Gone, But Not Forgotten: Evidence from the Archived Internet

Most types of digital evidence can be easily authenticated by testimony of one who participated in creating the evidence. For an email, testimony by the author ordinarily is sufficient to authenticate it; testimony by the recipient may also support its authenticity. Alternatively, courts may consider emails to be self-authenticating business records, so long as the requirements of Federal Rules of Evidence 902(11) and 803(6)(A)(C) are met, as shown by a certification from the records' custodian. To be considered business records under these rules, the emails must be created contemporaneously by one “with knowledge,” they must be kept in the course of the business's regularly conducted activity, and the writing of emails must be a regular practice of the business's activity.

Where digital evidence is not self-authenticating and the author is unavailable, or where the author challenges the authenticity of the evidence, the proponent must resort to other means of authentication. Testimony from one who saw the author create a document is strong authenticating evidence. Circumstantial evidence, such as a message's inclusion of an email address associated with the purported author, contents of a message that connect it to the purported author, or similarities to authenticated specimens from the purported author all indicate authenticity. Expert testimony too may be useful for authenticating digital evidence. An expert may use the Internet Protocol address associated with an email to trace it back to a device that the purported author commonly used, or refer to metadata associated with an electronic document to ascertain its author and other identifying information.

What Is the Wayback Machine?

As we have discussed, to obtain evidence of how a Web page looked in the past, litigants commonly turn to the tool known as the Wayback Machine, a creation of the nonprofit Internet Archive. But what is it, exactly?

The Wayback Machine uses automated software to “crawl” the Internet, retrieving snapshots of publicly available web pages. Data retrieved by the crawlers is “donated” to the Internet Archive, which preserves it and makes it accessible through the Wayback Machine. Individuals also can prompt snapshots to be archived by typing a website's Universal Resource Locator (URL) into the Wayback Machine and clicking “Save Page Now”; these snapshots, too, become part of the Wayback Machine.

Importantly, the Internet Archive stores snapshotted Web pages on its own servers, so the data exists independently from the original source. As such, the snapshot remains unchanged, even if the website from which it originally was retrieved is edited or removed. But the technology has some limitations. For instance, the Wayback Machine captures the text of Web pages, but it does not always render images accurately. And some historical Web pages may be unavailable because they are blocked to crawlers.

Wayback Machine users can type in a URL, select a date, and view the website's pages as they existed on that date. When a website has been incompletely archived, the Wayback Machine will supply the user with the snapshot with the closest available date. When a user prints an archived Web page from the Wayback Machine, the printout includes the Wayback Machine's banner at the top of the page. At the foot of the page appears a URL which notes the exact date and time at which the accessed Web page was archived.

The Challenge of Authenticating Evidence from the Archived Internet

To authenticate evidence from a website, courts and commentators have noted that three questions may arise:

1. What was actually on the website?
2. Does the offered piece of evidence accurately reflect what was actually on the website; and
3. If so, are the contents of that piece of evidence attributable to the author or website owner?

Proponents of evidence from the archived Internet face a particular difficulty in authenticating such evidence, relating to the second question. Unlike an email collected from an individual's computer, evidence from the archived Internet comes from a third party — the organization that runs the archive where historical versions of the Web page are stored, like the Internet Archive. As a result, the proponent must lay a foundation that the offered evidence itself is an accurate reflection of what existed on the Web page at a particular point in time. This requirement is separate from the authentication inquiry as to the accuracy of the contents of the Web page or its authorship.

One of the earliest cases to discuss the challenges associated with evidence from the archived internet, Novak v. Tucows, Inc., 73 Fed. R. Evid. Serv. 331 (E.D.N.Y. 2007), neatly defined this issue. The plaintiff in Novak alleged that the domain-registrar defendants had transferred the domain name for his online pet supply business in violation of trademark laws. Opposing defendants' motion to dismiss, the plaintiff offered evidence obtained from the Wayback Machine, including a printout that ostensibly showed a domain registration agreement from defendants' website during the relevant time period. He purported to authenticate the printouts with his own affidavit describing the Internet Archive and the Wayback Machine, how it collects data, and how that data is archived by date. The court observed that the information contained in the printouts was not corroborated by the owners or managers of the websites in question, and its accuracy therefore depended solely on those who collected and stored the information in the Internet Archive. Absent testimony or a sworn statement from an employee of the Internet Archive, the court held that the printouts had not been authenticated and were inadmissible.

Best Practices for Authenticating Evidence from the Archived Internet

Since the court's analysis in Novak, some courts have taken judicial notice of evidence from the archived internet. Pursuant to Federal Rule of Evidence 201, they have found that evidence from the Wayback Machine constitutes facts that “can be accurately and readily determined” from a source “whose accuracy cannot reasonably be questioned.” More commonly in reported cases, however, courts require the proponent of evidence from the archived Internet to offer testimony from a knowledgeable employee of the archive about the archive's operation and reliability to authenticate such evidence. This is particularly so in criminal cases where the government offers evidence from the archived internet in support of its case, likely because, as the Supreme Court held in Crawford v. Washington, 541 U.S. 36 (2004), the Sixth Amendment's Confrontation Clause bars testimonial evidence from being presented where opposing counsel did not have the opportunity for cross-examination.

In Bansal, the case involving pharmacy websites that distributed controlled substances, the government offered historical screenshots from those websites into evidence. The district court heard testimony from an employee of the Internet Archive, who described the Wayback Machine's crawler software and the Internet Archive's process of archiving Web pages. The witness also compared the offered screenshots with previously authenticated images from the same websites and described the reliability of the Wayback Machine screenshots, based on her personal knowledge. The district court found this testimony sufficient to authenticate the screenshots and admitted them into evidence. On appeal, the Third Circuit agreed with the district court's determination as to the screenshots.

In United States v. Gasperini, No. 16 Crim. 441 (NGG), 2017 WL 3140366 (E.D.N.Y. July 21, 2017), the defendant was charged with a variety of crimes surrounding a “click fraud” scheme to fraudulently inflate the number of views for online advertisements, thereby collecting unearned “per-click” payments from advertisers. The government offered copies of Web pages obtained from the Wayback Machine, which purportedly showed websites operated by the defendant displaying advertisements that were the subject of the charged crimes. In a motion in limine, the defendant argued that the evidence was inadmissible because it could not be authenticated. The government responded that it intended to offer authenticating testimony from the Internet Archive's office manager as to the purpose of the Internet Archive and the Wayback Machine, its use of crawlers to gather and store copies of Web pages, the mechanism by which the dates of archived Web pages are recorded, how information is accessed via the Wayback Machine, and the accuracy of its records. The court concluded that such testimony could address the issues identified in Novak but reserved judgment on the issue until it heard the authentication testimony. At the jury trial that followed, the Internet Archive's office manager did testify, and the evidence from the Wayback Machine was admitted. The defendant was found guilty of one count of computer intrusion. The district court's ruling as to evidence obtained via the Wayback Machine is one of several issues raised in the defendant's pending appeal to the Second Circuit.

Conclusion

Where a criminal case involves information that exists — or used to exist — on a website, the archived Internet can play an important role. With tools like the Wayback Machine, litigants can access billions of historical web pages with the click of a button.

Proponents should not assume the court will take judicial notice of information from the archived Internet, nor can they rely on testimony from the person who accessed the archive. Rather, courts often require testimony from an employee of the archive from which the evidence was obtained, which should describe the process for collecting, storing, and accessing the information, sufficient to lay a foundation that the offered evidence accurately reflects the website's contents as of the relevant date. Novak, Bansal and Gasperini provide a useful guide for authenticating such evidence.

*****
Robert J. Anello, a member of Business Crimes Bulletin's Board of Editors, is a partner in Morvillo, Abramowitz, Grand, Iason & Anello PC. Jane E. Bobet is an associate with the firm.