Admissibility of Evidence from Electronic Sources

Admissibility of Evidence from Electronic Sources

MySpace, Facebook Evidence Hub

Dramatic Changes in Electronic Discovery
In 1999, judicial resistance to webpage evidence that might have been altered was so great that it was outright excluded
By 2007 its authenticity was deemed to be presumptively correct.
Recent surveys confirm that more than 90 percent of all documents produced since 1999 were created in digital form.
Surprisingly, many attorneys fail to do any electronic discovery because of concerns that it is costly, time-consuming and complicated. The irony: It is usually dramatically cheaper to conduct discovery electronically.
New computer forensic techniques allow the cost effective and safe recovery of evidence normally invisible to the user. What used to cost tens of thousands of dollars can now be done for less than $5,000 using trained computer forensic examiners.
Law firms are now seeking computer-generated evidence, especially in cases related to defamation, trade secret and intellectual property theft, sexual harassment in the workplace, fraud, breach of contract, divorce proceedings and spoliation of evidence. Even in small personal injury auto cases, defense attorneys are going after e-mail and other electronic evidence related to wage and injury claims.
Federal Rules of Civil Procedure
Through Rule 34(a), Congress added electronically stored information (ESI) as a category of discoverable information.
To ensure that this amendment maintained its relevance as new technologies are invented, ESI was defined to be “writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations stored in any medium from which information can be obtained.”
By purposefully using the language, “in any medium,” in the future, the federal courts can require data from technology not even invented yet.
The corresponding Federal Rule 34(b) measure, passed at the same time as Federal Rule 34(a), allows the requesting party to determine the form in which evidence is presented.
Maybe a paper printout is enough to meet your goals in a particular instance.
In other circumstances, you may decide that the electronic version must be produced in order to include all background and transmission information.
Often times, the full electronic record will be the preferred choice of attorneys and clients alike as a hard copy will not tell the complete story behind a piece of evidence.
Only with the information that is stored on a computer or other electronic device will you be able to extract the time at which a particular transaction occurred, any information deleted from the current text, or possibly the date and time at which an online correspondence occurred.
What is Electronic Discovery
Electronic discovery (also called e-discovery) refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case.
E-discovery can be carried out offline on a particular computer or it can be done in a network.
Examples of E-discovery Evidence
text, images, calendar files, databases, spreadsheets, audio files, animation, Web sites (i.e Myspace, Facebook, YouTube, E-Bay etc.) and computer programs.
malware such as viruses, Trojans and spyware can be secured and investigated.
Email can be an especially valuable source of evidence in civil or criminal litigation, because people are often less careful in these exchanges than in hard copy correspondence such as written memos and postal letters.
Phone Records
E-Z Pass and SunPass Records
GPS Records
Importance of E-Discovery
The nature of digital data makes it extremely well-suited to investigation.
Digital data can be electronically searched with ease, whereas paper documents must be scrutinized manually.
Digital data is difficult or impossible to completely destroy, particularly if it gets into a network. This is because the data appears on multiple hard drives and because digital files, even if deleted, can be undeleted.
The only reliable way to destroy a computer file is to physically destroy every hard drive where the file has been stored.
What to do when Computer Evidence May be Relevant
Recent case law has helped define procedures that counsel should consider when computer evidence may be relevant:
1. Send a preservation letter.
2. Appoint a neutral forensic expert.
3. Prepare an order detailing the inspection protocol.
4. Hire a forensic expert to acquire and preserve computer data for examination.
5. Examine and analyze image data files for evidence.
6. Document the findings.
See Playboy Enterprises v. Welles, 60 F.Supp.2d 1050, 1054 (S.D. CA 1999); Simon Property Group v. mySimon, Inc. 2000 WL 963035 (S.D.); Trigon Insurance Company v. United States, 204 F.R.D. 277 (E.D. Va 2001); and Rowe Entertainment v. The William Morris Agency, 2002 WL 63190 (S.D.N.Y.).
Cyberforensics
Computer forensics, also called cyberforensics, is a specialized form of e-discovery in which an investigation is carried out on the contents of the hard drive of a specific computer.
After physically isolating the computer, investigators make a digital copy of the hard drive. Then the original computer is locked in a secure facility to maintain its pristine condition.
All investigation is done on the digital copy.
Admissibility
To ensure admissibility, the lawyer must focus on five issues:
Investigation
Discovery
Authentication
Hearsay
Best Evidence Rule
Investigation;
Locating electronic evidence will be dependent on several factors.
If the investigator is a state official, her/his searches will be governed by Fourth Amendment strictures,
Private actors will be restricted by state privacy and electronic communications [wiretap] laws.
Privacy principles will govern when one spouse ‘searches’ a partner’s computer, or when an employer checks that of an employee.
The same is true when accessing e-mails or similar electronic communications.
Once litigation has commenced, subpoena power and other discovery tools come into play. To this end, the Federal Rules of Civil Procedure come into play
Discovery;
Federal Rule of Civil Procedure 26(a) requires a party to disclose all documents, including electronically stored information that the party may use to supportits claims or defenses without awaiting a discovery request. Fed.R.Civ.P. 26(a)(1)(A)(ii)
Rule 26(b)(2) only limits the discovery ofelectronically stored information from sources that the party identifies as not reasonably accessible because of undue burden or cost. Fed.R.Civ.P. 26(b)(2)(B)
Authentication;
The evidence (e-mail, webpage, digital photograph) must be “authenticated,” or shown to be the proof at issue “by evidence sufficient to support a finding that the matter in question is what its proponent claims.”
Federal Rule of Evidence 901(a)
Requires that evidence be authenticated before a trier of fact will be permitted to consider the evidence.
Usually taken in the form of testimony by an individual with direct knowledge that the produced evidence is what is purports to be
Witness who testifies on the authenticity does not need to present any special qualifications or expertise on the programming or technical operation of the program, but merely requires first-hand knowledge of the program or technology presented
General rule: inaccuracies or suspicions of alteration of the electronic record are an issue for the trier of fact to consider when weighing the evidence, not in determining admissibility
Example: Digital photographs
Although easily subject to manipulation with readily availablecomputer software programs, the evidentiary standard for admissibility is low.
The photograph may be authenticated by the photographer or someone familiar with the scene depicted; and where the digital photo has been enhanced or is a converted image, testimony of an expert is an essential addition to explain the process used and the proven track record of generating reliable results.
Challenges to Authentication:
Questioning if the evidence was altered or manipulated after they were created and raise issues relating to the chain of custody of the evidence
If a specific programming function is introduced, a party may challenge the reliability of this function
A party may question whether the author’s identity of the post can definitely be attributed to the defendant
Account was fraudulently hacked into
Hearsay
Federal Rules of Evidence, Rule 801(c), Out of court statements being introduced for the truth of the matter asserted.
Hearsay Exclusions and Exemptions
Rule 801(d)(2), Admission of a party opponent
Rule 803(2), an excited utterance
Rule 803(1), present sense impression(consider, in this regard, instance messages, text messages, and e-mails)
Rule 803(3), a declaration of state of mind
Rule 803(4), one made for purposes of medical diagnosis or treatment
declaration against interest
business record
E-Discovery that is NOT Hearsay
Records generated by a system or process, such as a print-out of dialed telephone numbers or a toll booth receipt showing the date and time of payment, do not implicate the hearsay rule, as there is no assertion and there was no ‘person’ who originated the data.
These records are the products of a process, and require authentication of the process’ mechanism and reliability.
Chatroom dialogues (often utilized in internet sexual enticement prosecutions) will contain assertions not only by the accused but by others in the exchange. The latter will not be hearsay, as they are not admitted to prove the truth of what the third parties stated, but to provide context to the defendant’s words.
Best Evidence Rule
Federal Rules of Evidence Rule 1002, To prove the content of a writing, recording, or photograph, the original writing, recording, or photograph is required, except as otherwise provided in these rules or by Act of Congress.
Federal Rules of Evidence Rule 1003, A duplicate is admissible to the same extent as an original unless (1) a genuine question is raised as to the authenticity of the original or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original.
Because the contents of the writing are at issue, this rule requires production of an original. As duplicates are approved under the rule, however, this should rarely be a barrier to admission.
Limitations on E-Discovery
U.S. v. Comprehensive Drug Testing, Inc., (9th Cir. 2009).
This case is about a federal investigation into steroid use by professional baseball players.
Arising from the BALCO-related seizure of drug tests and urine samples of hundreds ofmajor league baseballplayers obtained in the supposedly confidential 2003 drug testing program, e.g. A-Rod, Big Papi, Sosa, etc.
More generally, however, it's about the procedures and safeguards that federal courts must observe in issuing and administering search warrants and subpoenas for electronically stored information
the Ninth Circuit's requirements imposed on search warrants for digital evidence:
Magistrates should insist that the government waive reliance upon the plain view doctrine in digital evidence cases.
Segregation and redaction must be either done by specialized personnel or an independent third party.If the segregation is to be done by government computer personnel, it must agree in the warrant application that the computer personnel will not disclose to the investigators any information other than that which is the target of the warrant.
Warrants and subpoenas must disclose the actual risks of destruction of information as well as prior efforts to seize that information in other judicial fora.
The government’s search protocol must be designed to uncover only the information for which it has probable cause, and only that information may be examined by the case agents.
The government must destroy or, if the recipient may lawfully possess it, return non-responsive data, keeping the issuing magistrate informed about when it has done so and what it has kept.
Examples of E-Discovery is the Court Room
In Tampa
Jordan Valdez, a Davis Islands teenager charged as an adult in the hit-and-run of a homeless woman
Detectives got a search warrant for the Murano and took a SunPass transponder and paint chips from the vehicle.
With the SunPass transponder, detectives were able to determine that the Murano was at the Selmon Crosstown Expressway's Plant Avenue toll plaza at 8:24 p.m. Feb. 8. The driver of the Murano could not be identified from the toll booth's security cameras, but there was no crash damage visible on the vehicle.
Police also searched the Valdez home and seized three computers and a cordless phone. Police said at the time there might be information on the hard drives that could be used to help build a case against the teenager.
Craig’s List Killer
Boston police were able to linkMarkoff to the email address used torespond to the Craigslist ads placed by his victims, link the IP address of his computer to that email address, and track his movements from his Blackberry service providerto the hotels where the robberies and the murder of Julissa Brisman took place.
DUI
Two weeks after Joshua Lipton was charged in a DUI crash that seriously injured a women, the college student attended a Halloween party dressed as a prisoner.
Someone posted pictures of him from the party labeled “Jail Bird,” on their Facebook page.
The Prosecutor used the pictures to paint Lipton as an unrepentant partier who lived it up while his victim recovered in the hospital. The Judge agreed and sentenced him to two years in prison.
Violation of Probation
Defendant Pressly was sentenced to a lifetime of probation. As part of the deal, he promised not to consume or drink any substance containing alcohol, and to not possess, use or have personal access to any computer or similar equipment that has internet capability without prior written permission of his Probation Officer.
Pressly’s wife’s MySpace page contained a picture of Pressly holding a beer with the caption that said, “Me and my wife.”
The Court found that the picture was relevant to whether Pressly violated the terms of his probation.
Civil Suit
A man filed the lawsuit after he suffered whiplash as a result of two car accidents in 2001 and 2003. In addition to other losses, he said the injuries affected his social life, claiming his friends no longer phoned him to go out because he continuously declined their invitations.
However, defense lawyers produced evidence from the man's Facebook profile that suggested his social life had not been affected at all. Postings made on his page showed that he hosted and attended parties, went to friend's cabins, and several other activities.
After being confronted with the evidence, the man shut down his Facebook page.
He was awarded $40,000 in general damages and suffering, however the judge rejected his claims which sought up to $1.3 million.
Divorce
Confessions involving an individual’s social life;
Photos with children in places they ought not be;
Photos of parties to the case consuming liquor or using drugs;
Income and employment information; or
Inappropriate sexual content
Don’t let E-Discovery Harm your Case!
Warn you Clients of the admissibility of:
Phone Records
Text Messages
Calls to Inmates
Facebook and MySpace Page
Friends
Pictures
videos
Comments
Status
Setting your account to Private does not prevent e-discovery. A Facebook spokesperson said: “We may be required to disclose user information pursuant to lawful requests, such a subpoenas or court orders, or in a compliance with applicable laws.”
Twitter
E-Bay
E-mails
Sent and received
Including deleted e-mails
Visiting inappropriate websites
Online Banking
SunPass and EZ Pass
GPS system
Warn your Witnesses
E-Discovery can impact their credibility
Q & A Session

Page 1 of 8