Well Worth a Read – George Paul’s “Foundations of Digital Evidence”

George Paul says that digital record keeping has caused an evidentiary crises of societal proportions and that it is our responsibility, as lawyers, to find a resolution – to find a way of effectively testing the authenticity of digital records so they do “what people expect them to do,” and so that truth is found and justice done.

The American Bar Association published Paul’s “Foundations of Digital Evidence” in 2008. Paul is an American trial lawyer from Arizona with a deep interest in the evidentiary implications of digital information. He was kind enough to provide short interview this week, and explained that this interest was sparked by “fooling around” with digital photography in the late 1990s. Apparently Adobe Photoshop’s power to obscure printed images left Paul asking questions about authenticity that eventually led him to connect with a number of leading information security professionals and, several years later, put pen to paper.

The core of Paul’s Foundations is a 150 page dissertation on digital evidence. Paul argues that the existing rules of evidence have not led American courts to sufficiently test digital evidence before admitting it as evidence. He also proposes a new regime for testing digital evidence – one that demands proof of system reliability.

How is the law of evidence flawed?

Paul starts with evidence law’s preference for original records and argues it is both irrelevant and dangerous. It is irrelevant because digital records are comprised of “pure information” and can be modified without creating any evidence of change (metadata aside). It is dangerous because it invites inflated assumptions about a document’s authenticity, a problem aggravated because we often proffer digital information after it has been recorded on paper. That is, we proffer a physical rendition of digital information that appears to have integrity. Paul argues “trivial showings” based on inspection of paper documents should not support admissibility:

The modern electronic file lives not as an artefact one can hold in one’s hand, but as pure information that can be reordered at will. Accordingly, without more, having a witness look at the order of the words on the first page of a recently printed electronic file does not logically entitle that witness, or our culture either, to make any assumptions whatsoever about the integrity of the order of the words in the middle of the document on page 54.

Paul also argues that the hearsay doctrine ought to bar the admission of computer-generated records – the output of computer processing – without special assurance of trustworthiness. He demonstrates, with case citations, that American courts have largely failed to recognize the risk posed by admitting out of court “statements” made by computers, often by utilizing the business records exception in a manner treats computer-generated as far more reliable than they deserve to be treated given the commonplace challenges in processing data: “Just because businesses rely on faulty computer programs does not necessarily mean that courts should follow suit.”

Paul’s alternative framework for testing digital evidence

Paul argues that we should replace the business records concept with a doctrine of admissibility that is based on “system reliability.” He says that a proponent of a computer generated record should be required to demonstrate that the system producing the record is likely to produce an accurate record and that the system is designed to produce records with integrity. Some relevant questions:

What was the environment of the of the system? Where was it? What is the history of the system? Is it off-the-shelf or custom-designed or implemented? Is there any evidence of malfunction on other occasions? How much of a role does human input cause in the statement that is output? Is there the possibility of configuration error? Critically, is there a theory of mistake, or error, and a demonstrated problem (akin to an assertion there was an 9-foot-tall man?) or, is there just a complaint: “How do I know this works.”

In recognition that this burden may be costly to discharge, Paul suggests that Courts apply a broad discretion to decide exactly how much of a foundation will be required in each case. In our interview he also explained that good record keeping is important in reducing the costs of litigating foundational issues. He says businesses should implement techniques that rely on technology like hashing and encryption to make business records with naturally strong foundations. Foundations includes a basic description of these “eunomic techniques” (which are about good information governance). Paul and other collaborators will deal with them in greater detail in a follow-up publication on digital record keeping which is due to be published in 2010.

Foundations is significant

Paul’s effort has received high praise from United States Magistrate Judge John Facciola, well-known for his leadership on e-discovery issues. In his Foreword to Foundations, Facciola says:

…this book serves as a remarkable, albeit demanding, intellectual exercise. It does not apologize for the need of its reader to spend some time trying to understand how computers work and guides the reader through that process as it affects evidentiary problems. It makes a most compelling case for the need for that understanding and for awareness of the reality that digital information, far from being inherently reliable, can be manipulated corrupted, and ;misused. The case it makes for rule changes based on that understanding and awareness is so well made that those who argue that no rule changes are needed will have to answer Paul’s arguments if they expect to be taken seriously. In that sense, the book is a watershed and demands the attention of those who hope to understand how courts and lawyers will have to engage in the most revolutionary and creative thinking to forge rules of evidence that will make sense in a society utterly dependent on digital information.

Indeed. Though Paul calls his book “a practical book about the new world of initial information,” Facciola rightly suggests that Foundations is not a “how to.” Paul’s advice is actionable in that it will root out your preconceptions about digital evidence and sow the seeds for new and important ideas. This is why Foundations is well worth a read.