Litigation
Cite as: Cooper Offenbecher, Admitting Computer Record Evidence after In Re Vinhnee: A Stricter Standard for the Future?, 4 Shidler J. L. Com. & Tech. 6 (Oct. 17, 2007), at <http://www.lctjournal.washington.edu/Vol4/a06Offenbecher.html>
©2007 Cooper Offenbecher
In re Vinhnee, a Ninth Circuit Bankruptcy Appellate Panel decision, employed Edward Imwinkelried’s eleven-step foundation process for authenticating computer records. In employing the eleven-step process, the Vinhnee court articulated a stricter standard than has previously been used by most courts for admitting computer records into evidence. This Article will first consider the various foundation standards that courts have applied to computer records. Next, the Article will analyze the Vinhnee standard, consider its elements, and compare it to the previous standards and commentary. Finally, the Article will conclude that the Vinhnee approach reflects common concerns by courts and commentators, and may influence other jurisdictions.
<1>In 2005, the United States Bankruptcy Appellate Panel of the Ninth Circuit issued In re Vinhnee, a decision that adopted a newer, stricter standard for the authentication of computer records.2 The court adopted an eleven-step foundation process, advocated for by Professor Edward J. Imwinkelried3 , and refused to admit computer records in a bankruptcy proceeding.4 In light of Imwinkelried’s process, the court stated that the witness’ knowledge of the hardware and software used by the company was insufficient to prove that the computer records were reliable.5 The opinion marked a serious departure from the previous foundation standard employed by courts for the authentication of computer records.
<2>Today, it is hard to find records and information that are not stored on computers in some form. In our increasingly technologically-oriented society, computers are being used for a broad range of functions in everyday life and business. A large majority of information that was previously calculated and stored on paper now exists exclusively on computers.6 As a result, computer records are becoming an increasingly important part of litigation.7 Complex commercial litigation, health care fraud prosecutions8 , white-collar crime, and bankruptcy proceedings are legal fields that frequently involve computer records as evidence. The admission or exclusion of computer records into evidence can be crucial to winning — or losing — an important case. As computers have become more prevalent and widely accepted, the theoretical question for legal scholars, lawyers, and judges alike, has been: Should courts infer reliability and trustworthiness from computer records?9 However, because the majority of computer records are reliable and authentic, at a more practical level the inquiry is: Through how many hoops should courts require the institutional record keeper to jump?
<3> This Article will consider the various standards that have been employed by courts for admitting computer records. Though evidence of all types is found on computers, this Article will primarily consider business records.10 The Article will then analyze Vinhnee and will consider whether the standard applied by the court is too strict. Ultimately, the Article will conclude that the Vinhnee standard is an accurate reflection of the concerns of courts and legal scholars, and may influence the law in other jurisdictions.
<4>Today’s lawyers rely on Federal Rule of Evidence 803(6), commonly referred to as the “business records exception” to the hearsay rule, as a way to admit business records, including those kept on computers, into evidence.11 The Federal Rules of Evidence (FRE), however, were only adopted in 1975.12 Prior to the national codification of the rules of evidence, a similar business record exception to the hearsay doctrine was recognized at common law due to necessity and reliance.13 The basic premise behind the “shop-book” rule (as it was called) was the importance of business records in litigation and the overwhelming expense and burden on judicial resources that would ensue if parties were required to call as a witness every person who had made an entry in a business ledger.14 Business records have been considered generally reliable because of the day-to-day reliance that businesses place on the records.15
<5>As computers became more frequently used as a means of storing business records, and computer records began playing an important role in litigation, federal courts took different approaches to the presumptive reliability of computer records. One approach was to consider the authenticity of business records on a computer as “immaterial”, and to treat the records as if they had been kept on paper.16 One court even went so far as to give computer printouts produced in the course of business at least a prima facie aura of reliability.17 Another approach was more cautious, and called for a more careful and detailed foundation concerning the computer systems that produced the records.18
<6>Rule 901(a) is the general authentication requirement under the FRE.19 Rule 901(b) offers, “by way of illustration only”, examples of authentication or identification that conform with the requirements of Rule 901.20 Rule 901(b)(9) states that “[e]vidence describing a process or system used to produce a result and showing that the process or system produces an accurate result” is required to authenticate evidence.21 The FRE Advisory Committee’s note explains that this rule can be properly applied to computer records.22 However, many courts have not required specific authentication procedures under 901(b)(9) for business records that have simply been kept on a computer.23 Rather, some courts have only required specific authentication under 901(b)(9) when the computer system or process has produced a compilation or analysis specifically for trial.24 As a result, Rule 901(b)(9) is often not considered by courts when the issue is merely the introduction of computer printouts of business records.
<7>When the FRE were enacted, Rule 803(6) codified the shop-book rule as the hearsay exception for “Records of Regularly Conducted Activity.”25 The rule permits the admission of records made by a person with knowledge and kept in the regular course of a generally conducted business activity unless the source of information or method of preparation indicates a lack of trustworthiness.26 While different courts have organized the process and the wording of the steps differently, the traditional foundation for business records under 803(6) requires that the records be:
<8>After initially adopting the FRE, courts largely treated computer records as presumptively trustworthy and did not require any special foundation to be laid for the authenticity of the records.28 The Ninth Circuit itself treated the “trustworthiness” caveat of 803(6) as an implied authenticity requirement, and considered computer records authentic absent a showing that the records were untrustworthy.29 This practice essentially shifted the burden of disproving the authenticity of the records to the opponent — if there was no evidence that the records were untrustworthy, then they were admitted. Many courts today still consider the text of 803(6) to “effectively incorporate an authentication requirement”.30
<9>The Manual for Complex Litigation (“Manual”) was one of the first secondary sources of authority to encourage courts to shift the burden of the authenticity question to the proponent of the records to show that the printouts were in fact what they purported to be. Imwinkelried cites the Manual as one of the main reasons some courts have required a more detailed foundation for computer records over the years.31 In its 1982 edition, the Manual recommended that, well in advance of trial, courts require that:
<10>These four recommendations put a much higher burden on the offering party to demonstrate the reliability of the computer processing procedure before the trial even began. For instance, requiring expert testimony about the processing program involves expenditure of a substantial amount of resources on the part of the parties and the courts. The Manual stopped short of recommending those four steps as the actual foundation process for computer records. Rather, the Manual stated broadly that courts should ensure that the proper foundation for computer records has been laid to avoid risk of procedural errors or falsification.33 The Manual referenced a case where the court required the proponent to lay a more comprehensive foundation, specifically requiring testimony about the frequency of the testing of the computer programs as well as specifics about the program’s reliability and accuracy.34
<11>One commentator read the Manual as proposing a new four-step foundation process, and strongly encouraged courts to adopt the process, in which the proponent was required to prove that (1) the document is a business record; (2) the document has probative value; (3) the computer equipment used is reliable; and (4) reliable data processing techniques were applied.35 Most courts, however, did not adopt a stricter foundation standard, and continued to admit computer records under the traditional 803(6) foundation.36 Any inquiry into the authenticity of the records was done under the auspices of the “lack of trustworthiness” caveat of the rule.37
<12>While subsequent editions of the Manual took a more lenient approach to the authentication of computer records, the most recent annotated edition suggests stricter recommendations, even citing Vinhnee itself. After 1982, the Manual took an increasingly hands-off approach to the authentication of computer records. In its 1985 edition, the Manual explicitly stated that “the proponent of computerized evidence has the burden of laying a proper foundation by establishing its accuracy.”38 However, the Manual did not recommend a specific foundation process or even cite to example cases as it did in the earlier edition. Rather, in a footnote, the Manual explains that the proponent need not prove the data is free from all error and must merely “be sufficient to support a finding that the matter in question is what its proponent claims.”39 After that standard is met, the trier of fact may weigh the evidence based on its own perception of reliability and accuracy. In its 2005 edition, the Manual stated simply that computerized data “raise[s] unique issues concerning accuracy and authenticity,” and broadly advised judges to consider the accuracy and reliability of computerized data without making any specific recommendations regarding the foundation process.40 However, the 2007 annotated edition actually cited the opinion in Vinhnee, noting the importance of inquiring into the policies and procedures for the use of the computer equipment, the control of access to computer programs, and the structure and implementation of backup systems and audit procedures for assuring the continuing integrity of the database.41
<13>Some commentators and scholars have long advocated for a more detailed foundation process for computer records. Edward J. Imwinkelried’s Evidentiary Foundations provided an eleven-step foundation process for the authentication of computer records when it was first published in 1980.42 In subsequent editions, Imwinkelried references scholarship on computer record authentication, including the Manual, explaining that many courts have “been lax in applying the authentication requirement to computer records” and have simply applied the traditional 803(6) foundation.43 Imwinkelried’s process requires the proponent to show that:
(1) The business uses a computer.
(2) The computer is reliable.
(3) The business has developed a procedure for inserting data into the computer.
(4) The procedure has built-in safeguards to ensure accuracy and identify errors.
(5) The business keeps the computer in a good state of repair.
(6) The witness had the computer readout certain data.
(7) The witness used the proper procedures to obtain the readout.
(8) The computer was in working order at the time the witness obtained the readout.
(9) The witness recognizes the exhibit as the readout.
(10) The witness explains how he or she recognizes the readout.
(11) If the readout contains strange symbols or terms, the witness explains the meaning of the symbols or terms for the trier of fact.44
Still, a higher level of scrutiny and a formalized foundation process had not been wholly endorsed by any court on a regular basis.
<14>In re Vee Vinhnee began as a bankruptcy proceeding when Vee Vinhnee filed a chapter 7 bankruptcy case.45 Mr. Vinhnee owed a large amount of money to American Express based on two credit cards.46 American Express filed an adversary proceeding seeking to have over $41,000 of the debt excepted from discharge. While Vinhnee himself did not actually appear for trial, the court nonetheless conducted the trial and required American Express to present evidence.47 American Express called a witness who identified himself as the custodian of records for the monthly statements and laid the foundation for the records under the traditional 803(6) method.48 The court was not satisfied with the witness’ knowledge of the hardware and software used to produce and store the information, and refused to admit the records into evidence, even after American Express was afforded the opportunity to make a post-trial supplementary submission.49
<15>The United States Bankruptcy Appellate Panel of the Ninth Circuit upheld the exclusion of the records and further articulated the necessity of laying a careful and detailed foundation for computer records: “The paperless electronic record involves a difference in the format of the record that presents more complicated variations on the authentication problem than for paper records.”50 The court cited Imwinkelried’s eleven-step foundation process as “the prism” through which to view the computer records.51 The court specifically noted that the complexity of “ever-developing computer technology” requires careful attention to ensure that the document offered in court is the same record that was originally created on the computer.52 Technological processes such as those that allow one to alter the text of documents, the court explained, necessitate the need for a new, more in-depth foundation.53 Vinhnee also cited The Manual for Complex Litigation as well as other contemporary commentators who have highlighted the need to protect, and inquire into, the integrity of electronic documents.54
<16>The Appellate Panel gave credence to the lower court’s ruling, but more importantly, it supported the decision with references to commentators, trends in the law, and Imwinkelried’s eleven-step process. By essentially adopting Imwinkelried’s eleven-step process, the court gave basis and precedent to the lower court’s disapproval of the custodian’s lack of familiarity with the hardware and software.
<17>Vinhnee breaks new ground in establishing a standard for authenticating business records. The court explained that early versions of computer foundations were too brief, even though the basic elements purportedly covered foundation under 803(6).55 The custodian of records testified to the requirements for foundation under Rule 803(6), but the court still excluded the records.56 Under the traditional 803(6) standard, the records would presumably have been admitted.
<18>Legal scholars are certainly noting the increasing importance of computer records in litigation and the reality that there can be serious reliability problems concerning computer records.57 Errors can occur when inputting information into the computer, when the computer is processing the information, and when accessing or retrieving the information from the computer.58 Increasing incidences of identity theft, 59 for example, highlight the vulnerability of information stored on computers. But despite the calls from commentators and scholars, many courts (the Vinhnee court excepted) seem to have relaxed the rules on authentication and are in fact treating computer records as self-authenticating.60 Some commentators have decided to go along with the courts and have concluded that the current rules of evidence and foundational processes are adequate, and that any questions about the authenticity of the evidence should affect the weight of the evidence, not the admissibility.61 Others have stated, however, like Imwinkelried and the Manual, that the presumption of reliability employed by some courts unfairly puts the burden on the opposing party to object to the authenticity.62 Indeed, such a presumption requires the opposing party to have detailed, affirmative knowledge about the computer systems. In these cases, however, the proponent is often the only party with access to the computer systems; the opposing party, conversely, usually lacks sufficient access to investigate potential sources of error. In today’s fast-paced technological world, requiring the opponent to object to computer evidence likely puts an undue burden on the opposing party.63 As a result, some argue that the 803(6) foundation does not satisfy the basic authentication requirements of Rule 901(a), and that computer records always need to be authenticated under Rule 901(b)(9).64 The method employed by Vinhnee incorporates many of these criticisms. It essentially puts the burden on the party offering the evidence to affirmatively demonstrate, through an eleven-step foundation process, that the offered record is in fact an accurate reflection of the information or record it purports to be.
<19>The Imwinkelried eleven-step process seems long and daunting. But some of the steps are cursory foundation steps that most witnesses who are prepared to authenticate computer records under the traditional Rule 803(6) process would be able to handle anyway. Steps four, five, and eleven are the steps that are most likely to give witnesses trouble. Step four requires that the witness testify that, “[t]he procedure has built-in safeguards to ensure accuracy and identify errors.”65 This step presumably requires the witness to understand internal processes of the hardware and software. Step five states that “the business keeps the computer in a good state of repair.”66 Most witnesses would likely be able to testify to the external physical state of the computer. However, to the extent that courts may interpret this step to require knowledge of the internal state of repair (perhaps requiring knowledge of the extent and frequency of virus scans and software maintenance and upgrades), the step may require knowledge beyond that known to a witness who is only prepared for the 803(6) foundation. The eleventh step states that “if the readout contains strange symbols or terms, the witness explains the meaning of the symbols or terms for the trier of fact.”67
<20>The Vinhnee court seemed most concerned with the witness’ knowledge of specifics regarding accuracy, security, and the potential for data error or loss. “There is no information regarding American Express’ computer policy and system control procedures, including control of access to pertinent databases, control of access to pertinent programs, recording and logging of changes to the data, backup practices, and audit procedures utilized to assure the continuing integrity of the records.”68 In doing so, the court highlights step four and step five (to the extent that it deals with the internal processes of the computer) as two of the most important foundation steps.
<21>It is difficult to know whether testimony in older cases would be sufficient to meet the Vinhnee standard since it is impossible to tell if witnesses in those cases knew more about the computer systems than their testimony demonstrated. In U.S. v. Linn, the defendant sought to exclude a computer printout of hotel phone records.69 At trial, the records were admitted into evidence through Ms. Fry, the hotel’s “Director of Communications.”70 The defendant argued that Ms. Fry was not a qualified foundation witness because she did not know how the computer printout was generated: she “did not understand the distinctions between ‘menus’, ‘data bases’, and computer ‘code’” and was thus “confused and inadequately trained.”71 The Ninth Circuit Court of Appeals dismissed the argument as “frivolous” and held the record properly admitted, stating that the record was generated automatically and that the phone record was retained in the ordinary course of business.72 The Vinhnee court, however, might not have been as forgiving. Here, it is unclear whether Ms. Fry would have been able to testify regarding the “built-in safeguards” step required of the Imwinkelried eleven-step process. However, her lack of knowledge concerning the differences between menus, data bases, and code suggests that she might not have been able to provide the affirmative information concerning the reliability of the computer system that Vinhnee requires. We also know that if Ms. Fry had been unable to specifically identify the types of hardware and software used by the company, the Vinhnee court would certainly have taken note, as it deemed “unpersuasive” the testimony of the American Express custodian who could not do the same.73 One can only imagine that there have been scores of custodians who have laid the foundation for computer records but would not have been able to state the types of hardware and software used in keeping or creating the records.
<22>In adopting Imwinkelried’s standard, the Vinhnee court may have taken unnecessary steps to exclude the American Express records in question. In footnotes, the court quotes from the testimony of the custodian of records as evidence for the court’s conclusion that the custodian’s assertions indicated lack of knowledge and were unpersuasive.74 The records custodian did not know the model of the computer system, whether the software was accounting software or billing software, and generally exhibited a complete lack of knowledge about the computer system.75 While these facts are not part of Imwinkelried’s process, they comprise a basic set of facts that most computer records custodians should possess. Had the custodian been able to recite the requested facts, the court might have accepted his conclusions regarding the reliability of the computer systems.
<23>Regardless of what reasons the court actually had for excluding the records, it explicitly adopted the Imwinkelried “prism” as the court’s means for evaluating the foundation.76 In doing so, it rejected the sufficiency of the traditional Rule 803(6) foundation as self-authenticating and implicitly renewed the need to affirmatively authenticate computer records. The Vinhnee court’s emphasis on reliability, accuracy, and system knowledge is consistent with urgings by the Manual and some scholars. Though it employs an eleven-step foundation process that has not previously been cited by courts, the key inquiries are into accuracy and reliability. These issues are not new and are the crux of traditional authentication inquiries in all areas of evidence. Imwinkelried’s foundation process has been in circulation since 1980 and his Evidentiary Foundations book is a widely employed trial tool. In its essence, the Imwinkelried foundation is a well-articulated inquiry into accuracy and reliability. The Vinhnee approach is not, by nature, an outlier. It reflects a long-standing desire by some to inquire into the accuracy and reliability of computer records. While other courts may not immediately follow Vinhnee, the decision is unlikely to be eschewed as requiring unrealistic, exacting knowledge of records custodians.77 The case may influence other judges who are similarly dissatisfied with the lack of knowledge of testifying witnesses.78
<24>The Vinhnee standard is a well-articulated inquiry into the accuracy and reliability of computer records. The standard accurately reflects the urging of commentators to require a more detailed inquiry into authenticity. The eleven-step process is, in reality, not that different from what some courts employ in practice. Still, many judges may be unwilling to adopt the new standard and expend judicial resources to exclude evidence, hear appeals, and retry cases. However, the Vinhnee court marks an important step in the evolution of the comfort levels of courts with computer records. And while some litigators and witnesses may not be ready to produce the type of knowledge required to authenticate under the Vinhnee standard, they would be wise to take notice of this case as some courts are likely to begin requiring a more detailed foundation than Rule 803(6) requires on its face.