Ninth Circuit Finds Facebook Records Referring to Defendant’s Drug Dealer Moniker, “Ghost,” Were Properly Authenticated
A divisive topic that has emerged over the past decade or so is the question of how parties can authenticate social media evidence. That latest example can be found in the recent opinion of the Ninth Circuit in United States v. Allen, 159 F.4th 625 (9th Cir. 2025).
In Allen, Jonathan Allen was charged with one count of distribution of methamphetamine and one count of felon in possession of a firearm. At trial, the prosecution introduced Facebook records against Allen. According to the court,
The records fell into two categories: (1) evidence of Allen’s direct participation in the charged offenses, and (2) evidence establishing that Allen was the user of the John Allen account. For example, the government offered as direct evidence the message in which the user of the John Allen account said, “I need to go pick up my shooter on Pines.” And for evidence of identity, the government pointed to Facebook messages referring to the user with Allen’s drug dealer moniker, “Ghost.”
After he was convicted, Allen appealed, claiming that the Facebook records were improperly authenticated.
The Ninth Circuit disagreed. First, in terms of establishing that the records came from Facebook, the court found them self-authenticated under Federal Rule of Evidence 902(11), which allows for “Certified Domestic Records of a Regularly Conducted Activity.” This was because “[t]he government offered certification from Facebook’s record custodian satisfying Rule 902(11). That sworn certification established that the record produced in response to the government’s search warrant was made “at or near the time the information was transmitted by [Allen]” and kept by automated systems “in the course of regularly conducted activity as a regular practice of [Facebook]….”
The court then found that the prosecution properly authenticated the content of the Facebook records as coming from Allen under Federal Rule of Evidence 901(b)(4), which provides that evidence can be authenticated through “The appearance, contents, substance, internal patterns, or other distinctive characteristics of the item, taken together with all the circumstances.”
The Ninth Circuit found such distinctive characteristics, noting:
Just to name a few pieces of evidence the government offered: the Facebook profile photograph in the Facebook records matched Allen’s appearance, the user had the same birthday as Allen, and the messages referred to Allen’s drug dealer moniker (“Ghost”) and cell phone number.