Electronic Evidence FAQs: A Family Law Judge Weighs In

Q: Do I need a witness?

Some types of electronic evidence are self-authenticating with no need for a sponsoring witness. One example might be email communications that are contained within business records admitted under a business-records affidavit.

Many jurisdictions provide that a party’s production of a document in discovery authenticates that document for use against that party, with no further predicate necessary. If the opposing party has produced photos, text messages, or social media evidence, his or her production is self-authenticating for use at trial. A best practice is to Bates-label all discovery produced and received so that you can quickly demonstrate at trial whether a key document has been authenticated through production by the opposing party in discovery.

Under the traditional reply-letter doctrine, a letter received in the due course of mail purportedly in answer to another letter is prima facie genuine and admissible without further proof of authenticity because it is unlikely that anyone other than the purported writer would know about and respond to the contents of the earlier letter. This old-fashioned doctrine has been adapted and applied to authenticate emails, text messages, and instant messages.

The Federal Rules of Evidence were amended in 2017 to add two new methods for self-authenticating electronic evidence. New Rule 902(13), “Certified Records Generated by an Electronic Process or System,” allows a party to self-authenticate a record generated by an electronic process or system that produces an accurate result as shown by a certification of a qualified person. New Rule 902(14), “Certified Data Copied from an Electronic Device, Storage Medium, or File,” provides for the authentication of data copied from an electronic device, storage medium, or file if authenticated by a process of digital identification as shown by a certification of a qualified person. Although these new rules still require that some qualified person certify that the evidence meets the requirements, they could save the expense of having a live witness at trial.

Q: What kind of witness can authenticate this evidence?

To authenticate evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is. If evidence is not self-authenticating, authentication may be done through the testimony of a witness with knowledge that the evidence is what it is claimed to be. Witnesses generally possess personal knowledge relevant to authentication in one of two ways: the witness recognizes the distinctive characteristics of the evidence or the witness has knowledge of a reliable process to confirm the evidence.

Distinctive Characteristics

If the evidence is readily identifiable, a witness can authenticate it through direct testimony that the witness recognizes identifying characteristics. For example, Rule 901(b)(4) refers to the appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances.

This is the primary method used to identify emails, text messages, social media, and other evidence that has a distinctive appearance. For example, a witness might testify that he or she knows the text messages were from the sender because the grammar, capitalization, slang, nicknames, or emojis used were consistent with that sender’s style. A witness might testify that when a meeting was arranged through text messaging, the purported sender showed up, or that the purported sender had information about the children that was communicated via text message. All of these could be distinctive clues that the evidence is what it is claimed to be.

Chain of Custody

Some evidence is not capable of being recognized by a witness. For example, a witness could not reliably testify at trial that one pile of cash is different from another or that a specific sample of drugs is in fact the relevant evidence in the case. A witness who can testify to a chain of custody may be able to authenticate fungible evidence or evidence that relies on analysis. For example, a live witness may testify that, based on reliable sample logging and tracking procedures, the urine sample taken from the opposing party was the same urine sample tested at the lab and that it is the same sample that tested positive for illegal drugs. Another area where chain-of-custody authentication testimony is frequently necessary is the forensic imaging and analysis of cellphones or hard drives.

Reliable Process

What if there is no witness with personal knowledge of the occurrence? With the growing use of home surveillance cameras, parties increasingly need to authenticate and admit video taken when no witness was present. The rules offer a method for authenticating evidence through testimony describing a process or system and showing that it produces an accurate result. If a witness can testify that a process or a system produces an accurate result, the evidence may be authenticated even if the witness has no personal knowledge of the event itself. For example, a security video may be authenticated through witness testimony about how the equipment functions, whether the equipment was working properly, whether it produces reliable output, how the media was retrieved and processed, and whether the resulting exhibit was tampered with.

Q: How much does the witness have to know?

In our system, the judge functions as the initial gatekeeper of the reliability of the evidence, with the jury assessing the weight and credibility of admitted evidence. The test for authenticating and admitting electronic evidence is whether the proponent of the evidence has offered a foundation from which the jury could reasonably find that the evidence is what the proponent says it is. The court need not find that the evidence is necessarily what the proponent claims, but only that there is sufficient evidence that the jury ultimately might do so. Jurisdictions differ as to how high this authentication hurdle is. This article will discuss the two more popular approaches—the skeptical Maryland approach and the more lenient Texas approach.

The Skeptical Maryland Approach

In Griffin v. State, 19 A.3d 415 (Md. 2011), the Maryland Court of Appeals (its highest court), addressed the authentication of a printout of a MySpace page. The opinion emphasized the anonymity of online sites and the ease with which anyone can create fictitious accounts. The Maryland approach is skeptical of social media and carries almost a presumption that information on the Internet is inherently untrustworthy. The court held that the potential for abuse and manipulation of a social networking site requires a greater degree of scrutiny. The court required witness testimony that closely linked the creator to the content, putting an increased burden on the proponent of the evidence to affirmatively demonstrate that the evidence is not faked.

The More Lenient Texas Approach

In Tienda v. State, 358 S.W.3d 633 (Tex. Crim. App. 2012), the Texas Court of Criminal Appeals also addressed the authentication of a MySpace page. Under the Texas approach, a social media exhibit can be admitted based on circumstantial evidence, taken as a whole, that could support a finding by a rational jury that the exhibit was created by the party. The burden then shifts to the opponent of the evidence, after it is admitted, to challenge the weight and credibility of the exhibit by offering evidence that it is a forgery. Under the Texas approach, the evidence is more likely to be admitted to be evaluated by the ultimate fact-finder. Another state has emphasized that the same uncertainties exist with traditional written documents—signatures can be forged, letterhead copied or stolen. Under the Texas approach, electronic evidence is not held to a standard higher than any other kind of evidence, and it should be evaluated under the traditional rules.

Best Practices

Even if your jurisdiction follows the Texas approach, you may draw a judge who is skeptical of electronic evidence. The best practice for ensuring admissibility of social media or Internet evidence is for the sponsoring witness to testify to three elements:

1. What was actually on the website?
2. Does the exhibit or testimony accurately reflect it?
3. If so, what distinctive characteristics show that it is attributable to the party?

Q: What Are Common Predicates for Electronic Evidence?

Emails and Texts

Distinctive characteristics include the contents, substance, internal patterns, or other distinctive characteristics, taken in conjunction with circumstances. These distinctive characteristics could include grammar, slang, capitalization, or punctuation used by the sender; topics that the person would have known; nicknames; trade inscriptions such as email signature blocks; and any other clue that links the email with the sender. Case law has held that mere testimony that an email originated from an email address is insufficient to authenticate it—some additional circumstantial clues are required.

Calendars, Diaries, and Logs

These items are frequently created by a client, so it is straightforward to have the client testify that the document is accurate. It is more difficult to overcome a hearsay objection to this evidence, which is likely a summary of the client’s testimony.

Social Media and Internet Sites

As discussed above, the Maryland and Texas approaches to authentication determine whether a website exhibit may be admitted solely through testimony that it is an accurate copy of something from the Internet or whether additional testimony must be offered to link it to the purported creator. In one Texas case addressing the admission of an online personal ad, the court held that it was sufficient for authentication that the exhibit was an authentic copy of the online posting and that whether the party placed the ad did not go to the authenticity of the exhibit, but, rather, to the underlying issues in the case. The Maryland approach would require that a witness have personal knowledge of distinctive characteristics linking the exhibit to the creator.

Audio and Video Recordings

Parties who record audio or video with a cellphone may testify that they made the recording and recognize the voices or scene and that the recording is accurate. Surveillance camera footage may need to be authenticated through testimony about how the equipment works and whether it produces a reliable result.

Q: What are some other important laws affecting electronic evidence?

Stored Communications Act

Attorneys frequently want to obtain social media evidence directly by sending a subpoena to the company for the opposing party’s account. Unfortunately, the federal Stored Communications Act prohibits this. Under the Act, a social media website may not disclose the content of user communications in response to a civil subpoena. If you want social media evidence, you will have to obtain it directly from the account holder through the discovery process or from some other source that can authenticate it under the tests described above.

Illegally Obtained Evidence

Clients will often want to “help” themselves by digging up evidence by any means necessary—going through a spouse’s phone, hacking into email, using keystroke loggers, installing apps to monitor a phone, or recording conversations. This conduct can be a crime or lead to statutory damages under state and federal laws that include wiretap laws, computer fraud and abuse laws, and stalking/tracking laws. An attorney who uses or discloses evidence a client obtained through wiretapping could be exposed to personal criminal or financial liability. These laws are beyond the scope of this article, but every family law practitioner needs to be familiar with them in order to recognize and appropriately confront illegally obtained evidence.

Conclusion

Every family law practitioner needs to be comfortable authenticating and admitting electronic and social media evidence. This evidence is relevant in almost every proceeding and is often the most raw, accurate, and persuasive information that can be presented.