Every year since continuing legal education requirements were imposed in Pennsylvania in 1992, I have had the privilege of teaching numerous CLE courses. Until 2005, while I was still a prosecutor, the topics were typically how to conduct wiretap investigations and present wiretap evidence in court and how, technically and legally, to search for digital evidence. For the last 15 years, I have presented on how to gather digital evidence, review it when producing e-discovery and present it in court.

Over the past few years, CLE providers have moved from presenting programs solely focusing on e-discovery and digital evidence to incorporating digital evidence presentations into programs regarding litigation generally. The issue I will explore in this month's column is whether the aforementioned move is of any great significance and, if so, what that significance is.

Electronic or Digital Conversations

Consider the litigator who must seek to introduce into evidence at a trial or hearing the substance of a telephone call between one of the call's participants, who is represented by the litigator or some other friendly witness and another (the party). The circumstances of the call are typical of those in 99% of all calls everyone makes or gets. The witness knows the party; the witness recognizes the party's voice; the witness knows the telephone number the witness has called from is that of the party; the witness speaks about something known to her and the party in a manner fitting their relationship; and, the manner in which the party speaks—business-like, jokingly, etc., depending upon the circumstances of the call, the relationship between the call's participants and the personality of the party—is that which the witness expects from the party, based upon the factors enumerated. Given those circumstances, the witness' recounting of the call will be admissible without challenge, assuming there are no other issues regarding the call, e.g., relevance or privilege.

Now, consider that the aforementioned phone conversation is, instead, a digital one, such as via an email or text message. Admissibility of a digital conversation—or of any evidence, for that matter—is governed by Federal and Pennsylvania Rules of Evidence 901, which are identical. Under those rules, to "satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is." Evidence supporting that finding includes, but is not limited to, the "testimony of a witness with knowledge," "comparison by an expert witness or the trier of fact" of the evidence with an "authenticated specimen by an expert witness or the trier of fact," "distinctive characteristics and the like," and "evidence about a process or system."

When a party offers a digital conversation into evidence and there is no agreement with the opposing party, there are numerous burdens of proof the offering party must carry to see the evidence admitted. First, all of the data that the reader can see—the date and time of the email, the email name of the sender, the text of the email—could be forged. To prove the authenticity of that data, the offering party must show that the copy of the document is identical in every way to the original. To show that, an expert must make a "forensic copy" of the original, which copy will include not simply data the user can read but metadata attached to the original as to the date and time it was created, last accessed and last modified (known as MAC dates and times). The original and copy must also be subject to a hash algorithm, a complex algorithm that uses parts of the original and copy to populate variables, and so create a "hash value" unique to the original and identical in every copy—if the slightest change is made between original and copy, the hash values are completely different. In addition to making a forensic copy of the original, it is wise for the forensics expert to make a forensic copy of the source of the data, so that the moving party can show that there was no digital evidence in any other files suggesting an attempt to forge the email.

As well, the digital forensics expert should locate, report and identify the internet protocol or "IP" address of the email. Any digital information sent via the internet is guided by an IP address, which contains some information that should help the expert establish the sender and the provider used by the sender to send the email. IP addresses are made up of four groups of digits, each containing two or three digits from 0 to 9, e.g., "146.70.913.25." Many years ago, IP addresses were "static," meaning that the first two sets of digits were assigned to a source and the next two sets were dedicated to the specific digital mail being sent. Today, providers use "dynamic" IP addresses, meaning that to identify that address as having come from a specific source assisted by the source's provider, the expert (or the litigation party) must contact the provider and obtain from it a record of who was assigned that IP address on the date and at the time the digital mail was sent. Testimony and records from the provider, then, may also be necessary.

It should come as no surprise that the cost to the offering party to obtain and present in court all of this evidence usually is substantial. The expert witness, who understands the world of digital communications, has gathered all of the responsive evidence and can present it clearly to the trier of fact, will present an hourly fee, plus costs, for analysis and expert testimony that will result in large costs to the litigating party. While it is entirely possible that the opposing party will stipulate to the evidence, such stipulation usually will not be made until all of the expert work, save testimony, has been done (and billed to the offering party), and the opposing party wishes to dampen the effect of the admission of that evidence by agreeing to its admission rather than having an articulate expert go through it, detail by damning detail, before the trier of fact. Of course, if the offering party does not engage the expert, it is all but certain that the opposing party will not stipulate.

It is obvious that the cost of offering email or text messaging into evidence is considerably greater than the cost of offering a telephone conversation. There are two reasons for that difference in cost: the evidence is itself different, with telephone conversations lending themselves far more to authentication by a witness who was part of the conversation; and, we as users are far more familiar with telephone calls than with digital conversations, and so can offer evidence supporting (or attacking, as the case may be) admission of the former because that evidence is not known only to experts, but is widely known. If one out of a thousand persons, for example, knows what an IP address is and how to identify it, 999 out of that thousand know that the telephone number that shows up on your phone (land line or cellphone) is the number of the participant on the other end of the phone call.

If, however, we go back to a time when telephone conversations were, relatively speaking, as new as digital conversations are today, and when phone technology was changing as digital technology changes today, we might find the same problem with the average call participant being able to identify the party on the other end of the call. The technology was not geared to tracing calls, involved too many unknown participants, and was constantly changing (improving to the user). Telephone numbers were not standardized; phones certainly did not display the telephone number of the phone on the other end of the call; operators received the call requests from the callers and sent the call to other operators, who then sent the call to the recipient (imagine trying to establish who those operators were, much less getting them to travel to the litigation location or remember call transactions that took place months or years before, took a few seconds and were not logged). Finally, the reception was not so good that the caller could usually recognize the call participant on the other end of the call simply by the sound of his voice.

As well, call participants knew very little about telephones. Callers had to be instructed as to how to speak with operators, make person-to-person calls, and otherwise use phones. As phones changed and the number of operators decreased, exchanges went from two to three digits and lost their names (for example, where I grew up, numbers were initially "Foxcroft 1-2-3-4," with the "F and the O" translating to "3-6" on the phone dial, but in the mid-1960s the exchange became "3-6-3," adding the second "3" and dropping "Foxcroft" completely). By the late 1960s the technology was more or less set as far as the user was concerned and the calls were clear enough to recognize the voice of the other participant; by the 1980s, the telephone number of the other call participant was displayed on a substantial percentage of devices, with that percentage eventually reaching 100%.

Conclusion—The Spectrum of Familiarity

The comparison of telephone calls "back in the day" and today to digital transmissions today shows that whatever a party might wish to offer into evidence will fall on a "spectrum of familiarity." The more familiar the average person is with the evidence, the easier and less expensive it will be to establish that evidence as admissible. Thus, in the 1920s, it would have been difficult for witnesses who were call participants to move a call into evidence, while today it would be easy, and most likely without any cost additional to whatever the cost might be to call witness to the stand, for the witness who was on one end of the call to provide sufficient evidence to have the call admitted into evidence (assuming its relevance). That witness would easily be able to offer "testimony of a witness with knowledge" and "evidence about a process or system," with that system and process being the telephone system from the user's perspective, as well as evidence regarding the "distinctive characteristics and the like" of the call, e.g., the phone number of the other participant and the sound of the other participant's voice. Over time, then, as telephone calls became more familiar to users and the technology supporting them became better, more stable and better under understood by users, telephone calls moved on the spectrum of familiarity from the unfamiliar to the familiar such that users could authenticate them so readily that challenges to admissibility vanished.

Given, then, the present-day issues with digital communications, such communications are in roughly the same place for the user today, i.e., on the "unfamiliar" end of familiarity spectrum. Digital technology is anything but stable and the users are, at best, familiar with how to use the devices that connect them to the internet, but hardly familiar with how the internet—and all devices dependent upon it—work. Users may remain on the "unfamiliar" end of the spectrum of familiarity for quite some time, because constant changes to the media have been and are being made and are expected into the future with no telling as to when things will settle down. To offer admissible testimony regarding those changes, users must be experts in the field, and it is hardly likely that the typical user will become such an expert and possess the tools needed to gather evidence to support any conclusion the user has drawn as to the source of any digital transmission received by the user.

It appears, then, that it will be, at best, a long while before circumstances move admissibility of digital transmissions from the unfamiliar to the familiar end of the spectrum of familiarity and so make it easy, and inexpensive, to have such transmissions admitted into evidence at trial. Of course, two factors may greatly shorten that "long while." First, digital technology radically changes quickly. Second, younger people well familiar with (and not afraid of) digital technology generally are constantly moving into the business and legal marketplace and so those working with and litigating matters involving digital transmissions will bring with them a far better "feel" regarding digital technology than that which is possessed by current, longtime CEOs and other business leaders, judges and litigators. Thus, the digital landscape might change so greatly and quickly that in six months or a year my "long while" prediction will be thrown into the junk heap of pundits' predictions and readers will use this piece whenever they want to get a laugh about the opinions of "experts." If such a change occurs, I will be happy to write a follow-up piece castigating myself for being shortsighted. Until then, however, litigators will have to continue fighting what appears to most to be a wasteful, expensive battle by taking careful and costly steps to offer into evidence received digital transmissions that, outside of the legal and digital expert worlds, no one would question.

Leonard Deutchman is a legal consultant retired from one of the nation's largest e-discovery providers, KLDiscovery, where he was vice president, Legal. Before joining KLDiscovery, he was a chief assistant district attorney at the Philadelphia District Attorney's Office, where he founded the Cyber Crime Unit and conducted and oversaw hundreds of long-term investigations involving cyber crime, fraud, drug trafficking and other offenses.