Donati v. State, 2014 Md. App. LEXIS 6 (Md. Ct. Spec. App. Jan. 9, 2014):

Admissibility of E-mails

Appellant's first contention is that the circuit court abused its discretion by admitting e-mails that were not properly authenticated. The Maryland appellate courts have addressed the authentication of other forms of electronically stored information, see Griffin v. State, 419 Md. 343, 358, 19 A.3d 415 (2011) (pages printed from a social networking site); Dickens v. State, 175 Md. App. 231, 239, 927 A.2d 32 (2007) (text messages), but the parties did not cite, and we did not find, a reported opinion in Maryland addressing specifically the authentication requirements for the admissibility of e-mail messages. We shall address that issue in this case.

***

B.

Authentication Requirements

Maryland Rule 5-901 addresses the requirements to authenticate evidence, including electronically stored evidence. It provides as follows: "The requirement of authentication or identification as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims." Md. Rule 5-901(a). Subsection (b) of Rule 5-901 provides examples of how to authenticate evidence. It states, in pertinent part, as follows:

   (b) Illustrations. By way of illustration only, and not by way of limitation, the following are examples of authentication or identification conforming with the requirements of this Rule:

(1) Testimony of witness with knowledge. Testimony of a witness with knowledge that the offered evidence is what it is claimed to be.

* * *

(3) Comparison with authenticated specimens. Comparison by the court or an expert witness with specimens that have been authenticated.

(4) Circumstantial evidence. Circumstantial evidence, such as appearance, contents, substance, internal patterns, location, or other distinctive characteristics, that the offered evidence is what it is claimed to be.

* * *

(10) Methods provided by statute or rule. Any method of authentication or identification provided by statute or by these rules.

Rule 5-901(b), by its express language, which is derived from Federal Rule of Evidence 901, makes clear that the authentication methods listed in this Rule are not exhaustive. See Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 544 (D. Md. 2007) ("the methods identified by Rule 901(b) are non-exclusive"). In Lorraine, Judge Paul W. Grimm discussed the "many ways" in which e-mail evidence may be authenticated:

   "[E]-mail messages may be authenticated by direct or circumstantial evidence. An e-mail message's distinctive characteristics, including its 'contents, substance, internal patterns, or other distinctive characteristics, taken in conjunction with circumstances[,]' may be sufficient for authentication.

Printouts of e-mail messages ordinarily bear the sender's e-mail address, providing circumstantial evidence that the message was transmitted by the person identified in the e-mail address. In responding to an e-mail message, the person receiving the message may transmit the reply using the computer's reply function, which automatically routes the message to the address from which the original message came. Use of the reply function indicates that the reply message was sent to the sender's listed e-mail address.

The contents of the e-mail may help show authentication by revealing details known only to the sender and the person receiving the message.

E-mails may even be self-authenticating. Under Rule 902(7), labels or tags affixed in the course of business require no authentication. Business e-mails often contain information showing the origin of the transmission and identifying the employer-company. The identification marker alone may be sufficient to authenticate an e-mail under Rule 902(7). However, the sending address in an e-mail message is not conclusive, since e-mail messages can be sent by persons other than the named sender. For example, a person with unauthorized access to a computer can transmit e-mail messages under the computer owner's name. Because of the potential for unauthorized transmission of e-mail messages, authentication requires testimony from a person with personal knowledge of the transmission or receipt to ensure its trustworthiness."

Id. at 554 (quoting Jack B. Weinstein & Margaret A. Berger, Weinstein's federal evidence § 900.07[3][c] (Joseph M. McLaughlin ed., Matthew Bender 2d ed. 1997)).

Judge Grimm further noted:

   Courts . . . have approved the authentication of e-mail by the above described methods. See, e.g., [United States v.] Siddiqui, 235 F.3d [1318,] 1322-23 [(11th Cir. 2000)] (E-mail may be authenticated entirely by circumstantial evidence, including its distinctive characteristics); [United States v.] Safavian, 435 F.Supp.2d [36,] 40 [(D.D.C. 2006)] (recognizing that e-mail may be authenticated by distinctive characteristics 901(b)(4), or by comparison of exemplars with other e-mails that already have been authenticated 901(b)(3)); Rambus [Inc. v. Infineon Technologies AG], 348 F. Supp. 2d 698 [(E.D.Va. 2004)] (E-mail that qualifies as business record may be self-authenticating under 902(11)); In re F.P., 2005 PA Super 220, 878 A.2d [91, 94 [(Pa. Sup. Ct. 2005)] (E-mail may be authenticated by direct or circumstantial evidence).

Id. at 554-55.

C.

Specific E-mails at Issue

Appellant objects to the admission of numerous State's exhibits, collectively containing dozens of e-mails. He argues on appeal, as he did below, that these e-mails were unauthenticated and improperly admitted.⁵ The exhibits at issue are as follows: (1) State's Exhibit 23, admitted during Chief Manley's testimony, containing e-mails originating from several different addresses between April 20, 2011, and September 26, 2011, all but one of which were either sent or received by Chief Manley; (2) State's Exhibit 24, admitted during Detective Worsey's testimony, all of which were either sent or received by Detective Worsey; (3) State's Exhibit 57, admitted during Lieutenant Jones' testimony, containing e-mails originating from several different addresses between April 20, 2011, and October 2, 2011, all but two of which were either sent or received by Lieutenant Jones; (4) State's Exhibit 73, admitted during Detective Grapes testimony, containing e-mails originating from "Mr. Essex," that were all either received or sent by Detective Grapes between September 30, 2011, and October 4, 2011; and (5) State's Exhibits 28 through 54, admitted during Mr. Zeppos' testimony, each of which contained an e-mail, sent from a variety of different e-mail addresses between April 23, 2011, and October 3, 2011, to either Mr. Zeppos' personal work e-mail address or the e-mail address for Growlers that Mr. Zeppos monitored. As explained below, we agree with the circuit court that the e-mails were properly authenticated.

5   Defense counsel argued below that the e-mails had not been authenticated as "coming from the source." He asserted: "If the computer expert can link it to [appellant], then they come in, just like a handwriting expert would testify that a letter is ascribed to a certain author, then they would all come in."

The most direct method of showing the authenticity of an e-mail is testimony by someone with personal knowledge that the evidence is what it is claimed to be, i.e., an e-mail sent to or from a particular person. Thus, the proponent could admit the e-mail through the testimony of the author of the e-mail or a person who saw the author compose and send the e-mail. See Devbrow v. Gallegos, 735 F.3d 584, 587 (7th Cir. 2013). Accord Lorraine, 241 F.R.D. at 555 (one of "[t]he most frequent ways to authenticate email evidence" is through a "person with personal knowledge" pursuant to FED. R. EVID. 901(b)(1)); Safavian, 435 F. Supp. 2d at 42 (the author of an e-mail "may testify as to his or her personal knowledge of any particular e-mails he or she sent or received"); Christopher B. Mueller and Laird C. Kirkpatrick, 5 Federal Evidence § 9:9 (4th ed. 2012) ("A witness can authenticate an e-mail as one sent by that witness merely by identifying it as such.").

Here, many of the e-mails were admitted by direct evidence, i.e., through testimony of witnesses who were the authors of the e-mails. Specifically, Chief Manley, Detective Worsey, Detective Grapes, and Lieutenant Jones each testified regarding the content of e-mails that they authored and sent. Accordingly, these e-mails were properly authenticated by witnesses "with knowledge that the offered evidence is what it is claimed to be." Md. Rule 5-901(b)(1).

To be sure, many of the e-mails were not supported by direct evidence. As indicated, however, e-mails may be authenticated by circumstantial evidence that allows a finder of fact to determine that the e-mails are what the State claims them to be. See United States v. Fluker, 698 F.3d 988, 999 (7th Cir. 2012) ("Only a prima facie showing of genuineness is required; the task of deciding the evidence's true authenticity and probative value is left to the jury."); Lynn McLain, Maryland Evidence, § 901:1 (3d Ed. 2013) (an item "will be properly authenticated if its proponent has offered foundation evidence that the judge finds would be sufficient to support a finding by a reasonable trier of fact that the item is what it is purported to be").

Maryland Rule 5-901(b)(4) gives examples of the type of circumstantial evidence that will authenticate evidence, "such as appearance, contents, substance, internal patterns, location, or other distinctive characteristics, that the offered evidence is what it is claimed to be." Circumstantial evidence that has been used to authenticate e-mail messages includes forensic evidence connecting a computer to an internet address for the computer from which the e-mails were sent. Bobo v. State, 102 Ark. App. 329, 335, 285 S.W.3d 270 (Ark. Ct. App. 2008). Other circumstances have included an e-mail reference to the author with the defendant's nickname, where the context of the e-mail revealed details that only the defendant would know, and where the defendant called soon after the receipt of the e-mail, making the same requests that were made in the e-mail. Siddiqui, 235 F.3d at 1322-23.

Here, there was sufficient circumstantial evidence authenticating the e-mails as being what the State claimed them to be, e-mails sent by appellant. This evidence included e-mail addresses found on a paper in appellant's home and on his computer, as well as the common theme of the e-mails from various addresses. We explain.

Starting with Exhibit 23, the following names and e-mail addresses, other than those used by Chief Manley, included: (1) "Robert Fox" at "barsecurity123@gmail.com"; (2) "John Fox" at "barsecurity12345@gmail.com"; (3) "Mr. Tipster" at "mrtpstr83@gmail.com"; (4) "Mr. Tipper" at "mrtipper008@gmail.com"; (5) "Henry Clay" at "hclay3508@gmail.com"; (6) "Mr. Tipper" at "mr.tipper@hotmail.com"; (7) "Mr Tipper" at "mrtppr48@gmail.com"; (8) "Mr. Tipper" at "mr.tipper2@hotmail.com"; (9) "Mr. Tipper" at "mrtipper2011111@hotmail.com"; (10) "Mr . Tipper" at "weedlocator@hotmail.com"; (11) "StanleySkimmerhorn" at "stanleyskimmerhorn@yahoo.com"; and (12) "Mr. Essex" at "mr.essex@ymail.com."

As indicated, the name "Mr. Essex" was listed on a piece of paper found in appellant's basement. And Detective Heverly found a fragment of an e-mail from "Mr. Tipper" addressed to Chief Manley, as well as a Hotmail account for Mr. Tipper. Thus, these names, and the e-mails containing those names, were linked to appellant. Moreover, the context of the e-mails from Mr. Essex and Mr. Tipper linked all the other e-mails to appellant because they all referenced the same subject matter, a marijuana grow in State parks operated by the staff of Growlers. For example, the e-mail from John Fox, the name used after Robert Fox was abandoned, begins by stating: "I contacted you yesterday about a person I know who grows marijuana in Seneca Creek State Park, and Black Hills." Similarly, e-mails from "Mr. Tipster" and "Mr. Tipper" begin as follow, respectively: "I am the guy who's been contacting you about the marijuana grows in your park" and "I have been in touch with regard to the marijuana grows in the parks." The e-mail from Mr. Essex clearly tied it to the other e-mails, stating, in pertinent part, as follows: "Oh well. The cheese is all gone Mr. Manning. Maybe next year then. Perhaps by then you will have the money to afford my help. . . . Zeppos is a little smarter than you, however, because you never got him. He did manage to harvest some of his weed, but not all of it." Given the circumstantial evidence tying the e-mails in Exhibit 23 to appellant, the circuit court did not abuse its discretion in determining that this Exhibit was properly authenticated.

The e-mails in State's Exhibit 24, which were sent to Detective Worsey, came from two named authors and addresses: (1) "Mr. Tipster" at "mrtpstr83@gmail.com"; and (2) "Mr. Tipper" at "mrtipper008@hotmail.com." The first e-mail contained information about Mr. Allen's involvement in cultivating marijuana in state parks and stated: "If you want the cheese to catch this rat you need to do something for me." A subsequent e-mail from "Mr. Tipster" demanded help for a "friend" whom Growlers' staff had "beat up" and then "had . . . busted."

Subsequent e-mails from "Mr. Tipster" referred to information that the author could provide as "the Cheese," similar to the final e-mail from "Mr. Essex" to Chief Manley. The last e-mail sent from the "mrtpstr83@gmail.com" address on May 4, 2011, began as follows: "Mr. Worsey, [d]ue to the length of time you are taking to respond, and our need for security, this e-mail address will no longer exist. . . . I'll be in touch through another email address in a week or two." On May 19, 2011, "Mr. Tipper" at "mrtipper008@gmail.com" e-mailed Detective Worsey, and stated: "I found the attorney's name for the guy we saw get set up by the Growlers['] security staff"; the end of the e-mail contained a link to the website of an attorney referred to in an e-mail to Chief Manley. Based on the information contained in the previously admitted e-mails, and the clear similarities between the e-mails contained in Exhibit 23 and 24, there was sufficient circumstantial evidence to indicate that, not only was the author of the e-mails contained in both exhibits the same person, but that person was appellant.

Appellant next contends that the circuit court erred in admitting the e-mails to Mr. Zeppos. For the reasons discussed, infra, the circuit court did not abuse its discretion in admitting State's Exhibits 28 through 54 because there was sufficient circumstantial evidence to establish that the e-mails were sent by appellant.

State's Exhibit 57 consists of e-mails forwarded to, sent to, or sent by Lieutenant Jones. As indicated, Lieutenant Jones could authenticate the e-mails he sent. With respect to the other e-mails, we hold that there was sufficient circumstantial evidence to authenticate those e-mails as communications from appellant. Initially, several of the e-mails were sent by "Clayton Thomas III" at "cthomas03@hotmail.com." As indicated, "cthomas03@hotmail.com" was one of the e-mail addresses listed on the piece of paper seized from appellant's basement. This evidence was sufficient to authenticate these e-mails as coming from appellant. Moreover, the context of those e-mails, which referred to Growlers being "deeply involved in the drug trade," and offering to help "stop this group," involved the same subject matter as the other e-mails. There was sufficient circumstantial evidence to establish that the e-mails contained in Exhibit 57 were authenticated as being authored by appellant.

Finally, we turn to State's Exhibit 73. That exhibit contained an e-mail exchange between Detective Grapes and "Mr. Essex" at "mr.essex@ymail.com." As indicated, this e-mail address was found written on a piece of paper in a locked room in appellant's basement. The contents of the e-mails touched on the themes contained in e-mails to the other law enforcement officers, and they discussed Detective Grapes talking to the Montgomery County State's Attorney's office on behalf of the author's friend "Mike," who also went by the nickname "Montana," to have assault and drug charges against "Mike" dropped.⁶

6   As indicated, appellant stipulated that his nickname was "Montana."

Moreover, as indicated, three minutes after Detective Grapes sent out a call to the Drug Task Force on the police radio that he had found appellant's van, he received an e-mail from "Mr. Essex" stating that he could no longer work with Detective Grapes. Detective Grapes then sent out a second call indicating that the officers were to seize appellant's van, and appellant left his house and walked quickly toward his vehicle. The circuit court did not err in finding that State's Exhibit 73 was properly authenticated, as there was sufficient circumstantial evidence that appellant was the author of the e-mails contained therein.⁷

7   Even if an e-mail is authenticated, the e-mail is still subject to a challenge that the rule against hearsay prevents it from admission into evidence. See Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534, 562 (D. Md. 2007). Appellant did not, for good reason, object to the admission of the e-mails on hearsay grounds. See United States v. Siddiqui, 235 F.3d 1318, 1323 (11th Cir. 2000) (e-mail by defendant not hearsay because not offered to prove the truth of the substantive content and because it an admission of a party opponent), cert. denied, 533 U.S. 940, 121 S. Ct. 2573, 150 L. Ed. 2d 737 (2001).