Lance Bellers - Fotolia

Governance needs shift as digital evidence in court becomes common

Digital, computer-generated records have been used as evidence in recent court cases, and the trend could cause major changes for corporate data governance.

Earlier this year, a U.S. federal judge issued an opinion in a criminal case that allowed Google's computer systems to provide evidence in criminal court. The case began after federal agents made a 2013 illegal-immigration arrest near the U.S.-Mexico border. The defendants argued they were not in the United States but in Mexico, which would make the arrest illegal.

One of the federal agents used a Google Earth application installed on his GPS device that established that the arrest took place in Arizona. The presentation of digital evidence in court lead to a conviction, which the defendant appealed to the Ninth Circuit Court in San Francisco by arguing that the satellite image was "impermissible hearsay." A Ninth Circuit panel ruled against the appeal and allowed the GPS evidence to be used in the case.

In this Q&A, attorney and information governance expert Jeffrey Ritter discusses the case and what the decision means for the future of digital evidence in court cases.

How did the court reach its decision? Isn't any computer record considered hearsay and, therefore, generally not admitted?

Jeffrey Ritter: Computer records generally face an uphill battle when lawyers try to get them admitted because the rules of evidence in the U.S. strongly favor the oral testimony of human beings. But the Ninth Circuit panel concluded both the satellite image and coordinates that were recorded by the agent's device were not hearsay. That is very different than presenting an email record that purports to be "Bob's statement to accept the terms of Tom's offer." That record is human-generated.

Does that mean any computer-generated record is now admissible?

For many companies, the information governance professional is relied upon to find and preserve potential digital evidence required for legal proceedings.

Ritter: No, but the tide is shifting. The panel's ruling emphasized that any computer-generated record must still be proven to be authentic. That requires the party offering the computer-generated record to present a witness who can describe the machines, applications and records. They also must be able to provide testimony indicating how those records are not capable of being altered or manipulated after the fact, such as changing autogenerated dates logged in an email.

As business communications and processes increasingly rely on computers, we are also relying on them to be the first witnesses to conduct, communications and even individual keystrokes, and then to create machine-generated records of those actions. All of that type of log data becomes potential evidence if its authenticity can be demonstrated.

How is this shift going to affect the responsibilities of information governance professionals?

Ritter: Information governance must expand their scope. For many companies, the information governance professional is relied upon to find and preserve potential digital evidence required for legal proceedings. Just 12 years ago, it was a big deal to treat emails as admissible records. Now, the machine-generated record is becoming evidence. The information governance professional is best prepared to generate the requirements, oversight and execution required to bring this evidence to the forefront.

Information governance seems to be shifting into something resembling real-time compliance if machine-generated records are valued as digital evidence in court. Is that right?

Ritter: Exactly so. After experiencing billions of dollars in fines and sanctions, JPMorgan invested nearly $1.5 billion in new compliance systems and processes. Their corporate report describes many machine-generated services that ensure records are evidence essential to compliance, like monitoring the keystrokes on mobile devices to detect potential misconduct before a message is even sent. That is certainly real time and those same records are potentially available to enforcement authorities. They have to be reliable and secure.

Isn't information security where the security of records is assigned? How does information governance get involved?

Ritter: Information security professionals realized a long time ago their mission required them to deliver the authenticity and reliability of the information assets. Information governance and security now share that responsibility. Information governance, however, knows how to connect those records to the way compliance is to be measured and evaluated. The two disciplines will need to work together for the machine-generated records to be useful as digital evidence in court.

Next Steps

Learn why information governance strategy is essential to producing reliable digital evidence in court cases, and why law enforcement is being complicated by the growing amount of computer-generated information. Then, read how to make the most out of your computer logs.

Dig Deeper on E-discovery and compliance