Lorraine v. Markel American Insurance Co.

A yacht was struck by lightning; the dispute over the insurer's payment went to arbitration, and the parties then cross-moved for summary judgment on the arbitrator's authority. Both sides supported their motions with copies of emails — attached without any authentication at all. The immediate question was whether those emails could be considered; the opinion's real subject became what, exactly, a proponent of electronically stored information must establish before any court may rely on it.

Five rules must be considered whenever ESI is offered: relevance under Rule 401; authentication under Rule 901(a) — evidence sufficient to support a finding that the item is what its proponent claims; the hearsay rules 801 through 807 if offered for its truth; the original-writing rules 1001 through 1008; and Rule 403 balancing. For authentication the opinion catalogs the workable methods, including Rule 901(b)(4) distinctive characteristics — where hash values and metadata can carry the showing — and 901(b)(9) evidence describing a process or system that produces an accurate result.

Neither party had cleared even the first authentication step: the emails arrived as unsworn exhibits, with no affidavit from anyone with knowledge, no metadata, and no foundation of any kind. The court declined to consider them and used the failure as the occasion for a hundred-page survey of how each rule applies to email, websites, chat logs, digital photographs, and computer-generated records — noting that counsel routinely fail to make even the minimal required showing precisely because ESI feels self-evident in a way paper never did.

Both motions were denied without prejudice, with leave to refile supported by admissible evidence. The sanction was mild; the framework was not. Lorraine became the standard citation for ESI admissibility, and its emphasis on hash values, metadata, and system reliability as authentication tools anticipated the 2017 addition of Rules 902(13) and (14), which now allow certified machine-generated records and certified data copied from a device to self-authenticate.