One method for authenticating ESI is based on its distinctive characteristics. This concept stems from the following portion of Rule 901(b):
(4) Distinctive Characteristics and the Like. The appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances.
Fed. R. Evid. 901(b)(4). “The party authenticating the exhibit need only prove a rational basis for that party’s claim that the document is what it is asserted to be. This may be done with circumstantial evidence.” United States v. Needham, 852 F.3d 830, 836 (8th Cir. 2017) (internal citations and quotations omitted); see also United States v. Young, 753 F.3d 757, 773 (8th Cir. 2014) (same).
IP Addresses. An Internet Protocol address (IP address) is a numerical label assigned to a device using a network. These distinctive codes can be used to authenticate ESI in some contexts.
For example, where malicious information (perhaps defamatory) has been posted on the Internet, a practitioner will want to identify who posted the information. Sometimes this is difficult, particularly where the poster has not provided a name. However, this is not the end of the inquiry. By obtaining the IP address used to post the information, an attorney can identify the internet service provider (ISP) associated with that IP address. This permits the attorney to subpoena the ISP to obtain the user’s contact information, which is oftentimes what the party is seeking.
Although a court order is needed for a cable provider acting as an ISP (due to the Cable Privacy Act, 47 U.S.C. § 551), non-cable providers are not subject to the same limitations. Likewise, cable providers will sometimes provide proposed orders, which, when signed, trigger the provider’s duty to turn over the requested information. Armed with the IP address and the user connected to the IP address, the party is equipped to amend pleadings to add the defendant’s name, connecting the defendant to the malicious post.
Note: Generally, the IP address will be in the possession of the Website or service where the post was made, e.g., Yelp or Google. A subpoena to obtain the IP address leads (using an IP lookup website) to the internet service provider (Comcast, CenturyLink, etc.) that made the connection between the user’s device (e.g., laptop, desktop or iPhone, etc.) and the Web site where the accused post was published.
