A Rule 902(14) Process of Digital Authentication of Social Media Evidence Explained (Technical Overview with Provided Resources)

Federal Rule of Evidence 902(14) is now in effect and is already significantly impacting computer forensics and eDiscovery collection practices. Baker & McKenzie, the world’s largest law firm, recently weighed in, stating that amended Rules 902(13)(14) “may incentivize parties to more aggressively challenge authenticity where it is apparent that an opponent is unable to make the pretrial certification envisioned by the amendments.”

To review, FRE 902(14) provides that electronic data recovered “by a process of digital identification” is to be self-authenticating, thereby not routinely necessitating the trial testimony of a forensic or technical expert where best practices are employed. Instead, such properly collected electronic evidence can be certified through a written declaration by a “qualified person,” attesting that they verified the hash value of an offered item of electronic evidence and that it was identical to the original.

A detailed overview of Rule 902(14) can be found here.

A sample Rule 902(14) written certification can be found here.

To enable compliance with Rule 902(14) for social media evidence, we have developed and are now releasing a freely available, patented electronic evidence verification tool for use in conjunction with evidence collected with X1 Social Discovery. The tool is used to verify the hash values of evidence collected by X1 Social Discovery, including social media evidence, webmail, and website collections.

When collecting social media evidence, X1 Social Discovery generates an MD5 hash value for each item preserved, on an automated basis at the time of collection. The validation tool allows the examiner to generate a “verification” hash calculation against the original, and thereby be able to certify the authenticity of the evidence under Rule 902(14).

However, the ephemeral nature of social media evidence presents unique, but not insurmountable challenges. The available fields that make up an item of social media evidence such as a Facebook post are dynamic and complex. Metadata fields are constantly added and removed by the social media platforms to provide new features or remove old ones. Recurring changes to metadata fields necessitates the dynamic addition and/or removal of critical fields for hash calculations, causing the need for a new methodology that allows for the algorithms which calculate the hash value to be updated on a version by version basis. For this reason, we have released a special point upgrade of X1 Social Discovery, version 5.3.1, which works in conjunction with the X1 Social verification tool.

Here’s how it works: During the ingestion process of evidence into X1 Social Discovery, an MD5 hash value (digital fingerprint) is calculated by using key metadata fields and/or content (depending on the source type) of the item to ensure the evidence is not altered post collection. The hashing process is done in a similar fashion to hashing email items for deduplication in the eDiscovery industry. The result, as seen in the below screenshot, is that the original collection hash of an item collected by X1 Social is verified by the re-calculated or verification of the item by the X1 Social verification tool.

Click on image to enlarge

This report is designed to map to the 902(14) procedure outlined in the Rule and its accompanying Committee Notes. The examiner can take the results of this report and attest to them in their written 902(14) certification.

The tool itself is automated and easy to use with a single interface. On April 5, we will be hosting a live webinar to provide an update on Rule 902(14) and to demonstrate in detail the X1 Social verification tool and how X1 Social Discovery effectively maps to the requirements of 902(14). We look forward to seeing you at the webinar. Please register here.