Originating Author: Kurt Stammberger
Until recently, electronic records were treated much like their paper counterparts, at least in terms of their admissibility as evidence in a court of law. But this seems to be changing—and quickly. In several recent landmark rulings, electronic business records that earlier would have been routinely admitted into evidence have been excluded because of questions as to their authenticity. This has resulted in a few nasty surprises— and some substantial defeats—for several businesses across the United States in the past few months. Courts already require that the proponent of an audiotape prove the elements of the foundation—in other words, prove that the tape is authentic and has not been tampered with—by submitting clear and convincing evidence of its pristine condition. Courts have developed this rule at least in part because they realize how easy it is to alter the contents of an audio recording. Likewise in 2004, a Connecticut court demanded that lawyers produce better evidence for the trustworthiness of digital images that they wished to submit as evidence, because of the difficulty of detecting changes made by widely available tools like Adobe Photoshop. It now appears that the chickens are coming home to roost on electronic records, like email and transaction archives, as well.
A whole range of issues has arisen in relation to the introduction of records into legal proceedings, including the genuineness, authorship, attestation and other requirements that may affect a document’s validity in court. Judges and opposing counsel alike are now challenging whether electronic records are what they purport to be, and that could spell trouble for American businesses.
Amex v. Vinhnee, December 2005 In this case, American Express claimed that Mr. Vinhnee had failed to pay his credit card debts, and took legal action to recover the money. But the trial judge determined that American Express failed to authenticate its electronic records, and that therefore Amex could not admit its own business records into evidence. American Express regrouped, and tried again to get the records admitted—and was again refused on the grounds that it failed to sufficiently establish a foundation of authenticity for the records offered into evidence. Finally, American Express challenged the judgment on appeal—and lost a third time. Interestingly, the defendant didn’t show up for the court date, and wasn’t even represented by counsel.
The decision is considered important because it said, in effect, that electronic records are not automatically presumed to be admissible (in court) unless you can establish that the document proffered is identical to the originally created record. The decision also laid the groundwork for courts and counsel to require parties offering documents as evidence to show some capability for testing (and proving) the authenticity of those electronic records.
In both the original and the appeals court, the judges made clear that the records presented by the custodian of the records at AmEx were too vague to be accepted into evidence, in essence, asking the Courts to accept a level of so-called “inferred authenticity” which was judged to be insufficient. Among other problems, the court said that the company failed to provide adequate information about its computer policy and system control procedures, control of access to the relevant databases and programs, how changes to the data were recorded or logged, what backup practices were in place, and how Amex could provide assurance of the continuing integrity of their records.
In respect of the issues in this particular trial, the judge pointed out that, “... the focus is not on the circumstances of the creation of the record, but rather on the circumstances of the preservation of the record … so as to assure that the document being proffered is the same as the document that originally was created…. Ultimately, however, it all boils down to the same question of assurance that the record is what it purports to be.”
Lorraine v. Markel, May 2007 In the Markel case, a couple brought suit in the United States District Court of Maryland against their insurance company, in a dispute over the cause and amount of damages to their yacht which had been struck by lightening. Both parties petitioned the court for summary judgment, and Judge Paul Grimm dismissed both of these motions, because the electronic documents at the center of the case could not be authenticated – and therefore were not admitted into evidence.
In his opinion, Judge Grimm wrote, “The primary authenticity issue in the context of business records is on what has, or may have, happened to the record in the interval between when it was placed in the files and the time of trial. In other words, the record being proffered must be shown to continue to be an accurate representation of the record that originally was created.”
An increasing number of federal judges are concerned that the electronic records produced for use in litigation may have been manipulated before their presentation to the court, or that the programs and procedures used to create and maintain the records can’t be relied upon to protect these documents from alteration by corporate insiders.
The ruling makes it clear that while some courts will continue to view electronic business records much as paper documents (which are rarely challenged on grounds of authenticity), attorneys should be prepared to face more frequent challenges to e-records in the coming years. Judge Grimm wrote, “Unless counsel knows what level of scrutiny will be required, it would be prudent to analyze electronic business records that are essential to his or her case by the most demanding standard. The cases further suggest that during pretrial discovery counsel should determine whether opposing counsel will object to admissibility of critical documents.
“The logical questions extend beyond the identification of the particular computer equipment and programs used,” the judge wrote. “The entity’s policies and procedures for the use of the equipment, database, and programs are important… how changes in the database are logged or recorded, as well as the structure and implementation of backup systems and audit procedures for assuring the continuing integrity of the database, are pertinent to the question of whether records have been changed since their creation.”
He concluded, “Further, although ‘it may be better to be lucky than good,’ as the saying goes, counsel would be wise not to test their luck unnecessarily. If it is critical to the success of your case to admit into evidence computer stored records, it would be prudent to plan to authenticate the record by the most rigorous standard that may be applied.”
The Future of Electronic Evidence To be sure, these rulings represent the vanguard of legal opinion. But several federal judges have indicated this may be the single biggest issue coming over the horizon for the judiciary, the courts and members of the American Bar. Momentum on this issue seems to be building on several fronts. Recent amendments to the Federal Rules of Civil Procedure now require the preservation of electronically stored information and have established a new “meet and confer” process to formulate a plan for managing electronic evidence in coming years. Furthermore, the information security and legal communities have been increasingly working together in a variety of forums to establish standards and guidelines for the integration of modern authentication technologies into the legal system. The Information Security Committee of the American Bar Association is expected to publish its “Foundations or Evidence for Electronically Stored Information” treatise later this year, while the members of the Se-dona Working Group 1—an elite gathering of respected judges, top litigators, technology experts and leading legal minds—are working on a new publication to address the technical mechanics of authenticating electronic records.
What You Can Do For all of these efforts, the key issue remains the same: proving the authenticity over time of a stored electronic record. The consensus seems to be that these projects will likely lead to formal amendments to the Federal Rules of Evidence—and soon. While we can’t predict exactly what form those rule changes will take, there are steps you can take now that can give your business a much better chance of getting your electronic archives admitted into evidence in a court of law.
- Document your access control and backup procedures and policies and test the effectiveness of your controls.
- Be prepared to explain how changes to your databases and content/record management systems are routinely recorded and logged.
- Protect e-records from post-archival tampering with modern data integrity and trusted timestamping technologies. (see ANSI X9.95 standard)
- Document the audit procedures you use to provide assurance of the continuing authenticity of the records.
Action Item: Courts see the characteristics of “authentication” as comprising of reliability (there is evidence that records are created and captured as part of the legitimate business process, and they are subject to a corporate management process), integrity (the document is provably protected from unauthorized alteration) and usability (the document is capable of being retrieved, presented and interpreted correctly). The ability of organizations to demonstrate these characteristics, taken together, will become fundamental to establishing the authenticity and evidential admissibility of electronic documents in coming years.
An Analogy to the Foundation for Audiotapes
Many courts require that the proponent of an audiotape prove the elements of the foundation by clear and convincing evidence. E.g., United States v. Cunningham, 462 F.3d 708, 713 (7th Cir. 2006). In part, they have developed this rule because they realize that it is so easy to alter the contents of an audiotape.
An Analogy to the Foundation for “Enhanced” Photographs
In 2004, the Connecticut court mandated a more extensive foundation for digitally enhanced images. State v. Swinton, 268 Conn. 781, 847 A.2d 921 (2004). In part, the court did so because of the difficulty of detecting enhancement.
An Analogy to Chain Of Custody
A ready identifiability foundation is insufficient and the courts demand proof of a chain of custody when the issue is an object’s condition rather than simply its identity. Given the ease of manipulating electronically stored information, realistically whenever a proponent offers a printout of such information, the present condition of the information is in issue.
Further Reading
Paul, George L. The Authenticity Crisis in Real Evidence. Law Practice Today, a publication of the American Bar Association. March 2006. Grimm, Paul W. Jack R Lorraine and Beverly Mack, Plaintiffs, v. Markel American Insurance Company, Defendants. Civil Action No. PWG-06-1893, United States District Court for the State of Maryland. May 4, 2007. Mason, Stephen. Authentication of Electronic Evidence. Information Age, October 18, 2006. Axelrod, David F. New Rules for Electronic Records? ALM Business Crimes Bulletin, June 2006.
Action Item:
Footnotes: