Mobile Devices

New Challenges for Admissibility of Electronic Evidence

As mobile devices, social media, and web archives change the nature of digital
evidence, will the courts be able to address the increasing complexity?

By Lucy L. Thomson

The Changing Digital Evidence introducing digital evidence. Adding to data and information must be shown
Landscape the layers of complexity, web archives to be what the proponent claims that it
In the future, the most important evi- are being created by global organiza- is.3 The foundations for digital evidence
dence may be created on a mobile tions; regular captures are being made are based on established principles of
device. Information technology has of websites, and the digital material authentication and admissibility that
caused a paradigm shift in the way is being saved and preserved for the originated with the use of “paper” evi-
individuals and organizations commu- future.2 dence. The five separate foundations
nicate—and create, collect, share, and The widespread use of mobile are:4
store—data and information. Advanced devices has created unprecedented
technologies ranging from mobile challenges in legal proceedings as the • Relevance—the evidence must be
devices to satellites1 are providing courts decide how to properly authen- relevant to the claims asserted,
sophisticated ways to document daily ticate digital information under the i.e., it must have “any tendency”
events, resulting in an expansive col- current judicial rules and procedures. to prove or disprove a conse-
lection of invaluable records. Millions Although the basic legal require- quential fact in the litigation.
of people are now creating documen- ments for establishing a foundation for • Authenticity—a process for
tation that may become “evidence” in admissibility of evidence in US courts establishing that digital data or
cases around the world. are well-established, their applicabil- a document is what it is repre-
Observers on the scene can now ity to digital data and devices from sented to be.
document the details of events which electronic evidence is gener- • Hearsay—an out-of-court state-
with photographs, video, and audio ated raises many difficult evidentiary ment introduced for the truth of
recordings from their cell phones issues and questions. As a result, courts the matter asserted; it applies if
and cameras, and postings of real- have applied widely different standards the proponent plans to use the
time commentary (often transmitted for similar types of evidence when record’s contents as substantive
through their mobile devices) on web- computer-generated information and evidence. The evidence must not
sites such as YouTube, global social digital images are presented in court. be hearsay, or it must be admissi-
media sites, and Twitter and in email ble under a hearsay exception.
and text messages—previously unavail- Twenty-First Century Foundations • Best Evidence—this standard
able real-time, up-to-the-minute of Digital Evidence applies if the document’s terms
recordings. Now in court proceedings, Court rules require that for evidence to are at issue; there are no “origi-
traditional eyewitness testimony can be be admissible, it must be authenticated. nals” of digital evidence.
greatly enhanced and corroborated by In the simplest terms, this means that • Probative Value Must Outweigh
photo: istockphoto

Published in The SciTech Lawyer, Volume 9, Number 3, Winter/Spring 2013. © 2013 American Bar Association. Reproduced with permission. All rights reserved. This information or any portion
thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.
 Mobile Devices
and Computing
By Brad Templeton

We’re going to see an expansion of the creation

of efficient markets for local business as a result
of new technology and increased artificial intel-
Any Prejudicial Effect—a court evidence generally has a low bar under ligence in mobile devices. Just as many have
may exclude relevant evidence Fed. R. Evid. 901(a). It is only neces- moved to shopping online from home, there are
under Rule 403 if its probative sary to establish a foundation from a growing number who won’t eat out without
value is substantially outweighed which the fact-finder (a jury) could consulting online review databases, or shop in
by the danger of unfair prejudice, legitimately infer that the evidence is a store without checking the online price.
or by considerations of undue what the proponent claims it to be; for Such trends are becoming increasingly proactive.
Soon your phone may ring if you unknowingly
delay, waste of time, or need- example, that a letter is genuine or a
walk into a restaurant with bad food, or a store
less presentation of cumulative photograph is accurate. The trial judge
with a bad reputation. Our mobile devices will
evidence. looks only to the proponent’s evidence give us the liberty to just wander at will, knowing
to assess the rational sufficiency of our device will protect us from bad merchants,
While US courts have been admitting the foundational evidence, a question bad neighborhoods, or even bad movies. The
computer records into evidence since of law. The opponent may have con- merchant-centered counterforces want to create
the 1970s when computer systems troverting evidence. Thus, for digital a world of spam that has huge privacy concerns,
became available for business and some evidence to be admissible, it must be and a battle is coming. Merchants imagine that
personal use, “traditional” foundations shown only to be arguably or colorably because we want our friends to be with us all
for electronic evidence have focused authentic. the time, we also want our merchants with us
on the relationship between the infor- Now that the nature of digital evi- all the time, too. But I have news for them: we
don’t have a relationship because I once bought
mation and the computer.5 Documents dence is significantly different from the
some toothpaste from you.
were admitted based on the assump- early days of mainframe or stand-alone
tion that information produced from a computers, traditional foundations for Brad Templeton is chair of networks & com-
computer is inherently reliable. computer records may no longer be puting at Singularity University.
The standard for the admissibility of adequate to address the complexities

Published in The SciTech Lawyer, Volume 9, Number 3, Winter/Spring 2013. © 2013 American Bar Association. Reproduced with permission. All rights reserved. This information or any portion
thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.
The failure to
understand how to require advance planning to
systematically document these
business and personal reasons.
• Because of cost reductions and
appropriately and key aspects of the electronic
evidence.
increased efficiencies, many orga-
nizations are outsourcing their
effectively authenticate information technology to cloud

electronic evidence Advanced Technology

Trends
service providers. Outsourcing
data storage and analysis to third
has resulted in adverse Much of today’s informa-
tion is created in electronic
parties adds another layer of
complexity to the authentication
rulings by federal form (“born digital”), and a
large percentage is never printed.
process. Furthermore, informa-
tion systems are international in
courts. Consider the challenges to authen-
tication presented by each of the
scope as a result of globalization
and industrial consolidation.
following technology developments • Web archives consist of collections
that have taken place in recent years: of many websites with material
created in the past, which pres-
of modern information systems from • A mobile transformation is upon ents significant challenges for
which electronic evidence is gener- us. The proliferation of mobile establishing a foundation for
ated—because digital information may devices results in the creation and admissibility. A foundation for
be created easily and without any veri- transmission of huge amounts each “layer” of evidence must be
fiable record of who did so, and it can of digital information through a provided separately, including the
be changed, often without detection. variety of devices, including lap- chain of custody.
To authenticate digital evidence, tops, smartphones, and tablets.
21st-century foundations must focus New and enhanced functional- Challenges to Digital Evidence in
more broadly on the key components ities of these devices also expand Legal Proceedings
of an information system: People— significantly the types of data The failure to understand how to
Process—Technology. Factors to be that are created, particularly with appropriately and effectively authenti-
considered in evaluating the integrity mHealth, mBanking and global cate electronic evidence has resulted in
of digital data include who created the e-commerce. adverse rulings by federal courts. For
evidence, what processes and technol- • In many cases, email and social example, in Lorraine v. Markel Ameri-
ogy were used, and what was the chain media have become predominant can Insurance Co., 241 F.R.D. 554 (D.
of custody throughout the entire digital means of communication, along Md. 2007), the court denied a motion
evidence lifecycle. Strategies for facili- with text messages, chat groups, for summary judgment due to the fail-
tating admissibility of digital evidence and blogs. Millions of people ure to provide admissible evidence and
are members of social networks, properly authenticate computer-gener-
Lucy L. Thomson is an attorney where complex relationships ated evidence. In Vinhnee v. American
and principal of Livingston PLLC, a between and among individuals Express Travel Related Services Com-
Washington, DC, law firm that focuses and businesses are documented pany, Inc., 336 B.R. 437 (9th Cir. BAP
on issues at the intersection of law and in a constantly changing tapestry 2005), the court of appeals affirmed the
technology, particularly cybersecurity of text, audio, and photographic trial court’s decision not to admit com-
and global data privacy. Ms. Thomson images.6 Few rules govern the puterized records because of the lack of
is Chair of the ABA Section of Science attribution of these data to their foundation for business records and an
& Technology Law (SciTech). A career sources, and changes to the infor- authentication foundation to assure the
federal criminal prosecutor at the US mation are often not logged or accuracy of the records.
Department of Justice and a former documented. There are several challenges that can
senior engineer at a global technology • The trend toward consum- be made to the authenticity of digital
company, she pioneered the use of erization of information records:
electronic evidence at trial in complex technology—often referred
white-collar crime and landmark civil to as Bring Your Own Device • Identity Management Challenge:
rights cases. She founded and co-chairs (BYOD)— means that individual Who Is the Author of the Records?
the ABA SciTech e-discovery and digital users will be permitted to con- Courts look for ways to tie the
evidence (EDDE) committee, and is nect their personal consumer author to the digital information
editor of the ABA best-selling Data devices, including laptops and offered into evidence. Whether
Breach and Encryption Handbook mobile devices, to company net- a message, document, video, or
(2011). works and use them for both photo was included in an email or

Published in The SciTech Lawyer, Volume 9, Number 3, Winter/Spring 2013. © 2013 American Bar Association. Reproduced with permission. All rights reserved. This information or any portion
thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.
 posted on a website, it is important the information to the website’s statically or dynamically display any
for the proponent to provide testi- sponsor is required depends on content the hacker wishes to present.
mony about who the author is. the circumstances, such as the
• Is the Computer Program That proponent’s incentive and abil- Authentication of State Official
Generated the Records Reliable? ity to falsify evidence—in some Records
Was the output of the computer cases, it is necessary to prove that Web pages can be generated from offi-
what it is purported to be? the website owner actually posted cial government websites; they are
• Were the Records Altered, Manip- the information. self-authenticating and admitted as evi-
ulated, or Damaged After They • Lenient. A web page is introduced dence, even though in a major report
Were Created? Changes to photo- through a screen shot—testimony published in 2007 by the American
graphs and videos can be made from the person who created the Association of Law Libraries (AALL)
using Photoshop or graphic screen shot is required stating casts serious doubt on the authenticity
design programs, while hack- that the image “accurately reflects of official records obtained from state
ers can alter websites, change the content of the website and the websites. In 2011, the Uniform Law
databases, and other electronic image of the page on the com- Commission passed the Uniform Elec-
media. Often they cover their puter at which the [screen shot] tronic Legal Material Act (UELMA)
tracks by changing audit log was made.” The party seeking to to address these shortcomings. It will
records. introduce the evidence does not not be until states pass UELMA, and
• Incompleteness and Integrity. Is need to show who authored or official publishers authenticate online
the evidence the entire record or sponsored the information. legal material, that this problem is fully
conversation? In a challenge to addressed.
the authenticity of email tran- There appears to be no uniformity
scripts, “instant messages,” and as to which standard will be applied. Information From Social Media Sites
“chats,” a court held that “obvi- Courts often make a cursory assess- The explosion of participants in social
ous omissions” in some of the ment and admit evidence such as email networking venues such as Facebook,
communications go to the weight based on its appearance; does it have MySpace, and LinkedIn has resulted
rather than the admissibility of “indicia” of reliability (familiar for- in the creation of information that is
the evidence. U.S. v. Lebowitz, mat, signature line, company identified, outside the knowledge and control of
647 F. Supp. 2d 133 (N.D. Ga. etc.)? From a technology standpoint, any specific person or organization.
2009). However, a Nebraska fed- using the lenient standard based on Courts generally apply a stricter stan-
eral court excluded entirely a the appearance of a website or email dard to authentication of information
“cut-and-paste” version of chat is not a reliable indicator of whether from social networking sites because
room conversations, finding that the evidence is authentic. The data can of the absence of restrictions on who
the omissions made the evidence be easily forged or altered by a hacker, may create or update a profile. Any-
“not authentic.” United States v. developer, or a layperson. When for- one can create a social network profile
Jackson, 2007 WL 1381772 (D. warding an email, the sender can edit anonymously, using a pseudonym, or
Neb. 2007). the message. Such alterations are often in someone else’s name. Because one
not detectible by the recipient. or many people may post messages on
To address these issues, the courts The content of a website introduced a social networking site, courts cannot
have created three approaches to into evidence may not be authentic for necessarily attribute a particular mes-
determine the admissibility of digital several reasons, including: (1) It can be sage to the person who owns the site.
evidence. While they were created in forged by saving the website to a local Determining who made a post is par-
the context of websites, they are appli- computer hard drive. The content can ticularly difficult if the person made the
cable to information from all types of then be redisplayed in a browser, modi- post from a public computer such as in
digital evidence. fied by a text editor, and printed from a library or a hotel.7
a substituted URL. (2) Websites are
• Strict. A witness with personal dynamic and may display different con- Authentication Criteria
knowledge must testify that the tent to different users. Websites that In order to demonstrate that the digital
information can be attributed to have been infected with a virus may evidence is what the proponent claims
a particular person or organiza- display malicious content to the user it to be, the foundation must take into
tion. The testimony will address, only once. (3) The website may change account not only the legal require-
e.g., who maintained a website its content slightly in seconds, so it ments of procedure and evidence, but
where information was posted may not be possible for the witness to must also include an evaluation of each
and who authored the document. preserve every word of the page. (4) of the key components of the informa-
• Somewhat Strict. Whether linking A hacker attack can make a website tion system from which the evidence

Published in The SciTech Lawyer, Volume 9, Number 3, Winter/Spring 2013. © 2013 American Bar Association. Reproduced with permission. All rights reserved. This information or any portion
thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.
 technology make it essential that liti- electronic evidence. This can be done
Mobile Devices gators and the courts understand the through a combination of witness tes-
context in which each piece of digital timony and documentary and physical
and Energy data is created, stored, and transferred. evidence that address particular points
By Gregg Maryniak Often the accuracy of the information in the case, and take into account the
is not at issue, and the evidence may be content and context of the evidence.
When people think about the poten- properly admitted for a valid purpose, For example, consistent testimony by
tial for mobile devices to impact the such as: unrelated witnesses about a particular
energy world, what often comes to mind event can indicate reliability.
are things like using one’s cell phone • for the truth of the matter Chain of custody. Documenta-
to remotely control home systems, like asserted tion for each piece of evidence should
heating, cooling, and lights. These are • to show knowledge, notice, or be created and maintained to record
certainly useful gadgets, but probably intent each step in the digital evidence
don’t rise to the level of transformational • habit life cycle to the extent practicable.
change. However, the proliferation of
• motive, intent, scheme, or plan Thereafter, issues relating to chain of
small mobile devices is now outpacing
• whether the alleged acts actually custody and the need to maintain care-
traditional desktop and laptop com-
puters, and we are seeing technology
occurred ful documentation of the collection
develop in new directions to keep pace • mental state and maintenance of digital informa-
with market needs. As mobile custom- • attitude tion must be addressed. Actions taken
ers worldwide demand improved battery • exact numbers or patterns, prob- in response to or consistent with an
life, this demand is helping spur better abilities, and trends. email, text message, or social media
energy storage systems (such as the use post can provide indicia of reliability.
of nanotechnology to make high surface Likelihood the Evidence Has Been If the purported author/sender was the
area electrodes). Altered or Falsified only one likely to know the informa-
The transformational impact created Has a challenge to the authenticity tion in a message, it may be assumed
by cell phones and other small mobile
of the evidence been made? If fraud, to be accurate.
devices may well be the driving trend
observed by Jonathan Koomey of Stan-
forgery, or destruction of evidence
ford University, which is now referred to is a central issue in the case, a jury A Deeper Understanding of New
as Koomey’s Law. Koomey related the would decide issues about electronic Technologies Is Needed
increase in energy efficiency in comput- evidence just as it would in a simi- In the digital age, there are many
ing to the decrease in energy cost per lar case involving paper documents. It ways to cast doubt on the authentic-
computation. Mobile devices by virtue of will be necessary to consider whether ity of electronic evidence. Although
their reliance on small batteries will push the information system was cor- the courts continue to grapple with
this trend beyond present limits. rectly designed, configured (firewalls, the authenticity of digital evidence,
audit and logging), and maintained including email, websites, website
Gregg Maryniak is the chair of energy
(patches). Evidence of the informa- information, and social media, most
and environmental systems at Singular-
tion security safeguards in place is courts—on whatever grounds—have
ity University.
one aspect of a showing that the data found the information admissible.
have not been changed or falsified. Indeed, notwithstanding the genuine
was generated. The rigor with which Many computer systems have sophis- risk of unreliability due to hack-
an evidentiary foundation must be ticated audit logging systems to track ing or other malicious changes, the
established depends on the purpose and record information about users courts continue to admit such infor-
for which the electronic information and their transactions, as well as integ- mation into evidence. As the volume
is being offered into evidence, whether rity checks and information security of digital evidence continues to grow
there is any reason to believe the evi- built in to ensure the data are accurate, exponentially and its importance to
dence is not authentic, and the extent important for authenticating electronic the outcome of cases remains criti-
to which the data and information can evidence. Forensic analysis may be cal, a deeper understanding of the
be corroborated. required to assess the more sophisti- nature of these records will be required
cated aspects of device and information to make meaningful decisions about
Purpose for Offering the Evidence system operations. its authenticity. Sound and informed
Decisions about admissibility will usu- information governance practices
ally turn on the purpose for which the How Can the Electronic Evidence Be must be adopted to determine whether
evidence is being offered. The complex- Corroborated? the evidence fulfills the legal require-
ities of modern business information Corroboration is an essential tool ments for authenticity, reliability, and
systems and global communications for the successful presentation of integrity.u

Published in The SciTech Lawyer, Volume 9, Number 3, Winter/Spring 2013. © 2013 American Bar Association. Reproduced with permission. All rights reserved. This information or any portion
thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.