Editor's note: This is the second in a two-part series.

In last week's column, I discussed another “boring” e-discovery opinion. In Commonwealth v. Mangel, 2018 Pa. Super. 57 (Pennsylvania Superior Court March 15, 2018), the Pennsylvania Superior Court affirmed the trial court's order barring admission of evidence purportedly coming from the Facebook account of defendant Tyler Kristian Mangel, which evidence was offered to demonstrate that the defendants were the perpetrators of an assault of victim Nathan Cornell, at a graduation party. The court's explanation as to why the evidence was inadmissible—because the commonwealth had failed to establish its authenticity—involves some technical discussion, but the great majority of the court's opinion is not particularly technical, another indication that the courts and the bar are catching up to the changes brought on by the digital revolution.

In the second part of this column, I discuss some legal issues and offer a brief analysis of the opinion.

Legal Issues

Turning to authentication of social media evidence, “such as Facebook postings and communications,” the court noted that Facebook is a social networking site where users may post items on their Facebook page that are accessible to other users, including Facebook “friends” who are notified when new content is posted. Additionally, Facebook “requires users to provide a name and email address to establish an account. Account holders can, among other things, add other users to their 'friends' list and communicate with them through Facebook chats or messages.”

To determine what was required to authenticate social media evidence, the court examined “the treatment accorded other types of electronic communications.” It noted that “Pennsylvania appellate courts have considered the authentication of computerized instant messages and cellphone text messages,” citing to In the Interest of F.P., a Minor, 878 A.2d 91, 96 (Pa. Super. 2005) (computerized instant messages), and Commonwealth v. Koch, 39 A.3d 996, 1005 (Pa. Super. 2011), affirmed by an equally divided court, 106 A.3d 705 (Pa. 2014) (cellphone text messages). (The court noted that Koch was not binding because it was affirmed by an equally divided court.) In In re F.P., the commonwealth sought to introduce instant messages from screen name “Icp4Life30” to “WHITEBOY Z.” The victim identified himself as “WHITEBOY Z” and testified that he thought “Icp4Life30” was the defendant and described how many of the instant messages were threats to the victim. Furthermore, this was reported to the school counselor, resulting in a meeting between the defendant and school officials and a mediation between both students. The contents of the instant messages also referred to these ongoing events and, in one instance, user identified by the commonwealth as the defendant referred to himself by his first name. Importantly, the defendant never denied sending the instant messages. The In re F.P. court concluded that this circumstantial evidence sufficiently identified defendant as “Icp4Life30,” and authenticated the instant message transcripts. The F.P. court noted that both digital communications (email, text messages) and written communication (letters) can be altered or forged, but that does not make either type of communication inherently unreliable. Instead, digital communications, like written ones, “can be properly authenticated within the existing framework of Pa.R.E. 901 and Pennsylvania case law.” Admissibility must be evaluated “on a case-by-case basis … to determine whether or not there has been an adequate foundational showing of its relevance and authenticity.”

Reviewing Koch, the court noted that the Koch court “examined whether cellphone text messages had been appropriately authenticated prior to their admission into evidence.” In Koch, the commonwealth sought the admission of text messages retrieved from a cellphone taken during the execution of a search warrant on the defendant's residence. During the raid, police found two cellphones, marijuana, scales, a bong, pipes for smoking marijuana, and other drug paraphernalia. The defendant admitted to owning one of the cellphones. Thirteen text messages were retrieved from the defendant's cellphone, the content of which indicated drug sale activity. At trial, a detective testified that he had transcribed the text messages and identifying information from the cellular phone belonging to the defendant. However, the detective conceded that he could not confirm that the defendant was the author of the text messages, and that it was apparent that the defendant did not write some of the messages.

The court further noted that the Koch court looked to the holding in F.P., as well as cases from other jurisdictions wherein courts had examined the authentication of text messages and concluded that implicit in these decisions was the realization that emails and text messages were documents and subject to the same requirements for authenticity as nonelectronic documents generally. The court also observed that the Koch court had “additionally observed that 'electronic writings typically show their source, so they can be authenticated by contents in the same way that a communication by postal mail can be authenticated.'” Because, however, more than one person can use an email address, and accounts can be accessed without permission, “'the mere fact that an e-mail bears a particular e-mail address is inadequate to authenticate the identity of the author; typically, courts demand additional evidence.'” Thus, the Koch court ruled that “'authentication of electronic communications, like documents, requires more than mere confirmation that the number or address belonged to a particular person. Circumstantial evidence, which tends to corroborate the identity of the sender, is required.'” Applying these considerations to the evidence on record, the Koch court concluded that the testimony of the detective was insufficient to authenticate the text messages in question, noting that there was no testimony from any person who had sent or received the text messages, nor any contextual clues in the drug-related text messages that tended to reveal the identity of the sender.

The court concluded that the same “authorship concerns, as expressed by the Koch court in relation to emails and instant messages, exist in reference to Facebook and other social media platforms, that can be accessed from any computer or smartphone with the appropriate user identification and password.” Indeed, the court found that “social media evidence presents additional challenges because of the great ease with which a social media account may be falsified, or a legitimate account may be accessed by an imposter.” Nevertheless, and importantly, they found that existing law was sufficient to deal with the issues of authentication of social media. “Initially, authentication of social media evidence is to be evaluated on a case-by-case basis to determine whether or not there has been an adequate foundational showing of its relevance and authenticity. … Additionally, the proponent of social media evidence must present direct or circumstantial evidence that tends to corroborate the identity of the author of the communication in question, such as testimony from the person who sent or received the communication, or contextual clues in the communication tending to reveal the identity of the sender.” The court cited to several other courts, including the U.S. Court of Appeals for the Second and Seventh circuits, as well as the appellate courts of Maryland, Massachusetts, Mississippi and Texas, who examined “the authentication of social media records” and “ruled that the mere fact that an electronic communication, on its face, purports to originate from a certain person's social networking account is generally insufficient, standing alone, to authenticate that person as the author of the communication.”

The court reasoned that the trial court, relying upon Koch, properly “denied the commonwealth's motion in limine on the basis that it had failed to present sufficient evidence that tended to corroborate that Mangel was the sender of the Facebook communications in question.” Mangel did not himself state at any time that the Facebook account in question was his own personal Facebook account or that he authored the posts and messages on the Facebook account, and the commonwealth did not introduce subsequent testimony from any other knowledgeable party to substantiate that the Facebook page (and, by association, the posts and messages contained therein) belonged to Mangel. Moreover, the commonwealth did not obtain the username or password for the Facebook account to confirm its authenticity. Although the commonwealth did produce evidence allegedly linking Mangel to the Facebook page in question, including a name, hometown, school district and certain pictures, the court found that “this information has generally been held to be insufficient to connect a defendant to posts and messages authored on a Facebook page.” Indeed, the court pointed out, the fact that defense counsel's search of Facebook for the name, “Tyler Mangel,” yielded five “Tyler Mangel” Facebook accounts, with only one of them having the same hometown of “Meadeville, Pennsylvania,” provided a strong example of why the evidence the commonwealth did produce was insufficient to link the defendant to the account.

The court further reasoned that a “thorough review of the Facebook posts and messages themselves” raised specific issues. The evidence presented by the commonwealth did not indicate the exact time the posts and messages were made. “The lack of a date and timestamps raises a significant question regarding the connection of the posts and messages to the alleged incident on June 26, 2016.” As well, the posts and messages suffered from a digital “hearsay” problem, in that “the 'Tyler Mangel' who allegedly authored the Facebook posts and messages [did] not specifically reference himself in the incident,” while only “other individuals, many of them who are not directly involved in the instant criminal case,” referenced a “'Tyler Mangel'” in response to a post made and in subsequent conversations about an alleged assault.” In addition, the posts and messages were “very ambiguous, containing slang and other nonsensical words with 'Like' replies,” and did not “specifically and directly relate to the alleged incident.” “Finally,” the court noted, “the commonwealth did not produce evidence as to the distinct characteristics of the posts and messages which would indicate [that] Mangel was the author.” The court also noted that “the commonwealth introduced a black and white copy of a Facebook picture of a hand,” which was “allegedly bloody and bruised.” This picture, however, “was posted by a Facebook user named 'Justin Jay Sprejum Hunt,' who made no reference to either victim, making the exhibit irrelevant “regarding the authentication of the Facebook posts and messages.” It further observed that the commonwealth did not produce any evidence that the defendant “had created, or had access to, the email accounts associated with the Facebook account (mangel17@facebook and [email protected]), per the Facebook subscriber records,” or any evidence that he “had access the cellular phone with the number associated with the Facebook account, or any relationship with the individual who owned that number (Stacy Mangel).”

The court found that the trial court, “in recognizing Koch as the controlling legal precedent in Pennsylvania for the authentication of electronic communications, applied the proper standard in determining whether the commonwealth had presented sufficient direct or circumstantial evidence that Mangel had authored the Facebook messages in question.” The problem for the commonwealth was that it failed to meet that standard. The “commonwealth presented no evidence, direct or circumstantial, tending to substantiate that Mangel created the Facebook account in question, authored the chat messages, or posted the photograph of bloody hands. The mere fact that the Facebook account in question bore Mangel's name, hometown and high school was insufficient to authenticate the online and mobile device chat messages as having been authored by Mangel. Moreover, there were no contextual clues in the chat messages that identified Mangel as the sender of the messages. Accordingly, the trial court did not abuse its discretion in denying the commonwealth's motion in limine to admit such items into evidence at trial.”

Analysis and Conclusion

The court's application of cases that applied general rules of authentication to digital evidence is spot on. Regardless of whether the court applied the “reasonable degree of scientific certainty” or “preponderance of the evidence” standard, the commonwealth here simply did not do its homework: what it relied upon to authenticate the digital evidence was insufficient and, in some cases, misleading. The court raised the issue of why the commonwealth did not produce any evidence that the defendant had created, or had access to, the email accounts associated with the Facebook account per the Facebook subscriber records. It is unlikely that the commonwealth investigated these accounts and found that they were wholly unrelated to the defendant; it is far more likely that they simply overlooked this. As well, and perhaps even more importantly, the commonwealth's failure to explore the IP addresses of those who accessed the Facebook account is baffling. Identifying and tracing those addresses to their sources could have established repeated accessing of the account by a device within the defendant's control when posts were made, thus demonstrating that the account did, indeed, belong to the defendant. Such evidence would have mooted the issue.

Mangel is a disappointing opinion in that one sees how the commonwealth did not do all that was reasonably expected of it to authenticate the digital evidence in question. From a jurisprudential point of view, however, it is a heartening opinion, as it demonstrated both that rules and opinions pertaining to authentication can be applied to the authentication of digital evidence without changes being made, and that the trial and superior courts understand digital evidence well enough to analyze with great subtlety the issues which compose the question of whether digital evidence has been sufficiently authenticated.

Leonard Deutchman is a consultant regarding e-discovery, digital forensics, and criminal and civil legal matters. Before that, he was vice president, legal for KLDiscovery and a chief assistant district attorney at the Philadelphia District Attorney's Office, where he founded the Cyber Crime Unit and conducted and oversaw hundreds of long-term investigations involving cybercrime, fraud, drug trafficking and other offenses.