstantial evidence of who sent the Facebook messages to overcome the possibility that they “could be generated by someone other than the named sender.”186 This was not warranted given the state of the evidence at trial. A trial judge should admit the evidence if there is plausible evidence of authenticity produced by the proponent of the evidence and only speculation or conjecture—not facts—by the opponent of the evidence about how, or by whom, it “might” have been created. Too many courts that considered admissibility of social media evidence completely overlooked this important distinction and, in doing so, made questionable rulings excluding evidence that should be admitted. A concrete understanding of Federal Rules of Evidence 104(a) and (b) is necessary to help in the determination of whether social media evidence is admissible and to avoid the unwarranted rulings discussed above. Rules 104(a) and (b) state, in relevant part:

(a) In General. The court must decide any preliminary question about whether a witness is qualified, a privilege exists, or evidence is admissible. In so deciding, the court is not bound by evidence rules, except those on privilege. (b) Relevance That Depends on a Fact. When the relevance of evidence depends on whether a fact exists, proof must be introduced sufficient to support a finding that the fact does exist. The court may admit the proposed evidence on the condition that the proof be introduced later.187

182 Id. at 820-21. 183 Id. at 820. 184 See id. at 820-21. 185 See FED. R. EVID. 104(b). 186 Eleck, 23 A.3d at 822, 824. 187 FED. R. EVID. 104(a)-(b). 460 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

The authenticity of evidence, including social media evidence, is governed by Rule 901 and “viewed as a subset of relevancy, because ‘evidence cannot have a tendency to make the existence of a disputed fact more or less likely if the evidence is not that which its proponent claims.’”188 When the trial judge is confronted by plausible evidence of both authenticity and inauthenticity, authenticating and admitting social media evidence or electronic evidence generally “calls for a factual determination by the jury.”189 Rule 104(b) governs, and the court must engage in a two-step process.190 First, the “‘[trial] court must determine whether its proponent has offered a satisfactory foundation from which the jury could reasonably find that the evidence is authentic.’”191 If the judge finds that the evidence is clearly authentic, or clearly inauthentic, and determines that a reasonable jury could not find to the contrary, “the judge withdraws the matter from [the jury’s] consideration.”192 However, “[i]f after all the evidence on the issue is in, pro and con, the jury could reasonably conclude that fulfillment of the condition is not established, the issue is for them.”193 That is, if the judge determines that a jury could reasonably find the evidence to be authentic, the evidence goes to the jury to “‘ultimately resolve[] whether evidence admitted . . . is that which the proponent claims.’”194 Under Rule 104(a), the judge makes a preliminary determination of the admissibility of conditionally relevant evidence based on whether a reasonable fact finder could find the evidence to be what it purports to be by a preponderance of the evidence.195 This standard applies in civil

188 Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 539 (D. Md. 2007) (quoting United States v. Branch, 970 F.2d 1368, 1370 (4th Cir. 1992)). 189 Id. 190 See id. at 539-40; see also FED. R. EVID. 901 advisory committee’s note to subdivision (a). (“Authentication and identification represent a special aspect of relevancy. . . . This requirement of showing authenticity or identity falls in the category of relevancy dependent upon fulfillment of a condition of fact and is governed by the procedure set forth in Rule 104(b).”). 191 Lorraine, 241 F.R.D. at 539 (quoting Branch, 970 F.2d at 1370). 192 FED. R. EVID. 104 advisory committee’s note to subdivision (b). 193 Id. 194 Lorraine, 241 F.R.D. at 539-40 (quoting Branch, 970 F.2d at 1370-71). 195 1 STEPHEN A. SALTZBURG ET AL., FEDERAL RULES OF EVIDENCE M ANUAL § 104.02[9] (8th ed. 2002) (“[T]he Supreme Court has, in several cases, held that the 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 461 and criminal cases alike.196 In Bourjaily v. United States,197 the Supreme Court “implied that the preponderance standard should be the governing standard for all preliminary questions decided under Rule 104(a),”198 and in Daubert v. Merrell Dow Pharmaceuticals,199 the Supreme Court “relied on Rule 104 and Bourjaily” to hold that “the proponent of expert testimony has the burden of establishing its reliability under Rule 702 by a preponderance of the evidence.”200 Additionally, “[l]ower [c]ourts have applied the preponderance standard to an array of competency questions.”201 Importantly, the Advisory Committee Notes state that “the preponderance standard applies to the Court’s rulings under Rule 104(a).”202 A litigant may authenticate social media evidence or electronically stored information (ESI) by use of Rules 901 and 902. The Lorraine court observed that Rule 901(b) provides a nonexclusive list of methods of authenticating ESI and that courts have recognized five of the methods listed in Rule 901(b) as being particularly appropriate for authenticating digital evidence.203 While many of the cases involve digital evidence from Internet sites other than social media sites, the methods approved by those cases apply with equal force to social media evidence.204

moving party has the burden of proving admissibility requirements under Rule 104(a) by a preponderance of the evidence. Where the objection goes to conditional relevance, the proponent must show that a reasonable juror could believe the preliminary fact by a preponderance of the evidence.”). 196 1 MICHAEL H. GRAHAM, HANDBOOK OF FEDERAL EVIDENCE § 104.1 (6th ed. 2006) (citing Bourjaily v. United States, 483 U.S. 171, 173-77 (1987)) (“In reaching a determination pursuant to Rule 104(a) on a question of admissibility for the court alone whether that be in a criminal or a civil case, the court should apply the standard for the burden of persuasion applicable generally in civil cases of more probably true than not true.”). 197 483 U.S. 171 (1987). 198 SALTZBURG ET AL., supra note 195 (citing Bourjaily, 483 U.S. at 175). 199 509 U.S. 579 (1993). 200 SALTZBURG ET AL., supra note 195 (citing Daubert, 509 U.S. 579). 201 Id. 202 Id.; see also FED. R. EVID. 702 advisory committee’s note to 2000 amendments. 203 Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 544-49 (D. Md. 2007). 204 See id. at 554-59 (discussing the authentication of e-mail, internet website postings, chat room content, and computer records and data evidence). 462 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433

Pursuant to 901(b)(1), courts have assessed the authenticity of ESI using the testimony of a witness with “personal knowledge of how that type of exhibit is routinely made”205 who provides “factual specificity” about how the ESI “is created, acquired, maintained, and preserved without alteration or change” or about how it is produced via “a system or process that does so.”206 Under Rule 901(b)(1), it is not sufficient for a witness to provide “boilerplate, conclusory statements that simply parrot the elements of the business record exception to the hearsay rule . . . or public record exception.”207 Courts have approved the comparison of ESI known to be authentic with ESI of questionable authenticity pursuant to Rule 901(b)(3), and they have considered circumstances and distinctive characteristics of the ESI—for example, hash values and metadata— pursuant to Rule 901(b)(4).208 Additionally, pursuant to 901(b)(7), courts have determined the authenticity of ESI that comes from public records based on whether the proponent has made a showing that “‘the office from which the records were taken is the legal custodian of the records.’”209 Finally, pursuant to Rule 901(b)(9), courts have accepted “proof that [the records] were produced by a system or process capable of producing a reliable result” to determine the authenticity of ESI.210 The Lorraine court further noted that Rule 902 provides for self- authentication (sometimes with an accompanying certificate signed by a custodian) of certain enumerated documents such as, inter alia, public documents, official publications, trade inscriptions, and certified domestic records of regularly conducted activity.211 An example of self-authentication under Rule 902212 is U.S. Equal Employment Opportunity Commis-

205 Id. at 545 (citing 5 JACK B. W EINSTEIN & MARGARET A. BERGER, W EINSTEIN’S FEDERAL EVIDENCE § 901.03[2] (Joseph M. McLaughlin ed., 2d ed. 1997)). 206 Id. 207 Id. at 545-46. 208 See id. at 546-48. 209 Id. at 548 (quoting 5 JACK B. W EINSTEIN & MARGARET A. BERGER, W EINSTEIN’S FEDERAL EVIDENCE § 901.10[2] (Joseph M. McLaughlin ed., 2d ed. 1997)). 210 Id. 211 Id. at 549-51. 212 See FED. R. EVID. 902(5). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 463 sion v. E.I. DuPont de Nemours & Co.,213 where the court concluded that “a printout of a table from the website of the United States Census Bureau,” which “contain[ed] the internet domain address from which the table was printed, and the date on which it was printed,” was admissible because it was self-authenticating.214 However, the Lorraine court cautioned that the opposing party still may challenge the authenticity of the document—in which case the “exhibit and the evidence challenging its authenticity goes to the jury, which ultimately determines whether it is authentic.”215 Judicial notice under Rule 201 also could be useful in authenticating ESI.216 With regard to website postings specifically, the Lorraine court noted that one concern is whether “the organization hosting the website actually posted the statements or authorized their posting.”217 It said that, “‘[i]n applying [the authentication standard] to website evidence, there are three questions that must be answered, explicitly or implicitly: (1) What was actually on the website? (2) Does the exhibit or testimony accurately reflect it? (3) If so, is it attributable to the owner of the site?’”218 Other

213 No. Civ.A. 03-1605, 2004 WL 2347559 (E.D. La. Oct. 18, 2004) (order denying motion in limine to exclude website printout exhibit). 214 E.I. DuPont, 2004 WL 2347559, at *1-2; see also Williams v. Long, 585 F. Supp. 2d 679, 688 n.4, 689 (D. Md. 2008) (noting that information posted on the Internet “by a qualifying public authority” is a publication for purposes of Rule 902(5), such that it is self-authenticating, and “[a] proponent of ESI could use the URL, date, and/or official title on a printed webpage to show that the information was from a public authority’s website, and therefore, self-authenticating”; concluding that “[t]he printed webpage from the Maryland Judiciary Case Search website is self- authenticating under Rule 902(5)” because it is a government publication, the page refers to the “Maryland Judiciary” and the “District Court of Maryland,” and “the URL on the top of the printed webpage identifies that the results are in fact from the website”; also concluding that “[t]he printed webpage from the Employment Standards Service website could also be considered a self-authenticating ‘official publication,’” because it is “hosted by a subdivision of a state agency . . . [,] the URL on the webpage identifies the correct website, and the agency’s name is printed preceding the search results”). 215 Lorraine, 241 F.R.D. at 551 (citing FED. R. EVID. 902 advisory committee’s notes). 216 Id. at 553. 217 Id. at 555. 218 Id. (alterations in original) (quoting Gregory P. Joseph, Internet and Email Evi- dence, 13 PRAC. LITIGATOR 45, Mar. 2002, reprinted in 5 STEPHEN A. SALTZBURG ET AL., FEDERAL RULES OF EVIDENCE MANUAL, pt. 4, at 21 (9th ed. 2006)). 464 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 factors relevant to the admissibility of website postings as evidence, and which counsel should consider when deciding how to build a foundation and authenticate the evidence, include

[t]he length of time the data was posted on the site; whether others report having seen it; whether it remains on the website for the court to verify; whether the data is of a type ordinarily posted on that website or websites of similar entities (e.g. financial information from corporations); whether the owner of the site has elsewhere published the same data, in whole or in part; whether others have published the same data, in whole or in part; whether the data has been republished by others who identify the source of the data as the website in question?219

The Lorraine court further stated that the “authentication rules most likely to apply, singly or in combination,” to website postings are the five that courts have applied to ESI—Rules 901(b)(1) (testimony of a witness with personal knowledge), 901(b)(3) (comparison with an authenticated document), 901(b)(4) (distinctive characteristics), 901(b)(7) (evidence about public records), and 901(b)(9) (evidence about a process or system) —as well as Rule 902(5) (official publications).220 Additionally, courts have relied on Rule 901(b) specifically for determining the admissibility of evidence from the Internet, which is equally applicable to authenticating social media evidence. In Telewizja Polska USA, Inc. v. Echostar Satellite Corp.,221 the defendant offered printouts from the plaintiff’s website as it appeared years earlier.222 To authenticate the printouts, the defendant offered an affidavit from the administrative director for the Internet Archive Company, the company that retrieved the historic website images,223 “verifying that the Internet

219 Id. at 555-56 (quoting Gregory P. Joseph, Internet and Email Evidence, 13 PRAC. LITIGATOR 45, Mar. 2002, reprinted in 5 STEPHEN A. SALTZBURG ET AL., FEDERAL RULES OF EVIDENCE MANUAL, pt. 4, at 22 (9th ed. 2006)). 220 Id. at 556; see FED. R. EVID. 901(b); FED. R. EVID. 902(5). 221 No. 02 C 3293, 2004 WL 2367740 (N.D. Ill. Oct. 15, 2004) (order ruling on plaintiff’s seventeen motions in limine and defendant’s thirty-eight motions in limine). 222 Telewizja Polska, 2004 WL 2367740, at *5. 223 St. Luke’s Cataract & Laser Inst. v. Sanderson, No 8:06-CV-223-T-MSS, 2006 WL 1320242, at *1 (M.D. Fla. May 12, 2006) (order denying plaintiff’s motion to admit Internet Archive website printouts) (discussing Telewizja at length); Telewizja Polska, 2004 WL 2367740, at *6. 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 465

Archive Company retrieved copies of the website as it appeared on the dates in question from its electronic archives.”224 The plaintiff objected to the evidence as not properly authenticated.225 The court rejected that argument, reasoning,

Federal Rule of Evidence 901 “requires only a prima facie showing of genuineness and leaves it to the jury to decide the true authenticity and probative value of the evidence.” Admittedly, the Internet Archive does not fit neatly into any of the non-exhaustive examples listed in Rule 901; the Internet Archive is a relatively new source for archiving websites. Neverthe- less, Plaintiff has presented no evidence that the Internet Archive is unreliable or biased. And Plaintiff has neither denied that the exhibit represents the contents of its website on the dates in question, nor come forward with its own evidence challenging the veracity of the exhibit.226

On that basis, the court concluded that the affidavit was “sufficient to satisfy Rule 901’s threshold requirement for admissibility.”227 It is clear that the best approach for authenticating and admitting social media evidence is to follow Rules 104(a) and (b). Following such an approach, courts consider evidence from all sources (even if not from a live witness)—including documents, whether electronic or hard copy—on a continuum. That is, clearly authentic evidence is admitted, clearly inauthentic evidence is excluded, and everything in between is conditionally relevant and admitted for the jury to make the final determination as to authenticity. Given the state of the case law as it currently exists regarding the authentication of social media evidence and the certainty that this type of evidence will continue to be offered in civil and criminal cases throughout the country in state and federal court, it is helpful to distill some rules of reason. Such rules will hopefully facilitate lawyers

224 Telewizja Polska, 2004 WL 2367740, at *6. 225 Id. 226 Id. (emphasis added) (citation omitted) (quoting United States v. Harvey, 117 F.3d 1044, 1049 (7th Cir. 1997)). 227 Id.; see also Perfect 10, Inc. v. Cybernet Ventures, Inc., 213 F. Supp. 2d 1146, 1153-54 (C.D. Cal. 2002) (order granting plaintiff’s motion for preliminary injunction) (admitting internet images over defendant’s objection because the accompanying affidavit from the individual responsible for printing the internet images, “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a reasonable juror in the belief that the documents are what Perfect 10 says they are” (emphasis added)). 466 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 and judges in reaching principled and predictable decisions regarding how social media evidence should be authenticated. It serves no interest for the law to remain in its current inconsistent and unpredictable state. If followed, the law should become more settled over time, the results should become more predictable, and this consistency should mutually benefit lawyers and judges alike.

III. Checklist for Authentication

The following rules of reason should help practitioners better prepare to introduce social media evidence successfully at trial.

A. Mind Your Ps

There is an old saying that “Prior Preparation Prevents Poor Perfor- mance.” Most unsuccessful attempts to authenticate social media or other digital evidence result from self-inflicted injuries caused by the failure to plan in advance of trial. In civil cases, the time to plan for introduction of social media evidence is during discovery when, for example, there is time to ask witnesses questions during a deposition that will establish the methods of authentication identified in Rules 901(b) and 902. In criminal cases, where there is far less discovery, plan how you will authenticate the evidence as soon as you first obtain it. Prior planning will alert you to when you need to call a live witness to authenticate social media evidence and will permit you time to issue a subpoena to get the needed witness to trial or, in a civil case, to take their deposition so that if they are unavailable for trial, their testimony is admissible under Rule 804(b)(1) as prior testimony of an unavailable declarant.

B. Do Your Homework

As previously discussed, courts have reached widely divergent and inconsistent rulings regarding the admissibility of social media evidence. Expect this to continue until a national consensus has developed. In the meantime, be prepared by researching whether the judge or court presiding over your case has issued any opinions regarding the admissibility of social media evidence. Adapt your approach to authentication in light of any prior rulings. If you are urging the court to change its prior 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 467 views, you should file a motion in limine well before trial to try to get an advance ruling. If the court does not agree with your approach, you have time to choose a method you are confident the court will accept.

C. Sometimes (But Not Often) It Helps to Be Lazy

Never rule out the possibility that your adversaries will stipulate to the authenticity of social media evidence you want to introduce, and do not be afraid to ask. If they agree, get it in writing. Often they will agree because they want stipulations from you as well. If they will not stipulate, you then have advance notice that you will get an objection and should prepare accordingly. Similarly, in civil cases, if you gained access to the social media evidence from your adversary in response to a document production request, most courts then recognize that there is a presumption of authenticity that applies to evidence obtained in discovery from an adversary.228 Also, in civil cases, do not overlook Federal Rule of Civil Procedure 36,229 which governs requests for admission of genuineness and authenticity of documents. Recall that if you file a request for admission, and your opponent fails to deny within thirty days, the requests are conclusively admitted for purposes of your litigation.230 Rule 36 requests are woefully underused and perfect to authenticate evidence.

D. Remember the Interplay Between Rules 104(a) and (b) and “Conditional Relevance”

Before any trial where you plan to introduce social media evidence, re-read Rule 104(a) and (b).231 If you are aware of any facts that your

228 Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 552 (D. Md. 2007) (citing Indianapolis Minority Contractors Ass’n v. Wiley, No. IP 94-1175-C-T/G, 1998 WL 19888026, at *6 (S.D. Ind. May 13, 1998) (“The act of production is an implicit authentication of documents produced.”)). 229 See FED. R. CIV. P. 36. 230 See FED. R. CIV. P. 36(a)(3) (“A matter is admitted unless, within 30 days after being served, the party to whom the request is directed serves on the requesting party a written answer or objection addressed to the matter and signed by the party or its attorney.”). 231 See FED. R. EVID. 104. 468 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 adversary will attempt to prove to rebut the evidence you intend to offer to authenticate your social media evidence, carefully consider whether you can argue that it is insufficient to convince a reasonable jury that your evidence is not authentic. If you conclude that the judge is likely to find that the evidence would be sufficient to persuade a reasonable jury that your evidence is not authentic, be prepared to argue that the evidence supporting authenticity is sufficient to persuade a reasonable juror that it is authentic. In this scenario, the judge must admit the exhibit conditionally and instruct the jurors that if they accept your version of the facts, they may consider the evidence and give it the weight that it deserves; if not, they must not consider it. Remember that the judge may not be familiar with the interplay between Rule 104(a) and (b). Consider gathering research to cite to support your argument that, if your opponent offers evidence of inauthenticity, the jury needs to resolve the conflict, and exclusion of the social media evidence by the judge is improper. If the judge rules against you, make sure to make an appropriate proffer pursuant to Rule 103 to preserve the issue for appellate review.232

E. Choose Wisely

As far in advance of trial as possible, and for each distinct type of social media evidence you intend to introduce, carefully plan the method you want to use to authenticate each exhibit. If possible, be prepared to authenticate more than one way. To pick the best way, review the methods listed in Rule 901(b).233 Of them, the most helpful for social media evidence are as follows:

1. Rule 901(b)(1)—Someone with Personal Knowledge

This rule allows a witness with personal knowledge to authenticate evidence.234 If you are introducing a screen shot from a Facebook page, call as a witness the person who created and maintains the page, and ask the witness if she made or authorized the posting. In a civil case, you can establish this foundation by deposing the owner.

232 See FED. R. EVID. 103. 233 See FED. R. EVID. 901(b). 234 See FED. R. EVID. 901(b)(1). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 469

2. Rule 901(b)(3)—Use of an Expert or Comparison by the Fact Finder

A computer forensic expert can frequently authenticate the maker of social media content.235 Obviously, you will need to retain the proper expert and ensure that he or she has enough time and information to make the identification. Advance planning is essential, and be mindful of the potentially substantial cost. If the social media evidence is critical to the success of your case, however, the cost is worth it. Less elegantly, Rule 901(b)(3) also allows the fact finder (usually the jury) to authenticate social media evidence when shown an example of a posting that is known to have been made by the person that you contend authored the posting by comparing it to a posting of unknown authenticity.236 While this method is allowed by the rule, it is risky to use because you never know how the jurors will respond, and you will not be able to obtain any feed- back from them as to how they came out on the issue until you receive a final verdict and attempt to figure out whether they saw things the way you wanted.

3. Rule 901(b)(4)—Distinctive Circumstances or Characteristics

This is one of the most successful methods used to authenticate all evidence, including social media evidence.237 Recall the old saying, “If it looks like a duck, waddles like a duck, and quacks like a duck, it must be a duck.” Make an inventory of all of the circumstances and characteristics that apply to the social media exhibit that add up to a showing that, more likely than not, it was authored by the person that you contend authored it. Consider the content, whether the post replied to an earlier

235 See FED. R. EVID. 901(b)(3) (allowing an expert witness to compare an “authenticated specimen” to the offered evidence). 236 See id. (allowing the trier of fact to compare an “authenticated specimen” to the offered evidence). 237 See generally FED. R. EVID. 901(b)(4) (allowing the “[t]he appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances” to support the assertion that offered evidence is what it is proclaimed to be). 470 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 inquiry or posting, any distinguishing language, abbreviations, slang, punctuation, use of emoticons,238 nicknames, content that was uniquely known by the person you claim is the author, Internet address, date, and any other factors that are unique to the person that you claim authored it. If you use this approach, make sure you do research to find any cases from the court that will try the case (or the appropriate appellate court having jurisdiction over that court) that discuss what is or is not sufficient similarity or circumstances to permit authentication by this method. Adjust your approach accordingly.

4. Rule 901(b)(9)—System or Process Producing Reliable Results

This is one of the most useful ways to authenticate social media evidence,239 but it requires a witness who has personal knowledge under Rule 602240 to explain how the social media evidence was created or, alternatively, is an expert qualified under Rule 702241 who can provide opinion testimony. Plan in advance by making sure that the witness is available to testify at trial or is deposed pre-trial in civil cases. If the witness is unavailable at trial, the deposition will be admissible under Rule 804(b)(1).242

5. Rule 902(5)—Official Publications

Although not likely to be a useful method to authenticate social media evidence such as a nongovernmental social media website like Facebook or Myspace, it is possible that this authentication method could be used

238 An emoticon is “a group of keyboard characters . . . that typically represents a facial expression or suggests an attitude or emotion and that is used especially in computerized communications.” Definition of Emoticon, MERRIAM-W EBSTER, http:// www.merriam-webster.com/dictionary/emoticon (last visited June 2, 2013). For example, using a colon and parenthesis : ) will convert to a smiley face ( emoticon. 239 See generally FED. R. EVID. 901(b)(9) (allowing offered evidence that was produced by a process or system to be authenticated by evidence “describing [the] process or system and showing that it produces an accurate result”). 240 See FED. R. EVID. 602. 241 See FED. R. EVID. 702. 242 See FED. R. EVID. 804(b)(1). 2013] AUTHENTICATION OF SOCIAL MEDIA EVIDENCE 471 if there is an interactive website sponsored by a government agency.243 For example, in Williams v. Long,244 the plaintiffs attempted to conditionally certify a collective action under the Fair Labor Standards Act and submitted as evidence printed webpages from the website of the Employ- ment Standards Service of the Division of Labor and Industry in the Maryland Department of Labor, Licensing and Regulation.245 If found to be “authentic and considered for their substantive truth,” these printouts suggested that “there [were] other claimants who might desire to join the [p]laintiffs’ suit.”246 The court addressed the applicability of Rule 902(5) to website postings specifically, stating that “[a] proponent of ESI could use the URL, date, and/or official title on a printed webpage to show that the information was from a public authority’s website, and therefore, self-authenticating.”247 Holding that the webpage printouts were a self-authenticating “official publication” under Rule 902(5), the court recognized that the “public authority’s selection of the posted information for publication on its website will act as the necessary ‘seal of approval.’”248 Keep in mind that the United States Government is considering use of social media sources to better communicate with the public. If so, state and local governments will likely follow, if they are not already.249

6. Rule 902(6)—Newspapers and Periodicals

Although traditionally used to authenticate hard copies of newspapers or magazines, because of the distinctive features of most newspaper

243 See FED. R. EVID. 902(5) (stating that official publications by public authorities are self-authenticating). 244 585 F. Supp. 2d 679 (D. Md. 2008). 245 Long, 585 F. Supp. 2d at 681-82. 246 Id. at 685 (citing Pls.’ Exs. 1, 3). 247 Id. at 689. 248 Id. 249 See Presidential Memorandum—Building a 21st Century Digital Government, 77 Fed. Reg. 32391, 32391 (The White House, Office of Press Sec’y, May 23, 2012), available at http://www.whitehouse.gov/the-press-office/2012/05/23/presidential- memorandum-building-21st-century-digital-government (directing government agen- cies to “use emerging technologies to serve the public as effectively as possible”). 472 AMERICAN JOURNAL OF TRIAL ADVOCACY [Vol. 36:433 mastheads and magazine covers, traditional news media sources are increasingly going digital. Many programs and reporters have Twitter sites. If the social media evidence includes a newspaper or periodical- sponsored Twitter posting, consider Rule 902(6).250 If accepted by the court, this rule allows the newspaper or periodical posting to be self- authenticated, eliminating the need for a sponsoring witness.251

Conclusion

Given the ubiquitous use of digital devices to communicate on social media sites, there is little chance that such evidence will cease to be highly relevant in either criminal or civil cases. This is particularly so whenever motive, state of mind, intent, interpersonal interactions, physical health, and conduct occurring outside of public observation are at issue. The current state of the law regarding admissibility of the evidence is in disarray, sending mixed and confusing messages to lawyers and judges alike and depriving them of the certainty to anticipate in advance of trial the likelihood of admission for social media evidence. Nowhere is this uncertain state more evident than in the near total absence in any of the reported cases of any recognition or application of the two evidence rules most important to making the correct ruling—Rules 104(a) and (b). Hopefully, this Article can shed some light on the nature of the confusion and offer useful suggestions on how to approach the authentication of social media evidence. It is a near certainty that the public appetite for use of social media sites is unlikely to abate, and it is essential for courts and lawyers to do a better job in offering and admitting this evidence. We hope that reading this Article will be their first step toward this goal.

250 See FED. R. EVID. 902(6) (“Printed material purporting to be a newspaper or periodical” is self-authenticating.). 251 Id. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

AUTHENTICATING DIGITAL EVIDENCE

Hon. Paul W. Grimm,* Daniel J. Capra,** and Gregory P. Joseph, Esq.***

I. Introduction ...... 2 II. An Introduction to the Principles of Authentication for Electronic Evidence: The Relationship Between Rule 104(a) and Rule 104(b)...... 5 III. Relevant Factors for Authenticating Digital Evidence ...... 11 A. Emails ...... 12 1. A Witness With Personal Knowledge May Testify to Authenticity...... 12 2. Business Records...... 13 3. Jury Comparison With Other Authenticated Emails...... 14 4. Production in Discovery...... 14 5. Circumstantial Evidence...... 15 a. Authenticating Authorship Circumstantially...... 15 b. Authenticating Receipt Circumstantially...... 18 B. Text Messages ...... 19 1. A Witness With Personal Knowledge May Testify to Authenticity...... 19 2. Jury Comparison With Other Authenticated Texts...... 19 3. Production in Discovery...... 19 4. Establishing That an Electronic System of Recordation Records Accurately...... 19 5. Circumstantial Evidence...... 20 a. Authenticating Authorship Circumstantially...... 20

*United States District Judge for the District of Maryland; Former Member, Judicial Conference Advisory Committee on Civil Rules. **Reed Professor of Law, Fordham Law School; Reporter to the Judicial Conference Advisory Committee on Evidence Rules. ***Partner, Joseph Hage Aaronson, New York City; former member of the Judicial Conference Advisory Committee on Evidence Rules. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2 BAYLOR LAW REVIEW [Vol. 69:1

b. Authenticating Receipt Circumstantially...... 22 C. Chatroom and Other Social Media Conversations ...... 22 D. Internet, Websites, Etc...... 24 1. Rule 901 Authentication Standards as Applied to Dynamic Website Information...... 25 2. Self-Authenticating Website Data...... 27 a. Government Websites...... 28 b. Newspaper & Periodical Websites...... 28 c. Websites Certified as Business Records...... 28 3. Authenticating the Date That Information Is Posted on a Website...... 29 E. Social Media Postings ...... 31 IV. Judicial Notice of Digital Evidence ...... 34 V. Authenticating Electronic Evidence By Way of Certification—New Amendments to the Federal Rules of Evidence ...... 38 A. The Need for Rules to Alleviate the Expense of Authenticating Electronic Evidence ...... 38 B. The Impact of the New Rules ...... 39 C. Overlapping Provisions ...... 40 D. Applications of Rules 902(13) and (14) ...... 42 E. Certifications of Authenticity of Electronic Evidence and the Right to Confrontation ...... 46 1. The Melendez-Diaz Carve-out ...... 46 2. Certifying Accuracy ...... 51 3. Adding a Notice-and-Demand Provision to Rule 902(13) for Criminal Cases ...... 52 Conclusion ...... 55

I. INTRODUCTION Digital evidence is now offered commonly at trial. Examples include emails, spreadsheets, evidence from websites, digitally-enhanced photographs, PowerPoint presentations, texts, tweets, Facebook posts, and computerized versions of disputed events. Does the fact that an item is electronic raise any special challenges in authenticating that item? 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 3

In federal courts, authenticity is governed by Federal Rule of Evidence 901(a), which requires that to establish that an item is authentic, a proponent must produce admissible evidence “sufficient to support a finding that the item is what the proponent claims it is.”1 Rule 901(b) provides many examples of evidence that satisfies the standard of proof for establishing authenticity, including testimony of a witness with knowledge,2 circumstantial evidence,3 and evidence describing a process or system that shows that it produces an accurate result.4 The standards and examples provided by Rule 901(a) and (b) are by design flexible enough to adapt to all forms of evidence—including electronic evidence. That does not mean that authenticating digital evidence is automatic. There are a large number of reported cases dealing with authentication of digital evidence over the last fifteen years. Digital evidence can present the challenge of convincing the court that it has not been altered or hacked and that it comes from a certain source. The Judicial Conference Advisory Committee on Evidence Rules, surveying this case law, determined that the Bench and Bar would be well-served by published guidelines that would set forth the factors that should be taken into account for authenticating each of the major new forms of digital evidence that are being offered in the courts.5 The idea for providing guidelines grew out of a symposium sponsored by the Advisory Committee on the challenges of electronic evidence.6 One of the participants of the symposium, Gregory Joseph, proposed rule amendments that would establish new rules governing the authenticity of electronic evidence.7 But the Advisory Committee decided that a rulemaking solution was not optimal for a number of reasons: (1) the length

1 FED. R. EVID. 901(a). Evidence proffered to support authenticity of a challenged item must itself be admissible, because authenticity will ultimately have to be established to the factfinder. See, e.g., United States v. Bonds, 608 F.3d 495, 500–02 (9th Cir. 2010) (finding that records could not be authenticated where the only basis for authentication was a hearsay statement not admissible under any exception). 2 FED. R. EVID. 901(b)(1). 3 Id. 901(b)(4). 4 Id. 901(b)(9). 5 See JUDICIAL CONFERENCE ADVISORY COMM. ON EVIDENCE RULES, MINUTES 9–10 (Fall 2014). 6 See Symposium, The Challenges of Electronic Evidence, 83 FORDHAM L. REV. 1163, 1255– 62 (2014). 7 Id. at 1258–62. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

4 BAYLOR LAW REVIEW [Vol. 69:1 of the rulemaking process could mean that a rule might be outmoded by technological development before it could be enacted; (2) the Evidence Rules do not ordinarily set forth lists of factors that are relevant to admissibility, given the risk of underinclusiveness; (3) authentication will require weighing relevant factors on a case-by-case approach—an approach that requires more flexibility than might be found in a set of hard-and-fast rules; and (4) the existing rules on authenticity are broad and flexible enough to cover electronic evidence.8 After the Advisory Committee decided not to propose rule amendments to authenticate digital evidence, the Reporter to the Advisory Committee began to work with two noted authorities on electronic evidence—Hon. Paul Grimm and Gregory P. Joseph, Esq.—to set forth standards and principles governing such authentication. The result is this article; it is the work of the authors alone. This article begins (in Part II) with an analysis of the basic rules on authenticating evidence, with a focus on digital evidence and the interplay between Evidence Rules 104(a) (providing that the judge is to decide admissibility factors by a preponderance of the evidence) and Rule 104(b) (providing that for questions of conditional relevance—such as authenticity—the standard of proof for admissibility is enough evidence sufficient to support a finding). Following the introduction, Part III sets forth some guidelines on authentication of the kinds of electronic evidence that are most frequently offered in litigation today: (1) emails; (2) texts; (3) chatroom conversations; (4) web postings; and (5) social media postings.9 In Part IV, we consider whether and when the proponent might argue that the court can take judicial notice of the authenticity of certain digital evidence. Finally, Part V

8 See generally Memorandum from Daniel J. Capra, Fordham Univ. Sch. of Law, to Judicial Conference Advisory Comm. on Evidence Rules (Oct. 1, 2014) (on file with author); see also JUDICIAL CONFERENCE ADVISORY COMM. ON EVIDENCE RULES, MINUTES 8–10 (Fall 2014). 9 This article covers the relatively new forms of electronic communications. Parties have been authenticating more traditional forms of electronic evidence for many years—examples include telephone conversations, audiotapes, and video recordings. See, e.g., United States v. Taylor, 530 F.2d 639, 641–42 (5th Cir. 1976) (finding that video evidence from a bank security camera was properly authenticated where testimony revealed the camera was present on the day in question, was facing the events of an armed robbery, and was functioning properly). This pamphlet does not cover such traditional forms of electronic communication. For more on authentication of such information, see STEPHEN A. SALTZBURG, MICHAEL M. MARTIN & DANIEL J. CAPRA, FEDERAL RULES OF EVIDENCE MANUAL § 901 (11th ed. 2015), which provides relevant case law and commentary. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 5 provides an extensive analysis of two amendments to the Federal Rules of Evidence—Rules 902(13) and (14)—scheduled to go into effect on December 1, 2017, that will ease the burden of authenticating electronic evidence. At the outset, it is important to emphasize that the standard for establishing authenticity of digital evidence is the same mild standard as for traditional forms of evidence. The factors set forth below are not required to be met in toto before digital evidence is found authentic. They are just relevant factors, and usually, satisfying one or two of any of the listed factors will be enough to convince the court that a juror could find the digital evidence to be authentic. But the factors will need to be applied case- by-case.

II. AN INTRODUCTION TO THE PRINCIPLES OF AUTHENTICATION FOR ELECTRONIC EVIDENCE: THE RELATIONSHIP BETWEEN RULE 104(A) AND RULE 104(B). This article is designed to provide answers to the fundamental evidentiary questions of how to authenticate digital evidence. But before turning to the authentication rules themselves, there are two preliminary rules that must be discussed and understood, because without them, authentication decisions are apt to be erroneous. These rules are Fed. R. Evid. 104(a) (which states the general rule governing preliminary questions about the admissibility of evidence) and Fed. R. Evid. 104(b) (the so-called “conditional relevance” rule10). Understanding these two rules is essential to making correct decisions about the authentication of digital evidence. We start with Rule 104(a). Its text is deceptively straightforward: “[t]he court must decide any preliminary question about whether a witness is qualified, a privilege exists, or evidence is admissible. In so deciding, the court is not bound by evidence rules, except those on privilege.”11 Most decisions about admissibility of evidence, whether digital or otherwise, are made by the judge alone.12 They include decisions about whether evidence is relevant, constitutes hearsay (or fits within one of the many hearsay exceptions), is excessively prejudicial when compared to its probative value; whether experts are qualified and the extent of opinion testimony that will be allowed; and most questions regarding application of the original

10 FED. R. EVID. 104(b) advisory committee’s note to 1972 amendment. 11 FED. R. EVID. 104(a) (emphasis added). 12 See id.; Symposium, supra note 6, at 1175. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

6 BAYLOR LAW REVIEW [Vol. 69:1 writing rule.13 When the judge makes a ruling under Rule 104(a), he or she is the sole decision-maker as to whether the evidence may be heard by the jury.14 If admitted, of course, the jury is free to give the evidence whatever weight (if any) they think it deserves.15 This is familiar turf to trial judges, but with digital evidence, there is a greater likelihood that the judge alone may not be the final decision-maker regarding admissibility. The jury also may have a part to play in the admissibility decision, and this is where Rule 104(b) comes in. Rule 104(b) qualifies Rule 104(a). It provides “[w]hen the relevance of evidence depends on whether a fact exists, proof must be introduced sufficient to support a finding that the fact does exist. The court may admit the proposed evidence on the condition that the proof be introduced later.”16 Read in isolation, Rule 104(b) seems too abstract to be helpful. But, in the case of disputes over the authenticity of digital evidence, it can be an important qualifier to the general rule of 104(a) that the trial judge decides questions about the admissibility of evidence. An illustration will help bring things into focus. Imagine the following variations of a common theme. In an employment discrimination case, the plaintiff, a woman, alleges that her supervisor, a man, intentionally discriminated against her in deciding to promote a lesser-qualified man to a position that the plaintiff sought. As evidence of intentional discrimination, the plaintiff wants to introduce an email that she asserts her supervisor sent to her that says: “Jane, stop bugging me about the sales supervisor position. Your track record compared to the men in our sales group is terrible, and confirms what I always have suspected. Women just don’t have the stuff it takes to get out there and sell our products. You should be glad you still have your sales job, and quit trying to be something you can never do well. Bob.” The email is from the company email account ([email protected]), addressed to the plaintiff ([email protected]), apparently signed by the supervisor (Bob), discusses a subject matter about which the supervisor has knowledge, and is dated on a day and time the supervisor was known to be at the office. Plaintiff contends that the email is “smoking gun” evidence of intentional gender discrimination.

13 See Symposium, supra note 6, at 1175. 14 Id. at 1175–76. 15 Id. 16 FED. R. EVID. 104(b). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 7

Imagine further the following scenarios when the plaintiff offers the email into evidence at trial. One: the defense attorney objects to the introduction of the email, the judge asks for the basis of the objection, and the defense attorney simply says “inadequate foundation.” Two: the defense attorney objects, the judge asks for the basis of the objection, and the defense attorney says: “Judge, this is an email, there is no evidence that the supervisor was the one who actually wrote it. It was found on a company computer, anyone in the company had access to that computer, including the plaintiff herself, whose office was right next to his, and my client is often away from his desk during the day, and he does not log out of his computer. Plaintiff hasn’t shown that someone else didn’t send that email pretending to be my client, and everyone knows how easy it is to fake an email.” Three: the defense attorney objects, the judge asks for the basis of the objection, and the defense attorney says: “Judge, my client will testify that on the day and time stated on the email he was at a sales meeting with the other supervisors and the president of the company. Five other people saw him there at that day and time and will testify that they did. During those meetings, no one is allowed to use their smartphone or to send or receive emails, on pain of being fired if the president sees them looking at their phones. The location of the meeting was on a different floor from where my client and the plaintiff work. He will testify that he did not send the email, and that when he leaves his office he does not log out, his computer stays on, and anyone can access it without a password and use his office email account. He also will testify that when he came back from the meeting, the plaintiff looked at him in a strange way, and said ‘I wouldn’t look so smug if I were you. You might not be that way for very long.’” With these scenarios in mind, what is the interplay between Rule 104(a) and 104(b) in determining whether the email may be admitted at trial and considered by the jury? In the first scenario, no explanation was given by the defense attorney for excluding the email other than the conclusory statement that the plaintiff had not laid a sufficient foundation. Here, the trial judge alone decides, under Rule 104(a), whether an adequate foundation has been established. If the foundation was deficient, the judge will require the plaintiff’s lawyer to make a fuller showing, and allow or exclude the email accordingly. Rule 104(b) is not implicated. In the second scenario, the defense attorney has made a conclusory legal argument that provides no facts showing that the supervisor did not author 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

8 BAYLOR LAW REVIEW [Vol. 69:1 the email, but rather speculates that it could have been written by someone else. The argument invites the trial judge to require the plaintiff’s lawyer to “prove a negative”—that no one but the supervisor was the author. But this is not the burden that the plaintiff must meet under Rule 104(a) to establish the admissibility of the email. Rather, all that plaintiff must do is to meet the obligation imposed by Rule 901(a), which is to “produce evidence sufficient to support a finding that the item is what the proponent claims it is.”17 Certainty is not required. All that is needed is evidence sufficient to convince a reasonable juror that, more likely than not, the email is what the plaintiff claims it is—an email her supervisor drafted. And, under the hypothetical facts of the second scenario, the defense counsel is wrong in saying the plaintiff has offered no evidence that the email came from the supervisor. She has shown that the email came from the supervisor’s email address, on the company email server, on a day when the supervisor was at the office, discussing a topic about which the supervisor had knowledge, and is signed with his name. Certainly this would be an example of authentication under Rule 901(b)(4), where the “appearance, contents, substance . . . or other distinctive characteristics of the item, taken together with all the circumstances”18 tend to show that the supervisor authored the email. The second scenario also raises only Rule 104(a) issues for the trial judge alone to determine admissibility. The facts, under which admissibility must be judged, are undisputed. If the trial judge concludes (as she should under these facts) that a reasonable juror could find from the foundation presented that it is more likely than not that the supervisor wrote the email, it is admissible. Defense counsel’s speculation about what “could” have happened is reserved for argument to the jury about how much weight (if any) to give to the email. Absent from scenario two is evidence that the supervisor in fact did not author the email, to contradict the undisputed facts introduced by the plaintiff regarding the distinctive characteristics of the email that associate it with the supervisor. Put another way, if “it might have been hacked” or “it might have been photoshopped” were enough to preclude authentication, then no digital evidence could ever be authenticated.19

17 Id. 901(a). 18 Id. 901(b)(4). 19 See, e.g., United States v. Safavian, 435 F. Supp. 2d 36, 41 (D.D.C. 2006) (“The possibility of alteration does not and cannot be the basis for excluding e-mails as unidentified or unauthenticated as a matter of course, any more than it can be the rationale for excluding paper 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 9

Scenario three does introduce facts contradicting the evidence the plaintiff introduced about the distinctive characteristics of the email tying it to the supervisor. The defense attorney has proffered that he will introduce evidence (the supervisor, the five witnesses who corroborate that he was with them at the time the email was sent, the policy prohibiting use of cell phones during meetings with the company president, the meeting’s location on a different floor of the building). Now the trial judge is presented with competing evidence that the supervisor did, and did not, author the email. If the plaintiff’s evidence is accepted over that of the defendant, then it is more likely than not that the supervisor is the author, and the email is relevant to show his discriminatory intent. But, if the defendant’s version of the facts is accepted over those offered by the plaintiff, then the supervisor did not author the email, and it is irrelevant to prove his state of mind. The relevance of the email turns on whether the plaintiff’s version or the defendant’s version is accepted, and this falls squarely within the scope of Rule 104(b). The relevance of the email depends on the existence of a disputed fact—authorship of the email. Who decides between the competing versions? If the case is tried before a jury, it is the jury, not the judge, who must resolve the dispute.20 The judge’s role under Rule 104(a) is to evaluate whether a reasonable jury could find (more likely than not) either that the supervisor did, or did not, author the email. If either version is plausible, then the judge conditionally admits the email, but at the time it is introduced instructs the jury that if they find that the plaintiff has shown that the supervisor more likely than not authored the email, they may consider it as evidence and give it the weight that they feel it is entitled to.

documents (and copies of those documents). . . . Absent specific evidence showing alteration . . . the Court will not exclude any . . . e-mails because of the mere possibility that it can be done.”). 20 The Advisory Committee explains when the jury must resolve the dispute: If preliminary questions of conditional relevancy were determined solely by the judge, as provided in subdivision (a), the functioning of the jury as a trier of fact would be greatly restricted and in some cases virtually destroyed. These are appropriate questions for juries. Accepted treatment, as provided in the rule, is consistent with that given fact questions generally. The judge makes a preliminary determination whether the foundation evidence is sufficient to support a finding of fulfillment of the condition. If so, the item is admitted. If after all the evidence on the issue is in, pro and con, the jury could reasonably conclude that fulfillment of the condition is not established, the issue is for them. If the evidence is not such as to allow a finding, the judge withdraws the matter from their consideration.

FED. R. EVID. 104(b) advisory committee’s note to 1972 proposal. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

10 BAYLOR LAW REVIEW [Vol. 69:1

Contrastingly, if they find that the defendant has persuaded them that, more likely than not, he did not author the email, they must disregard it entirely, and give it no weight in their deliberations. The final decision about whether the email has been admitted (and can be considered by the jury) or excluded (and disregarded by the jury) must await the jury’s deliberation on the merits of the case. The judge makes a preliminary assessment of whether the evidence is one-sided or two, and if the latter, submits it to the jury for their decision. The issue of conditional relevance generated by disputed facts regarding the authenticity (and hence, relevance) of evidence is especially prevalent with digital evidence. It is important for judges to distinguish between which of the scenarios listed above is presented to them when ruling on admissibility of digital evidence. For scenario one situations, the judge alone decides whether the proponent has laid a proper foundation to authenticate the digital evidence. Most often, the judge will consider whether one or more of the illustrations of how to authenticate found at Fed. R. Evid. 901(b)21 or 90222 has been shown. For scenario two situations, the judge alone makes the decision whether to admit or exclude. In doing so, he must be careful not to let unparticularized and conclusory argument by the party objecting to the introduction of the digital evidence about what “might” or “could have happened” lead him to impose on the proponent of the evidence a burden of

21 For digital evidence, the most useful authentication rules within Rule 901(b) are: 901(b)(1) (a witness with personal knowledge that the evidence is what it purports to be); 901(b)(3) (comparison of the evidence with an authenticated specimen by an expert witness or the finder of fact); 901(b)(4) (“the appearance, contents, substance, internal patterns or other distinctive characteristics of the item, taken together with all the circumstances”); 901(b)(5) (for audio recordings, an opinion identifying a person’s voice, whether heard firsthand or through electronic transmission or recording, based on having heard that voice in the past); and 901(b)(9) (“evidence describing a process or system and showing that it produces an accurate result”). 22 Federal Rule of Evidence 902 provides examples of self-authentication, where no extrinsic evidence or testimony is needed to authenticate. FED. R. EVID. 902. The following self- authentication rules may be helpful for digital evidence: 902(5) (“A book, pamphlet, or other publication purporting to be issued by a public authority.” Most public authorities have web sites and post publications relating to their fields of jurisdiction.); 902(6) (“Printed material purporting to be a newspaper or periodical.” Most newspapers and periodicals have “on line editions,” and this rule potentially is available to self-authenticate.); 902(11) and (12) (Certified copy of domestic and foreign records of regularly conducted activities); proposed Rule 902(13) (Certified copy of machine-generated information); and Rule 902(14) (proposed May 7, 2015) (Certified copy of computer generated or stored information). Authentication under proposed Rules 902(13) and (14) is discussed in a separate section. See infra Part V. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 11 proof greater than that ordinarily required by Rule 104(a)—a showing that the evidence more likely than not is what it purports to be.23 It is a mistake for a judge to require the party introducing digital evidence to prove that no one other than the purported maker could have created the evidence if the introducing party has shown that, more likely than not, it was created by a particular person, unless there is evidence (not argument) that some other person could have done so.24 Finally, for scenario three situations, where the judge is faced with competing facts plausibly showing that the digital evidence was, and was not, created by the person claimed by the proponent, then she should allow the evidence to be admitted “conditionally” under Rule 104(b). The judge should then instruct the jury that if they find that the evidence that the person claimed to have created the evidence did not do so is more believable than the evidence that he did, they must disregard it and give it no weight in their deliberations. Careful attention to the interplay between Rule 104(a) and 104(b), as well as consideration of the abundant authentication tools identified in Rules 901(b) and 902, will go a long way towards removing the mystery about authenticating digital evidence, even when the technology at play is unfamiliar to the judge. In the end, technical expertise is not needed. Rather, an awareness of the fundamental evidence rules governing admissibility and authentication of any evidence, whether digital or not, is all that is needed. And this article aims to provide illustrations to make the effort even easier.

III. RELEVANT FACTORS FOR AUTHENTICATING DIGITAL EVIDENCE What follows are general guidelines and lists of relevant factors for authenticating the basic forms of digital evidence that have developed over the last twenty years. The lists of relevant factors do not purport to be exclusive. There is no attempt to weigh the factors, or to take a cumulative approach, as the importance of any factor will be case-dependent. And there is no intent to imply that all of the factors listed must be met before the proffered digital evidence can be found authentic. In evaluating all the factors below, it is important to remember that the threshold for the court’s determination of authenticity under Rule 901 is not

23 See FED. R. EVID. 901(a). 24 Hon. Paul W. Grimm et al., Authentication of Social Media Evidence, 36 AM. J. TRIAL ADVOC. 433, 459 (2013) (“A trial judge should admit the evidence if there is plausible evidence of authenticity produced by the proponent of the evidence and only speculation or conjecture—not facts—by the opponent of the evidence about how, or by whom, it ‘might’ have been created.”). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

12 BAYLOR LAW REVIEW [Vol. 69:1 high: “[t]he [c]ourt need not find that the evidence is necessarily what the proponent claims, but only that there is sufficient evidence that the jury ultimately might do so.”25 Generally speaking, it will be a rare case in which an item of digital evidence cannot be authenticated. The question is whether the proponent is willing and able to expend the resources necessary to do so.26 The factors set forth below are intended to direct litigants to ways in which resources can be usefully spent on authenticating digital evidence—and on ways to avoid such costs in certain situations.

A. Emails The authentication questions for email most commonly focus on whether the email was sent or received by the person whom the party claims sent or received it. There are a number of factors that will assist the proponent in establishing authenticity for either or both of these purposes. Among them are:

1. A Witness With Personal Knowledge May Testify to Authenticity.27 Possibilities include:  The author of the email in question testifies to its authenticity.28  A witness testifies that s/he saw the email in question being authored/received by the person who the proponent claims authored/received it.29

25 United States v. Safavian, 435 F. Supp. 2d 36, 38 (D.D.C. 2006). 26 See Jeffrey Bellin & Andrew Guthrie Ferguson, Trial by Google: Judicial Notice in the Information Age, 108 NW. U. L. REV. 1137, 1157 (2014) (“Although much is made of [the authentication] hurdle in the Information Age, it is . . . an easy one to surmount. Success generally depends not on legal or factual arguments, but rather the amount of time and resources a litigant devotes to the problem.”) (footnote omitted). 27 See FED. R. EVID. 901(b)(1). 28 See, e.g., Anderson v. United States, Nos. 4:11-CR-006-01-HLM-WEJ, 4:14-CV-0114- HLM-WEJ, 2014 U.S. Dist. LEXIS 166799, at *13 (N.D. Ga. Dec. 2, 2014) (finding a sufficient showing of authenticity where defendant-witness acknowledged that the documents in question contained emails he sent to an undercover agent, the emails were sent from his email address, and the document contained the entirety of his email exchange with the undercover agent); see also Citizens Bank & Trust v. LPS Nat’l Flood, LLC, 51 F. Supp. 3d 1157, 1163 (N.D. Ala. 2014) (finding that witness’s personal knowledge of email contents and her affidavit authenticating emails as the ones she sent were sufficient for admissibility). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 13

 The recipient of emails in an email chain testifies that the emails accurately represent the conversation between him and the author in question.30

2. Business Records. The custodian of records of a regularly conducted activity testifies to a foundation, or certifies, in accordance with Fed. R. Evid. 902(11) or (12), that an email satisfies the criteria of Fed. R. Evid. 803(6).31 It should be

29 See United States v. Fluker, 698 F.3d 988, 999 (7th Cir. 2012) (stating, in outlining the variety of ways in which an email could be authenticated, that testimony from a witness who purports to have seen the declarant create the email in question was sufficient for authenticity under Rule 901(b)(1)). 30 United States v. White, No. 15-12025, 2016 U.S. App. LEXIS 15675, at *5 (11th Cir. Aug. 25, 2016) (allowing a witness to authenticate an email chain with many emails sent between the defendant and the witness, and holding the “anomalies and inconsistencies” in the email were insufficient to impact the admissibility of the documents). 31 Rules 902(11) and (12) provide for a means of certifying the authenticity of a business record, as well as the foundation requirements for the business records exception (Rule 803(6)) by way of a certificate of a qualified witness. The rules state as follows: Rule 902. Evidence That Is Self-Authenticating The following items of evidence are self-authenticating; they require no extrinsic evidence of authenticity in order to be admitted:

. . . . (11) Certified Domestic Records of a Regularly Conducted Activity. The original or a copy of a domestic record that meets the requirements of Rule 803(6)(A)–(C), as shown by a certification of the custodian or another qualified person that complies with a federal statute or a rule prescribed by the Supreme Court. Before the trial or hearing, the proponent must give an adverse party reasonable written notice of the intent to offer the record—and must make the record and certification available for inspection—so that the party has a fair opportunity to challenge them. (12) Certified Foreign Records of a Regularly Conducted Activity. In a civil case, the original or a copy of a foreign record that meets the requirements of Rule 902(11), modified as follows: the certification, rather than complying with a federal statute or Supreme Court rule, must be signed in a manner that, if falsely made, would subject the maker to a criminal penalty in the country where the certification is signed. The proponent must also meet the notice requirements of Rule 902(11).

FED. R. EVID. 902(11)–(12). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

14 BAYLOR LAW REVIEW [Vol. 69:1 noted, however, that emails—even of a business, do not automatically qualify as business records.32

3. Jury Comparison With Other Authenticated Emails.33 The authenticity of an email can be determined by the trier of fact by comparing the email in question with emails already authenticated and in evidence.34

4. Production in Discovery. If a document request is sufficiently descriptive, production in response to that request may serve in itself to authenticate the email, as the act of production may be a concession that the document is what the party asked for—and thus is what the party says it is. The act of production can constitute a statement of a party-opponent and consequently admissible evidence of authenticity.35 Authentication has also been found when an adversary produces in discovery a third party’s email received by the producing party in the ordinary course of business, and the email is offered

32 See, e.g., United States v. Cone, 714 F.3d 197, 220 (4th Cir. 2013) (“While properly authenticated e-mails may be admitted into evidence under the business records exception, it would be insufficient to survive a hearsay challenge simply to say that since a business keeps and receives e-mails, then ergo all those e-mails are business records falling within the ambit of Rule 803(6)(B).”); Morisseau v. DLA Piper, 532 F. Supp. 2d 595, 621 n.163 (S.D.N.Y. 2008) (“An e- mail created within a business entity does not, for that reason alone, satisfy the business records exception of the hearsay rule.”). It is probably fair to state that emails and social media postings will often be prepared too casually and irregularly to be admissible as business records. But this is not inevitably so, and again if the electronic communication does fit the admissibility requirements it is just as admissible as a hardcopy record. 33 FED. R. EVID. 901(b)(3). 34 United States v. Safavian, 435 F. Supp. 2d 36, 40 (D.D.C. 2006) (“Those emails that are not clearly identifiable on their own can be authenticated under Rule 901(b)(3), which states that such evidence may be authenticated by comparison by the trier of fact (the jury) with ‘specimens which have been [otherwise] authenticated’—in this case, those emails that already have been independently authenticated . . . .”) (alteration in original). 35 See FED. R. EVID. 801(d)(2); see also, e.g., Nola Fine Art, Inc. v. Ducks Unlimited, Inc., 88 F. Supp. 3d 602, 607 (E.D. La. 2015) (“[Defendant] produced the email to plaintiffs in discovery and therefore cannot seriously dispute the email’s authenticity.”); AT Engine Controls Ltd. v. Goodrich Pump & Engine Control Sys., Inc., No. 3:10-cv-01539 (JAM), 2014 U.S. Dist. LEXIS 174535, at *28–29 n.12 (D. Conn. Dec. 18, 2014) (collecting cases holding that production of emails in discovery constitutes a concession of authenticity). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 15 against the adversary.36 But some production may be so massive and extensive that it cannot be concluded that production itself is a concession of authenticity. Moreover, it is possible that a party might knowingly produce inauthentic documents, such as a forged check, and such production could not be found to be tantamount to authentication.

5. Circumstantial Evidence.37 Applying Rule 901(b)(4)—covering authentication on the basis of “appearance, contents, substance, internal patterns, or other distinctive characteristics of the item”—requires consideration of the totality of circumstantial evidence.38 While any one factor may be insufficient to determine admissibility, when circumstantial factors are weighed together, authenticity may be established. “This rule is one of the most frequently used to authenticate email and other electronic records.”39 Set forth below are circumstances that can, alone or in conjunction (depending on the case), establish authenticity. Different circumstantial factors may be relevant depending on whether the authenticity dispute is over whether a person sent or received the email.

a. Authenticating Authorship Circumstantially. The Inclusion of Some or All of the Following in an Email Can Be Sufficient to Authenticate the Email as Having Been Sent by a Particular Person:  the purported author’s known email address;40  the author’s electronic signature;  the author’s name;41

36 Broadspring, Inc. v. Congoo, LLC, No. 13-CV-1866 (JMF), 2014 U.S. Dist. LEXIS 177838, at *8–9 (S.D.N.Y. Dec. 29, 2014) (holding that third party emails sent to a party in the ordinary course of business and produced by the party in litigation are sufficiently authenticated by the act of production when offered by an opponent, but hearsay and other admissibility objections as to the third parties’ statements must separately be satisfied). 37 FED. R. EVID. 901(b)(4). 38 Id.; see United States v. Henry, 164 F.3d 1304, 1309 (10th Cir. 1999). 39 Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 546 (D. Md. 2007). 40 See, e.g., United States v. Siddiqui, 235 F.3d 1318, 1322 (11th Cir. 2000) (holding that an email identified as originating from the defendant’s email address and that automatically included the defendant’s address when the reply function was selected was considered sufficiently authenticated). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

16 BAYLOR LAW REVIEW [Vol. 69:1

 the author’s nickname;42  the author’s screen name;  the author’s initials;  the author’s moniker;43  the author’s customary use of emoji or emoticons;  the author’s use of the same email address elsewhere;  a writing style similar or identical to the purported author’s manner of writing;  reference to facts only the purported author or a small subset of individuals including the purported author would know;44  reference to facts uniquely tied to the author—e.g., contact information for relatives or loved ones; photos of the author or items of importance to the author (e.g., car, pet); the author’s personal information, such as a cell phone number, social security number, etc.45

41 See, e.g., United States v. Fluker, 698 F.3d 988, 999–1000 (7th Cir. 2012) (finding that emails sent from a “More Than Enough, LLC” (MTE) email address were sufficiently authenticated when the purported author was an MTE board member and “[i]t would be reasonable for one to assume that an MTE Board [m]ember would possess an email address bearing the MTE acronym”); United States v. Safavian, 435 F. Supp. 2d 36, 40 (D.D.C. 2006) (holding that email messages were properly authenticated when containing distinctive characteristics, including email addresses and name of the person connected to the address). 42 United States v. Brinson, 772 F.3d 1314, 1320 (10th Cir. 2014) (use of fake name commonly used by defendant). 43 See United States v. Simpson, 152 F.3d 1241, 1244 (10th Cir. 1998) (using chatroom log where user “Stavron” identified himself as the defendant and shared his email address was used to authenticate subsequent emails from that email address). 44 See Siddiqui, 235 F.3d at 1322 (ruling that messages that referred to facts only the defendant was familiar with were admissible). 45 Commonwealth v. Amaral, 941 N.E.2d 1143, 1147 (Mass. App. Ct. 2011) (“In other e- mails, Jeremy provided his telephone number and photograph. When the trooper called that number, the defendant immediately answered his telephone, and the photograph was a picture of the defendant. These actions served to confirm that the author of the e-mails and the defendant were one and the same.”) (citing MASS. G. EVID. § 901(b)(6)). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 17

Factors Outside the Content of the Email Itself Can Establish Authenticity of Authorship Circumstantially. For Example:  a witness testifies that the author told him to expect an email prior to its arrival;46  the purported author acts in accordance with, and in response to, an email exchange with the witness;  the author orally repeats the contents soon after the email is sent;  the author discusses the contents of the email with a third party;  the author leaves a voicemail with substantially the same content.

Forensic Information May Be Used to Support a Circumstantial Showing That the Email Was Sent by the Purported Author. Forensic Sources Include:  an email’s hash values;47  testimony from a forensic witness that an email issued from a particular device at a particular time.48

46 People v. Ruiz, No. 313087, 2014 Mich. App. LEXIS 855, at *10 (Mich. Ct. App. May 15, 2014) (interpreting MRE 901) (noting that witness testified to knowing the defendant authored an email because the defendant told him to expect an email relating to arson—the contents of the email subsequently received). 47 A hash value is: [a] unique numerical identifier that can be assigned to a file, a group of files, or a portion of a file, based on a standard mathematical algorithm applied to the characteristics of the data set. The most commonly used algorithms, known as MD5 and SHA, will generate numerical values so distinctive that the chance that any two data sets will have the same hash value, no matter how similar they appear, is less than one in one billion. ‘Hashing’ is used to guarantee the authenticity of an original data set and can be used as a digital equivalent of the Bates stamp used in paper document production.

BARBARA J. ROTHSTEIN, RONALD J. HEDGES & ELIZABETH C. WIGGINS, FEDERAL JUDICIAL CENTER, MANAGING DISCOVERY OF ELECTRONIC INFORMATION: A POCKET GUIDE FOR JUDGES 24 (2007); see also Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 547 (D. Md. 2007) (noting that “[h]ash values can be inserted into original electronic documents when they are created to provide them with distinctive characteristics that will permit their authentication under Rule 901(b)(4).”). 48 Lorraine, 241 F.R.D. at 547–48 (holding that because an electronic message’s metadata (including an email’s metadata) can reveal when, where, and by whom the message was authored, it could be used to successfully authenticate a document under 901(b)(4)). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

18 BAYLOR LAW REVIEW [Vol. 69:1

b. Authenticating Receipt Circumstantially. The Following Factors Can Be Probative in Authenticating an Email as Having Been Received by a Particular Person:  a reply to the email was received by the sender from the email address of the purported recipient;  the subsequent conduct of the recipient reflects his or her knowledge of the contents of the sent email;  subsequent communications from the recipient reflect his or her knowledge of the contents of the sent email;  the email was received and accessed on a device in the possession and control of the alleged recipient.

In addition to the factors listed above, a court may take judicial notice49 of an email, or an email chain when the contents of the email are authenticated elsewhere. For example, in Shurnas v. Owen, the authors of the emails in question were not in dispute and the contents of the emails were “contained in the certified records of the California Department of Business Oversight.”50 These factors allowed the court to take judicial notice of the emails the defendant sought to introduce.51 Finally, while it is true that an email may be sent by anyone who, with a password, gains access to another’s email account, similar questions (of possible hacking) could be raised with traditional documents. Therefore, there is no need for separate rules of authenticity for emails. And importantly, the mere fact that hacking, etc., is possible is not enough to exclude an email or any other form of digital evidence. As discussed above, if the mere possibility of electronic alteration were enough to exclude the evidence, then no digital evidence could ever be authenticated.52

49 Judicial notice is discussed more broadly infra Part III. 50 No. 2:15-cv-00908-MCE-KJN, 2016 U.S. Dist. LEXIS 18640, at *7 (E.D. Cal. Feb. 16, 2016). 51 Id. at *7–8. 52 See, e.g., In re F.P., 878 A.2d 91, 95 (Pa. Super. Ct. 2005) (holding that just as an email can be faked, a “signature can be forged; a letter can be typed on another’s typewriter; distinct letterhead stationary can be copied or stolen. We believe that e-mail messages and similar forms of electronic communication can be properly authenticated within the existing framework of Pa. R.E. 901 and Pennsylvania case law.”). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 19

B. Text Messages Text messages are not different in kind from email and so the rules and guidelines on authentication are similar. Here are some of the relevant factors for authenticating text messages:53

1. A Witness With Personal Knowledge May Testify to Authenticity. Possibilities include:  The author of the text in question testifies to its authenticity.  A witness testifies that s/he saw the text in question being authored/ received by the person who the proponent claims authored/received it.54

2. Jury Comparison With Other Authenticated Texts.

3. Production in Discovery.

4. Establishing That an Electronic System of Recordation Records Accurately. This process of illustration, authorized by Fed. R. Evid. 901(b)(9),55 can be useful if the objection to authenticity is that the original text has been altered in some way. For example, in United States v. Kilpatrick, the government sought to authenticate text messages sent from two SkyTel

53 The case law cited under the various factors discussed in the section on emails should be equally useful as supportive citations for the similar (or identical) factors supporting authentication of texts. 54 United States v. Ramirez, 658 Fed. Appx. 949, 952 (11th Cir. 2016) (admitting photos that were sent by text message because the recipient of the text message testified she received them, an agent testified he was present when the text messages were sent, and the defendant was listed as the owner of the phone number sending the messages); United States v. Barnes, 803 F.3d 209, 217 (5th Cir. 2015) (finding that government laid a proper foundation to authenticate Facebook and text messages as having been sent by the defendant; the defendant was a quadriplegic, but the witness who received the messages testified she had seen the defendant use Facebook, she recognized his Facebook account, and the Facebook messages matched the defendant’s manner of communicating: “[a]lthough she was not certain that Hall [the defendant] authored the messages, conclusive proof of authenticity is not required for admission of disputed evidence”). 55 FED. R. EVID. 901(b)(9). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

20 BAYLOR LAW REVIEW [Vol. 69:1 pages, each belonging to one of the defendants respectively.56 A SkyTel records-custodian verified that the text messages the government offered had not been and could not be edited in any way because when the messages are sent from the devices belonging to the defendants, they are automatically saved on SkyTel’s server with no capacity for editing.57 The court ruled that this showing was sufficient, under Fed. R. Evid. 901(b)(9), to establish authenticity over a claim that the messages had been altered.58 It should be noted that the showing as to the process or system in Kilpatrick will be able to be made by a certificate of the foundation witness—substituting for live testimony—under an amendment to the Evidence Rules that is scheduled to take effect on December 1, 2017.59

5. Circumstantial Evidence.

a. Authenticating Authorship Circumstantially. The Inclusion of Some or All of the Following in a Text Can Be Sufficient to Authenticate the Text as Having Been Sent by a Particular Person:  the purported author’s ownership of the phone or other device from which the text was sent;60  the author’s possession of the phone;  the author’s known phone number;  the author’s name;  the author’s nickname;61  the author’s initials;

56 No. 10-20403, 2012 U.S. Dist. LEXIS 110166, at *2 (E.D. Mich. Aug. 7, 2012). 57 Id. at *4, *8–9. 58 Id. at *16. 59 The proposed amendments would add two new subdivisions to Rule 902, which provides for various forms of self-authentication. See infra Part V for a full discussion of the use to which these new proposals can be put. 60 United States v. Mebrtatu, 543 F. App’x 137, 140–41 (3d Cir. 2013) (holding that when phone was in the purported sender’s possession; phone contains texts sent to and signed with the purported author’s first name, including texts from her boyfriend professing love and other texts whose content links them to her; texts sufficiently authenticated as hers). 61 Kilpatrick, 2012 U.S. Dist. LEXIS 110166, at *11–12 (outlining a number of distinctive characteristics that established the authenticity of the pager and cellphone text messages at issue; among these factors were the defendants’ use of their names (Kilpatrick) and nicknames (“Zeke” or “Zizwe”) to sign the messages they sent). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 21

 the author’s moniker;  the author’s name as stored on the recipient’s phone;  the author’s customary use of emoji or emoticons;  the author’s use of the same phone number on other occasions;62  a writing style similar or identical to the purported author’s manner of writing;  reference to facts only the purported author or a small subset of individuals including the purported author would know;  reference to facts uniquely tied to the author—e.g., contact information for relatives or loved ones; photos of author or items of importance to author (e.g., car, pet); author’s personal information, such as contact information, social security number, etc.; receipt of messages addressed to the author by name or reference.63

Factors Outside the Content of the Text Itself Can Establish Authenticity of Authorship Circumstantially. For Example:  a witness testifies that the author told him to expect a text message prior to its arrival;  the purported author acts in accordance with a text exchange;  the purported author orally repeats the contents soon after the text message is sent or discusses the contents with a third party.

62 See United States v. Fults, 639 F. App’x 366, 373 (6th Cir. 2016) (upholding the admission of text messages when the recipient testified he communicated with the defendant using that phone number many times). 63 United States v. Benford, No. CR-14-321-D, 2015 U.S. Dist. LEXIS 17046, at *16–17 (W.D. Okla. Feb. 12, 2015) (noting that in establishing that text messages from a device were authored by the defendant, the prosecution pointed to evidence that contact information for the defendant’s brother and girlfriend were saved on the phone and that incoming messages addressed the defendant by name) (citing United States v. Ellis, No. 12-CR-20228, 2013 U.S. Dist. LEXIS 73031, at *3–4 (E.D. Mich. May 23, 2013) (holding that the defendant’s possession of a cellphone that received messages addressed to him by name or moniker was, among other circumstantial evidence (such as his possession of the device), sufficient to establish that he was the author of outgoing text messages from the same phone)).

7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

22 BAYLOR LAW REVIEW [Vol. 69:1

b. Authenticating Receipt Circumstantially. The Following Factors Can Be Probative in Authenticating a Text as Having Been Received by a Particular Person:  a reply to the text message was received by the sender from the purported recipient’s phone number;  the subsequent conduct of the recipient reflects his or her knowledge of the sent message’s contents;  subsequent communications from the recipient reflect his or her knowledge of the contents of the sent text message;  the text message was received and accessed on a device in the possession and control of the alleged recipient.

C. Chatroom and Other Social Media Conversations By definition, chatroom postings and other social media communications are made by third parties, not the owner of the site. Further, chatroom participants usually use screen names (pseudonyms) rather than their real names. Thus the authenticity challenge is to provide enough information for a juror to believe that the chatroom entry or other social media communication is made by a particular person. Simply to show that a posting appears on a particular user’s webpage is insufficient to authenticate the post as one written by the account holder.64 Third party posts, too, must be authenticated by more than the names of the purported authors reflected on the posts.65 Evidence sufficient to attribute a social media or chat room posting to a particular individual may include, for example:  testimony from a witness who identifies the social media account as that of the alleged author, on the basis that the witness on other occasions communicated with the account holder;  testimony from a participant in the conversation based on firsthand knowledge that the transcript fairly and accurately captures the conversation;66

64 See Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 555 (D. Md. 2007). 65 See id. at 556. 66 See, e.g., United States v. Lebowitz, 676 F.3d 1000, 1009 (11th Cir. 2012) (finding that internet chat was authenticated by credible testimony of one participant); United States v. Lundy, 676 F.3d 444, 453 (5th Cir. 2012) (holding that testimony by one party to chat that the chats are as he recorded them is enough to meet the low threshold for authentication); United States v. Barlow, 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 23

 evidence that the purported author used the same screen name on other occasions;  evidence that the purported author acted in accordance with the posting (e.g., when a meeting with that person was arranged in a chat room conversation, he or she attended);  evidence that the purported author identified himself or herself as the individual using the screen name;  an admission that the computer account containing the chat is that of the purported author;67  use in the conversation of the customary signature, nickname, or emoticon associated with the purported author;  disclosure in the conversation of particularized information that is either unique to the purported author or known only to a small group including the purported author;  evidence that the purported author had in his or her possession information given to the person using the screen name;  evidence from the hard drive of the purported author’s computer reflecting that a user of the computer used the screen name in question;  evidence that the chat appears on the computer or other device of the account owner and purported author; and  evidence that the purported author elsewhere discussed the same subject matter.

Authentication as Business Records? Note that an attempt to authenticate social media messaging as business records will, of necessity, be limited to the timestamps, metadata, etc. maintained by the owner. The content of the messages themselves will not qualify as business records (because the content is supplied by a person outside the business with no duty to report accurately) and, accordingly, the content cannot be authenticated as business records under Rule 902(11). For

568 F.3d 215, 220 (5th Cir. 2009) (“English, as the other participant in the year-long ‘relationship,’ had direct knowledge of the chats. Her testimony could sufficiently authenticate the chat log presented at trial . . . .”). 67 United States v. Manning, 738 F.3d 937, 943 (8th Cir. 2014) (“[T]he government presented testimony of a law enforcement officer who helped to execute the search warrant, and the officer testified that the defendant admitted adopting the username ‘mem659’ for his computer account. The username for his computer account was the same one used in some of the chats.”). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

24 BAYLOR LAW REVIEW [Vol. 69:1 example, in United States v. Browne, the government contended that Browne engaged in incriminating conversations over Facebook Messenger.68 The government sought to authenticate the records with a certificate of a records custodian of Facebook.69 The custodian certified that the records “were made and kept by the automated systems of Facebook in the course of regularly conducted activity as a regular practice of Facebook . . . .”70 The court held correctly that this showing was insufficient to authenticate the messages as having come from the defendant—whether the defendant made the communications involved another level of hearsay, and the custodian had no personal knowledge of the authorship of the messages.71 Thus, the certificate could authenticate only the fact that the message was sent at a certain time from one address to another.72

D. Internet, Websites, Etc. Websites present authenticity issues because they are dynamic. If the issue is what is on the website at the time the evidence is being proffered, then there are no authenticity questions because the court and the parties can simply access the site and see what the website says.73 But proving up

68 834 F.3d 403, 405 (3d Cir. 2016). 69 Id. at 408. 70 Id. at 406. 71 Id. at 409–11. 72 The Browne court held, however, that any error in admitting the records with an inadequate authentication was harmless, because there was sufficient extrinsic evidence to authenticate Browne as the author of the messages: the people that he communicated with testified at trial consistently with the communications; Browne “made significant concessions that served to link him to the Facebook conversations”; the content of the conversation indicated facts about the sender that linked to Browne; and the government “supported the accuracy of the chat logs by obtaining them directly from Facebook and introducing a certificate attesting to their maintenance by the company’s automated systems.” Id. at 413–14. 73 Bellin & Ferguson, supra note 26, at 1157 (“It is hard to imagine many good faith disputes about whether proffered evidence really is a page from Google Maps or WebMD. Malfeasance would be foolish. The opposing party can simply go to the website to verify its authenticity, and if fraud is detected, the consequences for the offering party are dire.”); see also Wells Fargo Bank, N.A. v. Wrights Mill Holdings, LLC, 127 F. Supp. 3d 156, 167 (S.D.N.Y. 2015) (confirming that authenticity of existing website information could be determined by conducting a “basic Internet search”). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 25 historic information on the website raises the issue of whether the information was actually posted as the proponent says it was.74

1. Rule 901 Authentication Standards as Applied to Dynamic Website Information. In applying Rule 901 authentication standards to website evidence, there are three questions that must be answered:  What was actually on the website?  Does the exhibit or testimony accurately reflect it?  If so, is it attributable to the owner of the site?

A sufficient showing of authenticity of dynamic website information is usually found if a witness testifies—or certifies in compliance with a statute or rule—that:  the witness typed in the Internet address reflected on the exhibit on the date and at the time stated;  the witness logged onto the website and reviewed its contents; and  the exhibit fairly and accurately reflects what the witness perceived.75

74 See, e.g., Adobe Sys. v. Christenson, No. 2:10-cv-00422-LRH-GWF, 2011 U.S. Dist. LEXIS 16977, at *28–29 (D. Nev. Feb. 7, 2011) (“Although Defendants can probably determine, with little difficulty, whether a current Google search for the search terms ‘software surplus’ provides links on the first page [of a website], this would not prove that such a search would have resulted in such a link at a prior point in time.”). 75 See, e.g., Summit Auto Sales, Inc. v. Draco, Inc., No. 2:15-CV-00736-KOB, 2016 U.S. Dist. LEXIS 21643, at *17–18 (N.D. Ala. Feb. 23, 2016) (allowing screenshots of websites because a witness had personally reviewed the screenshots and could verify that they were accurate, and noting that the copyright date on the website and the web address helped authenticate the document); Rivera v. Inc. Vill. of Farmingdale, 29 F. Supp. 3d 121, 131–32 (E.D.N.Y. 2013) (involving internet postings offered to show community bias in Fair Housing Act case; testimony that witness “personally ‘downloaded all of the postings and confirmed the identities of the key posters’ . . . [suffices to show] a ‘reasonable likelihood’ that they were actually posted on the internet by members of an online community comprised of the Village’s own residents”); Estate of Konell v. Allied Prop. & Cas. Ins. Co., No. 3:10-cv-955-ST, 2014 U.S. Dist. LEXIS 10183, at *3 (D. Or. Jan. 28, 2014) (“To authenticate a printout of a web page, the proponent must offer evidence that: (1) the printout accurately reflects the computer image of the web page as of a specified date; (2) the website where the posting appears is owned or controlled by a particular person or entity; and (3) the authorship of the web posting is reasonably attributable to that person or entity.”); Buzz Off Insect Shield, LLC v. S.C. Johnson & Son, Inc., 606 F. Supp. 2d 571, 594 (M.D.N.C. 2009) (“[Defendant] could authenticate its printouts of 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

26 BAYLOR LAW REVIEW [Vol. 69:1

The exhibit should bear the Internet address and the date and time the webpage was accessed and the contents downloaded.76

When Evaluating the Proffer, the Court May Consider the Following Factors as Circumstantial Indications that the Information Was Posted by the Owner of the Site, Under Rule 901(b)(4):  distinctive website design, logos, photos, or other images associated with the website or its owner;77  the contents of the webpage are of a type ordinarily posted on that website or websites of similar people or entities;  the owner of the website has elsewhere published the same contents, in whole or in part;  the contents of the webpage have been republished elsewhere and attributed to the website; and  the length of time the contents were posted on the website.

Other Possible Means of Authenticating Website Postings Are as Follows:  testimony of a witness who created or is in charge of maintaining the website. That witness may testify on the basis of personal knowledge that the printout of a webpage came from the site.78  a printout obtained from the Internet Archive’s “Wayback Machine.” The Internet Archive documents and stores all websites and the “Wayback Machine” can retrieve website information from any

various websites by calling witnesses who could testify that they viewed and printed the information, or supervised others in doing so, and that the printouts were accurate representations of what was displayed on the listed website on the listed day and time.”). 76 See, e.g., ForeWord Magazine, Inc. v. OverDrive Inc., No. 1:10-cv-1144, 2011 U.S. Dist. LEXIS 125373, at *8–11 (W.D. Mich. Oct. 31, 2011) (admitting screenshots from websites, accompanied only by the sworn affidavit of an attorney, given “other indicia of reliability (such as the Internet domain address and the date of printout)”). 77 See, e.g., Metcalf v. Blue Cross Blue Shield of Mich., No. 3:11-cv-1305-ST, 2013 U.S. Dist. LEXIS 109641, at *28–29 (D. Or. Aug. 5, 2013) (establishing authenticity of website information of an organization’s purported website by logos or headers matching those of the organization). 78 St. Luke’s Cataract & Laser Inst., P.A. v. Sanderson, No. 8:06-cv-223-T-MSS, 2006 U.S. Dist. LEXIS 28873, at *5 (M.D. Fla. May 12, 2006) (holding that web master’s testimony can authenticate a printout). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 27

particular time.79 Some courts require a witness from the Internet archive to testify to establish that the “Wayback Machine” employs a process that produces accurate results under Rule 901(b)(9).80 Other courts, as discussed infra, take judicial notice of the reliability of the “Wayback Machine.”81

The opponent of the evidence is free to challenge authenticity of dynamic website data by adducing facts showing that the exhibit does not accurately reflect the contents of a website, or that those contents are not attributable to the ostensible owner of the site. There may be legitimate questions concerning the ownership of the site or attribution of statements contained on the site to the ostensible owner.

2. Self-Authenticating Website Data. Under Fed. R. Evid. 902, three types of webpage exhibits are self- authenticating—meaning that a presentation of the item itself is sufficient to withstand an authenticity objection from the opponent.82

79 Another example of a website that allows users to access archival copies of webpages is www.cachedpages.com, which allows users to employ one interface to search three different archival services—the Wayback Machine, Google Cache, and Coral Cache. 80 Compare Telewizja Polska USA, Inc. v. Echostar Satellite Corp., No. 02 C 3293, 2004 WL 2367740, at *6 (N.D. Ill. Oct. 15, 2004) (approving the use of the Internet Archive’s “Wayback Machine” to authenticate websites as they appeared on various dates relevant to the litigation), with Open Text S.A. v. Box, Inc., No. 13-cv-04910-JD, 2015 U.S. Dist. LEXIS 11312, at *7 (N.D. Cal. Jan. 30, 2015) (refusing to accept a screenshot from the Wayback Machine into evidence without testimony from a representative of the Internet Archive confirming its authenticity). Under a proposed amendment to the Federal Rules of Evidence, the reliability of the Wayback Machine process could be established by a certificate of the Internet Archive official, rather than in-court testimony. See Rule 902(13) (proposed Aug. 14, 2015) (allowing proof of authenticity of electronic information produced by a process leading to an accurate result to be established by the certificate of a knowledgeable witness). That proposed amendment is scheduled to become effective on December 1, 2017. See infra Part V. 81 See infra Part IV. 82 The relationship between Rules 901 and 902 is a complicated one. The examples of authenticity provided in Rule 901(b) essentially are given the same effect as the conditions establishing self-authentication under Rule 902, i.e., when met, they satisfy the admissibility standard and the authenticity question becomes a matter of weight for the jury. The only difference between the examples in Rules 901 and 902 is that in the latter, the factors establishing authenticity are found on the face of the evidence—no extrinsic evidence is necessary. It is not obvious that there should be an evidentiary distinction between establishing authenticity through extrinsic evidence and establishing authenticity on the face of the item. The rules are looking for 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

28 BAYLOR LAW REVIEW [Vol. 69:1

a. Government Websites. Under Rule 902(5), data on governmental websites are self- authenticating.83 As discussed below, courts regularly take judicial notice of these websites.84

b. Newspaper & Periodical Websites. Under Rule 902(6) (Newspapers and Periodicals), “[p]rinted material purporting to be a newspaper or periodical” is self-authenticating.85 This includes online newspaper and periodicals, because Fed. R. Evid. 101(b)(6) provides that any reference in the Rules to printed material also includes comparable information in electronic form.86 Thus all newspaper and periodical material is self-authenticating whether or not it ever appeared in hard copy.87

c. Websites Certified as Business Records. Rules 902(11) and (12) render self-authenticating business (organizational) records that are certified as satisfying Rule 803(6) by “the custodian or another qualified witness.”88 Exhibits extracted from websites that are maintained by, for, and in the ordinary course of, a business or other regularly conducted activity can satisfy this rule.89 the same thing—enough evidence to indicate to a reasonable person that the item is what the proponent says it is—and it doesn’t seem that the location of that evidence should be important to the court. Put another way, the factors in Rule 902 could have just been added to the list of factors in Rule 901(b) without any loss of utility. That said, the distinction exists in the Evidence Rules, and so this article follows that structure. 83 See, e.g., Williams v. Long, 585 F. Supp. 2d 679, 686–88, 688 n.4 (D. Md. 2008) (collecting cases indicating that postings on government websites are self-authenticating). 84 See infra Part IV. 85 FED. R. EVID. 902(6). 86 Id. 101(b)(6) (definitions) (“[A] reference to any kind of written material or any other medium includes electronically stored information.”). 87 See, e.g., White v. City of Birmingham, 96 F. Supp. 3d 1260, 1274 (N.D. Ala. Mar. 27, 2015) as amended (May 27, 2015) (noting sua sponte that news articles from Huntsville Times website (AL.com) “could be found self-authenticating at trial”). 88 FED. R. EVID. 803(6). 89 See, e.g., United States v. Hassan, 742 F.3d 104, 132–34 (4th Cir. 2014) (holding that Facebook posts, including YouTube videos, were self-authenticating under Rule 902(11) where accompanied by certificates from Facebook and Google custodians “verifying that the Facebook pages and YouTube videos had been maintained as business records in the course of regularly 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 29

3. Authenticating the Date That Information Is Posted on a Website. In some cases, a party may need to show not only that a posting was made on a website, but also the date on which the information was generated—this can be a distinct question from establishing what the website looked like at a particular time, which can be shown by the methods discussed above. Assume, for example, that a video is posted on YouTube on January 1, 2016. If the proponent wants to prove simply that it was posted on that day, this can be done by a person with knowledge, circumstantial evidence, etc. It is a different question if the proponent needs to show that the information itself was generated on a certain day. That will not be shown by proving it was posted on a certain date. For example, in Sublime v. Sublime Remembered, the plaintiffs brought suit against the defendant for violating a court order prohibiting defendant from performing songs belonging to the plaintiffs.90 As evidence, the plaintiffs sought to admit a YouTube video of the defendant performing the prohibited music.91 The court ruled that the video was not properly authenticated without evidence that it was recorded after the court order was issued.92 The mere fact that it was posted after the court order was issued was not enough to establish that the video was what the proponent said it was—performance of the music after the court order was entered.93 Establishing that a video (or any other kind of information posted on a website) was prepared on—or before or after—a certain date thus presents a separate question of authenticity. But it is a question that can be addressed through the same factors discussed above: for example, by a person with personal knowledge, a forensic expert, and/or circumstantial evidence. Illustrative is United States v. Broomfield, in which the defendant was convicted of felon-firearm possession.94 The government offered a YouTube video, which showed the defendant discharging an AR-15 rifle in conducted business activities”); Randazza v. Cox, No. 2:12-cv-2040-JAD-PAL, 2014 U.S. Dist. LEXIS 49762, at *11 (D. Nev. Apr. 10, 2014) (stating that videos posted to YouTube “are self- authenticating as a certified domestic record of a regular conducted activity if their proponent satisfies the requirements of the business-records hearsay exception”). 90 No. CV 06-6059 CAS (FMOx), 2013 U.S. Dist. LEXIS 103813, at *2 (C.D. Cal. July 22, 2013). 91 Id. at *8. 92 Id. at *10–11. 93 Id. at *10 (emphasis added). 94 591 F. App’x 847, 848 (11th Cir. 2014). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

30 BAYLOR LAW REVIEW [Vol. 69:1 front of Fowler Firearms.95 The date that the video was made was obviously critical.96 If it was made before the defendant was a convicted felon, then it depicted no crime.97 The government was not required, necessarily, to prove that the video was taken on a specific day, but it was required to establish that the video was taken after the defendant was convicted of a felony.98 And the date that the video was posted on YouTube was not the relevant date.99 The court found the date was properly authenticated given the following circumstances:  “Fowler Firearms’s manager [] testified that Broomfield was a Fowler Firearms member, that on January 21, 2011, Broomfield purchased two boxes of PMC .223 ammunition, and that he had not purchased that ammunition at any other time. [The manager] stated that the only firearm Fowler Firearms rented to customers at the time that used PMC .223 ammunition was the AR–15 rifle.”100  An employee who had worked at Fowler Firearms for ten years “testified that he could discern the approximate date the video was taken.”101 He “explained that the video showed side deflectors and lights on the gun range, which Fowler Firearms had installed in late 2010 or early 2011.”102 He also testified that Fowler Firearms “paints its floors and walls at the beginning of the season, and the freshly-painted floor and walls seen in the video indicated that the footage was filmed close to the start of 2011.”103  A witness who “operated a maintenance business that provided repair and maintenance to Fowler Firearms . . . testified that he installed the lighted baffles shown in the video, in late September or early October of 2010.”104

95 Id. 96 See id. at 849. 97 See id. at 848. 98 See id. 99 See id. at 849. 100 Id. at 848–49. 101 Id. at 849. 102 Id. 103 Id. 104 Id. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 31

All this was more than enough to indicate that the video was taken around the beginning of 2011—post-dating the defendant’s felony status— and so depicted the crime of felon-firearm possession.105

E. Social Media Postings “Social media” is defined as “forms of electronic communication ([such] as Websites) . . . through which users create online communities to share information, ideas, personal messages, and other content . . . .”106 Parties have increasingly sought to use social media evidence to their advantage at trial. A common example would be a picture or entry posted on a person’s Facebook page, that could be relevant to contradict that person’s testimony at trial. If the entry is challenged for authenticity, the proponent must present a prima facie case that the evidence is what the party says it is—e.g., that it is in fact a posting on the person’s Facebook page. If the goal is to prove that the page or a post is that of a particular person, authenticity standards are not automatically satisfied by the fact that the post or the page is in that person’s name, or that the person is pictured on the post.107 That is because someone can create a Facebook or other

105 Id. 106 Social Media, MERRIAM-WEBSTER DICTIONARY, http://www.merriam-webster.com/dictio nary/social%20media (last visited January 16, 2016). 107 See, e.g., United States v. Vayner, 769 F.3d 125, 132 (2d Cir. 2014), where the court held that a page on the Russian version of Facebook was not sufficiently authenticated simply by the fact that it bore the name and picture of the purported “owner” Zhyltsou: It is uncontroverted that information about Zhyltsou appeared on the VK page: his name, photograph, and some details about his life consistent with Timku’s testimony about him. But there was no evidence that Zhyltsou himself had created the page or was responsible for its contents. Had the government sought to introduce, for instance, a flyer found on the street that contained Zhyltsou’s Skype address and was purportedly written or authorized by him, the district court surely would have required some evidence that the flyer did, in fact, emanate from Zhyltsou. Otherwise, how could the statements in the flyer be attributed to him? Id. Essentially the court in Vayner held that a Facebook page is not self-authenticating. But see United States v. Encarnacion-LaFontaine, 639 F. App’x 710, 713 (2d Cir. 2016) (finding that threatening Facebook posts were properly authenticated where “the Government introduced evidence that (1) the Facebook accounts used to send the messages were accessed from IP addresses connected to computers near Encarnacion’s apartment; (2) patterns of access to the accounts show that they were controlled by the same person; (3) in addition to the Goris threats, the accounts were used to send messages to other individuals connected to Encarnacion; 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

32 BAYLOR LAW REVIEW [Vol. 69:1 social media page in someone else’s name. Moreover, one person may also gain access to another’s account. What more must be done to establish authenticity of a social media page? Most courts have found that it is enough for the proponent to show that the pages and accounts can be tracked through Internet protocol addresses associated with the person who purportedly made the post.108

Other Factors That Can be Relied Upon to Support Authentication of Social Media Postings Include the Following:109  testimony from the purported creator of the social network profile and related postings;  testimony from persons who saw the purported creator establish or post to the page;  testimony of a witness that she often communicated with the alleged creator of the page through that account;110  expert testimony concerning the results of a search of the social media account holder’s computer hard drive;111

(4) Encarnacion had a motive to make the threats[;] and (5) a limited number of people, including Encarnacion, had information that was contained in the messages”). 108 United States v. Hassan, 742 F.3d 104, 133 (4th Cir. 2014) (holding that the trial court did not abuse its discretion in admitting Facebook pages purportedly maintained by two of the defendants; the trial court properly “determined that the prosecution had satisfied its burden under Rule 901(a) by tracking the Facebook pages and Facebook accounts to Hassan’s and Yaghi’s email addresses via internet protocol addresses”); United States v. Brinson, 772 F.3d 1314, 1321 (10th Cir. 2014) (Facebook account linked to the defendant’s email). 109 See Hon. Paul W. Grimm, Lisa Yurwit Bergstrom & Melissa M. O’Toole-Loureiro, Authentication of Social Media Evidence, 36 AM. J. TRIAL ADVOC. 433, 444–55 (2013); Richard Raysman & Peter Brown, Authentication of Social Media Evidence, N.Y. L.J. (Nov. 8, 2011), http://www.newyorklawjournal.com/id=1202528306317/Authentication-of-Social-Media- Evidence. 110 United States v. Browne, 834 F.3d 403, 411–14 (3d Cir. 2016) (holding that Facebook chats were sufficiently authenticated because witnesses testified they communicated with the creator of the page through Facebook, they could identify the alleged creator of the page in court, and the available biographical data on Facebook matched the defendant). 111 Grimm, et al., supra note 109, at 469 (“A computer forensic expert can frequently authenticate the maker of social media content. Obviously, you will need to retain the proper expert and ensure that he or she has enough time and information to make the identification. Advance planning is essential, and be mindful of the potentially substantial cost.” (citation omitted)). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 33

 testimony about the contextual clues and distinctive aspects in the messages themselves tending to reveal the identity of the purported author;  testimony regarding the account holder’s exclusive access to the originating computer and social media account;  information from the social media network that links the page or post to the purported author;  testimony directly from the social networking website that connects the establishment of the profile to the person who allegedly created it and also connects the posting sought to be introduced to the person who initiated it;  expert testimony regarding how social network accounts are accessed and what methods are used to prevent unauthorized access;  production pursuant to a document request;  whether the purported author knows the password to the account, and how many others know it as well;  that the page or post contains some of the factors previously discussed as circumstantial evidence of authenticity of texts, emails, etc., including: - nonpublic details of the purported author’s life; - other items known uniquely to the purported author or a small group including him or her; - references or links to, or contact information about, loved ones, relatives, co-workers, others close to the purported author; - photos and videos likely to be accessed by the purported author; - biographical information, nicknames, not generally accessible; - the structure or style of comments that are in the style of the purported author; - that the purported author acts in accordance with the contents of the page or post.

Finally, a social media post meeting the foundational requirements of a business record under Fed. R. Evid. 803(6) may be self-authenticating through a certificate of a foundation witness under 902(11). While this may 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

34 BAYLOR LAW REVIEW [Vol. 69:1 not be enough to authenticate the identity of the person posting, it will be enough to establish that the records were not altered in any way after they were posted.112

IV. JUDICIAL NOTICE OF DIGITAL EVIDENCE This article has discussed the many ways that new forms of digital evidence might be authenticated. Almost all of these methods require expenditure of resources. Courts and parties have begun to realize that some of this new digital evidence has reached the point of being an undisputed means of proving a fact. In these circumstances, judicial notice may be used to alleviate the expenditure of resources toward authentication. Under Fed. R. Evid. 201(b), a court may judicially notice a fact if it is not subject to reasonable dispute.113 An example of a court taking judicial notice of a fact obtained through an electronic process is found in United States v. Brooks.114 The defendant in a bank robbery prosecution challenged the admissibility of GPS data that was obtained from a GPS tracker that the teller placed in the envelope of stolen money.115 The trial court took judicial notice of the accuracy and reliability of GPS technology.116 The court of appeals found no error: We cannot conclude that the district court abused its discretion in taking judicial notice of the accuracy and reliability of GPS technology. Commercial GPS units are widely available, and most modern cell phones have GPS tracking capabilities. Courts routinely rely on GPS technology to supervise individuals on probation or supervised release, and, in assessing the Fourth

112 An example of a sufficient showing that the records were not altered was provided by the court in United States v. Hassan: [T]he government presented the certifications of records custodians of Facebook and Google, verifying that the Facebook pages and YouTube videos had been maintained as business records in the course of regularly conducted business activities. According to those certifications, Facebook and Google create and retain such pages and videos when (or soon after) their users post them through use of the Facebook or Google servers. E.g., 742 F.3d at 133. 113 FED. R. EVID. 201(b). 114 715 F.3d 1069, 1077–78 (8th Cir. 2013). 115 Id. 116 Id. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 35

Amendment constraints associated with GPS tracking, courts generally have assumed the technology’s accuracy.117 Another common example of judicial notice of digital information is that courts take judicial notice of distances, locations, and the physical contours of an area by reference to Google Maps.118 What follows are some examples of judicial notice of digital information.

1. Government Websites. Judicial notice may be taken of postings on government websites,119 including:  Federal, state, and local court websites;120  Federal, state, and local agency, department and other entities’ websites;121

117 Id. at 1078. 118 See, e.g., United States v. Burroughs, 810 F.3d 833, 835 n.1 (D.C. Cir. 2016) (“We grant the government’s motion to take judicial notice of a Google map. It is a ‘source[] whose accuracy cannot reasonably be questioned,’ at least for the purpose of identifying the area where Burroughs was arrested and the general layout of the block.” (alteration in original) (citing FED. R. EVID. 201(b))); McCormack v. Hiedeman, 694 F.3d 1004, 1008 n.1 (9th Cir. 2012) (relying on Google Maps to determine the distance between two cities; the court held that Google Maps was a website whose accuracy could not reasonably be questioned under FED. R. EVID. 201(b)(2)); see also Cline v. City of Mansfield, 745 F. Supp. 2d 773, 801 n.23 (N.D. Ohio 2010) (taking judicial notice that the sun set at 7:47 pm on a particular date according to www.timeanddate.com); but see Wilbon v. Plovanich, No. 12 C 1132, 2016 U.S. Dist. LEXIS 30333, at *31–32 (N.D. Ill. Mar. 9, 2016) (withholding judicial notice of a Google Map because the plaintiffs marked the map with a description of the defendant’s alleged route, and the foundation for the route needs to be laid at trial). 119 United States v. Head, No. 08-CR-116 KJM, 2013 U.S. Dist. LEXIS 151805, at *7 n.2 (E.D. Cal. Oct. 22, 2013) (“The court may take judicial notice of information posted on government websites as it can be ‘accurately and readily determined from sources whose accuracy cannot reasonably be questioned.’”); Puerto Rico v. Shell Oil Co. (In re Methyl Tertiary Butyl Ether “MTBE” Prods. Liab. Litig.), No. 1:00-1898, 2013 U.S. Dist. LEXIS 181837, at *16 (S.D.N.Y. Dec. 30, 2013) (“Courts routinely take judicial notice of data on government websites because it is presumed authentic and reliable.”). 120 Thatcher v. OakBend Med. Ctr., No. H-14-3551, 2016 U.S. Dist. LEXIS 641, at *11 (S.D. Tex. Jan. 5, 2016) (holding that an ordinance taken from a city’s official website is self- authenticating and subject to judicial notice); Feingold v. Graff, 516 F. App’x 223, 226 (3d Cir. 2013). 121 See, e.g., United States v. Iverson, 818 F.3d 1015, 1022 (10th Cir. 2016) (noting that “courts have considered the FDIC website so reliable that they have taken judicial notice of 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

36 BAYLOR LAW REVIEW [Vol. 69:1

 Foreign government websites;122  International organization websites.123

2. Non-Government Websites. Generally, courts are reluctant to take judicial notice of non-governmental websites because the Internet “is an open source” permitting “[a]nyone [to] purchase an internet address and create a website[]” and so the information recorded is subject to dispute.124 A few websites, however, as discussed above, have become a part of daily life—their accuracy is both objectively verifiable and actually verified millions of times a day. Other websites are the online versions of sources that courts have taken judicial notice of for years, and the courts find little reason to distinguish a reputable web equivalent from a reputable hard copy edition.

Examples of Information Found Authentic on Non-Governmental Websites Through Judicial Notice.  Internet maps (e.g., Google Maps, MapQuest);125  Calendar information;126  Newspaper and periodical articles;127

information on it” (citing Laborers’ Pension Fund v. Blackmore Sewer Constr., Inc., 298 F.3d 600, 607 (7th Cir. 2002))); Lawrence v. Fed. Home Loan Mortg. Corp., No. A-13-CV-913 LY, 2015 U.S. Dist. LEXIS 40012, at *34 n.6 (W.D. Tex. Mar. 30, 2015) (federal government’s agreement with national bank as posted on government website); Flores v. City of Baldwin Park, No. CV 14-9290-MWF(JCx), 2015 U.S. Dist. LEXIS 22149, at *4–5 (C.D. Cal. Feb. 23, 2015) (municipal police department website); FAS Capital, LLC v. Carr, 7 F. Supp. 3d 1259, 1266–67 (N.D. Ga. 2014); Curcio v. Wachovia Mortg. Corp., No. 09-CV-1498-IEG (NLS), 2009 WL 3320499, at *2, *3–4 (S.D. Cal. Oct. 14, 2009). 122 See, e.g., United States v. Broxmeyer, 699 F.3d 265, 296 n.32 (2d Cir. 2012) (websites of governments of Vietnam and Brazil). 123 See, e.g., Kirtsaeng v. John Wiley & Sons, Inc., 133 S. Ct. 1351, 1367 (2013) (World Bank website). 124 United States v. Kane, No. 2:13-cr-250-JAD-VCF, 2013 U.S. Dist. LEXIS 154248, at *25 (D. Nev. Oct. 28, 2013). 125 See United States v. Burroughs, 810 F.3d 833, 835 n.1 (D.C. Cir. 2016). 126 See, e.g., Tyler v. United States, No. 1:08-CR-165-CC-JSA, 2012 U.S. Dist. LEXIS 184007, at *9 n.6 (N.D. Ga. Dec. 6, 2012); Local 282, Int’l Bhd. of Teamsters v. Pile Found. Constr. Co., No. 09-cv-4535(KAM)(LB), 2011 U.S. Dist. LEXIS 86644, at *17 n.5 (E.D.N.Y. Aug. 5, 2011). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 37

 Online versions of textbooks, dictionaries, rules, charters.128

Most non-governmental websites, even if familiar, are of debatable authenticity and therefore not appropriately the object of judicial notice. Wikipedia is a prime example. Courts have declined requests to take judicial notice of the contents of Wikipedia entries,129 except for the fact that the contents appear on the site as of a certain date of access.130

3. Wayback Machine. Archived versions of websites as displayed on the “Wayback Machine” (www.archive.org) are frequently the subject of judicial notice,131 but this is not always the case.132 Note that it is only the

127 See, e.g., Ford v. Artiga, No. 2:12-CV-02370 KJM-AC, 2013 U.S. Dist. LEXIS 106805, at *19 n.5 (E.D. Cal. July 30, 2013); HB v. Monroe Woodbury Cent. Sch. Dist., No. 11-CV-5881 (CS), 2012 U.S. Dist. LEXIS 141252, at *14 (S.D.N.Y. Sept. 27, 2012). 128 See, e.g., Shuler v. Garrett, 743 F.3d 170, 173 (6th Cir. 2014) (Oxford English Dictionary); United States v. Mosley, 672 F.3d 586, 591 (8th Cir. 2012) (Physicians’ Desk Reference); Morgan Stanley Smith Barney LLC v. Monaco, No. 14-cv-00275-RM-MJW, 2014 U.S. Dist. LEXIS 149419, at *5 (D. Colo. Aug. 26, 2014) (FINRA rules); Dealer Comput. Servs. v. Monarch Ford, No. 1:12-CV-01970-LJO-SKO, 2013 U.S. Dist. LEXIS 11237, at *11 n.3 (E.D. Cal. Jan. 25, 2013) (American Arbitration Association rules); Famous Music Corp. v. 716 Elmwood, Inc., No. 05-CV-0885A(M), 2007 U.S. Dist. LEXIS 96789, at *13 n.7 (W.D.N.Y. Dec. 28, 2007) (Articles of Association of ASCAP). 129 See, e.g., Stein v. Bennett, No. 2:12-CV-42-WKW [WO], 2013 U.S. Dist. LEXIS 126667, at *20–21 n.10 (M.D. Ala. Sept. 5, 2013) (stating that “Wikipedia is not a source that warrants judicial notice”); Blanks v. Cate, No. 2:11-cv-0171 WBS CKD P, 2013 U.S. Dist. LEXIS 11233, at *8 n.4 (E.D. Cal. Jan. 28, 2013) (refusing to take judicial notice of a Wikipedia entry “as such information is not sufficiently reliable”); Gonzales v. Unum Life Ins. Co. of Am., 861 F. Supp. 2d 1099, 1104 n.4 (S.D. Cal. 2012) (“The Court declines Plaintiff’s request to take judicial notice of the Wikipedia definition of Parkinson’s Disease because the internet is not typically a reliable source of information.”). 130 See, e.g., McCrary v. Elations Co., LLC, No. EDCV 13-00242 JGB (OPx), 2014 U.S. Dist. LEXIS 8443, at *3 n.3 (C.D. Cal. Jan. 13, 2014) (“While the court may take judicial notice of the fact that the internet, Wikipedia, and journal articles are available to the public, it may not take judicial notice of the truth of the matters asserted therein.”). 131 See, e.g., O’Toole v. Northrop Grumman Corp., 499 F.3d 1218, 1225 (10th Cir. 2007) (requiring that the district court take judicial notice of the contents gathered from the Wayback Machine and holding that the district court “abused its discretion” in failing to take judicial notice of the website (emphasis added)); Marten Transp., Ltd. v. PlattForm Adver., Inc., No. 14-2464- JWL, 2016 U.S. Dist. LEXIS 57471, at *7–8 (D. Kan. Apr. 29, 2016) (taking judicial notice of information retrieved from the Internet Archive after it had been authenticated by an employee of the Internet Archive); Under a Foot Plant, Co. v. Exterior Design, Inc., No. 6:14-cv-01371-AA, 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

38 BAYLOR LAW REVIEW [Vol. 69:1 contents of the archived pages that may warrant judicial notice—the dates assigned to archived pages may not apply to images linked to them, and more generally, links on archived pages may direct to the live web if the object of the old link is no longer available.

V. AUTHENTICATING ELECTRONIC EVIDENCE BY WAY OF CERTIFICATION—NEW AMENDMENTS TO THE FEDERAL RULES OF EVIDENCE

A. The Need for Rules to Alleviate the Expense of Authenticating Electronic Evidence The Judicial Conference of the United States has approved a proposal from the Advisory Committee on Evidence to add two new subdivisions to Rule 902, the rule on self-authentication. The first provision would allow self-authentication of machine-generated information, upon a submission of a certification prepared by a qualified person. The second proposal would provide a similar certification procedure for a copy of data taken from an electronic device, medium or file. These proposals are analogous to Rules 902(11) and (12) of the Federal Rules of Evidence, which permit a foundation witness to establish the authenticity of business records by way of certification.133 Barring any unforeseen developments, these new rules would go into effect on December 1, 2017.134 The proposals have a common goal of making authentication easier for certain kinds of electronic evidence that are, under current law, likely to be authenticated under Rule 901 but only by calling a witness to testify to authenticity. The Advisory Committee concluded that the types of electronic evidence covered by the two proposed rules are rarely the subject of a legitimate authenticity dispute, but it has often been the case that the proponent is nonetheless forced to produce an authentication witness,

2015 U.S. Dist. LEXIS 37596, at *4 (D. Or. Mar. 24, 2015) (“District courts have routinely taken judicial notice of content from The Internet Archive”). 132 See, e.g., Open Text S.A. v. Box, Inc., No. 13-cv-04910-JD, 2015 U.S. Dist. LEXIS 11312, at *7 (N.D. Cal. Jan. 30, 2015) (finding proffered Wayback Machine printouts not authenticated absent certification from representative of InternetArchive.org). 133 FED. R. EVID. 902(11)–(12). 134 As of this writing, the rule proposals are currently being reviewed by the Supreme Court. The Court has until May 1, 2017 to submit the rules to Congress. If Congress then does not act by December 1, 2017, the proposed amendments will take effect. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 39 incurring expense and inconvenience—and often, at the last minute, opposing counsel ends up stipulating to authenticity in any event. The text of the proposed amendments provides as follows: Rule 902. Evidence That Is Self-Authenticating The following items of evidence are self- authenticating; they require no extrinsic evidence of authenticity in order to be admitted: * * * * * (13) Certified Records Generated by an Electronic Process or System. A record generated by an electronic process or system that produces an accurate result, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent must also meet the notice requirements of Rule 902(11). (14) Certified Data Copied from an Electronic Device, Storage Medium, or File. Data copied from an electronic device, storage medium, or file, if authenticated by a process of digital identification, as shown by a certification of a qualified person that complies with the certification requirements of Rule 902(11) or (12). The proponent also must meet the notice requirements of Rule 902(11).135

B. The Impact of the New Rules The self-authentication proposals, by following the approach taken in Rule 902(11) and (12) regarding business records, essentially leave the burden of going forward on authenticity questions to the opponent of the

135 The references to Rule 902(11) and (12) are to the certification and notice requirements of those rules—their text is found in supra note 31. Those rules allow a certification to authenticate a business record under the hearsay exception for such records (i.e., Rule 803(6)). There is no intent to require, or permit, a certification under these new provisions to prove the requirements of Rule 803(6). Rules 902(13) and (14) are solely limited to authentication and any attempt to satisfy a hearsay exception must be made independently. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

40 BAYLOR LAW REVIEW [Vol. 69:1 evidence. Under those rules a business record is authenticated by a certificate, but the opponent is given “a fair opportunity” to challenge both the certificate and the underlying record.136 The proposals for new Rules 902(13) and 902(14) would have the same effect of shifting to the opponent the burden of going forward (not the burden of proof) on authenticity disputes regarding the described electronic evidence. These new amendments do not change the standards for authentication of electronic evidence. Rather, they change the manner in which the proponent’s submission on authenticity can be made. Instead of calling a witness, the proponent can provide a certificate prepared by the witness of the submission that he would have made if required to testify. Of course, if that submission would be insufficient if he had testified, these new amendments will be of no use. An insufficient showing of authenticity does not somehow become better by way of a certificate in lieu of testimony. The proposals are relatively mild in effect. They provide an easier method to authenticate but they do not reduce the standards of authentication. Moreover, a certification under the proposed rules can establish only that the proffered item has satisfied the admissibility requirements for authenticity. So the opponent remains free to object to admissibility on other grounds, such as hearsay. For example, assume that a plaintiff in a defamation case offers what purports to be a printout of a webpage on which a defamatory statement was made. Plaintiff offers a certification in which a qualified person describes the process by which the webpage was retrieved. Under the rule that certification sufficiently establishes that the webpage is authentic, if the witness’s testimony at trial would do so. But the defendant remains free to object that the statement on the webpage was not placed there by defendant and therefore cannot be admitted as a party-opponent statement. Similarly, a certification authenticating a computer output, such as a spreadsheet, does not preclude an objection that the information produced is unreliable—the authentication establishes only that the output came from the computer.

C. Overlapping Provisions It should be noted that there is an overlap in the two provisions. When data is copied from an electronic device, the result is a record (i.e., the copy) that is ordinarily generated by an electronic process (because the copy is generated electronically). So it is true that the electronic information

136 FED. R. EVID. 902(11)–(12). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 41 that is covered by Rule 902(14) could also for the most part (but not completely) be covered by Rule 902(13). The overlap does not run very far the other way, however; that is, records generated by an electronic system may well not be a “copy” of anything. The Advisory Committee had a good reason for proposing a separate subdivision for copies of electronic data, because the process of authenticating a copy—usually through hash value137—is unique and specific. Rule 902(14) is in large part directed to a fairly specific problem—cloning hard drives and offering the clone rather than the original, through a hash value match. The process of authenticating machine-generated evidence more broadly can be satisfied by a number of different methods. Put another way, the copying processes that serve for authentication under Rule 902(14) do only one thing—assuring that there is no change between the copy and the original. In contrast, other machine- generated evidence may involve many more processes, such as evaluating and processing various inputs, organizing information, and so forth. So the bottom line is that there is a rational basis for breaking out a small subset of machine-generated evidence (copying hard drives, phones, and the like) for individual treatment. In any case, there is no reason to seek to parse out a distinction between the coverage of the two subsections, as the requirements for both are exactly the same: a qualified person must file a certificate establishing authenticity under the same standards that would be applicable to an in-court witness.

137 The Committee Note to proposed Rule 902(14) provides a description of how a copy of an electronic file or device can be authenticated by hash value: A hash value is a number that is often represented as a sequence of characters and is produced by an algorithm based upon the digital contents of a drive, medium, or file. If the hash values for the original and copy are different, then the copy is not identical to the original. If the hash values for the original and copy are the same, it is highly improbable that the original and copy are not identical. Thus, identical hash values for the original and copy reliably attest to the fact that they are exact duplicates. This amendment allows self-authentication by a certification of a qualified person that she checked the hash value of the proffered item and that it was identical to the original. The rule is flexible enough to allow certifications through processes other than comparison of hash value, including by other reliable means of identification provided by future technology.

See Memorandum from James C. Duff to the Chief Justice of the U.S. and Assoc. Justices of the Supreme Court 8 (Sept. 28, 2016), http://www.uscourts.gov/rules-policies/pending-rules-and- forms-amendments. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

42 BAYLOR LAW REVIEW [Vol. 69:1

D. Applications of Rules 902(13) and (14) Here are some illustrative examples of how the new rules can be used to ameliorate the costs of authenticating electronic evidence:138

Examples of how Rule 902(13) can be used: 1. Proving that a USB device was connected to (i.e., plugged into) a computer: In a hypothetical civil or criminal case in Chicago, a disputed issue is whether Devera Hall used her computer to access files stored on a USB thumb drive owned by a co-worker. Ms. Hall’s computer uses the Windows operating system, which automatically records information about every USB device connected to her computer in a database known as the “Windows registry.” The Windows registry database is maintained on the computer by the Windows operating system in order to facilitate the computer’s operations. A forensic technician, located in Dallas, Texas, has provided a printout from the Windows registry that indicates that a USB thumb drive, identified by manufacturer, model, and serial number, was last connected to Ms. Hall’s computer at a specific date and time. Without Rule 902(13): Without Rule 902(13), the proponent of the evidence would need to call the forensic technician who obtained the printout as a witness, in order to establish the authenticity of the evidence. During his or her testimony, the forensic technician would typically be asked to testify about his or her background and qualifications; the process by which digital forensic examinations are conducted in general; the steps taken by the forensic technician during the examination of Ms. Hall’s computer in particular; the process by which the Windows operating system maintains information in the Windows registry, including information about USB devices connected to the computer; and the steps taken by the forensic examiner to examine the Windows registry and to produce the printout identifying the USB device.

138 The authors thank John Haried, who originally proposed these rule amendments at the Advisory Committee’s Symposium on Electronic Evidence, and who developed these illustrations in collaboration with the Reporter to the Evidence Rules Committee. See Symposium, supra note 6, at 1192–97. 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 43

Impact of Rule 902(13): With Rule 902(13), the proponent of the evidence could obtain a written certification from the forensic technician, stating that the Windows operating system regularly records information in the Windows registry about USB devices connected to a computer; that the process by which such information is recorded produces an accurate result; and that the printout accurately reflected information stored in the Windows registry of Ms. Hall’s computer. The proponent would be required to provide reasonable written notice of its intent to offer the printout as an exhibit and to make the written certification and proposed exhibit available for inspection. If the opposing party did not dispute the accuracy or reliability of the process that produced the exhibit, the proponent would not need to call the forensic technician as a witness to establish the authenticity of the exhibit. (There are many other examples of the same types of machine-generated information on computers, for example, Internet browser histories and Wi-Fi access logs.) 2. Proving that a server was used to connect to a particular webpage: Hypothetically, a malicious hacker executed a denial-of-service attack against Acme’s website. Acme’s server maintained an Internet Information Services (IIS) log that automatically records information about every internet connection routed to the web server to view a web page, including the IP address, webpage, user agent string and what was requested from the website. The IIS logs reflected repeated access to Acme’s website from an IP address known to be used by the hacker. The proponent wants to introduce the IIS log to prove that the hacker’s IP address was an instrument of the attack. Without Rule 902(13): The proponent would have to call a website expert to testify about the mechanics of the server’s operating system; his search of the IIS log; how the IIS log works; and that the exhibit is an accurate record of the IIS log. With Rule 902(13): The proponent would obtain the website expert’s certification of the facts establishing authenticity of the exhibit and provide the certification and exhibit to the opposing party with reasonable notice that it 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

44 BAYLOR LAW REVIEW [Vol. 69:1

intends to offer the exhibit at trial. If the opposing party does not timely dispute the reliability of the process that produced the registry key, then the proponent would not need to call the website expert to establish authenticity. 3. Proving that a person was or was not near the scene of an event: Hypothetically, Robert Jackson is a defendant in a civil (or criminal) action alleging that he was the driver in a hit-and-run collision with a U.S. Postal Service mail carrier in Atlanta at 2:15 p.m. on March 6, 2015. Mr. Jackson owns an iPhone, which has software that records machine-generated dates, times, and GPS coordinates of each picture he takes with his iPhone. Mr. Jackson’s iPhone contains two pictures of his home in an Atlanta suburb at about 1 p.m. on March 6. He wants to introduce into evidence the photos together with the metadata, including the date, time, and GPS coordinates, recovered forensically from his iPhone to corroborate his alibi that he was at home several miles from the scene at the time of the collision. Without Rule 902(13): The proponent would have to call the forensic technician to testify about Mr. Jackson’s iPhone’s operating system; his search of the phone; how the metadata was created and stored with each photograph; and that the exhibit is an accurate record of the photographs. With Rule 902(13): The proponent would obtain the forensic technician’s certification of the facts establishing authenticity of the exhibits and provide the certification and exhibit to the opposing party with reasonable notice that it intends to offer the exhibit at trial. If the opposing party does not timely dispute the reliability of the process that produced the iPhone’s logs, then the proponent would not have to call the technician to establish authenticity. 4. Proving association and activity between alleged co-conspirators: Hypothetically, Ian Nichols is charged with conspiracy to commit the robbery of First National Bank that occurred in San Diego on January 30, 2015. Two robbers drove away in a silver Ford Taurus. The alleged coconspirator was Dain Miller. Dain was arrested on an outstanding warrant on February 1, 2015, and in his pocket was his Samsung Galaxy phone. The Samsung phone’s software automatically maintains a log of text messages that includes the text content, date, time, and number of the other phone involved. Pursuant to a warrant, forensic technicians examined Dain’s 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 45 phone and located four text messages to Ian’s phone from January 29: “Meet my house @9”; “Is Taurus the Bull out of shop?”; “Sheri says you have some blow”; and “see ya tomorrow.” In the separate trial of Ian, the government wants to offer the four text messages to prove the conspiracy. Without Rule 902(13): The proponent would have to call the forensic technician to testify about Dain’s phone’s operating system; his search of the phone’s text message log; how logs are created; and that the exhibit is an accurate record of the iPhone’s logs. With Rule 902(13): The proponent would obtain the forensic technician’s certification of the facts establishing authenticity of the exhibit and provide the certification and exhibit to the opposing party with reasonable notice that it intends to offer the exhibit at trial. If the opposing party does not timely dispute the reliability of the process that produced the iPhone’s logs, then the court would make the Rule 104 threshold authenticity finding and admit the exhibits, absent other proper objection. Hearsay Objection Retained: Under Rule 902(13), the opponent—here, criminal defendant Ian—would retain his hearsay objections to the text messages found on Dain’s phone. For example, the judge would evaluate the text “Sheri says you have some blow” under F.R.E. 801(d)(2)(E) to determine whether it was a coconspirator’s statement during and in furtherance of a conspiracy, and under F.R.E. 805, to assess the hearsay within hearsay. The court might exclude the text “Sheri says you have some blow” under either rule or both. Example of how Rule 902(14) can be used: In the armed robbery hypothetical, above, forensic technician Smith made a forensic copy of Dain’s Samsung Galaxy phone in the field. Smith verified that the forensic copy was identical to the original phone’s text logs using an industry standard methodology (e.g., hash value or other means). Smith gave the copy to forensic technician Jones, who performed his examination at his lab. Jones used the copy to conduct his entire forensic examination so that he would not inadvertently alter the data on the phone. Jones found the text messages. The government wants to offer the copy into 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

46 BAYLOR LAW REVIEW [Vol. 69:1 evidence as part of the basis of Jones’s testimony about the text messages he found. Without Rule 902(14): The government would have to call two witnesses. First, forensic technician Smith would need to testify about making the forensic copy of information from Dain’s phone, and about the methodology that he used to verify that the copy was an exact copy of information inside the phone. Second, the government would have to call Jones to testify about his examination. With Rule 902(14): The proponent would obtain Smith’s certification of the facts establishing how he copied the phone’s information and then verified the copy was true and accurate. Before trial the government would provide the certification and exhibit to the opposing party – here defendant Ian—with reasonable notice that it intends to offer the exhibit at trial. If Ian’s attorney does not timely dispute the reliability of the process that produced the Samsung Galaxy’s text message logs, then the proponent would only call Jones.

E. Certifications of Authenticity of Electronic Evidence and the Right to Confrontation

1. The Melendez-Diaz Carve-out In the public comment on these proposed self-authentication rules for electronic evidence, a group of law professors139 expressed the concern that Rule 902(13) authorizes certificates that, when introduced into evidence, would violate the defendant’s right to confrontation under Melendez-Diaz v. Massachusetts.140 Melendez-Diaz held that a certificate from a lab indicating a positive result on a test for drugs (found in the defendant’s car) violated the defendant’s right to confrontation because the certificate was prepared solely for purposes of trial and therefore was “testimonial.”141 The

139 See Public Comment from Richard Friedman, B.C. French, N.M. Garland, L. Kirkpatrick, F.I. Lederer, T.A. Martin, I. Meyn, R.C. Park, as individuals, 2015-EV-0003-0197, https://www.regulations.gov/docket?D=USC-RULES-EV-2015-0003. 140 Id. at 1, 2–4. 141 Melendez-Diaz v. Mass., 557 U.S. 305, 310–11 (2009). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 47

Court in Crawford v. Washington held that if hearsay is “testimonial” its admission violates the right to confrontation unless the defendant has the right to cross-examine the declarant.142 It would seem like a certificate of authenticity would be testimonial as well, because it would by definition be prepared for purposes of a trial. But it is not that simple, because the Melendez-Diaz Court carved out certain certificates from the constitutional proscription. The heart of the confrontation question, as applied to certificates of authenticity, is a passage in Melendez-Diaz in which the majority was responding to the dissent’s argument that certificates of authenticity were admitted at common law, even though they would have fit the majority’s new-found definition of testimoniality (and thus that the majority was wrong in its assertion that its limitations on testimonial hearsay were historically-grounded). Here is that passage from Melendez-Diaz: The dissent identifies a single class of evidence which, though prepared for use at trial, was traditionally admissible: a clerk’s certificate authenticating an official record—or a copy thereof—for use as evidence. But a clerk’s authority in that regard was narrowly circumscribed. He was permitted “to certify to the correctness of a copy of a record kept in his office,” but had “no authority to furnish, as evidence for the trial of a lawsuit, his interpretation of what the record contains or shows, or to certify to its substance or effect.” The dissent suggests that the fact that this exception was “narrowly circumscribed” makes no difference. To the contrary, it makes all the difference in the world. It shows that even the line of cases establishing the one narrow exception the dissent has been able to identify simultaneously vindicates the general rule applicable to the present case. A clerk could by affidavit authenticate or provide a copy of an otherwise admissible record, but could not do what the analysts did here: create a record for the sole purpose of providing evidence against a defendant.143

142 541 U.S. 36, 74 (2004). 143 Melendez-Diaz, 557 U.S. at 322–23 (emphasis added) (citations omitted). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

48 BAYLOR LAW REVIEW [Vol. 69:1

This language in Melendez-Diaz has been relied on by every circuit court that has evaluated the admissibility of certificates offered under Rule 902(11) to provide the foundation for and to authenticate business records under the hearsay exception provided by Rule 803(6). Every court has held that the certificates permitted by Rule 902(11) do not violate the Confrontation Clause—and Rule 902(13) is simply applying the same principle of certification to electronic evidence as Rule 902(11) applies to business records. A typical analysis is found in United States v. Yeley- Davis,144 where the court held that a Rule 902(11) certificate authenticating phone records as business records was properly admitted over a confrontation objection: Justice Scalia [in Melendez-Diaz] expressly described the difference between an affidavit created to provide evidence against a defendant and an affidavit created to authenticate an admissible record . . . In addition, Justice Scalia rejected the dissent’s concern that the majority’s holding would disrupt the long accepted practice of authenticating documents under Rule 902(11) and would call into question the holding in Ellis [a case which had rejected a confrontation challenge to the use of Rule 902(11)]. See Melendez Diaz, 557 U.S. at n. 1 (“Contrary to the dissent’s suggestion, . . . we do not hold, and it is not the case, that anyone whose testimony may be relevant in establishing the . . . authenticity of the sample . . . must appear in person as part of the prosecution’s case.”).145 Every other circuit court with a reported decision on the topic has relied on the Melendez-Diaz carve-out to hold that authenticating certificates do not violate the Confrontation Clause.146

144 632 F.3d 673 (10th Cir. 2011). 145 Id. at 680–81. 146 See United States v. Albino-Loe, 747 F.3d 1206, 1211 (9th Cir. 2014) (finding no confrontation violation where the “certifications at issue here did not accomplish anything other than authenticating the A–File documents to which they were attached. In particular, they did not explicitly state anything about Albino–Loe’s alienage.”); United States v. Brinson, 772 F.3d 1314, 1322–23 (10th Cir. 2014) (finding no confrontation violation where debit card records were authenticated by a certificate, because the certificate was a “non-testimonial statement of authenticity”); United States v. Thompson, 686 F.3d 575, 582 (8th Cir. 2012) (finding no confrontation violation when employment records were authenticated as business record by certificate: “the . . . record itself was not created for the purpose of establishing or proving some 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 49

The professors in their public comment conceded that certificates offered for business records under Rule 902(11) are not testimonial.147 They did not directly challenge the existing, uniform case law. They further conceded that Rule 902(14) is probably consistent with the Confrontation Clause, because the certificate permitted there simply certifies a copy—and the majority in Melendez-Diaz explicitly authorizes the use of certifications that a document is an accurate copy.148 The professors’ complaint was that Rule 902(13) is problematic because (1) it allows more than simply a certification of a copy, as the certification can provide that the electronic evidence to be admitted is from a process or system that produces an accurate result; and (2) this additional certification can apply to machine output that was produced after the litigated controversy arose.149 Thus, under this line of thinking, a case like Yeley-Davis is acceptable because the records authenticated were historic phone records—electronic information that pre-existed the dispute. The professors argued that a certificate of authentication is problematic when is used “to leverage into evidence documents that have been created for the purpose of litigation.” It is true that some of the machine-generated information that will be authenticated under Rule 902(13) will be generated in anticipation of litigation. One example would be the output of a gas chromatograph machine that tested a substance obtained from the defendant at the time of arrest. But that does not mean that a Confrontation Clause violation occurs with the certification of such information. That is because, while the machine output might be prepared for litigation, it is not testimonial because it is not hearsay. Machines do not make statements, and cannot be cross-examined; and the Confrontation Clause applies only to statements that are hearsay.150 So why should it make any difference that a machine fact at trial, admission of a certified copy of that record did not violate Thompson’s Confrontation Clause rights”); United States v. Johnson, 688 F.3d 494, 505–06 (8th Cir. 2012) (finding that certificates of authenticity presented under Rule 902(11) are not testimonial, and the notations on the lab report by the technician indicating when she checked the samples into and out of the lab did not raise a confrontation question, because they were offered only to establish a chain of custody and not to prove the truth of any matter asserted). 147 See Public Comment from Richard Friedman et al., supra note 139, at 3–4. 148 Id. (citing Melendez-Diaz, 557 U.S. at 322–23). 149 Id. at 4. 150 See United States v. Moon, 512 F.3d 359, 362 (7th Cir. 2008) (noting that readings from an infrared spectrometer and a gas chromatograph did not violate the right to confrontation because “data are not ‘statements’ in any useful sense. Nor is a machine a ‘witness against’ anyone.”); see also Crawford v. Washington, 541 U.S. 36, 59 n.9 (2004) (noting that the 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

50 BAYLOR LAW REVIEW [Vol. 69:1 output is prepared for the litigation? If an authentication under Rule 902(11) is sound because it authenticates data that is not testimonial (as the professors concede) then there is no reason why an authentication under Rule 902(13) would be problematic when it, too, authenticates nontestimonial evidence. The difference in Melendez-Diaz is that the certificates there interpreted the test results that were testimonial, because the tests were conducted with human input in anticipation of a prosecution.151 That is not being done in a Rule 902(13) certification. The professors never explain why certifying items prepared for litigation is problematic when the items themselves create no constitutional concern. The case law does not support the view that authentication of nontestimonial evidence could violate the Confrontation Clause.152 But even if the professors are correct in finding a constitutional distinction between pre- and post-controversy reports, that critique does not affect the large number of certifications that will be made under Rule 902(13) of electronic evidence that is generated before any controversy. That is, in many cases—probably most cases—the certification under Rule 902(13) will be certifying electronic information that was generated before the litigation arose. Take the examples addressed above:  a printout of the Windows Registry to prove that a thumb drive was connected to a laptop;  an internet service log that records internet access;  metadata of whether and when a picture was taken on an iPhone;  a log of text messages between coconspirators.

All of the above would have been generated before a controversy arose. None is substantively different from the phone records in Yeley-Davis. So at the very least, Rule 902(13) certifications would, even under the professors’ argument, be properly admitted in the large number of situations in which the authenticated information was generated before the litigation arose.153

Confrontation Clause “does not bar the use of testimonial statements for purposes other than establishing the truth of the matter asserted”). 151 Melendez-Diaz, 557 U.S. at 310–11. 152 See, e.g., United States v. Anekwu, 695 F.3d 967, 976 (9th Cir. 2012) (finding no confrontation problem where “the certificates authenticated otherwise admissible records”). 153 This all assumes in any case that the government wishes to prove the authenticity of electronic evidence to the jury by way of a certificate. The government may well opt to use the certificate to pass the admissibility threshold with the judge, and then establish its authenticity to the jury (if challenged, as it often is not) by way of a witness, who will likely provide a more 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 51

2. Certifying Accuracy The professors posed another argument regarding the Confrontation Clause and Rule 902(13): that the certification under Rule 902(13) is problematic because the preparer will certify that the process or system “produces an accurate result.”154 This certification is apparently distinguished from one properly provided in a Rule 902(11) certification— that a document is authentic. But when one drills down into this argument, it turns out that the distinction is evanescent at best, and hopefully not the kind of difference (if any) on which the Constitution relies. A certificate admitted under Rule 902(11) does far more than authenticate a copy. It contains the factual assertions that the records were: (1) created at or near the time of the events they purported to establish, by someone with knowledge of those events; (2) kept in the course of regularly conducted business; (3) made as part of that business’s regular practice; and (4) true and correct copies.155 Such a certification, to be effective, will also provide the factual predicates for the first three conclusions, which are necessary to establish admissibility under the business records exception, Rule 803(6). Essentially what the affiant is certifying is that the record is reliable—it fits the reliability requirements of the business records exception. If that certification is permissible, as the professors concede, then what is the problem with a certificate that shows that the record is a product of a process that produces an accurate result? There is no substantive difference between reliability and accuracy. The Crawford line of cases is riddled with counter-intuitive fine line distinctions, but this one seems too fine even for Crawford. In sum, the concern about the proposed amendments under the Confrontation Clause is quite overstated, because:  The concern is limited to Rule 902(13), as Rule 902(14) is limited to certification of copies.  The concern about authenticating information prepared after the litigation arose is misguided because (1) most of the information authenticated under Rule 902(13) will have been produced before interesting presentation than a certificate ever could. When the government makes that decision, the certificate raises no constitutional concerns because it is not admitted at trial and so the declarant is not a “witness against” the defendant. 154 See Public Comment from Richard Friedman et al., supra note 139, at 4. 155 FED. R. EVID. 803(6). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

52 BAYLOR LAW REVIEW [Vol. 69:1

the litigation arose; and (2) machine-generated information that is produced after the litigation arises will not be testimonial (and if it is, it would be subject to confrontation objection on its own ground, and will not be saved by Rule 902(13)).  The concern about certifying accuracy is no different from certifications found acceptable under Rule 902(11) in which the certification establishes reliability.

3. Adding a Notice-and-Demand Provision to Rule 902(13) for Criminal Cases Assuming arguendo that there is a legitimate concern that certification under Rule 902(13) could raise a confrontation problem in criminal cases, there is a procedural device that could be added to the rule that would solve this concern. It is called a notice-and-demand provision, and it essentially operates as a means of obtaining a waiver of the defendant’s right to confrontation—the defendant is given notice that the government intends to introduce a testimonial certificate; if the defendant fails to demand production of the declarant within the designated time period, then the right to confront the declarant is deemed waived. In 2013, Rule 803(10)—the hearsay exception for proof of an absence of a public record—was amended to include a notice-and-demand provision.156 This was because the rule allows a government official to file a certificate that the official conducted a search for a record and found none—and this search is ordinarily conducted in anticipation of using that fact of absence (lack of a required record) at a criminal prosecution.157 Rule 803(10) now provides as follows:

156 Id. 803(10) (amended 2013). 157 An example is a prosecution for illegal reentry after deportation. To prove that the defendant was in the United States without permission, the government can under Rule 803(10) offer the certificate of an official who searched for a record of permission to re-enter and found none. But that search was conducted in anticipation of litigation. See, e.g., United States v. Orozco-Acosta, 607 F.3d 1156, 1161 n.3 (9th Cir. 2010), where, in an illegal reentry case, the government proved unpermitted reentry by introducing a certificate of non-existence of permission to reenter (CNR) under Rule 803(10). The trial was conducted and the defendant convicted before Melendez-Diaz. On appeal, the government conceded that introducing the CNR violated the defendant’s right to confrontation because under Melendez-Diaz that record is testimonial. The court in a footnote agreed with the government’s concession, stating that its previous cases holding that CNRs were not testimonial were “clearly inconsistent with Melendez- 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 53

(10) Absence of a Public Record. Testimony—or a certification under Rule 902—that a diligent search failed to disclose a public record or statement if: (A) the testimony or certification is admitted to prove that (i) the record or statement does not exist; or (ii) a matter did not occur or exist, if a public office regularly kept a record or statement for a matter of that kind; and (B) in a criminal case, a prosecutor who intends to offer a certification provides written notice of that intent at least 14 days before trial, and the defendant does not object in writing within 7 days of receiving the notice—unless the court sets a different time for the notice or the objection. The Committee Note explains the basis for adding notice-and-demand provisions: Rule 803(10) has been amended in response to Melendez-Diaz v. Massachusetts, 557 U.S. 305 (2009). The Melendez-Diaz Court declared that a testimonial certificate could be admitted if the accused is given advance notice and does not timely demand the presence of the official who prepared the certificate. The amendment incorporates, with minor variations, a “notice-and-demand” procedure that was approved by the Melendez-Diaz Court.158 But adding a notice-and-demand provision to Rule 902(13) would be the equivalent of squashing a gnat with a sledgehammer. Including a notice- and-demand provision would limit the effectiveness of the provision, because the defendant can simply avoid the certificate by making the demand—if only to make the prosecution go to the effort of producing the authenticating witness. Thus the whole point of the amendment—to save

Diaz” because like the certificates in that case, a CNR is prepared solely for purposes of litigation, after the crime has been committed. 158 FED. R. EVID. 803(10) advisory committee’s note to 2013 amendment (citation omitted). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

54 BAYLOR LAW REVIEW [Vol. 69:1 costs—would be muted in criminal cases. While that is acceptable if the alternative is that the Rule will surely be struck down without it, it seems far less acceptable if the risk of that result is remote, as is the case with Rule 902(13). Moreover, there is another concern, one of rulemaking: it is to say the least odd, and awkward, to include a notice-and-demand provision in a Rule that will already have a notice provision. The two notice provisions would be serving different functions. The basic notice provision would provide the opponent an opportunity to meet the evidence. The notice-and-demand notice provision would provide the opponent an opportunity to demand production of the witness. It is difficult to have one notice provision cover both concepts—especially when the general notice requirement is written with flexible standards and the notice-and-demand provision is written with specific time periods. Having two separate notice provisions in the same rule is balky at best, and is likely to result in confusion and difficulties of application. But even if a notice-and-demand provision would not cripple the rule, or make it overly complicated, there are other costs in adding it. The professors concede that a notice-and-demand provision is completely unnecessary for the many situations in which Rule 902(13) can be used to authenticate electronic information that is generated before the litigation arose. It is surely bad policy to institute a procedural requirement that by definition is unnecessary to solve any problem. Thus, at a minimum, the notice-and-demand language should be limited to the narrow situation of certification of electronic evidence that is generated for purposes of litigation. Finally, any inclusion of a notice-and-demand provision will raise a red flag about the lack of such a provision in Rule 902(11). Given the very minor difference between an authenticating certificate under that rule and under Rule 902(13), including a notice-and-demand provision in the new rule might well be seen to operate as a concession that similar provisions should be added to the older rule—even though Rule 902(11) has withstood every constitutional challenged in the federal courts. For all these reasons, the Advisory Committee was correct in concluding that a notice-and-demand provision would be an unnecessary and unwelcome addition to Rule 902(13). 7 GRIMM, CAPRA, JOSEPH (DO NOT DELETE) 3/23/2017 9:56 AM

2017] AUTHENTICATING DIGITAL EVIDENCE 55

CONCLUSION Determining whether digital evidence is authentic can be a difficult task, but it is not a task that is different in kind from authenticating hardcopy items. The admissibility standard for authenticity is relatively low, and compiling circumstantial evidence tied to the purported source of the electronic evidence will go a long way toward meeting that standard. But expenditure of resources is a concern, especially if that expenditure is required to meet broad objections like “my webpage might have been hacked.” The Advisory Committee has been working to ameliorate some of those costs; and a proper knowledge of the relationship between Rule 104(a) and (b) will go a long way toward streamlining the admissibility decision for the judge and overcoming such blunderbuss arguments. This Article hopefully reduces the burden of authenticating evidence further by providing guidelines on how to authenticate the basic forms of digital evidence used in trials today.