Authenticating Web Evidence

The bar is lower than most people assume, and that cuts both ways

Rule 901(a) asks for one thing: the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is. That is not proof of authenticity but a threshold showing, and courts have long treated it that way. In Telewizja Polska USA, Inc. v. Echostar Satellite Corp., No. 02 C 3293, 2004 WL 2367740 (N.D. Ill. Oct. 15, 2004), the court described Rule 901 as requiring “only a prima facie showing of genuineness” and leaving it “to the jury to decide the true authenticity and probative value of the evidence.”

Two consequences follow, and litigators tend to internalize only the first. The good one is that you rarely need to prove a web page is accurate to get it in; you need someone who can say what it is. The bad one is that a low bar is still a bar, and a record with nothing on it clears nothing. Exhibits fail authentication not because the opponent proved them false but because the party offering them never put on the two minutes of testimony that would have established what they were.

Five hurdles, not one

The organizing framework for electronic evidence is Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (D. Md. 2007), Judge Paul Grimm's roughly hundred-page treatment of admitting electronically stored information. It sets out five hurdles, and an exhibit must clear all of them:

1. relevance, under Rules 401, 402, and 105;
2. authentication, under Rules 901 and 902;
3. hearsay, under Rules 801 through 807;
4. the original writing rule, under Rules 1001 through 1008; and
5. unfair prejudice and the rest of the Rule 403 balance.

Lorraine also discusses hash values and metadata as authentication methods, which is where the 2017 self-authentication rules later landed. The practical value of the framework is diagnostic: when an exhibit is in trouble, the first question is which hurdle it is failing, because the fixes are different and are not interchangeable. A screenshot with no capture record fails at hurdle two. An archived page offered to prove that its contents were true fails at hurdle three no matter how well authenticated it is. A chart with a truncated axis fails at hurdle five with a perfect foundation.

What a screenshot is, before anyone testifies about it

Standing alone, a screenshot is an image file. It carries no reliable record of the URL requested, the date and time of the request, the time zone, the device and browser, whether the person capturing it was signed in to an account, or whether anything was edited afterward. Text on screen can be changed in a browser's developer console in about four seconds.

Search results add a problem general web evidence does not have. What a search engine returns is personalized and localized — results vary by location, language, device type, and in some cases by the account's own history — so two people running the same query at the same moment can legitimately see different pages. An exhibit captioned “Google results for the plaintiff's brand” states almost nothing until the witness fixes the query string, the location, the device, and the account state.

The capture record is therefore the exhibit's foundation, and it is short: the full URL requested, the date and time with the time zone, the method and tool used, the device and browser, the signed-in or signed-out state, the location or the location setting forced, the person who performed the capture, and where the resulting files were stored. In my experience an exhibit survives or fails on whether that record was written at the time or reconstructed from memory a year later.

Route one: a witness with knowledge, under 901(b)(1)

Rule 901(b)(1) accepts testimony of a witness with knowledge that an item is what it is claimed to be. For web evidence that is usually the person who made the capture, and it is the simplest foundation available: no certification, no third party, no expert.

Its limits are where the route breaks. A witness can vouch for what that witness did. Someone who captured four pages cannot authenticate a ninety-page printout, and someone who received a folder of screenshots from a client cannot authenticate any of them; the most that witness can say is that the folder is the one received. Scope objections to bulk web exhibits are routine and usually correct.

The second limit is subtler. A witness with knowledge authenticates the capture, not the world. Testimony that the exhibit shows what the witness's browser displayed does not establish what a different user, in a different city, on a different device, would have seen. Where the disputed fact is what the public saw, the witness has to be able to speak to how the capture was configured to represent that.

Route two: distinctive characteristics and comparison

Rule 901(b)(4) allows authentication from the appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances. Web pages are unusually rich in these: a footer copyright line and year, a phone number, an address, a tracking identifier embedded in the page source, template markers unique to one content management system, an internal linking pattern, a typographical error repeated across a site. Taken together with circumstances — the page was produced by the opposing party in discovery, or matches a version in that party's own files — the showing is often stronger than a custodian's testimony.

Comparison is the adjacent route, and the Federal Circuit gave it force in Valve Corp. v. Ironburg Inventions Ltd., 8 F.4th 1364 (Fed. Cir. 2021). The Board had refused to consider a printout for want of authentication; the Federal Circuit reversed, holding it could be authenticated by comparison under Rule 901(b)(3) with an authenticated specimen — the same article as it appeared in a certified prosecution history — because the two were “nearly identical, with the same text, number of paragraphs, and images.” The court also rejected the assumption that expert testimony was needed: “There is no requirement that such testimony be supplied,” since Rule 901(b)(3) contemplates comparison by the trier of fact.

The practical lesson is to look for a second copy: a page that also exists in a document production, an attachment, or a filing gives you a comparison specimen.

Route three: the process or system, under 901(b)(9)

Rule 901(b)(9) permits authentication by evidence describing a process or system and showing that it produces an accurate result. It is the rule written for machine output, which is most of what a search matter consists of.

It is the hook for a crawler — an automated program that requests a list of URLs and records what each server returns, including the status code, the response headers, and the page source. It is the hook for a web server log, the file a server writes recording every request it received. It is the hook for an archiving service, and for an analytics system, the tagging and reporting infrastructure that records visits to a site.

What 901(b)(9) asks for is a description of the system and a showing that it produces an accurate result. In practice that means explaining what the tool requests and how it records what comes back, stating the configuration used — crawl depth, user agent, whether JavaScript was rendered, rate limits, date range — and demonstrating accuracy, usually by reproducing the run or by comparing output against a state independently known to be true. Where this route fails, it fails for one reason: the proponent named a product instead of describing a process. “The crawl tool reported 412 broken links” is a brand assertion. “The crawler requested every URL in the sitemap and recorded the status the server returned; 412 returned 404; here is the configuration and a re-run showing the same result” is a process. Where a qualified person can certify the system, Rule 902(13) turns the same showing into a document.

Authentication is not admission

Clearing Rule 901 gets the exhibit past one hurdle. The next one kills more web evidence than authentication does.

Hearsay turns on what the exhibit is offered to prove. Offered to show that a statement was made, that a page was published, or that a party had notice, page content is frequently not hearsay at all. Telewizja Polska put it directly: to the extent images and text are introduced to show the images and text found on the websites, “they are not statements at all — and thus fall outside the ambit of the hearsay rule.” The court also treated the content as an opposing party's admission. Offered to prove that what the page said was true — that the product really had the specification listed — the exhibit needs a hearsay answer, and having authenticated it does not supply one.

Rule 403 is the other survivor. An accurate, well-founded exhibit can still be excluded where its presentation is more argument than information. That is a live risk for anything chart-shaped, and since 1 December 2024 it is governed by an explicit division between summaries admitted as evidence and illustrative aids that are not.

Where web foundations fail in search matters

The failures repeat, and each is recognizable early enough to fix.

• Capture with no record. Screenshots pasted into a slide deck with no URLs, no timestamps, and no capture log.
• Provenance laundering. An exhibit assembled from a third-party tool's export, where nobody can say what queries were run, from what location, or how the tool obtained its numbers.
• Scope overreach. A long printout of a site offered through a witness who examined a handful of its pages.
• Mismatch between exhibit and claim. A capture of one results page proves what one query returned to one configured device at one moment. It is not proof of a ranking held over time, and an opinion treating it that way invites a damaging cross-examination.
• Silent editing. Cropping, highlighting, and annotation done to the captured file rather than a working copy, so the exhibit no longer matches anything verifiable.

None of these is a legal problem when it is created. Each is a documentation problem that becomes a legal problem at the exhibit stage, when it can no longer be cured. If you are retained early, the highest-value hour of the engagement is the one spent capturing the live pages properly while they still exist. The current text of Rule 901 is published by the Legal Information Institute at Cornell.

Frequently Asked Questions

Published 2026-08-11