New Rules for Electronic Records?

The Case

Vinhnee is a significant departure from this permissive approach. In this case, an American Express employee testified, as custodian of records, that the entries in computerized credit card records were made at or about the time of the transactions, and that the records were kept in the ordinary course of business pursuant to a regular business practice. Although the debtor did not object (he didn't appear for trial), the Bankruptcy Court sua sponte required additional foundational testimony regarding the computer, software and procedures to assure continuing accuracy of the data. After allowing American Express to supplement its proffered foundation, the Bankruptcy Court excluded the electronic records and entered judgment for the debtor, adding 'salt to the wound' by noting that American Express 'would have prevailed on one of two counts if the records had been admitted.' 336 B.R. at 440.

In affirming, the Panel focused on key differences between paper and computer records. The foundation for paper records 'is well understood and usually is easily established,' including custody, access and procedures to prevent tampering. In contrast, a paperless electronic record 'involves a difference in the format ' that presents more complicated variations on the authentication problem than for paper records.' Id. at 444-45. The logical questions extend beyond simple identification of the computer equipment and software. For instance, digital technology makes it easier to alter documents that have been scanned into a database, thereby increasing the importance of audit procedures to assure the continuing integrity of the records.

'It is becoming recognized that early versions of computer foundations were too cursory, even though the basic elements covered the ground,' the Panel observed. Therefore, to assure continuing accuracy of the records, the Panel required additional foundational testimony regarding:

• the proponent's policies and procedures for use of the equipment, database and programs;
• how access to the pertinent database is controlled and, separately, how access to the specific program is controlled;
• how changes in the database are logged or recorded;
• the structure and implementation of backup systems; and
• audit procedures for assuring the continuing integrity of the database.

For a 'generally serviceable modern foundation,' the court turned to Edward J. Imwinkelried, Evidentiary Foundations ' 4.03[2], which suggests the following 11-step foundation for authenticating computer records:

• The business uses a computer.
• The computer is reliable.
• The business has developed a procedure for inserting data into the computer.
• The procedure has built-in safeguards to ensure accuracy and identify errors.
• The business keeps the computer in a good state of repair.
• The witness had the computer read out certain data.
• The witness used the proper procedures to obtain the readout.
• The computer was in working order at the time the witness obtained the readout.
• The witness recognizes the exhibit as the readout.
• The witness explains how he or she recognizes the readout.
• If the readout contains strange symbols or terms, the witness explains the meaning of the symbols or terms for the trier of fact.

As suggested by the Panel's criticism of standard computer foundations, Vinhnee conflicts with many prior rulings by other courts. For instance, in United States v. Salgado, 250 F.3d 438, 453 (6^th Cir. 2001), the authenticating witness was not required to understand the maintenance and technical operation of the computer in which the records were created and stored. In contrast, Vinhnee sharply criticized the custodian's ignorance of the software used to create and maintain the records. Indeed, the Panel seemed to be offended by the depth of the custodian's ignorance, since the witness 'did not seem to know anything 'of consequence either about the software or the hardware.”

Although Vinhnee marks a break from the traditional approach, it did not appear completely out of the blue. At least one relatively ancient case commented on the need for a 'more comprehensive foundation' for computer records. United States v. Scholle, 553 F.2d 1109, 1125 (8^th Cir. 1977). Simi-larly, Vinhnee relied on the current version of the Manual for Complex Litigation, which notes that a judge should 'consider the accuracy and reliability of computerized evidence' and that a 'proponent of computerized evidence has the burden of laying a proper foundation by establishing its accuracy.' The Department of Justice, in its manual, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (July 2002) (DOJ Manual) (http://www.cybercrime.gov/s&smanual2002.htm), acknowledges that 'federal courts are likely to move away from [a] 'one size fits all' approach as they become more comfortable and familiar with computer records ' [T]he fact that a computer rather than a human being has created the record alters the evidentiary issues that the computer-generated records present.' ' V. A.

Significantly, Vinhnee conflicts with other views contained in the DOJ Manual. For instance, the Manual says the standard for authenticating computer records is 'the same for authenticating other records. The degree of authentication does not vary simply because a record happens to be (or has been at one point) in electronic form.' And again: 'From a practical perspective, the procedure for admitting a computer-stored record pursuant to the business records exception is the same as admitting any other business record.' ' V. C. 2.

The Government's View and Vinhnee

Perhaps the greatest difference between the government's view and Vinhnee is about who has the burden to establish integrity of the data. With significant support from prior cases, the government claims, in effect, a presumption that computer records are reliable. 'Absent specific evidence that tampering occurred, the mere possibility of tampering does not affect the authenticity of a computer record.' Id. ' V. B. 1. Vinhnee supports a contrary argument. The Panel decided that the fourth element of Professor Imwinkelried's proposed foundation, 'built-in safeguards to ensure accuracy and identify errors,' requires affirmative testimony regarding security procedures. The Panel also criticized American Express for failing to come forward with information sufficient to establish the accuracy of its computers in the retention and retrieval of the information contained in the documents. This is tantamount to requiring the proponent to establish a prima facie case of reliability as a prerequisite for authentication.

Conclusion

Vinhnee's undeniable logic may soon supplant the traditional lenient approach to authentication of computer records, bringing opportunity for some and risk for others. In criminal cases, it may offer defense counsel an opportunity to challenge the authenticity of computerized records, both through cross-examination and by calling their own experts.

On the other hand, it may create risk for businesses and individuals that rely on such records in litigation. Records management and e-mail archiving systems may be used proactively to prepare for potential litigation and meet the specific concerns articulated in Vinhnee. This sort of preparation may also significantly reduce the expense of producing computer records, once litigation is filed. Additionally, to try to satisfy the courts' increased appetite for sound forensic procedures, electronic data should be collected, processed, validated and presented as any other kind of evidence, with due care to help ensure the chain of custody, from acquisition to presentation in court.

Trial and in-house counsel should train themselves to be ready for the growing importance of hardware and software in the courtroom. The Boy Scout motto applies here as much as anywhere: Be Prepared.

David F. Axelrod ([email protected]) is a director in the Forensic & Dispute Services practice of Deloitte Financial Advisory Services LLP. A former Assistant U.S. Attorney and law firm partner, his practice includes corporate investigations, assisting in the implementation of corporate compliance programs, electronic discovery and other litigation support.

A recent decision by a Ninth Circuit Bankruptcy Appellate Panel rejected the prevailing standard for authenticating electronically stored records and imposed stringent requirements that may help defend against computerized evidence in a broad range of cases, including white-collar prosecutions. In re: Vinhnee, 2005 WL 3609376 (B.A.P. 9^th Cir. Dec. 16, 2005). Although decisions of the Panel, which consists of three bankruptcy judges, are binding precedent only for bankruptcy courts in the Ninth Circuit, Vinhnee's persuasive analysis has the potential to change the use of electronic evidence in other courts.

Most federal courts admit computer records under Fed. R. Evid. 803(6) on a showing that they are business records kept pursuant to a routine procedure for reasons that tend to assure their accuracy. See, eg, United States v. Salgado , 250 F.3d 438, 452 (6 th Cir. 2001); United States v. Destnik , 36 F.3d 904, 909-10 (10 th Cir. 1994). Vinhnee does not conflict with that approach to the hearsay issue.

It does, however, reject the approach ordinarily used to authenticate computer records, ie, to prove they are what their proponent claims, as required by Fed. R. Evid. 901(a). Courts have generally permitted authentication of computer records in a manner similar to that used for paper records, even by witnesses with little or no knowledge of how the records were generated or maintained. See, eg, United States v. Whitaker , 127 F.3d 595, 601 (7 th Cir. 1997) (FBI agent who was present at seizure of defendant's computer allowed to authenticate seized files); United States v. Moore , 923 F. 2d 910, 914, 915 (1 st Cir. 1991) (electronic records authenticated by telephone company billing supervisor).

The Case

Vinhnee is a significant departure from this permissive approach. In this case, an American Express employee testified, as custodian of records, that the entries in computerized credit card records were made at or about the time of the transactions, and that the records were kept in the ordinary course of business pursuant to a regular business practice. Although the debtor did not object (he didn't appear for trial), the Bankruptcy Court sua sponte required additional foundational testimony regarding the computer, software and procedures to assure continuing accuracy of the data. After allowing American Express to supplement its proffered foundation, the Bankruptcy Court excluded the electronic records and entered judgment for the debtor, adding 'salt to the wound' by noting that American Express 'would have prevailed on one of two counts if the records had been admitted.' 336 B.R. at 440.

In affirming, the Panel focused on key differences between paper and computer records. The foundation for paper records 'is well understood and usually is easily established,' including custody, access and procedures to prevent tampering. In contrast, a paperless electronic record 'involves a difference in the format ' that presents more complicated variations on the authentication problem than for paper records.' Id. at 444-45. The logical questions extend beyond simple identification of the computer equipment and software. For instance, digital technology makes it easier to alter documents that have been scanned into a database, thereby increasing the importance of audit procedures to assure the continuing integrity of the records.

'It is becoming recognized that early versions of computer foundations were too cursory, even though the basic elements covered the ground,' the Panel observed. Therefore, to assure continuing accuracy of the records, the Panel required additional foundational testimony regarding:

• the proponent's policies and procedures for use of the equipment, database and programs;
• how access to the pertinent database is controlled and, separately, how access to the specific program is controlled;
• how changes in the database are logged or recorded;
• the structure and implementation of backup systems; and
• audit procedures for assuring the continuing integrity of the database.

For a 'generally serviceable modern foundation,' the court turned to Edward J. Imwinkelried, Evidentiary Foundations ' 4.03[2], which suggests the following 11-step foundation for authenticating computer records:

• The business uses a computer.
• The computer is reliable.
• The business has developed a procedure for inserting data into the computer.
• The procedure has built-in safeguards to ensure accuracy and identify errors.
• The business keeps the computer in a good state of repair.
• The witness had the computer read out certain data.
• The witness used the proper procedures to obtain the readout.
• The computer was in working order at the time the witness obtained the readout.
• The witness recognizes the exhibit as the readout.
• The witness explains how he or she recognizes the readout.
• If the readout contains strange symbols or terms, the witness explains the meaning of the symbols or terms for the trier of fact.

As suggested by the Panel's criticism of standard computer foundations, Vinhnee conflicts with many prior rulings by other courts. For instance, in United States v. Salgado , 250 F.3d 438, 453 (6 th Cir. 2001), the authenticating witness was not required to understand the maintenance and technical operation of the computer in which the records were created and stored. In contrast, Vinhnee sharply criticized the custodian's ignorance of the software used to create and maintain the records. Indeed, the Panel seemed to be offended by the depth of the custodian's ignorance, since the witness 'did not seem to know anything 'of consequence either about the software or the hardware.”

Although Vinhnee marks a break from the traditional approach, it did not appear completely out of the blue. At least one relatively ancient case commented on the need for a 'more comprehensive foundation' for computer records. United States v. Scholle , 553 F.2d 1109, 1125 (8 th Cir. 1977). Simi-larly, Vinhnee relied on the current version of the Manual for Complex Litigation, which notes that a judge should 'consider the accuracy and reliability of computerized evidence' and that a 'proponent of computerized evidence has the burden of laying a proper foundation by establishing its accuracy.' The Department of Justice, in its manual, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (July 2002) (DOJ Manual) (http://www.cybercrime.gov/s&smanual2002.htm), acknowledges that 'federal courts are likely to move away from [a] 'one size fits all' approach as they become more comfortable and familiar with computer records ' [T]he fact that a computer rather than a human being has created the record alters the evidentiary issues that the computer-generated records present.' ' V. A.

Significantly, Vinhnee conflicts with other views contained in the DOJ Manual. For instance, the Manual says the standard for authenticating computer records is 'the same for authenticating other records. The degree of authentication does not vary simply because a record happens to be (or has been at one point) in electronic form.' And again: 'From a practical perspective, the procedure for admitting a computer-stored record pursuant to the business records exception is the same as admitting any other business record.' ' V. C. 2.

The Government's View and Vinhnee

Perhaps the greatest difference between the government's view and Vinhnee is about who has the burden to establish integrity of the data. With significant support from prior cases, the government claims, in effect, a presumption that computer records are reliable. 'Absent specific evidence that tampering occurred, the mere possibility of tampering does not affect the authenticity of a computer record.' Id. ' V. B. 1. Vinhnee supports a contrary argument. The Panel decided that the fourth element of Professor Imwinkelried's proposed foundation, 'built-in safeguards to ensure accuracy and identify errors,' requires affirmative testimony regarding security procedures. The Panel also criticized American Express for failing to come forward with information sufficient to establish the accuracy of its computers in the retention and retrieval of the information contained in the documents. This is tantamount to requiring the proponent to establish a prima facie case of reliability as a prerequisite for authentication.

Conclusion

Vinhnee's undeniable logic may soon supplant the traditional lenient approach to authentication of computer records, bringing opportunity for some and risk for others. In criminal cases, it may offer defense counsel an opportunity to challenge the authenticity of computerized records, both through cross-examination and by calling their own experts.

On the other hand, it may create risk for businesses and individuals that rely on such records in litigation. Records management and e-mail archiving systems may be used proactively to prepare for potential litigation and meet the specific concerns articulated in Vinhnee. This sort of preparation may also significantly reduce the expense of producing computer records, once litigation is filed. Additionally, to try to satisfy the courts' increased appetite for sound forensic procedures, electronic data should be collected, processed, validated and presented as any other kind of evidence, with due care to help ensure the chain of custody, from acquisition to presentation in court.

Trial and in-house counsel should train themselves to be ready for the growing importance of hardware and software in the courtroom. The Boy Scout motto applies here as much as anywhere: Be Prepared.

David F. Axelrod ([email protected]) is a director in the Forensic & Dispute Services practice of Deloitte Financial Advisory Services LLP. A former Assistant U.S. Attorney and law firm partner, his practice includes corporate investigations, assisting in the implementation of corporate compliance programs, electronic discovery and other litigation support.