A Primer on FBI Chain-of-Custody Procedures

In an election, chain-of-custody is a “process used to track the movement and control of an asset through its lifecycle by documenting each person and organization who handles an asset, the date/time it was collected or transferred, and the purpose of the transfer.”^{1U.S. Election Assistance Comm’n, Glossary of Election Terminology (July 16, 2021), https://www.eac.gov/sites/default/files/glossary_files/Glossary_of_Election_Terms_EAC.pdf.} Assets may include voting equipment, ballots, voter registration lists, and other election documentation or materials, depending on state law.

Similarly, when law enforcement officials obtain evidence as part of an investigation, they are required to maintain the chain of custody for that evidence. The chain of custody is a recorded means of verifying where evidence has travelled and who handled it.

The reason for establishing a chain of custody is to prevent substitution of, tampering with, mistaking the identity of, damaging, altering, contaminating, misplacing, or falsifying the evidence. The chain of custody serves to verify both the integrity and the authenticity of all evidence.^{2Nat’l Inst. of Just., Law 101: Legal Guide for the Forensic, Chain of Custody (Aug. 22, 2023), https://nij.ojp.gov/nij-hosted-online-training-courses/law-101-legal-guide-forensic-expert/pretrial/pretrial-motions/chain-custody.} This is what allows, for example, a law enforcement agent witness to testify that an item such as a firearm is the same one the agent seized when making an arrest, and that it remains intact and unaltered since the agent seized it.

The FBI has specific chain-of-custody requirements that agents and technicians must follow. Chain-of-custody rules are generally split across two documents: (1) the Field Evidence Management and Operations Policy Implementation Guide (PG), which provides the step-by-step requirements for handling evidence;^{3FBI, Field Evidence Management and Operations Policy Implementation Guide (“PG”) (Oct. 27, 2009), https://www.aclu.org/sites/default/files/field_document/ACLURM005360.pdf. This version of the PG is dated Oct. 27, 2009, and was obtained via a FOIA request by the American Civil Liberties Union. This is the most recent publicly available version we have been able to locate. However, the FBI may have updated the PG one or more times since 2009, potentially altering one or more of the chain-of-custody procedures described in this document. Nonetheless, this provides a useful starting place for inquiry into the FBI’s chain of custody protocol in a particular case.} and (2) the Domestic Investigations and Operations Guide (DIOG), which provides the rules for conducting investigations.^{4FBI, Domestic Investigations and Operations Guide (“DIOG”) (Feb. 27, 2024), https://vault.fbi.gov/FBI%20Domestic%20Investigations%20and%20Operations%20Guide%20%28DIOG%29/fbi-domestic-investigations-and-operations-guide-diog-2024-version.}

The PG and DIOG prescribe the sequence of events from the search and seizure to the return or destruction of the evidence. The material below relies on the 2009 version of the PG and the 2024 version of the DIOG.

1. Identify and describe each item seized at the scene. Using Form FD-597 (Receipt for Property Received/Returned/Released/Seized), also referred to as the inventory form, agents identify and describe each item when they take possession of it. After the search has concluded, one copy of the inventory form is provided to the person or persons from whom the materials were seized, and a second copy is provided to the court alongside the executed search warrant.^{5PG, supra note 3 at 4.1.1-2; DIOG, supra note 4 at 18.7.1.6.1.7(B-C); see also Fed. R. Crim. P. 41(f)(1)(B-D) (requiring that “[a]n officer present during the execution of the warrant must prepare and verify an inventory of any property seized,” “give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property” and “promptly return [the warrant]—together with a copy of the inventory—to the magistrate judge designated on the warrant.”).}
2. Package and label seized items. The PG instructs agents that seized “items are to be carefully packaged and the containers properly identified.”^{6Id. at 4.1.2.} The PG also recommends designating only one or two agents to identify and describe all evidence at a search or arrest site, to minimize the number of agents required to establish chain of custody if called to testify at trial.
3. Start the chain-of-custody record. Agents maintain a chain-of-custody form (FD-1004) for seized evidence from “the time possession is transferred to the investigator to the time of trial/disposition.”^7Id.
4. Submit evidence and documentation to Evidence Control Technician. The agents who seized the evidence must submit the evidence and/or documentation to an Evidence Control Technician (ECT)^{8An Evidence Control Technician is an FBI employee charged with keeping records, storage, and maintenance of all evidence, retrieving and transmitting evidence, disposing of property, and testifying in court regarding evidentiary property. Id. at 2.3.} within ten calendar days of the seizure, along with a Form FD-192 (logging and tracking evidence).^{9Id. at 4.5.7.} During the time between seizure and submission to the ECT, the evidence remains under the custody and control of the FBI agents. Once the ECT receives the evidence, “[t]he ECT is the designated custodian of the seized/recovered evidentiary property.”^{10Id. at 4.5; 4.5.6.}
5. Store seized items in evidence control room. Agents store evidence in a designated evidence control room, “a separate area, usually within the confine of [FBI] field office space, used solely for the storage of seized/ recovered/ contributed property.”^{11Id. at 4.2.1.} The PG notes that access to an evidence control room “is restricted to ensure evidentiary property is accounted for…and can withstand defense challenges concerning chain-of-custody.”^12Id. If the evidence seized is so voluminous that it is not practical to store it in an evidence control room or field office space, the evidence “may be stored in a secure off-site facility” afforded the same security measures as an evidence control room.^{13Id. at 4.2.3.}
6. Examine and confirm record of seized evidence. The ECT then ensures, “by physical examination of property,” that the descriptions of evidence entered by the agents into the FBI database “adequately and properly reflect[] the property being retained.”^{14Id. at 4.5.5.} The ECT must also “make certain that the exact location of property is noted in the collected item database,” and that every container of evidence has its own required documentation and barcode.^{15Id. at 4.5.9.}

7. Maintain access log for evidence control room. An ECT must maintain an access log, on Form FD-455, for each evidence control room containing evidence. Each individual that accesses an evidence control room must log their name, reason for entry, the case file number, ID number, and the date and time of entry and exit.^{16Id. at 4.2.4.} At the end of each month, an evidence program supervisor must ensure that access logs for each evidence control room are printed and retained.^{17Id. at 4.4.5.}
8. Maintain chain-of-custody documentation. An ECT also ensures that chain-of-custody documentation for evidence is recorded in the collected item database and on an automated Form FD-192.^{18Id. at 4.5.10.}
9. Securing evidence for forwarding, as needed. If evidence needs to be forwarded to FBI headquarters or other field offices, an ECT ensures that the evidence is properly packaged and labeled for forwarding,^{19See id. at 4.6, Administrative Handling and Storage of Evidentiary Property (detailing evidence handling and storage procedures and noting three forms that may accompany evidence forwarded from one office to another).} and that the transmittal is recorded in the FBI’s collected item database.^{20Id. at 4.5.11.}
10. Periodic review of evidence storage and documentation. In periodic file reviews, supervisors must check whether evidence was stored and disposed of properly and documented under evidence control policies.^{21DIOG, supra note 4 at 3.5.4.5.} Each evidence control room conducts an audit and inventory of general evidence in its possession at least once per year.^{22PG, supra note 3 at 4.20.1.}
11. Relevance and disposal. Seized items that are clearly irrelevant to the investigation, with no foreseeable value, should be returned or destroyed, and the disposition recorded in the file. Items of uncertain relevance may be held until a supervisor makes a determination about their disposition.^{23DIOG, supra note 4 at 18.4.}
12. Dispose of / return property. An ECT assists case agents in disposing of evidence either through actual destruction, return to the owner, or other methods, as appropriate.^{24PG, supra note 3 at 4.5.15.}