2019 COA 150
Colo. Ct. App.2019Background
- Dropbox flagged an account for suspected child pornography and provided NCMEC a video, an account ID, an email address, an activity log, and an IP address; NCMEC forwarded that to local police.
- Police obtained search warrants for Dropbox and Comcast; Dropbox produced the account contents (including videos and stills) and activity records; Comcast traced the IP to a residential address tied to an account owned by the defendant’s girlfriend and roommate.
- At the residence search, a detective interviewed N.T.B.; he admitted owning a Dropbox account tied to his work email and watching pornography shared over Snapchat but did not confirm the account number.
- Prosecutor planned to introduce Dropbox and Comcast records to link N.T.B. to the files but had not endorsed custodians to testify under CRE 803(6) nor provided a CRE 902(11) certification; defense moved to exclude the records as hearsay/business records.
- The trial court excluded the records as inadmissible hearsay business records without a custodian or an affidavit, granted the defendant’s motion to dismiss, and the district attorney appealed.
- The court of appeals held the detective’s proffered testimony would have been sufficient to authenticate the records under CRE 901, but the records nonetheless constituted hearsay and were not admissible under the business-records exception without custodian testimony or a proper certification; the trial court’s exclusion was approved.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Dropbox/Comcast records could be authenticated under CRE 901 | Investigator’s testimony about issuing warrants and receiving records suffices to authenticate the records | Records lack direct indicia of authorship; need custodian or certification | Investigator’s proffer would have sufficed to authenticate under CRE 901 (prima facie showing met) |
| Whether the records were hearsay | Not hearsay because there is no human declarant or because defendant admitted owning the account | Records assert facts (account ownership, uploads, IP assignments) and are offered for their truth — so hearsay | Records were hearsay; prosecutor did not show they were nondeclarative computer-generated records |
| Whether the business-records exception (CRE 803(6)) or CRE 902(11) could admit the records without a custodian | Records are business records of Dropbox/Comcast and comparable to other computer-generated business records | No custodian testimony or certified affidavit was provided to show regular business practice and trustworthiness | Court correctly required custodian testimony or proper certification; absence of foundation justified exclusion under CRE 803(6)/902(11) |
| Whether user-generated content (photos/email) defeats business-records treatment for server-generated metadata (account ID, activity log, IP) | Server-generated account data are business records distinct from user content and should be admissible | User content differs from server metadata; third-party statements may require showing of substantial reliance | Court distinguished metadata (account IDs, activity logs, IP) as business-generated but held metadata still hearsay absent foundation; exclusion affirmed |
Key Cases Cited
- United States v. Whitaker, 127 F.3d 595 (7th Cir.) (officer who retrieved records during a warrant execution can authenticate electronic records)
- United States v. Sliker, 751 F.2d 477 (2d Cir.) (investigating officer may authenticate documents obtained under a warrant)
- Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534 (D. Md. 2007) (discusses authentication and reliability of electronically stored information)
- People v. Huehn, 53 P.3d 733 (Colo. App. 2002) (authentication and business-records precedent for computer-generated records)
- People v. Morise, 859 P.2d 247 (Colo. App. 1993) (authenticity does not eliminate hearsay concerns)
- People v. Lesslie, 939 P.2d 443 (Colo. App. 1996) (authentication standard and relevance of CRE 104 to weight vs. admissibility)
- People v. Berger-Levy, 677 P.2d 351 (Colo. App. 1983) (credit-card/financial records as business records)