Posted in Authentication Forensic Video Analysis

Case Study: Authenticating Facebook Video – “We Live!”

Case Study: Authenticating Facebook Video – “We Live!” Posted on March 15, 2019

The admissibility of Facebook video was at issue in Lamb v. State of Florida, 246 So.3d 400 (2018) (District Court of Appeal of Florida, Fourth District).  The defendant was being tried for two carjackings and the state sought to introduce Facebook Live video apparently recorded within minutes of the carjackings and purporting to show the defendant in one of the stolen cars.  A digital forensic examiner testified that he found the video evidence on a co-defendant’s public Facebook page.  He downloaded the video and confirmed that it was a faithful copy of the one found on Facebook.  He could not say whether the date and time stamp reflected the time when the video was recorded or when it was posted to Facebook.  Aside from the date and time stamp, he could not say when the video was actually recorded.  At trial, the prosecutor first claimed that the Facebook video was self-authenticating. When that patently incorrect statement was not accepted by the court, the digital forensic examiner was called to testify.  The state also called police and civilian evidence identifying the stolen vehicle and the defendant in the video.  It was that evidence collectively that met the threshold test for authentication.

The trial court found that the state had sufficiently established authentication of the video such that it became a matter for the jury to decide.  

The District Court of Appeal of Florida, Fourth District, was asked to review the trial court’s ruling on authentication.  The Court stated that the mere fact than a video appears online does not make it self-authenticating.  Predicate testimony to establish its authenticity may be required. The Court further stated at p. 408-410:

However, “authentication for the purpose of admission is a relatively low threshold that only requires a prima facie showing that the proffered evidence is authentic; the ultimate determination of the authenticity of the evidence is a question for the fact-finder.” Mullens, 197 So.3d at 25. “Evidence may be authenticated by appearance, content, substance, internal patterns, or other distinctive characteristics taken in conjunction with the circumstances. In addition, the evidence may be authenticated either by using extrinsic evidence, or by showing that it meets the requirements for self-authentication.” Symonette v. State, 100 So.3d 180, 183 (Fla. 4th DCA 2012)(quotation marks and citation omitted).

Here, the state met the relatively low threshold required to authenticate the Facebook video. The digital forensic examiner visited one of the codefendants’ public Facebook page. He looked for videos posted within the carjackings’ time frame. He found a Facebook Live video showing the stolen vehicles being driven by the defendant and the codefendants. He downloaded the video, verified that the original and the downloaded videos were the same, confirmed that the video which the state sought to introduce into evidence was the same video which he downloaded, and testified that the video remained posted on the codefendant’s Facebook page at the time of trial. The first victim testified that the defendant could be seen on the Facebook video driving the first victim’s car while wearing the first victim’s watch while a codefendant counted the first victim’s Cuban money. The Jupiter police detective also testified that the defendant could be seen on the Facebook video driving the first victim’s car while stating “we live” on the video. Based on this evidence, we conclude the state made a prima facie showing of the video’s authenticity for the purpose of admission into evidence, thus allowing the jury to make the ultimate determination of the weight to be given to the video’s contents.

The defendant’s argument that we should require the state to provide testimony from the defendant, codefendants, or other witnesses who appear in the video, or from someone who recorded the video, sets the authentication burden too high. See U.S. v. Broomfield, 591 Fed. Appx. 847, 852 (11th Cir. 2014)(Biggins factors usually applied to admitting government surveillance, such as how recording occurred, the recording equipment’s condition, and how relevant speakers were identified, were unnecessary to authenticate a YouTube video, because “the prosecution could seldom, if ever, authenticate a video that it did not create.”). Instead, as in Broomfield, if the video’s distinctive characteristics and content, in conjunction with circumstantial evidence, are sufficient to authenticate the video, then the government has met its authentication burden. Id.

We choose to follow the Eleventh Circuit and other courts which have permitted the admission of social media videos in criminal cases based on sufficient evidence that the video depicts what the government claims, even though the government did not: (1) call the creator of the videos; (2) search the device which was used to create the videos; or (3) obtain information directly from the social media website. See, e.g., U.S. v. Washington, 2017 WL 3642112, *2 (N.D. Ill. Aug. 24, 2017)(YouTube video which the government contended showed the defendant and several other men pointing firearms at the camera was sufficiently authenticated where law enforcement witness would testify that he watched this video on YouTube, recognized the defendant, and downloaded the video); State v. Gray, ––– So.3d ––––, ––––, 2017 WL 3426021, *16 (La. Ct. App. June 28, 2017) (YouTube videos were sufficiently authenticated where the investigating officer’s testimony provided sufficient support that the videos were what the state claimed them to be, that is, videos depicting the defendant and other gang members in a park and surrounding area). As the Washington court stated, “[w]hile a witness with [knowledge of the video’s creation] could authenticate [the] video, Rule 901 does not require it.” 2017 WL 3642112 at *2.1

Here, as in the foregoing cases, the state met its authentication burden. The state presented the Jupiter Police digital forensic examiner’s testimony regarding how the Facebook video was obtained and its distinctive characteristics, and the first victim’s and the Jupiter police detective’s testimony regarding the Facebook video’s distinctive content. Therefore, the trial court did not abuse its discretion in admitting the Facebook video into evidence over the defendant’s objection that such evidence was not properly authenticated.  

This case is helpful as it illustrates a willingness by the courts to accept a broad array of evidence in aid of the authentication of social media video.  The digital forensic examiner was limited in what he was able to say in aid of authentication.  He was able to confirm that the video appeared to have been uploaded around the time of the carjackings but could not be certain as to the date and time the events depicted actually occurred.  Nor was there any evidence as to whether the video had been altered in any way.  He was able to confirm that he had captured the entire video as it appeared on Facebook and that a true copy was before the court.

As noted in an earlier post on this website entitled “Social Media Images: Authentication Challenges”, this type of technical evidence would likely be insufficient to meet the authentication threshold as there was nothing in the video itself to specifically tie it to the defendant, absent additional testimony.  What elevated this case to achieving authentication was the evidence of the victim of the carjacking who viewed the video and was able to:

  • Identify the defendant before the court and the person seen in the video as being the person who had carjacked him.
  • Identify the defendant in possession of his car.
  • Identify the defendant in possession of his watch.
  • Identify a co-defendant counting Cuban money, noting that Cuban money had been stolen from the victim.

This eyewitness testimony effectively eliminated the most common problem with social media video – the inability to link it to the defendant.  

When the person who shot the video or someone present in the video is able to testify to confirm the accuracy of the video, authentication may also be established, but this method of authentication is often absent. When seeking to authenticate social media video, it is important to present technical evidence as to the integrity of the video (if that is determinable) and further evidence to establish the accuracy of what is being portrayed and the necessary link to the defendant.  When that is done, the statement “We Live!” becomes “We in Trouble!”