Chain of Custody in Criminal Proceedings
Introduction
The production of physical evidence is essential for the conduct of criminal trials. Chain of custody procedures represent the application of a legal principle intended to ensure the evidence produced at trial is the same evidence seized by law enforcement authorities related to the crime, and has not been confused with evidence related to other crimes. In addition, chain of custody procedures are necessary to ensure the evidence has not been altered or tampered with between the time of seizure and the time the evidence is produced in court. Both documentation about the way the evidence was protected as well as the legal adequacy of the procedures used by law enforcement authorities is necessary to establish chain of custody. The failure to establish a chain of custody may result in the exclusion of the evidence at trial, although in some situations involving a broken chain of custody the evidence may be admissible if it can be precisely identified by a unique characteristic such as a serial number.
While the documentary requirements to establish chain of custody are relatively similar for the evidence for most crimes, there is variation in the procedures used to maintain a chain of custody depending on the type of crime and the nature of the evidence. The burden of establishing the authenticity of the evidence with chain of custody generally rests with the party seeking admission of the evidence at trial, although there may be a presumption of the integrity of the evidence in some jurisdictions. In general, establishing the chain of custody requires testimony showing the evidence introduced in court is what it purports to be, testimony of continuous custody or control over the evidence, and testimony showing that each person having control over the evidence passed it on in the same condition as which it was received (Giannelli, 1996).
Chain of Custody Statutes and Decisions
Federal Chain of Custody The Federal Rules of Evidence provide general guidance for the management of evidence at the federal level. Rule 901(a) states: “The requirement of authentication or identification as a condition precedent to admissibility is satisfied by evidence sufficient to support a finding that the matter in question is what its proponent claims.” The party introducing the evidence has the burden of establishing its authenticity by providing testimony about the means by which the evidence was collected and the security procedures used for storage and transmittal between the time the evidence was collected and the time it is presented at trial. Authentication of the chain of custody can be established by testimony by individuals securing, maintaining and delivering the evidence to the court.
Court decisions control the way in which the rules of evidence are applied in federal jurisdiction. The general standard for chain of custody was established in Albert Lopez Gallego v. United States of America, 276 F.2d 914, 917 (9th Cir. 1960), with the ruling that an item entered into evidence must be in substantially the same condition as when the crime was committed (Berg, 2000). Most federal jurisdictions have also adopted the rule established in United States v. Lane, 591 F.2d 961 (D.C. Cir. 1979), of a presumption of integrity in the routine handling of evidence by government officials unless a defendant can make a minimal showing of tampering or bad faith. After such a showing, the government must fully establish the authenticity and integrity of the evidence with testimony by the individuals responsible for maintaining the chain of custody. If the government cannot meet the burden of proof, the evidence may be inadmissible.
A break in the chain of custody alone, however, may not be sufficient to render evidence inadmissible in federal courts. The court examines the situation surrounding the break in custody, and may admit the evidence if it finds alteration or substitution improbable. In United States v. Ladd, 885 F2d 954 (1st Cir. 1989), the First Circuit adopted the rule that a break in the chain of custody is related to the weight of the evidence rather than its admissibility. In practice, the presumption of integrity in the chain of custody and the examination of the totality of the circumstances shifts the burden of proof to the defendant to show the evidence has been tempered with or is not the same physical evidence purportedly seized by law enforcement officials. In addition, a break in the chain of custody may not result in the exclusion of the physical evidence but may affect the weight a reasonable finder of face should place on the evidence (Giannelli, 1996).
State Chain of Custody The states have adopted rules of evidence similar to those used in federal jurisdiction and intended to establish the authenticity of the evidence. Some states require the submission of a chain of custody affidavit with physical evidence attesting to the adequacy of the custody procedures, which creates a rebuttable presumption that the evidence is authentic. The threshold at which a break in the chain of custody will result in the inadmissibility of the evidence and whether the evidence should be excluded is variable among the states. For example in Floyd v. State, 27 FLW S697 (FSC 2002), Florida adopted the rule that a break in the chain of custody will result in the exclusion of the evidence only if the defendant can reasonably demonstrate the evidence has been tampered with. In Martin v. State, 554 A.2d 429 (Md. Ct. Spec. App. 1989), however, Maryland adopted the rule used in the federal First Circuit that a break in the chain of custody affects the weight placed on physical evidence rather than its admissibility. In New Jersey, there is no presumption of integrity in the routine handling of evidence by law enforcement authorities. Under the ruling in State v. Roszkowski, 129 N.J. Super. 315, 323 A2d 531 (App.Div. 1974), the party introducing the evidence must show the evidence has not been tampered with and no irregularity exists reducing the probative value of the evidence.
International Issues While chain of custody principles vary significantly in other nations, there is some movement towards the development of international standards for the management of evidence that could lead to greater admissible of evidence collected by foreign authorities in American and other national courts. The International Organization on Digital Evidence (IGOE) has developed guidelines for the seizure, authentication, and security of digital evidence that conform generally to the federal and state requirements to establish chain of custody (Digital Evidence, 1999). The International Association for Property and Evidence (IAPE) has also established international standards for property management intended to meet requirements for chain of custody in most nations, although compliance with the standards does not ensure the evidence will be admitted in an American court. The Interpol standards to combat corruption also partially address chain of custody issues with evidence such as currency or illicit drugs that are subject to a greater possibility of theft or tampering.
Management Practices for Different Crimes The general chain of custody procedures used in law enforcement is fundamentally similar regardless of the type of crime. The methods and procedures used to collect evidence at a crime scene should be fully documented, with the evidence tagged with identifying information that includes the name of the individual collecting the evidence, the date and location of collection and the case number assigned by law enforcement authorities. A documentary record should also be used to track the movement of the evidence from the crime scene to a storage or processing location. The documentary record should include the identity of all individuals with access to the evidence in the transportation and storage process. Evidence storage in locked containers requiring dual access can also help to increase assurances that the chain of custody has been maintained because two individuals must be present whenever the evidence is accessed for analysis (Kuchta, 2002). All evidence should be in the clear custody of an individual or in a locked location at all times or the chain of custody cannot be fully established. In addition, a record should be made of any tests or procedures used to authenticate the evidence.
Violent Crimes Physical evidence in violent crimes can consist of the injuries sustained by the victim and any evidence pertaining to the weapon used to create the injuries or the identity of the perpetrator. In homicide, the chain of custody over the body and other evidence in the vicinity of the body at the time of the discover is initiated by the police officers taking control over the crime scene. The body is then transferred to a medical examiner to identify the cause of death, with the detective often required to attend the autopsy to more strongly establish the chain of custody over evidence that may be discovered during the autopsy (Keel, 2008). Custody of the body is transferred to the medical examiner either at the scene of the crime or may be accompanied to the medical examiner’s location by a police officer. If the victim is only injured during the violent crime, the physical evidence about the injuries is collected by medical personnel in an emergency setting. While the first priority of the medical personnel is the treatment of the patient, the medical personnel should also be aware of the need to identify and collect evidence during the treatment process (Yost & Burke, 2006). One of the issues associated with collecting medical evidence of a violent crime is attempting to maintain as short a chain of custody for evidence as possible (Assid, 2005). If a large number of medical practitioners attempt to collect evidence from an injured individual at the same time, there is a greater likelihood the evidence will be contaminated. In addition, the testimony of a larger number of individuals may be necessary to establish the chain of custody from the evidence collection point through the analysis process and until it is presented in court. Specific problems with chain of custody may arise with gunshot evidence. If a bullet or bullet fragments are removed from the victim of a violent crime, they must be immediately tagged and segregated. In addition, the gunshot evidence must remain in the custody of the medical practitioner until it can be transferred to a law enforcement official who may not be present in the room where the bullet extraction occurs. In a homicide situation, the medical examiner should ensure that all bullet fragments are removed from the body at the time of the autopsy. The chain of custody may be broken is a bullet fragment is discovered after the completion of the autopsy (Denton, Segovia, & Filkins, 2006).
Sexual Crimes Evidence of sexual crimes is usually collected by medical personnel at the time the victim of the crime receives treatment for sexual assault or violence associated with the sexual crime. The medical evidence can consist of samples of bodily fluids left behind during the assault, and photographs or x-rays of injuries. One of the difficulties with establishing the chain of evidence in an emergency situation in which a victim requires medical care is the possibility the individual obtaining the evidence will not have specific training in the appropriate methods of obtaining and preserving evidence of sexual assault (Sievers, Murphy, & Miller, 2003). In addition, only one medical practitioner should obtain the evidence of rape to limit the number of individuals that must testify to establish the chain of custody. Situations involving sexual abuse or assault of children, follow a similar procedure of obtaining any physical evidence from the child that the assault has occurred. In the case of minors, however, permission to collect the samples must be obtained from a parent or guardian, or through a court order.
Because the specimens must be analyzed to provide the necessary evidence, maintaining documentation of the chain of custody and the physical integrity of the specimens is critical for sexual assault situations. Improper handling or storage of the specimens could result in degradation or contamination of the biological material that can be the basis of an admissibility challenge in court. Although DNA analysis of rape evidence is now frequently performed, an issue has arisen with the storage of rape evidence collected prior to the use of DNA analysis. If the evidence has been properly maintained and has not been destroyed by the law enforcement agency after final adjudication in the case, it may remain viable for DNA testing and admission in appellate proceedings (Jones, 2005). In addition, the tagging and securing of all blood, hair or fiber specimens is essential for maintaining the chain of custody because of the possibility that these types of specimens can be easily confused with other specimens if they are improperly labeled.
Drugs
Illicit narcotics seized as evidence by law enforcement authorities create special problems for chain of custody issues management because the evidence involves fungible drugs that must be segregated from other similar types of drugs. In addition, currency may become evidence of the attempt to purchase narcotics, which must also be carefully segregated from other currency in the custody of law enforcement agencies. Because the evidence in narcotics is not unique or resistant to change and tampering, the court must determine that the testimony supporting the chain of custody is sufficient to admit the evidence. Once the evidence is admitted, however, any defects in the chain of custody can be relevant to the weight placed on the evidence (Buckles, 2001). In some situations, it may also be necessary to obtain a blood or urine sample from a suspect after obtaining permission from the suspect or a court order to determine if the individual is under the influence of a narcotic. The sample must be appropriately drawn and witnessed, tagged and stored appropriately pending analysis, which is similar to other biological specimens obtained for evidence (Evans, 1992). Drug evidence must be carefully segregated in tagged and sealed containers from other drug-related evidence that may be stored in the same location. Because drug evidence passes from law enforcement authorities to a laboratory for analysis, the documentary record and the procedures to maintain segregation of the evidence are particularly important aspects of evidence management. In some cases, the laboratory performing the analysis is operated by private contractors who may not fully comply with the documentation and storage requirements necessary to maintain chain of custody for the evidence. The weight and identity numbers of the substance should be carefully noted prior to the analysis, and the container sealed and returned to a storage unit as soon as possible after the completion of any testing (Seized Drugs and Weapons, 1999). An issue with the chain of custody in drug-related crimes is the preservation of the laboratory analysis data including any electronic data about the analysis on which the conclusions were drawn. In practice, it is not enough merely to maintain a chain of custody over the specific sample on which the analysis was based. The methods used to perform the analysis and the data supporting the conclusions become part of the evidence. A link between the data and the sample must be maintained (Barnett, 2001).
Property Crimes The physical evidence in property crimes generally involves items recovered from a suspect in the commission of the crime or a receiver of stolen property. This type of evidence should be tagged and a record made of the procedures used to maintain custody. It may be necessary to process the property for fingerprints to determine if a suspect had possession of the property. In addition, a chain of custody of the fingerprints taken from a suspect must be established to support the evidence that a suspect had possession of the property. Property crimes can include property that can be readily identified as belonging to another person because of some unique identifying mark or attribute and property whose owner cannot be easily identified such currency. For crimes involving unique property identifiable by a serial number or other specific mark, a break in the chain of custody may not result in the inadmissibility of the evidence. The authenticity of the evidence can be established by testimony establishing its identity with the unique identifying mark. For crimes involving fungible property such as currency, however, a significant break in the chain of custody can result in the exclusion of the evidence. As a result, currency or other fungible evidence of the crime has to be clearly labeled and carefully segregated, with a record made of the procedures used each time the evidence is accessed.
Computer/Cyber Crime The existing procedures and court decisions regarding chain of custody were developed for physical property, with digital evidence associated with computer and cyber crime more difficult to manage because it includes both physical and non-physical attributes. The physical attributes involve the device containing the digital information, which range from computers to digital storage devices. The non-physical attributes involve the binary code contained within the device containing the information that provides the evidence of a crime (Kerr, 2005). Another consideration in the handling of evidence from cyber crimes is the possibility the evidence will be accumulated over a period of time in which law enforcement agencies monitor a suspect’s use of computers or other digital devices. In this process, the monitoring is intended to fill gaps in the chain of evidence when there is evidence a crime has been committed, but the identity of the criminal cannot be easily ascertained from the existing computer records. The monitoring may require making digital copies of computer files or activities rather than the seizure of a tangible device such as a computer for evidence (Kerr, 2005).
Digital evidence is particularly susceptible to alteration during the collection, storage, and retrieval process because any individual viewing the material after collection can potentially alter the content. Both a physical and an electronic chain of custody must be established for the digital evidence with the chain of custody document. The electronic data contains metadata with information about the creation of the digital document, the date it was last revised, and the identity of the person revising the document. Because of the relative ease for changing the contents of an electronic document each time it is viewed or accessed, the general procedure for seized electronic evidence is to make a master copy of the evidence at the time of seizure, with subsequent viewing or access to the material made from a copies of the master. The process generally involves creating a complete duplicate of the hard drive of a computer, which is known as imaging (Kerr, 2005). The actual digital evidence is not directly accessed, but rather accessed via certified copies of the original (Ruhnka & Bagby, 2008). At the same time, physical custody must be maintained for digital evidence. Physical custody not only involves the general chain of custody certification for other types of evidence, but also involves ensuring the evidence is not disrupted or destroyed by an electromagnetic field. Chain of custody of digital evidence is established and maintained by proper handling and documentation of custody and handling procedures. A documentary record of all actions taken with the evidence should be maintained, with tamper-evident packaging holding the device containing the digital evidence. The record indicates all actions taken to restore or copy the digital evidence and the methods used to make the copy. The record is separate from the chain of custody log used during the transport of the evidence, which identifies the individuals handling the evidence and its storage location. Prior to introducing the evidence at trial, the digital evidence is stored similar to other evidence, although it may require special protections against disruption from electromagnetic fields (Morris, 1998).
Photographic Evidence Photographic evidence can consist of images taken of a crime scene, a victim and images seized as evidence of a crime as in the case of child pornography. Photographs of the crime scene or victim should be developed or digitally viewed immediately to ensure they do not have to be retaken (Assid, 2005). The photographs should be tagged as with any other evidence and entered into the record documenting the nature of the evidence and the individuals having access to the evidence.
Because of the development of digital imaging as a substitute for film imaging, photographic evidence chain of custody issues overlaps with digital chain of custody issues. A digital photographic image can be more easily tampered with than other digital documents. While a digital image contains metadata information about origin and processing similar to other digital information, the metadata can be missing or altered. If the photographic evidence involves pictures of a crime scene and a digital camera is used, a chain of custody for the camera must be established to ensure the pictures have not been altered between the time the photographs were taken and the time the photographs were produced for viewing.
If the photograph was taken by the suspect and is itself evidence of a crime, authentication generally occurs immediately after law enforcement authorities seize the evidence to verify it actually depicts what it purports to depicts. In certain types of crimes such as child pornography, the image has to be an actual depiction of a child in a sexually explicit manner and not an artificially constructed (Scientific Working Group, 2008). As with other physical evidence, a chain of custody must be maintained throughout the collection and analysis of photographic evidence.
Burglary
The evidence in a burglary involves both the evidence of breaking and entering and evidence of the felony the burglar intended to commit after entry into the premises. Evidence showing a break in has occurred can include fingerprints, fibers, impressions, blood and damage to the premises, which is photographed, tagged, and preserved for analysis. The most significant problem associated with the chain of custody for this type of burglary evidence is ensuring the evidence has not been contaminated at the crime scene by the owner or others having access to the crime scene before it can be secured. The government also has a higher burden for establishing the chain of custody for fungible evidence obtained at the crime scene such as hair or blood specimens that can be easily confused in a visual inspection. In most cases, the intended felony following the breaking and entering is larceny, with the evidence treated as the theft of property if it is recovered (Buckles, 2001). If the intended felony in the burglary is other than a crime against property, the means used to collect and secure the evidence may vary.

Field with the Greatest Difficulty Maintaining Chain of Custody At the current time, digital evidence may present the greatest difficulty with maintaining a chain of custody. The evidence in a computer or cyber crime has both physical and electronic components, with specialists in digital data preservation required to authenticate and preserve the digital information. In practice, digital evidence requires maintaining two separate chains of custody. The first chain of custody involves the physical components of the evidence such as the computer or data storage discs. This type of physical evidence is collected, secured and documented in a manner similar to other physical evidence used in crime. A second digital chain of custody must be maintained, however, over the electronic information contained in the device. A break in either the physical or electronic chain of custody can result in the exclusion of the evidence or a reduction in its probative value.
One of the greatest problems with digital data is the possibility that the data has been inadvertently altered during the collection, storage or analysis of the evidence (Stonecipher & Watson, 2006). Prior to authenticating and analyzing the digital evidence to demonstrate a crime has been committed or identify the perpetrators, a complete electronic copy of the contents of the storage device must be made and used for the analysis (Kanellis, et al., 2006). If the digital data is not accessed with appropriate software for copying, critical information in the original data such as date stamps or temporary files may be erased. Improper access can create difficulties for establishing the evidence has not been tampered with.
Another difficulty with maintaining the chain of custody over electronic data is the possibility that some of the data will have to be produced in a physical form as evidence in the court. With child pornography stored on computers, for example, the electronic data will have to be converted into physical images to demonstrate a crime has been committed. Chain of custody procedures attach to the physical evidence produced by the electronic evidence stored in the computer.
The difficulties associated with electronic evidence contrast with other types of evidence that are only in physical form. While there are inherent segregation and labeling difficulties maintaining a chain of custody for fungible evidence such as drugs or currency, following appropriate evidence maintenance procedures can reduce the likelihood of a break in the chain of custody. With electronic evidence, the chain of custody issues extend to the methods used to copy and analyze the data to ensure it remains unchanged from the time at which it was collected.
Solutions for Chain of Custody Issues A solution for maintaining chain of custody increasingly used in law enforcement is evidence management software. The software functions as an inventory tracking system tracking the location and access to evidence in police custody. The software also tracks the identity of the individuals accessing the evidence to ensure the testimony of the individuals can be obtained to establish chain of custody at trial. An automated chain of custody tracking system can create greater awareness of the need to maintain documentation of custody during all phases of evidence transport and analysis (Stonecipher & Watson, 2006). The traditional solution for supporting chain of custody is to ensure all personnel involved with collecting, transporting and analyzing evidence have a thorough understanding of the identification and control procedures necessary to maintain chain of custody. While law enforcement officials routinely receive chain of custody training, a substantial amount of evidence is collected and analyzed by professionals such as medical personnel, computer specialists and laboratory personnel who may not have sufficient training in chain of custody procedures. Ensuring all personnel associated with evidence are familiar with chain of custody documentation and are aware of the need to maintain physical control over evidence at all times can reduce difficulties with establishing chain of custody at trial. In addition, procedures for handling evidence in which the identity of the individuals handling evidence should be flexible enough to accommodate the collection and control of multiple types of evidence associated with a single crime, such as the handling of digital evidence and drug, currency or other fungible evidence associated with the same crime.

References
Assid, P. (2005). Evidence collection and documentation. Topics in Emergency Medicine, 27(1), 15-26.
Barnett, P. (2001). Ethics in forensic science. Boca Raton FL:
CRC Press.
Berg, E. (2000). Legal ramifications of digital imaging in law enforcement. Forensic Science Communications, 2(4). Available at: http://www.fbi.gov/hq/lab/fsc/backissu/oct2000/berg.htm#Digital%20Imaging%20and%20Chain%20of%20Custody. [Accessed June 29, 2008].
Buckles, T. (2001). Laws of Evidence. Clifton Park NJ: West
Publishing.
Denton, S., Segovia, A., & Filkins, J. (2006). Practical pathology of gunshot wounds. Archives of Pathology & Laboratory Medicine, 130(9), 1283-1289.
Evans, D. G. (1002). A dose of drug testing. Security
Management, 36(5), 48-50.
Federal Rules of Evidence. (2007). Available at: http://www.law.cornell.edu/rules/fre/#article_ix. [Accessed June 28, 2008].
Digital evidence: Standards and principles. (2000). Forensic
Science Communications, 2(2). Available at: http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm. [Accessed June 29, 2008]
Giannelli, P. (1996). Forensic science: Chain of custody.
Criminal Law Bulletin, 32(5), 447-465.
Jones, C. (2005). Evidence destroyed, innocence lost. American
Criminal Law Review, 42(2), 1239-1264.
Kanellis, P., Kiometouzis, E., Kolokotronis, N., & Martakos, D.
(2006). Digital crime and forensic science in cyberspace. London: Ideal Group.
Keel, T. (2008). Homicide investigations: Identifying best practices. FBI Law Enforcement Bulletin, 77(2), 1-9.
Kerr, O. (2005). Digital evidence and the new criminal procedure. Columbia Law Review, 105(1), 279-318.
Kuchta, K. (2002). Forensic methodologies: A computer forensic professional’s compass. Information Systems Security, 10(6), 42-49.
Morris, R. (1998). Evidence. International Review of Law,
Computers & Technology, 12(2), 280-287.
Ruhnka, J. & Bagby, J. (2008). Forensic implications of metadata in electronic files. CPA Journal, 78(6), 68-71.
Scientific Working Group on Imaging Technology. (2008). Best practices for image authentication. Forensic Science Communications, 10(2). Available at: http://www.fbi.gov/hq/lab/fsc/backissu/april2008/standards/2008_04_standards02.htm. [Accessed June 29, 2008].
Seized drugs and weapons. (1999). General Accounting Office,
GAO/AIMD-00-17.
Sievers, V., Murphy, S., & Miller, J. (2003). Sexual assault evidence collection more accurate when completed by sexual assault nurse examiners: Colorado’s experience. Journal of Emergency Nursing, 29(6), 511-514.
Stonecipher, R. & Watson, D. (2006). Cutting-edge cyber forensic analysis uses full-enterprise LIMS. Scientific Computing, 24(1), 32-34.
Yost, J. & Burke, T. (2006). Forensic nursing. FBI Law
Enforcement Bulletin 752(2), 7-12.