7.6 Hearsay

Digital evidence might not be admitted if it contains hearsay because the speaker or author of the evidence is not present in court to verify its truthfulness.

Evidence is hearsay where a statement in court repeats a statement made out of court in order to prove the truth of the content of the out of court statement. Similarly, evidence contained in a document is hearsay if the document is produced to prove that statements made in court are true. The evidence is excluded because the crucial aspect of the evidence, the truth of the out of court statement (oral or documentary), cannot be tested by cross-examination. (Hoey 1996)

For instance, an e-mail message may be used to prove that an individual made certain statements but cannot be used to prove the truth of the statements its contains. Therefore, although Larry Froistad sent a message to an e-mail list indicating that he killed his daughter, investigators needed a confession and other evidence to prove this fact (see Chapter 18 for case details). The Canadian case against Pecciarich provides an interesting example of what may be considered hearsay in the context of online activities.

CASE EXAMPLE (REGINA v PECCIARICH):

Pecciarich was initially charged with one count of distributing obscene pictures and one count of distributing child pornography by using his personal computer to upload files to computer bulletin boards where others could download the files. The bulletin board was examined remotely, only allowing investigators to testify that they had seen many files on the bulletin board that contained the suspect's code name "Recent Zephyr" and had downloaded a few of them.

Mr Blumberg testified that the graphic, or pictorial files Moppet 1.GIF through Moppet 4.GIF were downloaded by him on September 20, 1993, all exhibiting on screen a printed statement that they were uploaded by Recent Zephyr on dates in August and September, 1993. A sample description of MOPPET 01 was "A Gateway original GIF! Two with girls fully nude and a younger one without panties, and just pulling off the top!" He testified that all remaining files specified in count 2 of the information were seen on either the Gateway or another bulletin board such as "Scruples," and all were identified as having been uploaded by Recent Zephyr on August 3, 1993. Only certain ones were downloaded and stored, due to time and space limitations ... Other files purportedly uploaded by Recent Zephyr were seen on many bulletin boards, and sometimes identified as associated with the company names "Yes Software" and "UCP Software."

On appeal the judge overturned the distribution charges stating that, "the statements from the bulletin 'uploaded by Recent Zephyr' accompanied by a date in August or September 1993, are pure hearsay and therefore not evidence of uploading or of the date specified." This decision appears to have been influenced by the description of the bulletin board, leading the court to believe that the data could not be relied upon. In cross-examination, Blumberg acknowledged that even if a subscriber to the bulletin board uploaded the images, the systems operator could alter any data on the system, including removing clothing, "drawing in" body parts including genitalia, and inserting the words "uploaded by Recent Zephyr." Blumberg even acknowledged that an imposter could upload materials onto the bulletin board in the name of another subscriber, using his telephone number without his knowledge; however, in testimony, which was less than crystal clear, Blumberg explained that a system of call back verification may or may not pick up on the false identity of the uploader.

The court upheld the charge of possession despite the defense argument that the evidence used to attribute the documents to Pecciarich was also hearsay.

Defense counsel argues that proof of authorship is not possible unless the documents are used in violation of the hearsay rule - namely to prove the truth of their message that the creator is "Recent Zephyr." However, rather than for truth, I have used the documents as pieces of original circumstantial evidence that the accused and the name "Recent Zephyr" are so frequently linked in a meaningful way as to create the logical inference that they are the same person.

Proving that someone distributed materials online is challenging and generally requires multiple data points that enable the court to connect the dots back to the defendant beyond a reasonable doubt. In Regina v. Pecciarich, although there was only a theoretical possibility of evidence tampering, the judge had little confidence in the digital evidence and believed that the date-time stamps on the bulletin board were hearsay even though the computer probably generated them (technically, hearsay only applies to human statements). The judge may have been skeptical of these date-time stamps because they were observed remotely through the bulletin board interface rather than collected directly from the system's hard drive. More corroborating evidence such as creation and modification times of the relevant files on the bulletin board system's hard drive and telephone records showing when the suspect had accessed the bulletin board may have helped prove distribution to the satisfaction of the court. A list of bulletin board user names with associated addresses and telephone numbers was presented to show that the defendant's telephone number was associated with the Recent Zephyr user name. However, the court determined that could not be used "to show that the accused and Recent Zephyr have the same telephone number and city of residence. Such use would clearly be for the truth of the contents, and thus would violate the hearsay rule." Furthermore, lists of users cannot demonstrate that the defendant had connected to the bulletin board at the times the images in question were uploaded.

7.6.1 Hearsay Exceptions

There are several exceptions to the hearsay rule to accommodate evidence that portrays events quite accurately and that is easier to verify than other forms of hearsay. For instance, the US Federal Rules of Evidence specify that records of regularly conducted activity are not excluded by the hearsay rule:

A memorandum, report, record, or data compilation, in any form, or acts, events, conditions, opinions or diagnoses, made at or near the time by, or from information transmitted by a person with knowledge, if kept in the course of a regularly conducted business activity, and if it was the regular practice of that business activity to make the memorandum, report, record, or data compilation, all as shown by the testimony of the custodian or other qualified witness, unless the source of the information or the method or circumstances of preparation indicate lack of trustworthiness. The term "business" as used in this paragraph includes business, institution, association, profession, occupation, and calling of every kind, whether or not conducted for profit.

The Irish Criminal Evidence Act, 1992, has a similar exception in Section 5(1):

... information contained in a document shall be admissible in any criminal proceedings as evidence of any fact therein of which direct oral evidence would be admissible if the information

was compiled in the ordinary course of a business,

was supplied by a person (whether or not he so compiled it and is identifiable) who had, or may reasonably be supposed to have had, personal knowledge of the matters dealt with, and

in the case of information in non-legible form that has been reproduced in permanent legible form, as reproduced in the course of the normal operation of the reproduction system concerned.

Although some courts evaluate all computer-generated data as business records under the hearsay rule, this approach may be inappropriate when a person was not involved. In fact, computer-generated data may not considered hearsay at all because they do not contain human statements or they do not assert a fact but simply document an act. The USDOJ manual (USDOJ 2002) clearly described the difference between digital evidence that is computer-generated versus computer-stored:

The difference hinges upon whether a person or a machine created the records' contents. Computer-stored records refer to documents that contain the writings of some person or persons and happen to be in electronic form. E-mail messages, word processing files, and Internet chat room messages provide common examples. As with any other testimony or documentary evidence containing human statements, computer-stored records must comply with the hearsay rule ... In contrast, computer-generated records contain the output of computer programs, untouched by human hands. Log-in records from Internet service providers, telephone records, and ATM receipts tend to be computer-generated records. Unlike computer-stored records, computer-generated records do not contain human "statements," but only the output of a computer program designed to process input following a defined algorithm ... The evidentiary issue is no longer whether a human's out-of-court statement was truthful and accurate (a question of hearsay), but instead whether the computer program that generated the record was functioning properly (a question of authenticity).

As an example, in the English case of R. v. Governor of Brixton Prison, ex parte Levin ([1997] 3 All E.R. 289) the House of Lords considered whether computer printouts were inadmissible because they were hearsay. In this case Levin was charged with unauthorized access to the computerized fund transfer service of Citibank in New Jersey, USA, and making fraudulent transfers of funds from the bank to accounts that he or his associates controlled. Lord Hoffman concluded that the printouts were not hearsay:

The hearsay rule, as formulated in Cross and Tapper on Evidence (8^th Ed., 1995) p. 46, states that "an assertion other than one made by a person while giving oral evidence in the proceedings is inadmissible as evidence of any fact asserted." The print-outs are tendered to prove the transfers of funds which they record. They do not assert that such transfers took place. They record the transfers themselves, created by the interaction between whoever purported to request the transfers and the computer programme in [New Jersey]. The evidential status of the print-outs is no different from that of a photocopy of a forged cheque. (p. 239)

However, data that depend on humans for their accuracy, such as entries in a database that are derived from information provided by an individual, are covered under the business record exception if they meet the above description.

More courts are likely to acknowledge the distinction between computer-generated and computer-stored records as they become familiar with digital evidence and as more refined methods for evaluating the reliability of computer-generated data become available, such as the Certainty Scale.