Computer Evidence
Henry Waldock
Last updated: 2018-02-09
- Computer Evidence
Principles
Computers (cell phones, tablets and other information processing devices) may contain evidence probative of any offence. That evidence is usually mere information.
Canadian law treats information differently from physical objects: it offers substantial privacy to personal information, but accords it little property value. Because s.8 of the Charter protects privacy, you need authority to intrude into private information. That means getting warrants or consent from a person who has authority over that information.
Careful how you execute them.
- Data in a computer system may be changed easily. Therefore you must capture and preserve it in a fashion which prevents accidental or deliberate alteration.
- Search only for what you can justify. Justify what's useful.
- Searches inside the box need support from evidence outside the box.
Data May Not Be A 'Thing'
A union hired Stewart [1988]
1
S.C.R. 96 to help them organize the employees of a hotel.
Mr Stewart bribed a clerk to allow him to photocopy an employee
list. She turned him in. When charged with counselling the
commission of a theft, Stewart argued that his plan was never to deprive
the hotel of anything. Copying confidential information is not
theft of a “thing”. Held: Acquitted.
Similarly, s.487 of the Criminal Code, which authorizes the taking of
a 'thing', does not authorize the taking of a credit balance in a bank
account, because it is an intangible. R.
v. Banque Royale du Canada (1985) 18 C.C.C. (3d) 98 (Que CA).
If computer data is not a 'thing' for these purposes, then is it a
'thing' for other purposes, such as search warrants?
In 1998, a court generally agreed with this argument, but admitted
evidence obtained by search warrant anyway. The ITO clearly
explained what the police intended to do with the "things" (the
computers) once they "seized" them. Weir,
1998 ABQB 56
Information Privacy
and Search Issues
What's Private?
In R.
v. Tessling, 2004 SCC 67 the Supreme Court of Canada considered
whether a search warrant was required for police to fly over a house
and obtain FLIR images. The court observed that the FLIR device
revealed very no intimate details of the lifestyle and personal
choices of the individual. The court ruled that it did not
require prior judicial authorization.
Personal computers are private. Morelli, 2010 SCC 8 (para 2).
Texting between two users of cell phones may be
private. Don't rely upon standing, but ensure you have lawful
authority to read their communications. Marakah,
2017 SCC 59.
Personal computers differ from other "receptacles"
because they may receive information from the internet, they
automatically collect personal information, and they retain some
information even after the user thinks its gone. Therefore,
you generally require specific judicial pre-authorization to search
personal computers. Vu,
2013 SCC 60.
After a you lawfully obtain a quantity of private information, you may examine or analyze it for purposes related to your seizure, but searching it for other incriminating material may breach someone's Charter rights. Someone stole Mr Law's (2002 SCC 10) safe, cracked it open, and left it in a field. When police located the safe, they found with it various papers Mr Law had stored in the safe. An officer not connected with the theft investigation suspected Mr Law of tax evasion. He photocopied the documents and forwarded them to Revenue Canada, who found them so compelling that they charged him with tax evasion. Even though the safe was stolen, Mr Law complained that he had a remaining expectation of privacy which the police violated. The court agreed that Law's remaining expectation of privacy in the documents was low, but there remained enough that the police should have respected it more. The evidence was excluded.
Because computers can contain very large quantities of personal information, this case suggests that you should consider whether they the computer you want to search may contain such information. Is there a "reasonable expectation of privacy"? Do you have authority to obtain the information you seek?
When police obtained a search warrant for a residence containing Mr Billings'
2004 BCSC 378 property, they did not include his computer as an item
they sought. They took it anyway, and searched it. The
court found this violated his privacy, and excluded the evidence.
Mr Pommer 2008 BCSC 423 and his wife were on bad terms. She and her daughter slept in the master bedroom, and he slept elsewhere. The daughter discovered a hidden video camera set up and recording in the master bedroom. The wife kicked him out of the house. He took his laptop, but left the family computer behind. Pommer and his wife signed a separation agreement which said that the property remaining at the house was family property, to be divided later. The wife asked a police officer to examine the family computer to see if Mr Pommer used it to distribute pictures of the daughter on the internet. The officer, who dabbled in forensic computer analysis in his spare time, took it home and undeleted some files. He found child pornography on Mr Pommer's password protected account. Defence complained that he should have got a warrant. The judge disagreed. The evidence was admissible because the wife consented to the search.
"Canadians may reasonably expect privacy in the information contained on their own personal computers. In my view, the same applies to information on work computers, at least where personal use is permitted or reasonably expected." - Fish J., Supreme Court of Canada.
While doing routine maintenance, a computer technician at a school found a nude photo of an underage student on a school laptop. The laptop belonged to the school, but Mr Cole, 2012 SCC 53, a teacher at the school, had exclusive use of it, and permission to store private information on it. The school seized the computer, searched it, and copied child pornography from the computer onto separate disks. They gave the computer and the disks to police. Police copied the hard drive and searched it without getting a warrant.
Did Mr Cole enjoy any expectation of privacy over his computer as
against the school? Did the police violate his expectations of
privacy?
| Private |
Non-Private |
|
The school's written policy permitted personal use. In practice, teachers used their laptops for personal purposes. Computer was password-protected. Cole kept pictures of his wife on the laptop. |
The school's written policy asserted that it owned the computer and the data on it. Remote access software permitted other school personnel to access the entire contents of the laptop. Cole knew of this technical capability and used it himself
on other laptops on the school network. |
When the officer received the computer from the school, the officer did a sensible thing: he investigated the teacher's expectation of privacy. He read the policies affecting it. Unfortunately, he thought that ownership of the laptop and data determined whether Cole enjoyed a reasonable expectation of privacy.
The court disagreed. Ownership doesn't determine expectations of privacy.
That makes sense. Your doctor owns your medical records, but their contents are private to you.
Although I think it was a close call, the court concluded that Mr
Cole enjoyed a reduced expectation of privacy, but one which s.8 still
protected.
- The school's responsibilities to protect students justified the school's search of the computer.
- The police did not "search" anything when they received the disks, and so their receipt of those disks did not violate s.8.
- The police did violate Mr Cole's reasonable expectations of
privacy when they searched the computer without a warrant.
The good sense of the investigating officer paid off. Because
he cared about Cole's expectations of privacy, and because he thought
about privacy rights in the laptop, the court found it could admit the
evidence in spite of the breach of s.8. The prosecution will be
able to tender all of the evidence against Mr Cole.
The take-home messages are
- Before searching, think about expectations of privacy.
- The law gives personal electronic information devices (like
smart-phones, laptops, home computers) lots of s.8 protection.
- Don't search personal electronic devices unless you have clear lawful authority.
- Err on the side of caution - consider getting a warrant.
Searching computers "Incidental To Arrest"
See this section of Warrantless Search of the Person.Searching computers seized "In Plain View" or under s.489
If you lawfully seize a cell phone or computer, you don't need a warrant to search it as an object. But you do need a warrant to search the information in it. "[S]earching for hidden compartments, testing that cell phone for fingerprints, or reading the identification number physically inscribed on the cell phone, do not interfere with the heightened expectation of privacy in the accessible information." Fearon, 2014 SCC 77
As part of an investigation into the murder of Mr Little's, 2009 CanLII 41212 (ON S.C.) wife, police obtained a search warrant for his house. As they were searching for other things, they noticed his cell phone, with a blood stain on it. They seized it too. Later, they searched it. Did they need a warrant? This judge said that the seizure was lawful as a "plain view" seizure, or a seizure under s.489(1) of the Criminal Code. But searching its contents required judicial authority.
When searching Ms Brown's
2014 BCSC 112 residence for marijuana, police found a camera.
They turned it on, and examined some of the photographs. The
warrant did not authorize the search of electronic devices. The
court found that the expectation of privacy in a digital camera fell
somewhere between a photo album and a computer. This warrant did
not authorize the search of electronic devices, and therefore this
search violated Ms Brown's expectation of privacy. They should
have obtained another warrant to perform this search.
Comparing information
to a Database
Two of three judges of the Ontario Court of Appeal found that compelling a person to provide a name so that it can be checked against a police database is a significant interference with privacy. Harris 2007 ONCA 574. But the one said that there's little expectation of privacy in a name, and nobody can expect privacy in the information in a police database. I don't think this case will decide the point. We can expect these questions to persist.
Search Warrant Issues
Checklist
| Real world | Digital world |
| Identify the addresses of the places you want to search | Identify all the electronic devices you want to search. Some people recommend asking for authority to search your own exhibit locker as a "place". I recommend describing the devices as "receptacles" (see s.487) |
| Describe the things you want to search for - not just the drugs, but the score sheets and the documents of residency which identify the occupants of the place. | Identify all the data you want to search for: not just the child pornography but the innocent documents and log entries which were made close in time which tend to identify who used the computer. |
| Identify the people - including non-peace officers - who will assist in the search. | Identify the people - including non-peace officers - who will examine the data. |
| On the face of the warrant, specify when you will start the search. In the ITO explain why you need the time frame requested. | On the face of the warrant, specify when you will start the data examination. Avoid writing language which requires you to complete the search within any particular time. |
| If you intend to search in any unusual way, explain why in the ITO. | If you intend to get the data on-site, explain why in the ITO. |
| If you need an order compelling someone to assist in your search explain why in your ITO, and ask for an assistance order. | If you need an order compelling someone to assist in your search explain why in your ITO, and ask for an assistance order. |
| Searching for data on connected devices - s.487(2.1) - give yourself authorization on the face of the warrant, and explain why in the ITO. | |
| Don't search for things not mentioned on the face of the warrant. | Don't search for data not mentioned on the face of the warrant. |
| If you encounter evidence of other offences, you may seize it. If you want to search for more, you must apply for another warrant. | If you encounter evidence of other offences, you may seize it. If you want to search for more, you must apply for another warrant. |
Informations To Obtain
Before a justice can issue a warrant for child pornography or
obscenity, the justice must be satisfied that the place contains the
obscene or pornographic images. Must you send copies of the
images to the justice? No. But the ITO must sufficiently
describe the images so that the justice can decide for him- or
her-self that they are indeed contraband. R.
v. Harris, 1987 CanLII 181; R.
v. Smith, 2007 CanLII 32671 (ON S.C.).
The justice must be satisfied that the evidence will still be
there. When police applied to search Mr Morelli's,
2010 SCC 8 computer, they knew that the hard drive had
recently been reformatted. The court wasn't satisfied that the
child pornography would still be there.
What to Search For
Things or data?
Searching for and seizing a computer or cell phone differs from
searching the data inside it. If you want to do both, ask for
authority to do both. Search warrants in Form 5 allow you to
search for and seize things. Form 5 was drafted before the
Charter and before computers existed. It doesn't spell out the
difference between seizing a computer and analyzing the data inside
it.
Current case law distinguishes between possessing a computer and
searching its contents. Your warrant must spell out what
evidence you seek. If your searching turns up evidence of a
different crime, you need a new warrant to search for more evidence of
that offence. Jones,
2011 ONCA 632.
In Marek, 2016 ABQB 18, the searcher delivered all the documents and data from a hard drive to the investigator instead of merely the documents and data of interest. The court found that breached the defendant's rights. This suggests that the technician needs a thorough briefing of the circumstances of the case, and the technician should report out only the relevant evidence. See also Dadmand, 2016 BCSC 878 - technicians must show the focus of the search responded to warrant granted.
Do you just want to search the computer for contraband? The
trial judge knew Mr McGarvie,
2014 ONCA 394 was the one using the family computer for viewing child
pornography in part because his browsing history showed a pattern of
viewing material related to his personal hobbies, interspersed with
searching for and viewing the porn. Consider searching the
computer for evidence of ownership and use, such as:
- emails,
- resumés,
- family photographs of the suspect(s),
- internal logs for evidence of the times of use, and
- internet searches done from the computer.
Don't copy that list into your ITO. You don't need to spell out
what kinds of computer files you want to examine. Instead,
describe the type of data you want to find. Jones,
2011 ONCA 632 at para 43.
If you spell out in your ITO that computers tend to record dates and
times on documents and data as they perform their operations, then the
justice may permit you to look at those documents to determine who was
responsible for the contraband you find. You could ask to search
for documents and data containing what you seek (eg child
pornography), and documents and data relating to them either in
content - such as emails referring to the images - or in time - such
as documents and data date-stamped within hours of the date-stamps on
the child pornography.
After police caught Mr Dragos, 2009 CanLII 51517 (ON S.C.) in a hotel room having sex with a 13-year-old girl he had lured there, they got a warrants to search all the data on his computers. They found child porn. He complained that it should have been limited to emails and chat logs. Although his complaint did not succeed, it warns you to specify a wide variety of probative types of data for which to search.
How do you describe a computer and all the associated peripherals and storage devices? How do you describe the data on it? You could do worse than write:
In this information to obtain, I use the terms "computer system" and "data" to mean the same as those words are defined in s.342.1 of the Criminal Code.
Is this overbroad? Possibly. Language of this sort was accepted in Phillips 2011 ONSC 1881.
If you're searching for documents or photographs in a house, you need separate authority to search the computers you find in the house for that documentary information. In Vu 2013 SCC 60, police searched a grow up for evidence of who occupied the place. They found computers, which they examined in the residence. They found a computer using MSN Messenger and Facebook. Those programs showed information tending to identify the defendant. They searched the computer and found the defendant's resumé. Defence complained that computers contain so much information that police should obtain specific judicial authorization to search computers. The court agreed.
In Sop,
2014 ONSC 4610, the court excluded evidence based upon the breadth of
the search of a computer. Based on information that that the
target purchased child pornography from AZOV Films, the investigators
obtained a warrant to search his computers for child pornography. The
trial judge understood that the officers examined all 40TB of the
target's computer storage. More probably, the officers scanned the
contents using search engines, looking for child pornography.
They found AZOV films material, and other child pornography.
Because the officers searched more broadly than they had reasonable
grounds to believe they would find, the judge found that they breached
his s.8 rights. Try to document how much of the target's
personal information you actually see, so that you can respond to
concerns about overbreadth.
Focus your Search
