THE NATIONAL CENTER FOR JUSTICE AND THE RULE OF LAW AND THE NATIONAL JUDICIAL COLLEGE EVIDENTIARY FOUNDATIONS & USE OF DIGITAL EVIDENCE DIVIDER 5 Professor Donald R. Mason OBJECTIVES: After this session, you will be able to: 1. Identify the major evidentiary considerations for use of digital evidence; and 2. Discuss how the rules of evidence may apply in cases involving technology facilitated crimes against children. REQUIRED READING: PAGE 1. Donald R. Mason, Use of Digital Evidence: Evidentiary Considerations for Trial (Aug. 2011) [NCJRL PowerPoint]...1 2. Donald R. Mason, Evidentiary Foundations for Electronically Stored Information: Resources (Aug. 2011) [NCJRL Document]...21 SI: TECHNOLOGY ASSISTED CRIMES AGAINST CHILDREN: EVIDENTIARY & PROCEDURAL MATTERS AT TRIAL AUGUST 1-2, 2011 RENO, NV WB/KZ
Use of Digital Evidence Evidentiary Considerations for Trial Don Mason Associate Director, NCJRL Research Professor Objectives After this session, you will be able to: Identify the major evidentiary considerations for use of digital evidence Discuss how the rules of evidence may apply in cases involving technology facilitated crimes against children Digital Evidence and the Rules of Evidence In general, the Rules of Evidence apply to electronic evidence in the same ways they apply to more traditional forms of evidence. 1
Leading Case Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007). This courtaddressed the five hurdles to admitting electronic evidence in great detail. 5 Hurdles to Clear Hurdles 1. Relevance 2. Authenticity 3. Best Eid Evidence 4. Hearsay 5. More Prejudicial than Probative 2
Preliminary Rulings Rule 104(a) Questions of admissibility generally. This applies to the admission of expert testimony, whether a privilege exists, and whether a statement is hearsay. Not bound by Rules except of privilege. Conditional Relevancy Rule 104(b). This applies to authenticity. Jury not the court makes findings of fact. Predicate facts must be admissible ibl under the Rules. Rule 104 Example In admitting an e mail the jury would determine whether or not the e mail was what it purports to be, but a judge would determine whether or not the e mail was an admission by a party opponent. 3
First Hurdle - Relevance Rule 401 tends to make some fact of consequence more or less probable. Admissibility distinguished from weight or sufficiency. Second Hurdle - Authentication Is evidence what it is purported to be? A party need only submit evidence sufficient tosupporta finding that the evidence is what the party claims it to be. Circumstantial evidence can be used to authenticate evidence. Ways to Prove Authentication Testimony of a witness with knowledge Comparison by expert or trier of fact Distinctive characteristics 4
Authenticity of a Computer Printout Bookkeeper testifies she inputted sales, inventory, payroll and tax info regularly; the printout accurately reflected that information; and the company regularly printed such reports. United States v. Catabran,, 836 F.2d 453 (9th Cir. 1988). Authenticity of a Mirrored Hard Drive Police Officer testifies as to his method in mirroring the drive, software used to examine the contents, and that the information extracted accurately represented information on the original drive. Bone v. State,, 771 N.E.2d 710 (Ind. Ct. App. 2002). Authenticity of Chat Log Defendant argued gov t could not prove he made the statements contained in the log. Chatter gave defendant s first initial, last name, and street address. Police found the name, street address, e mail address, and telephone number the undercover officer gave chatter on a pad near defendant s computer. Court found log admissible. United States v. Simpson,, 452 F.3d 1241, 1249 50 (10th Cir. 1998); see also United States v. Tank, 200 F.3d 629 (9th Cir. 2000). 5
Not Authentic Chat log pasted into a Word document could not be authenticated. Defense expert testified the process did not properly p reproduce the chat and that there were several errors in the copies made. All copies of the full transcript were lost or destroyed. United States v. Jackson,, 488 F. Supp. 2d 866 (D. Neb. 2007). Authenticity of Text Message Text messager identified himself as Sean and stated that he was driving a Ford Contour. This coupled with testimony about how text messages aresentwas enough to authenticate texts as being from murder victim, Sean, who was in a Contour on the night of his disappearance. State v. Taylor,, 632 S.E.2d 218 (N.C. Ct. App. 2006) Authentication of Social Media Information 6
Authentication of Social Media Information MySpace account used defendant s name and hometown. Account had pictures of defendant. This was sufficient evidence to authenticate that the account belonged to the defendant. Tienda v. State,, 2010 WL 5129722 (Tex. Ct. App. Dec. 17, 2010) On the other hand Printout of MySpace profile pages not sufficiently authenticated where State attempted authentication through lead investigator s testimony Contained photo of purported creator and Petitioner in embrace Contained user s birth date, referenced her location, and identified her boyfriend by Petitioner s nickname Griffin v. State, 19 A.3d 415 (Ct. App. MD 2011) Griffin Majority [P]otential for abuse and manipulation of social networking sites by others, in particular, requires more Describesotherpossible methods Dissent Cites federal decisions finding authentication proper if a reasonable juror could find in favor Asserts majority s concerns go to weight rather than admissibility of the printouts 7
Need Testimony to Authenticate Evidence? Two exceptions: 1. Self authenticating evidence; and 2. Evidence turned over as part of discovery Self Authentication Rule 902 Public Documents Trade Inscriptions i Certified Records of Regularly Conducted Business Activity Is E-Mail Self Authenticating? Rule of Evid. 902(7) makes self authenticating documents with inscriptions, signs, tags, or labels purporting to have been affixed in the course of business and indicating ownership, control, or origin. 8
E-Mail Signature Thomas K. Clancy Director & Research Professor National Center for Justice and the Rule of Law University of Mississippi School of Law P.O. Box 1848 University, MS 38677 662-915-6918 www.ncjrl.org author: The Fourth Amendment: Its History and Interpretation (Carolina Press 2008) www.cap-press.com/books/1795 Is This Different? Authentication & Best Practices Best practices are not necessary to authenticate evidence. However, best practices strengthen arguments that an item is what it purports to be. Best practices also increase the weight that should be given to the evidence presented. 9
Chain of Custody Challenge to the chain of custody goes to the weight rather than the admissibility of the evidence. U.S. v. Lopez,, 758 F.2d 1517 (11th Cir. 1985). A missing link in the chain of custody for a hard drive went to the weight given the evidence by the jury not to the hard drive s admissibility. U.S. v. Gavegnano,, 305 Fed. Appx. 954 (4th Cir. 2009). Hash Values Hash values are created using algorithms which create 32 character (or longer) strings for pieces of digital information. Like DNA, Hash Values are unique to each piece of information and can not be changed. The chances of two different inputs generating the same hash value are 1 in 340 Undecillion. How are Hash Values Useful for Authentication? A hash value taken from the source of acquisition that matches the copy or mirrored piece of information verifies that the information is exactly the same. 10
Hash Values Third Hurdle - Hearsay Is it a statement? Was it made out of court by a declarant? Isit offered to provethe truth of the matter asserted? Is it covered by an exception? Is It Hearsay? Chat transcript in an enticement trial not hearsay, but instead the act of enticement itself. State v. Glass,, 190 P.3d 896 (Idaho Ct. App. 2008). Child pornography in a child pornography trial is not hearsay. Images are not statements. They are contraband just like a bag of cocaine. U.S. v. Cameron,, 2011 WL 197365 (D. Me. Jan. 18, 2011). 11
Business Record Exception (1) Data entered in the normal course of business (2) Data entered at or near time of the occurrence (3) Source indications of reliability Overlaps with Authenticity Some courts have compressed the authentication and business record exception analysis. Generally if a document qualifies as a business record it meets the authenticity requirements. Business Record Exception Application Bills of Lading. Sea Land Service, Inc. v. Lozen Intern., LLC,, 285 F.3d 808 (9th Cir. 2002). Fed Ex Delivery Record. Dyno Const. Co. v. McWane, Inc.,, 198 F.3d 567 (6th Cir. 1999). Insurance Payment Register. U.S. v. Sanders, 749 F.2d 195 (10th Cir. 1984). 12
Common Computer Records Objection The vulnerability of computer records to manipulation makes them inherently untrustworthy. Are Computer Records Less Reliable? Computer generated records are not less reliable than other business records. US U.S. v. Young Bros., Inc.,, 728 F.2d 682 (5th Cir. 1984). To the extent they are less reliable, that fact goes to weight and not admissibility. U.S. v. Glasser,, 773 F.2d 1553 (11th Cir. 1985). Establishing BR Exception for E-mail Monthly inventory printout is a systematic and regularly kept record. E mail is an ongoing electronic message and retrieval system. Monotype Corp. PLC v. Int l Typeface Corp.,, 43 F.3d 443 (9th Cir. 1994). If e mail is a regularly kept record, do you have to show that the content is also regularly kept? New York v. Microsoft Corp.,, 2002 WL 649951 (D.D.C. April 12, 2002) 13
Fourth Hurdle Best Evidence Rule Rule 1002 requires an original in order to prove content of a writing, recording, or photo. Rule 1001 defines original ii lt to include readable dbl displays which includes printouts. Rule 1003 states accurate duplicates are originals for admissibility purposes. Rule 1006 allows for summaries of voluminous materials. Best Evidence Rule - Cases A duplicate of a hard drive is admissible. State t v. Morris,, No. 4CA0036, 2005 WL 356801, at *2 (Ohio. Ct. App. Feb. 16, 2005); Broderick v. State,, 35 S.W.3d 67 (Tex. Ct. App. 2000). GPS Information U.S. v. Bennett, 363 F.3d 947 (9th Cir. 2004) Police found a GPS unit while searching a boat suspected of importing drugs into the United States. An officer looked through the GPS history showing the boat had just come from Mexican waters. The unit was not confiscated, but the officer testified at trial as to the information he got from the unit. 14
U.S. v. Bennett Was the information obtained from the Unit a writing or recording? Did the testimony regard the content of a writing or recording? Should it have been excluded? U.S. v. Bennett 9th Circuit ruled the officer s testimony regarded a writing or recording and concerned the content of the GPS. Analogizing to testimony regarding the content of a security camera the court found the evidence should have been excluded. U.S. v. Bennett Would a printout from the GPS be sufficient under the best evidence rule? In other contexts some courts have found that format matters because information may be lost in simply printing out the graphical information. In Armstrong v. Executive Office of the President, Office of Admin.,, 1 F.3d 1274 (D.D.C. 1993), a district court ruled that printouts of e mails that did not include directories, distribution lists, acknowledgements, and potentially other information were not complete records. 15
Fifth Hurdle Filter Rule Rule 403 allows for the exclusion of evidence if its probative value is substantially outweighed by the danger of unfair prejudice, confusion of the issues, or misleading the jury, or by considerations of undue delay, waste of time, or needless presentation of cumulative evidence. United States v. Caldwell, 586 F.3d 338 (5th Cir. 2009) Defendant was charged with possession of child pornography he downloaded via Limewire. The gov t introduced three CP clips, adult porn videos, and part of adult bestiality film that was downloading via P2P at time search warrant was served and defendant was alone in his home. Defendant was not charged in connection with the bestiality or other adult porn films. The films were used to show the defendant knew how to use Limewire to download movies. Probative Value 16
Unfair Prejudice Jury might punish defendant for his involvement with bestiality instead offor for the crime charged. Other Possibilities What if the videos had been downloaded at a time when the gov t was unsure who was in the home? Court s Ruling The video downloading at the time of the search was properly admitted. The video previously downloaded might have been improper, but any error was harmless because there was no contemporaneous objection and other similar videos had already been admitted. 17
United States v. Grimes, 244 F.3d 375 (5th Cir. 2001) Defendant was charged with possession of child pornography. The images in question featured nude sexually lascivious i behavior by minors. The gov t sought to introduce sexual narratives involving minors found on the same computer. The narratives featured sexual violence and moderate torture. Probative Value Narratives proved the defendant s intent to possess sexually explicit materialinvolving involving children and made it less likely possession was accidental. Unfair Prejudice The violent nature of the narrative which featured young girls in chains, a young girl in handcuffs, and references to blood might cause the jury to act with emotion instead of reason. 18
Court s Ruling The narratives were admitted in error and the defendant was entitled to a new trial. The court did state the narratives had probative value and redacted to exclude violence might be admissible. Contact Information Don Mason 662-915-6898 drmason@olemiss.edu www.ncjrl.org 19
20
Evidentiary Foundations for Electronically Stored Information RESOURCES Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. May 4, 2007) LORRAINE V. MARKEL: ELECTRONIC EVIDENCE 101 (A LexisNexis Discovery Services white paper) http://www.lexisnexis.com/discovery THE SEDONA CONFERENCE COMMENTARY ON ESI EVIDENCE & ADMISSIBILITY http://www.thesedonaconference.org/dltform?did=esi_commentary_0308.pdf George L. Paul, FOUNDATIONS OF DIGITAL EVIDENCE (American Bar Association 2008) DIGITAL EVIDENCE IN THE COURTROOM: A GUIDE FOR LAW ENFORCEMENT AND PROSECUTORS Special Report by National Institute of Justice (NCJ 211314, January 2007) http://www.ncjrs.gov/pdffiles1/nij/211314.pdf Edward J. Imwinkelreid, EVIDENTIARY FOUNDATIONS (LexisNexis 6th ed. 2005) Federal Judicial Center, MANUAL FOR COMPLEX LITIGATION Beatrice O'Donnell and Thomas A. Lincoln, Authenticating E-Mail Discovery as Evidence (The Legal Intelligencer, August 13, 2007) H. Christopher Boehning and Daniel J. Toal, Keep 'Smoking Gun' E-Mails from Backfiring (New York Law Journal, October 25, 2007) Orin S. Kerr, Computer Records and the Federal Rules of Evidence, United States Attorneys USA Bulletin (March 2001, Vol. 49, No. 2) http://www.usdoj.gov/criminal/cybercrime/usamarch2001_4.htm 21