Poisoned Fruit: Evidence From a Compromised System
A hash proves a file did not change after it was collected. What happened before collection is the question a court must decide.
A hash proves a file did not change after it was collected. What happened before collection is the question a court must decide.
The question a judge actually has to answer is not whether a sheriff's office did something wrong. It is narrower and more awkward: if the data behind an exhibit was handled by a system the accused says was used against him, what has to happen before a jury sees it? That is a chain of custody question — and it is older than any of the technology involved.
What authentication requires — Federal and Texas rules:
A hash is a fingerprint of a file. It proves the file did not change between two moments. It says nothing about what happened before the first of those moments — and that is where a compromised environment becomes an evidentiary problem rather than a technical complaint. A pristine hash of a record extracted from a system nobody can audit is a guarantee about the wrong end of the timeline.
Three places a chain breaks:
“A hash is a fingerprint of a file.”
When the vendor sits in between — private companies and state action:
Private companies are not usually bound by the Fourth Amendment — the exception is when they act as an instrument of the state. Courts ask whether the government exercised coercive power, encouraged the private conduct, or so intertwined itself with the private actor that the action is fairly attributable to the state. A jail telephone contract, awarded by a county, performed inside a county facility, with recordings delivered to county investigators on request — is a relationship a court will look at closely. The civil rights claim, if there is one, runs under 42 U.S.C. §1983 and the doctrine courts call joint action.
Brady obligations — the county cannot sign them away:
The duty to disclose material exculpatory evidence — including a record of a detainee's calls, messages, and visits — is not discharged by pointing the finger at a contractor. A county cannot shed its constitutional obligations by signing a contract.
What this is not saying — and what it is:
It is not saying that any exhibit in any case is fabricated — and a reader should not take it that way. It is saying that the integrity of digital evidence is a testable proposition, that the tests are ordinary, and that a party who cannot produce the underlying records is asking the court to accept a conclusion on faith. That standard applies to the state and to the defense alike.
What the Record Shows:
Which documents do not prove an evidentiary violation in any particular prosecution — but they do establish that the questions are being asked about a real system, in a real county, by a person with a documented stake in the answer. Courts respond to specificity: a motion that names the record, the custodian, and the gap is a motion that gets answered.