Tag Archives: hash value

by John Patzakis

A US Federal Appellate Court, Second Circuit, recently overturned a criminal conviction upon finding that the lower court erroneously admitted a screenshot of the defendant’s alleged profile on “the Russian equivalent of Facebook,” (“VK.com”) due to improper authentication.

In United States vs. Vayner, 2014 WL 4942227 (C.A. 2 (N.Y.)), a jury convicted Aliaksandr Zhyltsou on a single count of the unlawful transfer of a false identification document. The government’s key evidence included a screen shot purporting to be Zhyltsou’s VK.com profile page. The lower court admitted the printout over Zhyltsou’s objection on insufficient authentication grounds. However, the appellate court determined that the government presented insufficient evidence that the page was what the government claimed it to be—that is, Zhyltsou’s profile page, as opposed to a profile page on the Internet that Zhyltsou did not create or control. The prosecution used the alleged profile page to establish a key connection between Zhyltsou and Vladyslav Timku, another perpetrator who reached a plea bargain and became the Government’s star witness.

Ultimately, the Court concluded that because the page was intended to corroborate testimony regarding the defendant’s alleged online identity, it was  “required that there be some basis beyond Timku’s own testimony on which a reasonable juror could conclude that the page in question was not just any Internet page, but in fact Zhyltsou’s profile. No such showing was made and the evidence should therefore have been excluded.”

This is a clear cut case of a conviction being thrown out over a social media evidence collection that failed to follow best practices. The federal second circuit, which covers all of New York, Connecticut and Vermont, is a very influential court and this decision will impact standards for and the scrutiny of all social media evidence collection in criminal and civil matters nationwide.

United States vs. Vayner is yet another case illustrating that social media provides torrential amounts of evidence potentially relevant to litigation matters, with courts routinely facing proffers of data preserved from various social media websites. This evidence must be authenticated in all cases, and the authentication standard is no different for website data or chat room evidence than for any other. Under Federal Rule of Evidence 901(a), “The requirement of authentication . . . is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” United States v. Simpson, 152 F.3d 1241, 1249 (10th Cir. 1998).

Ideally, a proponent of the evidence can rely on uncontroverted direct testimony from the creator of the web page in question. In many cases, such as in the Vayner case where incriminating social media evidence is at issue, that option is not available. In such situations, the testimony of the examiner who preserved the social media or other Internet evidence “in combination with circumstantial indicia of authenticity (such as the dates and web addresses), would support a finding” that the website documents are what the proponent asserts. Perfect 10, Inc. v. Cybernet Ventures, Inc. (C.D.Cal.2002) 213 F.Supp.2d 1146, 1154. (emphasis added) (See also, Lorraine v. Markel American Insurance Company, 241 F.R.D. 534, 546 (D.Md. May 4, 2007) (citing Perfect 10, and referencing MD5 hash values as an additional element of potential “circumstantial indicia” for authentication of electronic evidence).

One of the many benefits of X1 Social Discovery is its ability to preserve and display all the available “circumstantial indicia” or “additional confirming circumstances,” in order to present the best case possible for the authenticity of social media evidence collected with the software. This includes collecting all available metadata and generating a MD5 checksum or “hash value” of the preserved data for verification of the integrity of the evidence. It is important to collect and preserve social media posts and general web pages in a thorough manner with best-practices technology specifically designed for litigation purposes.  For instance, there are over twenty unique metadata fields associated with individual Facebook posts and messages. Any one of those entries, or a combination of them contrasted with other entries, can provide unique circumstantial evidence that can establish foundational proof of authorship. (We identify the nearly two dozen fields of unique Twitter metadata in our white paper available here).

Additionally, when an examiner merely relies on print screen, they also severely limit the scope and thoroughness of the social media and internet collection. Employing more automated means, such as X1 Social Discovery, enables the examiner to quickly collect entire web pages and publically available social media accounts, which can be hundreds of pages long. This allows the examiner to build a much stronger case for authentication by building timelines, drawing more connections between witnesses and their various posts, collecting more collaborating metadata, and a litany of other means to build a compelling circumstantial case to authenticate the social media or web page evidence in question.

When lawyers and their service providers rely on simple screen captures, printouts or even compliance archiving solutions that fail to collect and preserve all key metadata to admit social media into evidence, they run a significant risk of having key evidence in support of their client’s case disallowed by the court. The federal prosecutors in Vayner just learned this lesson the hard way.