Self-Authenticating Electronic Records: How Rules 902(13) and 902(14) Work

You want the extracted phone data, the account export or the system log in evidence without flying in a forensic examiner or IT manager for ten minutes of foundation testimony. Since December 2017, Federal Rules of Evidence 902(13) and 902(14) have allowed certain electronic evidence to be authenticated by the written certification of a qualified person instead of live testimony, as long as the opposing party gets advance notice.

Used well, these rules save money and hearing time. Used carelessly, they produce a certification that the opponent picks apart, or one that authenticates a data file while the exhibit actually offered is something else. This guide explains what each rule covers, who can sign, what notice involves, what a 902(14) certification typically contains, and the limits that matter for text messages and other communications. It addresses the federal rules; state counterparts vary and some states have none.

What do Rules 902(13) and 902(14) cover?

Rule 902(13) covers records generated by an electronic process or system that produces an accurate result. Rule 902(14) covers data copied from an electronic device, storage medium or file, if the copy is authenticated by a process of digital identification. Both require a certification by a qualified person that complies with the certification requirements of Rule 902(11) or 902(12), and both require the notice described in Rule 902(11).

The advisory committee note to 902(14) describes hash values as the common method of digital identification, while leaving room for other reliable methods. If the concept is new to the team, the guide to what a SHA-256 hash value proves covers the mechanics.

What does a certification prove, and what does it leave open?

A certification under these rules establishes authenticity only: that the record or copy is what the proponent says it is. It does not make the evidence admissible over other objections.

• Hearsay. A certified copy of a text thread is still a collection of out-of-court statements. Each statement needs its own path, such as an opposing party’s statement under Rule 801(d)(2) or a hearsay exception. See hearsay and text messages.
• Relevance and Rule 403. Unaffected by certification.
• Authorship. A 902(14) certification shows the copied data matches the device. Many practitioners treat the separate claim that a particular person wrote a particular message as needing its own support, usually under Rule 901. The guide to authenticating text messages under Rule 901 covers that showing.
• Genuine challenges. The opponent can still contest authenticity. If they raise a real dispute, the proponent may need a live witness after all.

Who counts as a “qualified person”?

A qualified person is someone with enough knowledge of the process to make the certification truthfully, the same knowledge they would need to testify to it. For 902(14), that is typically the forensic examiner or technician who made and verified the copy. For 902(13), it is someone who understands how the system generates the record and why its output is accurate, such as a system administrator or records custodian.

The certification must comply with the 902(11) requirements, which in federal practice is commonly satisfied with a declaration under penalty of perjury. Choose a certifier who could appear if the certification is challenged. Someone who merely received files from another person, with no knowledge of how they were acquired, is a weak choice.

What does the notice requirement involve?

Rule 902(11) requires that, before the trial or hearing, the proponent give the adverse party reasonable written notice of the intent to offer the record and make the record and certification available for inspection, so the party has a fair opportunity to challenge them. The rules do not set a fixed number of days; scheduling orders and local practice often do.

1. Calendar notice early. Tie it to pretrial disclosure deadlines or the exhibit exchange, not the week before the hearing.
2. Serve a written notice. Identify each record, the rule relied on, and the certifying person.
3. Attach the certification. Include the signed certification, not a promise of one.
4. Make the data available. Provide the copy or a way to inspect it, along with the hash values and the tool and method used, so the opponent’s expert can verify.
5. Track the response. Note any objection and plan for a live witness on contested items.

What goes into a 902(14) certification?

A useful certification tells the court who did what, to which source, with which tool, and how the match was verified. The outline below is a starting structure that counsel adapts to the governing rule and the actual facts.

For 902(13), replace items 4 through 6 with a description of the system, how it generates the record, the controls or checks that make its output accurate, and how the specific record was retrieved. In both cases, keep a contemporaneous record of the handling between acquisition and the hearing; the guide to chain of custody for digital evidence includes a log format.

What mistakes undermine a 902(13) or 902(14) certification?

Most weak certifications fail on knowledge, timing or fit rather than on the technology. These are the problems opposing counsel looks for first.

• Hashing late. A hash computed weeks after the data reached the firm shows only that the file has not changed since then. The certification should describe a hash taken as close to acquisition as possible.
• Boilerplate in place of facts. A certification that recites the rule but never names the device, tool, date or hash values gives the court nothing to evaluate.
• The wrong signer. An attorney, or a staff member who never touched the acquisition, certifying a process they did not perform or observe.
• Algorithm mismatch. Certifying a SHA-256 value while the production or the opposing expert uses MD5, with no crosswalk between the two.
• Converted files. Certifying the original export, then offering a version that was converted, re-saved or compressed, which carries a different hash.
• Notice served too late. If the opponent did not have a fair opportunity to inspect, the certification may not do its job, whatever its quality.

Each of these is avoidable with a simple habit: hash on arrival, log every handoff, and draft the certification from the log rather than from memory.

When is the certification route worth it?

Certification pays off when authenticity is unlikely to be genuinely disputed but proving it live is expensive or slow. It is less useful when the real fight is about who wrote the messages.

• Good fit: an out-of-town examiner, many custodians or devices, high volume, a records custodian at a third-party business
• Good fit: you want authenticity settled before the hearing so preparation can focus on substance
• Weaker fit: authorship is the contested issue, which a hash cannot resolve
• Weaker fit: a short bench hearing where a participant can lay the foundation in minutes
• Weaker fit: there is not enough time left to give reasonable notice

Message logs are one natural fit. A tool like Message Extractor produces the log with a SHA-256 digest and a declaration template modeled on FRE 902(13)–(14), a template counsel completes and adapts; see how the message log and declaration fit together. In state court, first confirm whether your state’s evidence code has a counterpart to these rules at all. If it does not, plan on live foundation testimony or a stipulation, and have a licensed attorney in that jurisdiction confirm the approach before relying on a certification.