Authenticating a Web Page

The four assertions inside one web exhibit

This is written for counsel deciding what a web exhibit will carry in an internet defamation matter. A web page is not a document. It is a set of instructions executed by a browser against a server that can send different bytes to different requesters at the same instant, and nothing at all tomorrow. Authentication under FRE 901(a) asks for evidence sufficient to support a finding that the item is what the proponent claims it is, and in a defamation case that claim contains four assertions rather than one.

1. This text existed.
2. It was at this URL.
3. It was there on this date.
4. It was visible to the public, or to a defined audience.

A method can be strong on one of those and silent on the rest, which is why arguments about web evidence talk past each other. The recurring dispute is not the first assertion; it is the third and the fourth. What follows is what each method records, and what it leaves unrecorded.

Why a screenshot is not a capture

A screenshot establishes that a screen once looked a certain way. That is the entire proposition; everything a caption adds is assertion. A bare screenshot — above all a phone photograph of a monitor — does not establish:

• The URL. Unless the address bar is legible in the same frame as the content, the URL is a caption. Mobile app screenshots usually have no address bar at all.
• The date. The device clock is user-settable, a screenshot's file timestamp is the capturing machine's clock, and a photograph's EXIF timestamp is the phone's clock.
• That the server sent this. Developer tools let anyone edit the visible text of any page in seconds and screenshot the result. A screenshot has no property distinguishing it from a fabrication of that kind, and it is the first thing a competent opponent raises.
• Public visibility and completeness. A logged-in view, a personalized view, an A/B variant and a geo-targeted variant look identical in an image, and a viewport screenshot omits everything below the fold.

The Scientific Working Group on Digital Evidence puts screenshots last in its acquisition hierarchy — the least forensically sound manner of acquiring online content, to be used alongside stronger methods. The decisions agree: in United States v. Vayner (2d Cir. 2014) the court reversed where a social-networking profile printout was offered with nothing tying the page to the defendant beyond its own contents. Screenshots are still worth taking — a photograph of an ephemeral Story beats nothing — and belong at the bottom of the ladder rather than dressed up.

What a defensible collection actually contains

The strongest collection records the interaction, not a picture of it: a full-page rendered image with the address bar visible, the served HTML, the post-JavaScript DOM, the response headers, a hash of every file, a contemporaneous capture log, and where possible a WARC file — the archival format that stores a page together with the requests and server responses that produced it. WARC is an international standard, ISO 28500:2017, written by wget --warc-file or by the Webrecorder tools. Its value is that it can be replayed and the replay compared against the original response headers, which no image format supports.

One habit decides more than the tool choice: capture the same URL more than once where the content is dynamic, so change over time is documented rather than argued about later.

Hashing, and the moment it starts counting

A hash is a fixed-length digest computed from a file's bytes; change one byte and the digest changes. The 2017 Advisory Committee Note accompanying FRE 902(14) describes hash values as the ordinary method of authenticating an electronic copy, stating that identical values reliably attest that the original and copy are exact duplicates. Two points sit underneath that, and the Note makes neither.

Algorithm choice is now a cross-examination line. MD5 and SHA-1 are no longer defensible as collision-resistant: the SHAttered demonstration by CWI Amsterdam and Google in February 2017 produced two distinct PDF files with the same SHA-1 digest. NIST's approved hash functions are specified in FIPS 180-4 (August 2015) and FIPS 202, and SHA-256 is the practical default. An existing MD5 manifest is not worthless, but it hands an opponent a free and accurate line of questioning.

A hash proves integrity forward from the moment of hashing, and not one second before. It says the file has not changed since it was hashed. It says nothing about whether the file faithfully represents what the server sent. Conflating those claims is the most common overstatement in this area, and it is why the interval matters: hash at collection, record the digest in the log at that moment, and the claim covers the whole life of the file.

A timestamp token narrows a different gap, proving a digest existed before a given moment on a third party's clock under IETF RFC 3161.

What the Internet Archive declaration attests to, and what courts have done with it

The Internet Archive publishes the declaration it will sign, at archive.org/legal/affidavit, read 12 August 2026. The declarant is a Records Request Processor at the Archive, declaring of that person's own knowledge; the method is web archiving software that automatically stores copies of files available via the Internet; and the exhibits are true and accurate copies of browser screenshots of the Archive's records of those files.

So it attests to a narrow proposition: the Archive's records show a file at this URL was captured at this extended-URL timestamp, and the screenshots are true copies of what those records show. It does not attest that the crawler saw what the public saw, that the capture is complete, or that no intervening version existed. The limitation the Archive states about its own product comes from the operator, not an opponent:

"The date indicated by an extended URL applies to a preserved instance of a file for a given URL, but not necessarily to any other files linked therein… the primary HTML file and the other files will each have their own respective extended URLs and may not have been archived on the same dates."

— Internet Archive, standard affidavit text, read 12 August 2026

Clicking an archived hyperlink serves the file with the closest available date, so a Wayback exhibit is a composite that walks the viewer silently across time. A caption reading "the page as it appeared on 14 March 2024" overstates unless it names the extended URL and confines itself to the primary HTML file. Against that, the extended URL is a deterministic address anyone can retype for the same bytes. Three limits travel with it: a site owner may request exclusion, with no guarantee given beforehand about the outcome; absence of a capture proves nothing; and content behind logins or heavy JavaScript is often not archived.

The reported decisions run through the declaration rather than around it. In United States v. Bansal, 663 F.3d 634 (3d Cir. 2011), and in United States v. Gasperini, 894 F.3d 482 (2d Cir. 2018), Wayback exhibits were authenticated on an Archive witness who described the system and compared the printouts against the Archive's records. In Weinhoffer v. Davie Shoring, Inc., No. 20-30568, decided 20 January 2022, the Fifth Circuit held a Wayback printout is not self-authenticating under FRE 902 and that taking judicial notice of it was an abuse of discretion, reasoning that a private internet archive falls short of a source whose accuracy cannot reasonably be questioned. The reported failures cluster on proponents who skipped it.

How FRE 902(13) and 902(14) fit a web capture

Two 2017 additions to Rule 902 supply the mechanism by which a certified electronic record is self-authenticating, and they fit different halves of a collection. FRE 902(13) covers a record generated by an electronic process or system that produces an accurate result — the fit for a capture tool's output, a server log, an automated crawl. FRE 902(14) covers data copied from a device, medium or file and authenticated by a process of digital identification — the fit for a hashed copy of a collected file or a platform's exported archive. Most collections implicate both: the crawl is a process, the resulting files are copies.

Both incorporate the certification and notice requirements of FRE 902(11) by reference, and neither defines a qualified person beyond requiring information sufficient to establish authenticity if a witness gave it at trial. In practice that is whoever ran the collection and can describe the process, which is why the capture log matters: it is the raw material the certification is written from, and a capture made with an unnamed extension whose behavior nobody can describe gives that person nothing to certify. The Advisory Committee stated the ceiling:

"A certification under this Rule can establish only that the proffered item has satisfied the admissibility requirements for authenticity."

— 2017 Advisory Committee Note to Fed. R. Evid. 902, as the research reports it

These are the federal rules; many states have adopted parallel provisions and some have not, and which set governs is a question for counsel. One commercial note belongs here. Vendors sell captures delivered with a signed certificate and a hash manifest. What they add is real — an operator who can be deposed, a documented process — but no evidentiary status, because no rule confers it.

What authentication does not reach

The value of doing this properly is bounded, and stating the boundary is part of doing it properly. A well-collected, well-hashed capture shows a page existed in this form at this URL at this time and that the files have not changed since. It shows nothing about four things counsel still needs.

• Whether the collected page was the page the public saw. The capture is one requester's view; personalization, geo-targeting, experiment assignment and login state all break the equivalence.
• Whether the statement is false. Authentication is silent on content.
• Who wrote it. A page carries a display name, which is a claim the page makes about itself. What connects an account to a person sits in platform records reachable only by process.
• How many people read it. No property of a capture measures readership, and no platform metric measures readers either.

Letting a clean capture imply the rest is the central overstatement risk in this discipline, and it is why a finding has to be stated as narrowly as the record supports. On this method the honest statement is unusually strong: another analyst, given the same URL, the same extended-URL timestamp or the same WARC, and the same hash manifest, reaches the same result. That is what reproducible means here, and it is worth something precisely because it stops where it stops.

Frequently Asked Questions

Published 2026-08-15