{
"slug": "federal-rules-evidence-rule-902-13-14",
"topic_id": "TOPIC-056",
"cluster": "Regulatory & Sovereign AI",
"tier": "Tier B",
"title": "Self-authenticating records: why some logs are admitted and others are not",
"summary": "Evidence rules provide a route for electronic records to authenticate themselves. A plain application log does not qualify; a record with a verifiable digital identification can.",
"lede": "The practical difference between producing a log file and producing evidence is whether anyone has to be put on the stand to vouch for it. Two provisions in the federal evidence rules turn that into a procedural question rather than a factual dispute.",
"date": "2025-11-03",
"category": "Compliance",
"author_id": "nadia-ferreira-strand",
"tags": [
"evidence",
"authentication",
"litigation",
"FRE 902",
"digital signatures",
"admissibility"
],
"image_title": "Self Authenticating Electronic Records",
"schema": "Article",
"key_takeaways": [
"Rule 902(13) and 902(14) allow certain electronic records to be self-authenticating with a qualified person's certification rather than live testimony.",
"902(14) turns on a process of digital identification — a hash or signature — which a plain JSON log does not have.",
"Authentication is a threshold question. Clearing it does not make evidence persuasive, but failing it makes everything else moot."
],
"body": [
{
"type": "h2",
"text": "What the two provisions do"
},
{
"type": "diagram",
"kind": "compare",
"alt": "Two records, two routes into evidence",
"caption": [],
"nodes": [],
"left": {
"title": "Plain application log",
"items": [
"A mutable row in a database",
"Integrity rests on system trust",
"Needs a custodian to testify",
"Attackable on access and retention",
"Authentication is contested"
]
},
"right": {
"title": "Signed record",
"items": [
"Hash and signature over content",
"Integrity checkable by anyone",
"Certification still needed",
"Tampering is detectable, not arguable",
"Authentication is a narrower fight"
]
}
},
{
"type": "table",
"head": [
"Provision",
"Covers",
"Requires"
],
"rows": [
[
"902(13)",
"Records generated by an electronic process or system",
"Certification by a qualified person that the process produces an accurate result"
],
[
"902(14)",
"Data copied from an electronic device, storage medium or file",
"Certification that the item was authenticated by a process of digital identification"
]
]
},
{
"type": "p",
"html": "Both provide a path to self-authentication with written certification plus notice to the opposing party, in place of calling a custodian to testify. Neither makes the evidence admissible on its own — relevance, hearsay and the rest still apply."
},
{
"type": "h2",
"text": "Why 902(14) is the interesting one"
},
{
"type": "p",
"html": "It contemplates a specific technical practice: identifying an item by a hash or comparable digital identification, so that the copy can be shown to be identical to the original."
},
{
"type": "p",
"html": "This is why forensic practice hashes acquired images. It is also why a record that carries its own cryptographic identification sits naturally within the rule, and a record that does not requires a different route."
},
{
"type": "h2",
"text": "What a plain log lacks"
},
{
"type": "code",
"text": "# A typical application log line\n{\"ts\":\"2026-05-18T14:22:01Z\",\"event\":\"payment.released\",\n \"amount\":84000,\"user\":\"u_4471\"}\n\n# Problems as evidence:\n# • no integrity marking — nothing distinguishes original from edited\n# • no identification of who produced it, beyond an account string\n# • authentication requires a witness on system reliability\n# • completeness and retention become disputed issues"
},
{
"type": "p",
"html": "None of this means such logs are inadmissible. They are admitted routinely, through a custodian's testimony and a business-records foundation. It means the process is slower, more expensive and contestable on grounds that have nothing to do with the merits."
},
{
"type": "h2",
"text": "What a signed record changes"
},
{
"type": "ul",
"items": [
"Integrity is verifiable by anyone with the published key, not asserted by a witness",
"The signing credential identifies a specific enrolled authenticator",
"The verification is reproducible — the opposing party can run it themselves",
"The record's contents are fixed at signing, so drift is detectable rather than arguable"
]
},
{
"type": "p",
"html": "The third point is the one litigators care about. Evidence an opponent can independently verify tends to be conceded rather than fought, which removes a motion from the schedule."
},
{
"type": "h2",
"text": "The certification still matters"
},
{
"type": "p",
"html": "Both provisions require certification by a qualified person. The cryptography does not remove that step; it makes what the person certifies simpler and more defensible."
},
{
"type": "table",
"head": [
"Without signatures",
"With signatures"
],
"rows": [
[
"The system reliably records events, based on my knowledge of its design and operation",
"This record was produced by our signing process; here is the published key and the verification procedure"
],
[
"Retention and completeness rest on process description",
"Each record stands alone and verifies independently"
],
[
"Cross-examination targets system reliability",
"Cross-examination targets whether the signer understood what they signed"
]
]
},
{
"type": "p",
"html": "The last row is where the argument moves, and it is a better place for it to be. Whether a person understood an approval is a real question about the merits; whether a database was reliable is a proxy fight."
},
{
"type": "h2",
"text": "What this does not do"
},
{
"type": "p",
"html": "Three limits worth stating plainly."
},
{
"type": "ol",
"items": [
"Authentication is not admission. Hearsay, relevance and privilege are separate questions and a signature addresses none of them.",
"A signature does not establish truth. It shows a credential signed a statement. Whether the statement was accurate is a factual question.",
"Practice is developing. How courts treat these provisions for cryptographically signed records is not uniformly settled, and outcomes vary by jurisdiction and judge."
]
},
{
"type": "p",
"html": "This is general discussion, not legal advice. Evidentiary questions are jurisdiction-specific and fact-dependent; take them to counsel."
},
{
"type": "h2",
"text": "Designing records with litigation in mind"
},
{
"type": "p",
"html": "If a class of action is likely to be disputed — payments, approvals, consent, oversight decisions — a few design choices cost little now and matter later."
},
{
"type": "ul",
"items": [
"Sign the record at the moment the action occurs, not when a report is assembled",
"Include a canonical form so the digest is reproducible years later",
"Publish the verification key at a stable location with a documented rotation history",
"Retain the verification tooling alongside the records",
"Keep the signed statement human-readable, so what was attested is self-evident"
]
},
{
"type": "h2",
"text": "A worked example: what the cross-examination looks like"
},
{
"type": "table",
"caption": "The same event, two postures",
"head": [
"Question to the witness",
"Plain log",
"Signed record"
],
"rows": [
[
"Who could edit this table?",
"Several administrators",
"Editing invalidates the signature"
],
[
"How do you know it was not changed?",
"Access controls and process",
"Verify the signature"
],
[
"Was the clock correct?",
"Server time, adjustable",
"Same issue — signatures do not fix time"
],
[
"Who authorised the action?",
"A user id in a column",
"A key bound to a person at enrolment"
]
]
},
{
"type": "p",
"html": "Note the third row: a signature says nothing about whether the timestamp is honest. Anyone claiming otherwise is overselling, and a careful opponent will find it."
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“Self-authentication means the record is admitted.” It means the authentication hurdle can be cleared by certification rather than live testimony. Relevance, hearsay and weight are all still live."
},
{
"type": "p",
"html": "“The certification is a formality.” It is not. A qualified person must attest to the process, and the quality of that person and process is itself attackable."
},
{
"type": "p",
"html": "This is a general description of evidentiary structure, not legal advice. Take any specific matter to counsel."
}
],
"faq": [
{
"q": "Does a signature make evidence admissible?",
"a": "No. It addresses authentication, which is a threshold question. Hearsay, relevance and privilege are separate and unaffected."
},
{
"q": "Is a certification still needed?",
"a": "Yes, both provisions require certification by a qualified person. The signature makes what they certify simpler and easier to defend."
},
{
"q": "Does the signature prove the statement was true?",
"a": "No. It shows a credential signed that statement. Whether the content was accurate remains a factual question."
},
{
"q": "Is the law settled here?",
"a": "Treatment of cryptographically signed records under these provisions is still developing and varies by jurisdiction. This is general discussion, not legal advice."
},
{
"q": "Does a signature make a record admissible?",
"a": "It addresses authentication. Relevance, hearsay and weight remain separate questions."
},
{
"q": "Does signing fix timestamp problems?",
"a": "No. A signature proves content integrity, not that the clock was honest. Use an external time source where timing matters."
},
{
"q": "Is the certification still needed?",
"a": "Yes, and it is attackable — the qualification of the certifier and the quality of the process both matter."
}
],
"sources": [
{
"t": "Federal Rule of Evidence 901 — Authenticating or Identifying Evidence",
"u": "https://www.law.cornell.edu/rules/fre/rule_901"
},
{
"t": "Advisory committee notes on the 2017 amendments to Rule 902."
},
{
"t": "NIST — digital forensics and evidence handling resources",
"u": "https://www.nist.gov/digital-evidence"
},
{
"t": "RFC 8037 — CFRG elliptic curve signatures for JOSE",
"u": "https://www.rfc-editor.org/rfc/rfc8037"
},
{
"t": "Federal Rules of Evidence, Rule 902 — Cornell LII",
"u": "https://www.law.cornell.edu/rules/fre/rule_902"
}
],
"related": [
{
"slug": "death-paper-trail-audit-distributed-ai-systems",
"title": "Auditing distributed systems without database dumps",
"category": "Compliance"
},
{
"slug": "digital-signatures-eidas-enough-difference-between-signed",
"title": "Signed PDFs versus action receipts",
"category": "Compliance"
},
{
"slug": "automated-compliance-auditing-manav-verify-external-auditors-re",
"title": "Re-performing controls offline",
"category": "Developer"
},
{
"slug": "zero-knowledge-fallacy-enterprise-approvals-plaintext-statements",
"title": "Zero-knowledge proofs and the audit that needs to see the data",
"category": "Compliance"
}
],
"image": "https://cdn.twc.sh/images/igcache/Self%20Authenticating%20Electronic%20Records/1500_900/blog.jpg",
"wordcount": 1013,
"url": "/blog/federal-rules-evidence-rule-902-13-14.html",
"reading_time": "5 min read",
"seo_title": "Self-authenticating records under FRE 902(13) and (14)",
"meta_description": "Evidence rules let some electronic records authenticate themselves. A plain application log does not qualify; a digitally identified record can.",
"hub": {
"slug": "topics/ai-oversight-regulation",
"title": "AI oversight and regulation"
},
"answer": "Because the rule rewards a specific property: a record identified by a process of digital identification, certified by a qualified person. A plain application log has no such identification — it is a mutable row whose integrity depends entirely on the trustworthiness of the system that holds it.",
"answer_q": "Why do some electronic records self-authenticate and others do not?",
"glossary": [
{
"term": "Self-authentication",
"def": "A route by which a record's genuineness is established by certification rather than live testimony."
},
{
"term": "Process of digital identification",
"def": "A mechanism — typically hashing and signing — by which a record can be identified and integrity-checked."
},
{
"term": "Qualified person",
"def": "Someone able to certify the process, whose qualification is itself open to challenge."
}
],
"checklist": {
"title": "Designing records with litigation in mind",
"id": "records",
"desc": "Five steps.",
"steps": [
{
"name": "Sign the record at creation.",
"text": "Not at export, which proves nothing about the interval."
},
{
"name": "Hash the content that matters.",
"text": "What was rendered, not just an identifier."
},
{
"name": "Bind the key to a person at enrolment.",
"text": "Otherwise you have authenticated a machine."
},
{
"name": "Keep the certification process documented.",
"text": "Someone qualified must be able to attest to it."
},
{
"name": "Be honest about timestamps.",
"text": "Use an external time source if timing matters."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav produces records with the property the rule rewards: a hash and signature over the rendered content, bound to a person at enrolment and verifiable by anyone.",
"href": "../docs.html",
"label": "See record structure"
}
}