Falsity and the Record

What I can fix, and what stays open

This page is written for counsel deciding what a technical examination adds to the falsity element, and where it runs out. I can establish what a page said and when it said it, in a form another analyst working from the same records can reproduce. I cannot establish whether what it said was true.

That is not a modesty formula. It is the line an opposing expert pushes on, and an expert who slides across it under cross-examination takes the rest of the report with him. Whether a statement is one of fact or opinion, who carries the burden of proving falsity, and whether substantial truth defeats the claim on these facts are questions for counsel; what follows is what the record shows.

What the record is good at is the as of question. A defamation timeline has moments in it: the day a sentence first appeared at an address, the day its wording changed, the day it moved. The technical work fixes those moments precisely enough that documentary evidence can be laid against them. That is a smaller job than the word falsity suggests, and usually the job actually needed.

Three classes of record, and I work in two of them

Falsity disputes run three kinds of record together. Separating them early decides where the expert money goes.

1. Records of what was published — archive captures, contemporaneous collections, platform exports. These establish content at a time.
2. Records of the underlying fact — corporate registries, court dockets, licensing boards, regulatory filings, property records, employment files. These establish the state of the world at a time.
3. Records of what changed — version history, edit logs, diffs, redirect chains. These establish sequence.

My contribution sits almost entirely in classes one and three. Class two is ordinary documentary evidence: a paralegal pulls it and a custodian authenticates it. Dressing it as a technical exhibit adds cost and supplies a methodology to argue about where none was needed. If the disputed sentence is that a clinic lost its license in a stated year, the capture shows the sentence was published on a date and the licensing board's own record shows the fact. Only one of those needs me.

What a web archive establishes, and what it does not

The Internet Archive is the default source for what a page said in the past and it is genuinely valuable. It is also crawl-driven, and its documentation says so. The Archive's Wayback Machine General Information page, read 15 August 2026, states that "hundreds of web crawls contribute to the web captures available via the Wayback Machine" while giving no crawl frequency and no assurance of coverage. It lists what is not captured, in its own words: "Pages that require a password to access," "Pages that are only accessible when a person types into and sends a form," pages subject to "robots exclusions," and pages where "some sites are excluded by direct site owner request."

The consequence is the point most often got wrong in this subject. The absence of a capture is not evidence that a page did not exist. That the archive holds no copy of a URL on a date is equally consistent with a page that existed and was never crawled. An expert who offers absence of capture as proof of non-existence has handed the other side a rebuttal written by the archive operator.

Two further limits belong in front of counsel before a chronology is built on captures. First, the crawler is not a user: logged out, cookie-less, and often not executing page scripts the way a browser does. Personalization, consent walls, paywalls and script-loaded comment threads all mean an archived copy may be one of several pages that URL served. Where the disputed content is a comment loaded beneath an article, it is frequently not in the archive at all.

Second, the Archive honors direct site-owner exclusion requests, so a Wayback URL cites something a third party can ask to have withdrawn. The response is cheap and belongs on the day the capture is found: collect the archived page itself — rendered page, page source, response headers, the Wayback URL and its timestamp — and hash it.

Why the corroborating copy is gone

Until recently an archive capture could be checked against a second, independently maintained snapshot: the search engine's cached copy, made by a different crawler on a different schedule. Two unrelated records agreeing about what a page said is a far stronger position than one. That cross-check has largely disappeared. In September 2024 the Internet Archive announced that archived versions had instead become reachable from inside Google's search interface — Internet Archive Blogs, New Feature Alert: Access Archived Webpages Directly Through Google Search, 11 September 2024, read 15 August 2026.

I am deliberately not giving a date for the cache retirement or quoting Google about it. I could not locate a first-party statement, and the accounts in circulation trace back to trade press rather than to the operator. Where I cannot read the operator's own page, I say so instead of repeating a number from somewhere else.

The consequence does not depend on that gap being filled: the historical record of the open web is now materially more concentrated in one non-profit archive than it was two years ago. For a litigator that is a preservation argument rather than a complaint. Independent contemporaneous capture, made by a party and hashed on the day the content is found, carries more weight because there is less left to check it against.

Where change is actually documented

Sequence is often more useful than content. Whether wording was softened after a demand letter, whether a passage was added to an old post, whether a page moved — those are answerable from change records, which are unevenly distributed.

• Wiki-style platforms expose a public revision history with per-revision timestamps, the editing account, byte deltas and edit summaries. It is the richest public edit record on the open web. Before putting one of its timestamps in a report I check the platform's documentation for the time-zone convention and for the mechanisms that hide a revision from public view, because both change what the visible history means.
• Consumer platforms are inconsistent, and the inconsistency is the finding. Some expose an edit trail, some silently replace the text, and review platforms display only the current version. The internal record frequently exists where the public view does not, which makes edit history a discovery request rather than an observation.
• Content management systems retain post revisions in the database by default. On a defendant's own site this is often the single most probative artifact available: the wording at each save, with a user and a timestamp. Routine database cleanup destroys it. A demand naming "the website" does not reach it; one naming post revisions, the database and the media library does.
• Version control is weaker than it looks. A commit's dates are written by the client and can be set to any value. Anything independent has to come from the host's server-side record of when the push arrived, and what that record holds is a question for discovery rather than an assumption.

Time anchors that are not my clock and not the publisher's

The weakest form of dating evidence is a screenshot with an operating system clock in the corner: it records what one machine believed the time was. The most defensible thing I add to an as of question is a time source controlled by neither the collector nor the publisher.

The first is the server's own Date: response header, captured alongside the page. It is generated by the responding server, independent of the collecting machine, and costs nothing to preserve if the collection is done properly.

The second is stronger and under-used here. Certificate Transparency logs are public, append-only and independently operated. RFC 9162, Certificate Transparency Version 2.0 (December 2021, read 15 August 2026) describes a log as "a single, append-only Merkle Tree of submitted certificate and precertificate entries," a structure allowing "anyone to audit certification authority (CA) activity," whose trees "can be used to efficiently prove that any particular instance of the log is a superset of any particular previous instance." A Signed Certificate Timestamp is "the date and time at which the certificate or precertificate was accepted by the log."

In a defamation matter that anchors infrastructure rather than words: when a hostname first existed and held a certificate, which dates when a site went live, when a look-alike domain was stood up, and when a hostname changed hands. What it does not touch is content. Used inside those bounds it is one of the few cryptographically verifiable time anchors on the open internet; offered beyond them it proves nothing about the case.

Why I plan for the stricter assumption

The reported decisions on archive evidence do not point one way. Some courts have treated archived pages as suitable for judicial notice; others have looked for testimony supporting them. Which line a particular court sits on is a legal question and not mine to answer.

What follows for the engagement is practical. I plan on the stricter assumption, which means the collection is documented while it happens: what was collected, from what address, at what time, with what tool, producing what hash. That record costs an hour on the day and cannot be manufactured later.

I am naming the split rather than reciting cases. The case lists in circulation on this point come from secondary summaries, and a citation an attorney has to check before using is not worth putting in front of one.

Where the timeline stops and the fact begins

Contemporaneous records establish what was said and when. They do not establish whether it was accurate. That sounds obvious written down and is violated constantly, usually by an expert who has assembled a careful chronology and then adds a paragraph characterizing the statement.

There is a quieter version of the same error. Truth is assessed as of some moment, and which moment comes from the law and from counsel's theory rather than from the data. My job is to date the statement and the surrounding record accurately enough that whichever moment counsel identifies can be examined. Choosing it is not a technical decision.

So the honest description of a falsity examination is this: a dated, hashed, reproducible account of what appeared at an address, what changed, and in what order — laid out so registry records, board records, filings and testimony can be set against it. The comparison itself is argument, and argument belongs to counsel.

When this element does not need an expert

Three situations come up often enough to name, and in each, retaining anyone is a poor use of a client's money.

The publication date is undisputed and the wording has not changed. If both sides agree when the post appeared and what it says, there is no as of question left. The dispute is about the underlying fact, which lives in class two records needing a custodian.

Nothing was preserved and nothing crawled it. A low-traffic site the archive never captured, a host whose logs rotated away, a deleted post with no contemporaneous collection. There may be nothing to examine, and that is worth establishing in a first conversation rather than after a retainer.

The real dispute is defamatory meaning. Whether a sentence carries the imputation the complaint alleges is not settled by dates, diffs or hashes. It is a reading question, and forensic chronology does not move it.

Where the work pays for itself is specific: contested sequence, an undocumented wording change, a page that moved, a defendant who says the passage was never there, or a timeline where the difference between two dates is the difference between two theories of the case.

Frequently Asked Questions

Published 2026-08-15