In December 2017, two additions to the US Federal Rules of Evidence quietly changed the economics of digital evidence. Rules 902(13) and 902(14) made certain electronic records self-authenticating: offered with the right certification, they need no foundation witness at trial to establish authenticity.

  • 902(13) covers records generated by an electronic process or system shown to produce an accurate result.
  • 902(14) covers data copied from a device, storage medium, or file, authenticated by a "process of digital identification."

Both require a certification by a qualified person and reasonable advance notice to the other side. The effect is a rebuttable presumption of authenticity: the opponent must decide whether to mount a challenge, rather than authenticity being litigated live by default.

Where "hash" actually lives — and why it matters

Here is the detail practitioners get wrong constantly: the word "hash" does not appear in the rule. The rule requires a "process of digital identification." Hashing appears in the Advisory Committee Notes — the official commentary — as the paradigm example: if the fingerprints of the original and the copy match, the copy is authenticated.

The distinction is not pedantic. The rule is binding; the note is persuasive. So the precise claim is never "we comply with hash" — hash is not the standard. The claim is: the record satisfies the process-of-digital-identification requirement, implemented through hash comparison, the method the committee itself endorses. The same notes add that the rule is flexible enough to accommodate other reliable means, including future technology — which is where newer corroboration layers, like public-network anchoring, find their footing as reinforcement rather than as the headline.

What the rules pointedly do not resolve

The committee illustrated the limits with an example strikingly close to everyday web-evidence practice: a plaintiff offers a printout of a web page carrying a defamatory statement, with a qualified person's certification of the capture process. The certification establishes that the page is authentic — and the defendant remains free to argue he never posted it. Authentication is not authorship. Nor does 902(14) touch relevance, hearsay, or accuracy; each is challenged separately.

There is also a human constant: certification comes from a qualified person, and software cannot testify. If the method itself is attacked, someone who understands it must be able to defend it under examination. The rules reduce friction; they do not remove people.

The practical takeaway

902(13)/(14) reward exactly one kind of preparation: records built, from the moment of capture, around a documented process and a verifiable digital identification — fingerprints computed at collection, custody accounted for, verification open to the other side. Records prepared that way ride a presumption. Records assembled after the fact fight uphill for authenticity the old, expensive way.

General information about US federal evidence rules, not legal advice for any specific matter.