PRACTICAL ISSUES WITH DIGITAL EVIDENCE IN CRIMINAL CASES KEY POINTS

1. Cases
   1. Microwave Safety Systems v Commissioner for Fair Trading, Department of Commence¹⁾
      1. SEARCH WARRANT – validity – whether investigator had belief on reasonable grounds that there was evidence of a breach of a provision of the Fair Trading Act 1987 – facts material to decision to issue or to decline to issue warrant – whether disclosure in application for warrant of reasonable grounds for a belief as to contravention – invalid issue of warrant.
      2. Need to carefully consider relevant warrant issuing provisions in each case.
      3. Summary of law, p64-71
      4. Warrant too broad p93
      5. Need to use Adobe Acrobat to capture evidence giving rise to ability to issue warrant in first instance.
   2. Director of Public Prosecutions v Kear²⁾
      1. A person who has in his or her possession child pornography is guilt of an offence³⁾. Child pornography means film. Film includes cinematograph film, …and any other form of recording
      2. Data was found stored in the temporary Internet cache folder 5000 images (p3). The evidence was that the images were automatically recorded by browser when the defendant viewed the website. There was no evidence that the defendant was aware that the images were recorded onto the computer’s hard drive in any form.
      3. The prosecution conceded that it could not prove that the defendant was in possession of the images recorded on his computer in the absence of any knowledge that they were there. The prosecution contended that the recorded images were evidence of the defendant’s use of the computer to view the images which themselves amounted to possession albeit temporary.
      4. The Court found that he was not in possession on his computer because he was not aware of it being recorded. The image when viewed by the defendant on the monitor was, merely the retrieval or reproduction of material stored in the jpeg file in the temporary Internet cache. The visual image on the monitor was not itself a recording and, therefore, the defendant when viewing an image was not by that activity alone in possession of a recording.
      5. Need to carefully consider wording of offence “possession” and consider broadening search to include backups, cds etc. Insufficient evidence.
   3. Oke v Commissioner of the Australian Federal Police⁴⁾
      1. a blanket claim of legal professional privilege over all computer records contained on a laptop seized pursuant to a warrant.
      2. Oke applied for an injunction to restrain the AFP from inspecting the contents of the laptop computer. Parties agreed upon an inspection protocol with the intention that it be made an order of the Court. Examination and processing commenced without an order of the Court. AFP was permitted to search the computer records by key word searches
      3. Disputes arose as to the nature and extent of the notes taken by AFP as to the description (and, the applicant conjectured, the contents) of documents or files and the inspection process was abandoned. Injunction sought to enforce the agreed procedure
      4. Court held – the agreement does not on its proper construction prevent the AFP from applying to the Court to vary the procedural process to which the Agreement relates. The parties were given an opportunity to make further submissions as to what directions should now be given to identify the documents or files on the computer records which the applicant claims attract legal professional privilege, and to have them described to the AFP in a form which enables the AFP to indicate whether it accepts or disputes those claims. The disputed claims to privilege were to be resolved at a further directions hearing.
   4. Trevor John Kennedy v Peter Baker and Australian Securities and Investments Commission⁵⁾, Kennedy v Baker (No. 2)⁶⁾, Kennedy v Wallace
      1. Subsection 3L(1A) of the Crimes Act extends to taking an image of whole of the hard disk p66;
      2. Scope of Warrant p16
      3. See Claims for Legal Professional Privilege Guidelines p20, p96 (opportunity to claim)
      4. See steps 24-28. p32, p35
   5. Hart v Commissioner, Australian Federal Police [2002] FCAFC 392 (5 December 2002)⁷⁾
2. General Points
   1. What evidence are you after images? documents? backups/CDs? logs?
   2. Draft warrant accordingly - consider third parties who may be holding evidence.
3. Software tools
   1. Use Adobe Acrobat to collect a copy of the website viewed www.adobe.com
   2. Use Google desktop (free) to do keyword searching
      Desktop search
      Search your computer as easily as you search the web with Google
      http://desktop.google.com.au/?promo=app-gds-au-v1-1
   3. Use Google Enterprise to do keyword searching
      http://desktop.google.com.au/enterprise/index.html
      Find email, files, media, web history and chats instantly
      View web pages they've seen, even when they're not online
      View search results from your intranet, Google.com and their own desktop in one place
      ..Control content and enforce document retention policies
   4. Use other third party products

STEVE WHITE
WHITE SW COMPUTER LAW
MAY 2008

www.computerlaw.com.au

© White SW Computer Law 2008

This article is a guide only and should not be used as a substitute for proper legal advice, readers should make their own enquiries and seek appropriate legal advice.