Going from analog to digital world has meant significant change in virtually every aspect of modern life and certainly in modern law practice. For the better? Maybe. But different? Absolutely. No longer can you count on believing what you see.
Remember the good old days? The days when the world was “analog.” We had records made out of vinyl and telephones that really “dialed.” Pictures were worth a thousand words. And generally, what you saw was what you got. Press the fast-forward
button of life to 2005, and everything has changed.

Evidence used to exist primarily in two forms: as physical evidence— objects, paper, models, charts, drawings, photographs; and as oral evidence—testimony and transcripts. Certainly with paper, what one generally saw were the physical four corners of a document. And while some text may have been redacted for reasons of privilege or other inadmissible factors, what you saw on the page was all there was.

Today, an increasing percentage of information produced in response to a typical discovery request is solely in digital form. The range of sources of such information continues to broaden as more digital devices, gizmos and gadgets appear on the market. Press the rewind button of life and go back to 1995. Who would have predicted that a criminal case could turn on a downloaded speech stored on a small white digital “music” player? Even today, would most lawyers consider adding “MP3 or other digital audio/music players” to a discovery request? Producing an iPod in response? Who would have thought it possible? Welcome to electronic discovery.

With the rise of newer digital data distribution approaches, such as “podcasting” ( i.e., broadcasting informational content via the Internet in a format readable and playable by MP3-compatible music players or in a WAV or similar digital audio-format playable on any PC platform.), the challenges for litigators trying to cover their bases in discovery becomes infinitely more complex. Digital evidence comes from a panoply of sources. These include the “traditional” source: computer hard drives and backup media, as well as many more: e-mail; chat-room logs; Web pages; databases stored locally or virtually; wireless devices such as cell phones and PDA-enabled smartphones; flash drives; digital film cards; digital cameras; and video recorders with internal memory; digital audio recorders; digital music players; media such as floppies, CDs, DVDs, and magneto-optical (MO) disks. Dorothy would now chant, “lions and tigers and 975 varieties of bears, oh my!”

The proliferation of digital evidence will only further expand. The challenge facing lawyers and courts today is in dealing with the incredible ease with which digital evidence can be altered, destroyed, or fabricated in a way that can be so convincing that even experts can be duped. We’ve all seen the computer-generated effects in films like Shrek and the recent Star Wars epics. Though these kinds of high-level digital gymnastics were clearly executed by experts, credible and convincing digital data alterations can be made by rank novices at home using free downloaded software. With such ease of alteration, how can digital evidence be trusted, much less admitted by a judicial body?


Let’s go to the source. The Federal Rules of Evidence cover duplicate digital evidence and its authentication. For admissibility in court, the evidence should possess a chain of custody to show that no inadvertent or purposeful contamination occurred. Preserving evidence to ensure its integrity proves important to the court’s consideration of its originality when traditionally under “best evidence” rules, originals are required or preferred. Therein lies the rub. What does “original” mean in the context of digital evidence, much of which is in a constant state of flux? Paper is paper, and although Wite-Out® “technology” can obfuscate original text, detection is hardly scientifically demanding.

The Federal Rules of Evidence provide significant guidance regarding electronic evidence. Federal Rule 1001(1) defines writings and recordings to include magnetic, mechanical, and electronic methods of setting down letters, words, numbers, and their equivalents. Federal Rule 1001(3) states, “If data are stored in a computer or similar device, any printout or other output readable by sight, shown to reflect accurately, is an ‘original.’”

Fed. R. Evid. 1003 provides that “a duplicate is admissible to the same extent as an original unless (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original.”

Fed. R. Evid. 1001(4) defines duplicate as “a counterpart produced by the same impression as the original . . . by mechanical or electronic rerecording . . . or by other equivalent techniques which accurately reproduces the original.”

Fed. R. Evid. 901(a) provides that “the requirement of authentication or identification as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.”

Example nine of Fed. R. Evid. 901(b) states, “Process or system. Evidence describing a process or system used to produce a result and showing that the process or system produces an accurate result.”

Title 42 U.S.C. § 2000aa-7, covers digital evidence under definition (a), “documentary materials,” which states, “materials upon which information is recorded, and includes, but is not limited to . . . other mechanically, magnetically, or electronically recorded cards, tapes, or discs.”

Original evidence or a derivative of the original, either electronic or printed, therefore, proves admissible if the handling, duplication, and authenticity provides assurance to courts that the evidence is as claimed.

So what does this mean for the erstwhile self-proclaimed techno-peasant litigator struggling to craft the basic facts of a case into a persuasive argument—and suddenly the entire balance of the case is hinging on an extraordinarily geeky line of testimony explaining the bits and bytes of computer forensics related to data acquisition, maintenance of the chain of custody, the authentication approach, and the ability of the trier of fact to comprehend the significance of a failure of an MD5 hash table comparison?

It’s enough to make even a dyed-in-the-wool digital cognoscenti’s propeller hat spin. Welcome to discovery in the twenty-first century. The complexity we see today may be just the tip of the iceberg.

The challenge facing lawyers and courts today is in dealing with the incredible ease with which digital evidence can be altered, destroyed, or fabricated

Practice tips

Reams of commentary have been written on this subject. Whether focused on criminal or civil proceedings, journals such as the International Journal of Digital Evidence ( www.ijde.org), or internal procedures employed by crime-fighting agencies such as the FBI or Interpol, the key is education. Guidelines for today’s litigators scrambling to build electronic discovery knowledge might include:

1. Understand and identify the range of digital data sources and forms ( i.e., U.S. attorneys now routinely ask for not only “electronic documents,” but also the hidden metadata below the visible surface of the document file). See also Hot Tips, page 7.

2. Understand the data preservation process. For example, many people are unaware of the fact that merely turning a computer off or on can substantially change the state of evidence subject to a discovery request or order. Failure to suspend use of a metadata removal utility would have the same effect.

3. Understand the data acquisition process. This means how to evaluate the credibility of computer forensic experts, knowing standard practices for computer forensic acquisition of data, maintenance of an unassailable custody chain, framing search methodologies that explore relevant materials of probative value, and forestall objections based on overbroadness.

4. Understand how federal and state rules of evidence and procedure frame the requirements for admissibility of digital evidence. Rather than a rote recitation of the magic words to show compliance with best evidence rules, establishing the foundation for digital evidence admission, or attacking it, can become the focus of the case, stealing the attention from the core facts in question. Do the homework, choose the right expert, prepare, rehearse, get second opinions—be ready to delve deeper into the bits and bytes world of the computer geek than you ever imagined.

5. E-discovery resources and educational opportunities abound: CLE programming, articles, seminars, and more are available everywhere. Never succumb to the temptation of sending one’s paralegal as an emissary with the mission of coming back to the firm and “filling the rest in.”

With regard to digital evidence, its discoverability and admissibility, lawyers, regardless of their level of technical expertise or savvy must learn and learn fast. Failure to do so will result at best in professional embarrassment and, at worst, in costly sanctions, the exclusion of key evidence, and lost cases. Digital hocus pocus is real, accessible to everyone, and a fact of life in the “iPod era.” Clinging rotely to traditional discovery practice is a recipe for disaster for today’s litigator. However, for those who “get it,” the range of weapons available in the trial lawyer’s arsenal multiply manyfold. Through best interpretation and application of traditional evidentiary practice and procedure, a new class of digitally enabled super-trial lawyers has emerged and will routinely prevail. FA

Ross L. Kodner is an attorney and founder of Milwaukee's MicroLaw, Inc., an international legal technology consultancy for law firms and legal departments. He educates lawyers and legal professionals about issues relating to the practical impact of technology on litigation and can be reached at rkodner@microlaw.com.

Published in Family Advocate, Volume 28, No. 3, Winter 2006. © 2006 by the American Bar Association. Reproduced with permission. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or stored in an electronic database or retrieval system without the express written consent of the American Bar Association.