Bot or Not? Authenticating Social Media Evidence at Trial in the Age of Internet Fakery

Prosecutors offer Facebook posts to show that a gang leader “green lighted” the hatchet killing of a homeless man for “snitching” on him.¹ A plaintiff in an Internet stalking case offers the hundreds of abusive emails she received from anonymous senders after spurning the defendant’s advances.² The government secures a conviction for illegal firearm possession by offering Facebook photos of the defendant with a .45 caliber pistol—but no physical evidence.³

These cases illustrate how social media evidence has become an important feature of modern trial practice, just as it affects how we shop, work, eat, vote, watch TV, and interact with one another. We can summon and use social media virtually instantly with smart phones—devices the Supreme Court recently called “almost a feature of human anatomy.”⁴ Given social media’s pervasiveness in our culture, and the frequency with which people use it compared to other forms of communication, social media evidence is a broader and deeper trove of courtroom evidence than has ever been available before. At the same time, however, social media evidence is uniquely vulnerable to alteration or forgery, particularly as advances in technology allow so-called “bot” accounts to create social media content autonomously.⁵

Offering instant messages, tweets, and social media posts of all types at trial is now commonplace. Such evidence can be useful, for example, to prove a party’s mental state or to prove that someone was in a given place at a given time—like on a ski slope days after an alleged injury.⁶ Even before trial, social media may provide strategic value—for instance, if a plaintiff’s statements on product-review forums contradict the allegations in a consumer class action complaint—that could potentially help a defendant secure pretrial dismissal.

But while social media has improved our ability to tell the jury “what really happened,” it also creates new challenges for how that story can be told. The jury cannot see evidence unless it is authenticated and admitted. Federal Rule of Evidence 901(a) (and numerous state analogs) requires the proponent of evidence to “produce evidence sufficient to support a finding that the item is what the proponent claims it is.” This standard imposes a relatively low bar, requiring “[o]nly a prima facie showing of genuineness . . . ; the task of deciding the evidence’s true authenticity and probative value is left to the jury.”⁷ Compared to a voicemail, a letter, or even an email, however, authenticating social media evidence can be challenging due to “the ease with which a social media account may be falsified or a legitimate account may be accessed by an imposter.”⁸ Thus, lawyers must lay a foundation that addresses the “concern that someone other than the alleged author may have accessed the account and posted the message in question.”⁹

Courts sometimes disagree on what must be shown to satisfy this concern. Some impose a relatively high bar, requiring the proponent to all but eliminate the possibility of phony authorship.¹⁰ Others hold that social media evidence is just like any other type of evidence,¹¹ requiring only the introduction of facts from which a reasonable juror could find that the evidence was created by the purported author. We submit that the permissive approach aligns better with the text of Rule 901 and is thus correct.¹² Rule 901(a) requires only a preliminary showing that the evidence is what the proponent claims; this “does not require . . . rul[ing] out all possibilities inconsistent with authenticity.”¹³ Evidence that an imposter created the content might be a basis for admitting the evidence conditionally under Rule 104(b) or for excluding it under Rule 403, but it should not affect whether Rule 901’s threshold for authentication can be met.¹⁴ Once the proponent presents enough evidence for a reasonable juror to find that the author was who the proponent asserts, evidence suggesting otherwise may affect the weight the jury gives the evidence but should not impact its admissibility.¹⁵

Even so, some courts continue to apply the more stringent approach.¹⁶ For example, in United States v. Vayner, the U.S. Second Circuit Court of Appeals reversed a district court’s decision to admit screenshots from a social media profile that contained the defendant’s name, photo, and work history.¹⁷ Vayner holds that merely presenting evidence proving that a post came from a particular user’s account is insufficient to authenticate the post as actually coming from that user.¹⁸ Regardless of which approach is correct, lawyers cannot take for granted that courts will rule in their favor on evidentiary issues—particularly those involving complex technology and novel evidence in the heat of trial, amid numerous other evidentiary motions and objections.

Lawyers offering social media evidence at trial should be prepared to “over-authenticate” their evidence by laying a foundation that, if possible, substantially eliminates the possibility that an imposter created the content. If a witness will admit to authoring a post or owning a social media profile, and can lay a foundation supporting that admission, then the proponent’s work should be done.¹⁹ But in criminal cases (and even some civil ones), the Fifth Amendment may make this type of testimony unavailable if the witness believes that providing such testimony could be self-incriminating. Regardless, adverse witnesses often will simply be unwilling to admit they created a post or that they can remember doing so. Authentication of social media evidence should thus rely on foundational testimony about three topics: (1) circumstantial evidence of authorship or account creation, (2) how the evidence was identified and verified (i.e., “chain of custody”), and (3) how the social media platform itself provides the evidence with indicia of reliability. Below we suggest three ways a proponent can provide this authentication.

1. Circumstantial evidence of authenticity

Witnesses can testify from personal knowledge about “contextual clues in the communication tending to reveal the identity of the sender.”²⁰ This is the type of testimony that Rule 901(b) contemplates for circumstantially authenticating any type of communication. Consider the following lines of questioning:

Does the evidence contain information—photos, friends, locations, etc.—that is consistent with a witness’s testimony about the asserted author or of how that person writes, speaks, or behaves? For instance, in Allen v. Zonis, an Internet stalking case in which one of the authors of this article was appellate counsel, the plaintiff testified that the writing style in abusive emails she received from anonymous senders matched that from messages the defendant had sent her previously.²¹ Also, in Burgess v. State, a Myspace account bearing the name “Oops” was properly authenticated through an officer’s testimony that he had confirmed with the defendant’s sister that the defendant’s nickname was “Oops.”22

Have witnesses previously communicated with the asserted author using this profile? In Allen, the plaintiff’s authenticating testimony included the fact that she received the anonymous, threatening messages at an email account that only the defendant had ever used to communicate with her. This illustrates how linking a previously used communication channel with the purported author can be an effective means of establishing genuine authorship.

Does the post include a username that is consistent with posts on other platforms that are more readily linked to the asserted author? For example, even if a Facebook page contains no photos or uses a false name, witness testimony that the same name appears on other social media platforms containing visual depictions of the purported author can be sufficient to authenticate the Facebook page.²³

Have the asserted author’s offline activities ever corresponded to events or experiences described over social media? This can be a particularly persuasive way to authenticate social media evidence. Even a single instance where, for example, the purported author met with someone after arranging the encounter through social media can be enough to authenticate not only the messages arranging the encounter, but all messages coming from the account in question.²⁴

Do timestamps or geolocation data associated with the post help connect it to particular people or events? Social media posts often contain information indicating the date, time, and location of the post’s creation.²⁵ Witness testimony that the purported author was in that location on that date can thus help authenticate the evidence. This type of data is not always accurate, however,²⁶ and attorneys should be prepared to offer testimony explaining any discrepancies.²⁷

2. “Chain of custody” evidence

Offering testimony from investigators, electronic discovery specialists, or expert witnesses can help authenticate social media evidence by establishing the evidence’s “chain of custody,” that is, how the proponent’s investigation identified the information, verified it, and led to its inclusion in the exhibit offered at trial. In particular:

How was the evidence identified and then copied, reproduced, or transcribed into the exhibit being offered in court? This testimony should include a description from the witness of how the evidence was accessed and turned into an exhibit. For instance, an investigator could testify to accessing a particular website or app, taking a “screen shot” of the device’s monitor, and printing out the screen shot. A percipient witness can then testify as to whether the printout fairly and accurately reflects the social media evidence that the witness initially saw.

Do IP addresses or social media subscriber records link the evidence to a particular person? Social media companies may be compelled to disclose certain records in response to a...