Evidentiary Foundations and Use of Digital Evidence

THE NATIONAL CENTER FOR JUSTICE AND THE RULE OF LAW AND THE NATIONAL JUDICIAL COLLEGE

EVIDENTIARY FOUNDATIONS & USE OF DIVIDER 5 DIGITAL EVIDENCE

Professor Donald R. Mason

OBJECTIVES:

After this session, you will be able to: 1. Identify the major evidentiary considerations for use of digital evidence; and 2. Discuss how the rules of evidence may apply in cases involving technology facilitated crimes against children.

REQUIRED READING: PAGE 1. Donald R. Mason, Use of Digital Evidence: Evidentiary Considerations for Trial (Aug. 2011) [NCJRL PowerPoint] ...... 1 2. Donald R. Mason, Evidentiary Foundations for Electronically Stored Information: Resources (Aug. 2011) [NCJRL Document] ...... 21

SI: TECHNOLOGY ASSISTED CRIMES AGAINST CHILDREN: EVIDENTIARY & WB/KZ PROCEDURAL MATTERS AT TRIAL AUGUST 1-2, 2011 RENO, NV

Use of Digital Evidence Evidentiary Considerations for Trial

Don Mason Associate Director, NCJRL Research Professor

Objectives After this session, you will be able to:to:  Identify the major evidentiary considerations for use of digital evidenceevidence  Discuss how the rules of evidence may apply in cases involving technology facilitated crimes against children

Digital Evidence and the Rules of Evidence In general, the Rules of Evidence apply to electronic evidence in the same ways they apply to more traditional forms of evidence.evidence. NCJRL. org

Use of Digital Evidence – Evidentiary Considerations for Trial Technology Assisted Crimes Against Children: Evidentiary and Procedural Matters at Trial, August 1‐2, 2011 Copyright © 2011 National Center for Justice and the Rule of Law –All Rights Reserved

1 Leading Case

Lorraine v. Markel American Insurance CoCo., 241 F.R.D. 534 (D. Md. 2007). This court addressed the five hurdles to admitting electronic evidence in great detail.

NCJRL. org

5 Hurdles to Clear

NCJRL. org

Hurdles

1. Relevance 2. Authenticity 333. Best EidEvidence 4. HearsayHearsay 5. More Prejudicial than Probative

NCJRL. org

2 Preliminary Rulings

Rule 104(a) – Questions of admissibility generally. This applies to the admission of expert testimony, whether a privilege exists, and whether a statement is hearsay.hearsay. Not bound by Rules except of privilege.

NCJRL. org

Conditional Relevancy

Rule 104(b). This applies to authenticity. Jury not the court makes findings of fact. PdiPredicate facts must be adiibldmissible under the Rules.

NCJRL. org

Rule 104 Example

In admitting an e‐‐mail the jury would determine whether or not the e‐‐mail was what it purports to be, but a judge would determine whether or not the e‐‐mail was an admission by a party opponent.

NCJRL. org

3 First Hurdle - Relevance

Rule 401 – tends to make some fact of consequence more or less probable. Admissibility distinguished from weight or sufficiency.

NCJRL. org

Second Hurdle - Authentication

Is evidence what it is purported to be? A party need only submit “evidence sufficient to support a finding” that the evidence is what the party claims it to be. Circumstantial evidence can be used to authenticate evidence.

NCJRL. org

Ways to Prove Authentication

•• Testimony of a witness with knowledgeknowledge •• Comparison by expert or trier of fact •• Distinctive characteristics NCJRL. org

4 Authenticity of a Computer Printout Bookkeeper testifies she inputted sales, inventory, payroll and tax info regularly; the printout accurately reflected that information; and the company regularly printed such reports. United States v. Catabran, 836 F.2d 453 (9th Cir. 1988). NCJRL. org

Authenticity of a Mirrored Hard Drive Police Officer testifies as to his method in mirroring the drive, software used to examine the contents, and that the information extracted accurately represented information on the original drive. Bone v. State, 771 N.E.2d 710 (Ind. Ct. App. 2002).

NCJRL. org

Authenticity of Chat Log Defendant argued gov’t could not prove he made the statements contained in the log. Chatter gave defendant’s first initial, last name, and street address. Police found the name, street address, e‐‐mail address, and telephone number the undercover officer gave chatter on a pad near defendant’s computer. Court found log admissible. United States v. Simpson, 452 F.3d 1241, 1249‐‐50 (10th Cir. 1998); see also United States v. Tank, 200 F.3d 629 (9th Cir. 2000). NCJRL. org

5 Not Authentic Chat log pasted into a Word document could not be authenticated. Defense expert testified the process did not ppproperly reproduce the chat and that there were several errors in the copies made. All copies of the full transcript were lost or destroyed. United States v. Jackson, 488 F. Supp. 2d 866 (D. Neb. 2007).

NCJRL. org

Authenticity of Text Message

Text messager identified himself as Sean and stated that he was driving a Ford Contour. This coupled with testimony about how text messages are sent was enough to authenticate texts as being from murder victim, Sean, who was in a Contour on the night of his disappearance. State v. Taylor, 632 S.E.2d 218 (N.C. Ct. App. 2006)2006)

NCJRL. org

Authentication of Social Media Information

NCJRL. org

6 Authentication of Social Media Information •• MySpace account used defendant’s name and hometown. Account had pictures of defendant.defendant. ••This was sufficient evidence to authenticate that the account belonged to the defendant.defendant.

Tienda v. State, 2010 WL 5129722 (Tex. Ct. App. Dec. 17, 2010)17, 2010) NCJRL. org

On the other hand … Printout of MySpace profile pages not sufficiently authenticated where ‐ State attempted authentication through lead investigator’s testimony ‐ Contained photo of purported creator and Petitioner in embrace ‐ Contained user’s birth date, referenced her location, and identified her boyfriend by Petitioner’s nickname Griffin v. State, 19 A.3d 415 (Ct. App. MD 2011)

Griffin Majority ‐‐ “[P]otential for abuse and manipulation” of social networking sites by others, in particular, requires more ‐ Describes other possible methods Dissent –Cites federal decisions finding authentication proper “if a reasonable juror could find in favor” ‐ Asserts majority’s concerns go to weight rather than admissibility of the printouts

7 Need Testimony to Authenticate Evidence? Two exceptions: 1. Self ‐‐authenticatinggg evidence; and 2. Evidence turned over as part of discoverydiscovery

NCJRL. org

Self Authentication

Rule 902 •• Public Documents •• TdTrade IiiInscriptions •• Certified Records of Regularly Conducted Business Activity

NCJRL. org

Is E-Mail Self Authenticating? Rule of Evid. 902(7) makes self authenticating documents with “inscriptions, signs, tags, or labels purporting to have been affixed in the course of business and indicating ownership, control, or origin.”

NCJRL. org

8 E-Mail Signature

Thomas K. Clancy Director & Research Professor National Center for Justice and the Rule of Law University of Mississippi School of Law P.O. Box 1848 University, MS 38677 662-915-6918 www.NCJRL.org author: The Fourth Amendment: Its History and Interpretation (Carolina Press 2008) www.cap-press.com/books/1795

NCJRL. org

Is This Different?

NCJRL. org

Authentication & Best Practices Best practices are not necessary to authenticate evidence. However, best practices strengthen arg uments that an item is what it purports to be.be. Best practices also increase the weight that should be given to the evidence presented.presented.

NCJRL. org

9 Chain of Custody

“Challenge to the chain of custody goes to the weight rather than the admissibility of the evidence.” U.S. v. Lopez, 758 F.2d 1517 (h(11th Cir. 1985). A missing link in the chain of custody for a hard drive went to the weight given the evidence by the jury not to the hard drive’s admissibility. U.S. v. Gavegnano, 305 Fed. Appx. 954 (4th Cir. 2009).

NCJRL. org

Hash Values

•• Hash values are created using algorithms which create 32 character (or longer) strings for pieces of digital information. •• Like DNA, Hash Values are unique to each piece of information and can not be changed.changed. •• The chances of two different inputs generating the same hash value are 1 in 340 Undecillion.

NCJRL. org

How are Hash Values Useful for Authentication? A hash value taken from the source of acquisition that matches the copy or mirrored piece of information verifies that the information is exactly the same.

NCJRL. org

10 Hash Values

NCJRL. org

Third Hurdle - Hearsay Is it a statement? Was it made out of court by a declarant? Is it offered to prove the truth of the matter asserted?asserted? Is it covered by an exception?exception?

NCJRL. org

Is It Hearsay? •• Chat transcript in an enticement trial not hearsay, but instead the act of enticement itself. State v. Glass, 190 P.3d 896 (Idaho Ct. App. 2008))).

•• Child pornography in a child pornography trial is not hearsay. Images are not statements. They are contraband just like a bag of cocaine. U.S. v. Cameron, 2011 WL 197365 (D. Me. Jan. 18, 2011). NCJRL. org

11 Business Record Exception (1) Data entered in the normal course of businessbusiness (2) Data entered at or near time of the occurrenceoccurrence (3) Source indications of reliability NCJRL. org

Overlaps with Authenticity

Some courts have compressed the authentication and business record exception analysis. Generally if a document qualifies as a business record it meets the authenticity requirements.

NCJRL. org

Business Record Exception Application

•• Bills of Lading. SeaSea‐‐Land Service, Inc. v. Lozen Intern., LLC, 285 F.3d 808 (9th Cir. 2002). •• Fed Ex Delivery Record. Dyno Const. Co. v. McWane, Inc., 198 F.3d 567 (6th Cir. 1999).1999). •• Insurance Payment Register. U.S. v. Sanders, 749 F.2d 195 (10th Cir. 1984).

NCJRL. org

12 Common Computer Records Objection The vulnerability of computer records to manipulation makes them inherently untrustworthy.

NCJRL. org

Are Computer Records Less Reliable? •• ComputerComputer‐‐generated records are not less reliable than other business records. USU.S. v. Young Bros., Inc., 728 F2dF.2d 682 (5th Cir. 1984). •• To the extent they are less reliable, that fact goes to weight and not admissibility. U.S. v. Glasser, 773 F.2d 1553 (11th Cir. 1985).1985). NCJRL. org

Establishing BR Exception for E-mail Monthly inventory printout is a systematic and regularly kept record. EE‐‐mail is an ongoing electronic message and retrieval system.system. Monotype Corp. PLC v. Int’l Typeface Corp., 43 F.3d 443 (9th Cir. 1994). If e‐‐mail is a regularly kept record, do you have to wshoshow that the content is also regularly kept? New York v. Microsoft Corp., 2002 WL 649951 (D.D.C. April 12, 2002) NCJRL. org

13 Fourth Hurdle – Best Evidence Rule

•• Rule 1002 requires an original in order to prove content of a writing, recording, or photo. •• RlRule 1001 dfidefines oriiigina l to ildinclude readbldable displays which includes printouts. •• Rule 1003 states accurate duplicates are originals for admissibility purposes. •• Rule 1006 allows for summaries of voluminous materials.materials. NCJRL. org

Best Evidence Rule - Cases •• A duplicate of a hard drive is admissible. Sta te v. MiMorris, No. 4CA0036, 2005 WL 356801, at *2 (Ohio. Ct. App. Feb. 16, 2005);2005); Broderick v. State, 35 S.W.3d 67 (Tex. Ct. App. 2000).

NCJRL. org

GPS Information U.S. v. Bennett, 363 F.3d 947 (9th Cir. 2004) Police found a GPS unit while searching a boat suspected of importing drugs into the United States. An officer looked through the GPS history showing the boat had just come from Mexican waters. The unit was not confiscated, but the officer testified at trial as to the information he got from the unit. NCJRL. org

14 U.S. v. Bennett

•• Was the information obtained from the Unit “a writing or recording?”recording?” •• Did the testimony regard the “content” of a “writing or recording?” •• Should it have been excluded?excluded?

NCJRL. org

U.S. v. Bennett

•• 9th Circuit ruled the officer’s testimony regarded a “writing or recording” and concerned the “content” of the GPS. •• Analogizing to testimony regarding the content of a security camera the court found the evidence should have been excluded.

NCJRL. org

U.S. v. Bennett

•• Would a printout from the GPS be sufficient under the best evidence rule? •• In other contexts some courts have found that format matters because information may be lost in simply printing out the graphical information. •• In Armstrong v. Executive Office of the President, Office of Admin.Admin., 1 F.3d 1274 (D.D.C. 1993), a district court ruled that printouts of e‐‐mails that didt notno include directories, distribution lists, acknowledgements, and potentially other information were not complete records.

NCJRL. org

15 Fifth Hurdle – Filter Rule Rule 403 allows for the exclusion of evidence “if its probative value is substantially outweighed by the danger of unfair prejudice, confusion of the issues, or misleading the jury, or by considerations of undue delay, waste of time, or needless presentation of cumulative evidence.”

NCJRL. org

United States v. Caldwell, 586 F.3d 338 (5th Cir. 2009) •• Defendant was charged with possession of child pornography he downloaded via Limewire. •• The gov’t introduced three CP clips, adult porn videos, and part of adult bestiality film that was downloading via P2P at time search warrant was served and defendant was alone in his home. •• Defendant was not charged in connection with the bestiality or other adult porn films. NCJRL. org

Probative Value The films were used to show the defendant knew how to use Limewire to download movies.movies.

NCJRL. org

16 Unfair Prejudice

•• Jury might punish defendant for his involvement with bestiality instead of for the crime charged.

NCJRL. org

Other Possibilities

•• What if the videos had been downloaded at a time when the gov’t was unsure who was in thethethe home?home?

NCJRL. org

Court’s Ruling

•• The video downloading at the time of the search was properly admitted. •• The video ppyreviously downloaded might have been improper, but any error was harmless because there was no contemporaneous objection and other similar videos had already been admitted.admitted.

NCJRL. org

17 United States v. Grimes, 244 F.3d 375 (5th Cir. 2001) •• Defendant was charged with possession of child pornography.

•• The images in question featured nude sexually liilascivious bhbehav ior by m inors. •• The gov’t sought to introduce sexual narratives involving minors found on the same computer.computer. •• The narratives featured sexual violence and “moderate torture.” NCJRL. org

Probative Value

•• Narratives proved the defendant’s intent to possess sexually explicit material involving children and made it less likely possession was accidental.accidental.

NCJRL. org

Unfair Prejudice •• The violent nature of the narrative which featured “young girls in chains, a young girl in handcuffs, and references to blood” might cause the jury to act with emotion instead of reason.

NCJRL. org

18 Court’s Ruling

•• The narratives were admitted in error and the defendant was entitled to a new trial. •• The court did state the narratives had probative value and redacted to exclude violence might be admissible.admissible.

NCJRL. org

Contact Information

Don Mason 662-915-6898 [email protected] www.ncjrl.org

20 Evidentiary Foundations for Electronically Stored Information

RESOURCES

Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. May 4, 2007)

LORRAINE V. MARKEL: ELECTRONIC EVIDENCE 101 (A LexisNexis Discovery Services white paper) http://www.lexisnexis.com/discovery

THE SEDONA CONFERENCE® COMMENTARY ON ESI EVIDENCE & ADMISSIBILITY http://www.thesedonaconference.org/dltForm?did=ESI_Commentary_0308.pdf

George L. Paul, FOUNDATIONS OF DIGITAL EVIDENCE (American Bar Association 2008)

DIGITAL EVIDENCE IN THE COURTROOM: A GUIDE FOR LAW ENFORCEMENT AND PROSECUTORS Special Report by National Institute of Justice (NCJ 211314, January 2007) http://www.ncjrs.gov/pdffiles1/nij/211314.pdf

Edward J. Imwinkelreid, EVIDENTIARY FOUNDATIONS (LexisNexis 6th ed. 2005)

Federal Judicial Center, MANUAL FOR COMPLEX LITIGATION

Beatrice O'Donnell and Thomas A. Lincoln, “Authenticating E-Mail Discovery as Evidence” (The Legal Intelligencer, August 13, 2007)

H. Christopher Boehning and Daniel J. Toal, “Keep 'Smoking Gun' E-Mails from Backfiring” (New York Law Journal, October 25, 2007)

Orin S. Kerr, “Computer Records and the Federal Rules of Evidence,” United States Attorneys’ USA Bulletin (March 2001, Vol. 49, No. 2) http://www.usdoj.gov/criminal/cybercrime/usamarch2001_4.htm