High Tech: The Law

[home] [the science]

1.0 expertise

Technology is playing an increasing role in criminal prosecutions due to the proliferation and ever increasing ease of access to technology. In addition, the seeming anonymity of some forms of technology has increased the prevalence of its use in the commission of crime. The analysis and presentation of evidence related to technology may take several forms. Depending on the form and substance, it may or may not be considered expert opinion evidence. For example, in R v Hamilton, 2011 ONCA 399 the Ontario Court of Appeal held that evidence related to the basic technology governing cell phone use - including the general rules and principles of cell phone technology - was not "opinion" evidence and did not require a voir dire to that effect. This approach will likely apply to a range of "expert" evidence related to technology including evidence about computer memory and data encryption. It is important to properly characterize "expert" evidence in this context and avoid unnecessary (and arguably inappropriate) steps to qualify witnesses as expert opinion witnesses whose evidence is merely technical and factual.

2.0 Disclosure

2.1 Overview

The Crown must disclose the fruits of the investigation to the accused, so that the accused can make a full answer and defence [1]. This obligation includes disclosure of how digital evidence was extracted from an electronic device [2]. Police often rely on expensive and complex tools to search and extract digital evidence, which are not necessarily available to the accused. The Crown must therefore also grant the accused access to the software used for extraction [3]. However, the Crown is not obliged to purchase the software for the accused or to train the accused’s own expert in its use, so long as the accused has an opportunity to privately access it in the police station [4].

2.2 Jurisprudence 

The accused were charged with forging and falsifying credit cards. Investigators obtained several encrypted files from their seized hard drives that could not be decrypted. The accused sought disclosure of these files. The Crown refused disclosure because, due to the encryption, the Crown was not able to access the files. The Court agreed that since the Crown could not use the evidence as part of its case [5]. Arguably the accused do not have the same concern with respect to the right to make full answer and defence [6]. Additionally, the Crown would be unable to exercise its discretion to determine whether or not the evidence is relevant or privileged [7]. Finally, the court could compromise the integrity of the administration of justice by ordering the Crown to return information to the accused that might be used in further criminal acts, without being able to properly safeguard that information [8]: R v Beauchamp, 2008 CanLII 27481 (ONSC)

Mr. Cassidy was charged with possession of child pornography based in large part on digital evidence retrieved from his computer hard drive using EnCase and DIGIT software. The Crown disclosed the impugned files but refused to provide access to or copies of the full hard drives or the two software programs. ENCASE costs approximately $2,500 to purchase and DIGIT is not available for purchase by the public. The Court concluded that Crown must provide an accused with access to the extraction software programs, but does not have to purchase copies of the programs for the accused. Access to the programs allows the defence to replicate the process used by the police to obtain the evidence and to explore matters that might be relevant to making full answer and defence, such as the context in which the material was found and the dates on which it was saved to the hard drives: R v Cassidy, 2004 CanLII 14383 (ONCA)

The accused, the former Privacy Commissioner of Canada, was charged with fraud over $5,000 and breach of trust by a public officer. He requested that the Crown provide a copy of EnCase and training on the software, or alternatively, for the Crown to pay the cost of obtaining the software and training. Radwanski argued that providing disclosure of the evidence extracted from seized hard drives, without the software used to extract and view it, is akin to not providing disclosure at all. The Court however found that the Crown met its disclosure obligation by providing copies of the evidence. The defence could retain an expert for whom it would take no more than two days to view the information and to conduct the file-by-file search proposed by the defence of all electronic data on the hard drives. Where the expert owns the EnCase software, this could be done in the privacy of the expert's office and without inconvenience to the defence. Alternatively, the defence could attend the RCMP premises as contemplated in R v Cassidy, 2004 CanLII 14383 (ONCA): R v Radwanski, 2006 CanLII 43496 (ONSC)

3.0 Section 8

3.1 Reasonable Expectation of Privacy

Section 8 guarantees that individuals are free from unreasonable search and seizure. The protections of section 8 are engaged where the conduct is question is that of a state agent and the search or seizure impacts upon an area where a person possess a reasonable expectation of privacy. In the context of technology cases, this issue has been canvassed by the courts on a number of occasions. For example, in R v Spencer, 2014 SCC 43 the Court recently considered whether a person possesses a reasonable expectation of privacy in their name and address held by an Internet Service Provider [ISP]. The Court held that this information is considered as "informational" privacy and is protected by section 8 - there is a reasonable expectation of privacy. In so concluding the Court held that there are "three conceptually distinct although overlapping understandings of what privacy is. These are privacy as secrecy, privacy as control and privacy as anonymity" [para 38]. When the police obtained the user name and address they were obtaining not just the identity of someone in a contractual relationship with the ISP but the identity of someone linked to a particular internet activity.

Important to the analysis in Spencer are two points. First, the Court identified the privacy interest at stake as informational and went on to recognize three branches of informational privacy: privacy as secrecy; privacy as anonymity; and privacy as control. An IP address, the Court held, falls under privacy as secrecy; in other words, a person acts anonymously online utilizing their IP address, in this way, their identity if “secret”. The Court attached a very high degree of privacy to this information given the very personal nature of Internet usage. Second, in assessing the nature of the privacy interest and subject matter of the search the Court held that a broad consideration of the implications of the information must be considered: the tendency of information sought to support inferences in relation to other personal information must be taken into account [para 31].

The precise ratio of Spencer is clear and simple: IP addresses carry with them a REP and prior judicial authorization is required to access that information. The broader implications of Spencer remain to be seen. Two recent cases, however, may suggest that the conclusion in Spencer is limited to IP address.

In R v Khan, 2014 ONSC 5664 the police obtained the name of a subscriber for a particular phone number from Rogers; the phone number was related to a fraud investigation. Code J rejected the application of Spencer and assertion that the accused had a REP in his name as associated with that number. Unlike and IP address, Code J held that the accused commonly shared his phone number with others and had placed this phone number on business cards.

In Lattif the police obtained the accused the accused phone number and address from social services as they believed he may be involved in a series of robberies with another man whose phone records they had obtained through a production order. Nordheimer J rejected the application of Spencer and assertion that the accused had a REP in his phone number and address.

Khan and Lattif offer helpful insight into the limits of Spencer. While Spencer may signal a new emphasis on broader consideration of privacy interests, its practical application may extend to only a very limited scope of activities which carry with them such heightened privacy implications as online activity.

In a different context, the Court in R v Vu, 2013 SCC 60 considered the expectation of privacy in computers. The issue in that case was not whether this existed - as clearly it does - but rather whether the expectation was of such significance that where a warrant was obtained the police were required to expressly identify computers as a target of the search. In concluding that specific authorization was required to search a computer the Court relied upon the heightened privacy interests that are associated with computers:

The privacy interests implicated by computer searches are markedly different from those at stake in searches of receptacles such as cupboards and filing cabinets. Computers potentially give police access to vast amounts of information that users cannot control, that they may not even be aware of or may have chosen to discard and which may not be, in any meaningful sense, located in the place of the search. These factors, understood in light of the purposes of s. 8 of the Charter, call for specific pre- authorization in my view.

It would seem that this approach also applies to other less traditional computers and may even apply to storage media like USB devices: R v Tuduce, 2014 ONCA 547.

3.2 Search Incident To Arrest

Where a reasonable expectation of privacy exists the police will generally require prior judicial authorization in order to search. There are exceptions to this general rule however. Search incident to arrest is one such example. After years of debate, the application of this principle to cell phones has been settled in R v Fearon, 2014 SCC 77. The Court held that police officers will not be justified in searching a cell phone or similar device incidental to every arrest. Rather, such a search will comply withs. 8  where:

(1)     The arrest was lawful;

(2)     The search is truly incidental to the arrest in that the police have a reason based on a valid law enforcement purpose to conduct the search, and that reason is objectively reasonable. The valid law enforcement purposes in this context are:

(a)           Protecting the police, the accused, or the public;

(b)           Preserving evidence; or

(c)           Discovering evidence, including locating additional suspects, in situations in which the investigation will be stymied or significantly hampered absent the ability to promptly search the cell phone incident to arrest;

(3)     The nature and the extent of the search are tailored to the purpose of the search; and

(4)     The police take detailed notes of what they have examined on the device and how it was searched. [@ para 83]

Justice Cromwell noted that cell phones attract a high privacy interest. He referred back to the three features identified in R. v. Vu2013 SCC 60 (CanLII), that make a computer different from other “places”—immense storage capacity; the ability to generate and store information about the intimate details of the user’s interests, habits, and identity without the user’s knowledge; and the ability to provide access to information in different locations—and found that these features apply to cell phones. [@ para 51]

The new rule dealing with search of a cell phone incidental to arrest applies to all cell phones, whether or not the phone is password protected, and whether the phone is “relatively unsophisticated” or a “smart phone.” [@ paras 52-53]

Justice Cromwell elaborated on the circumstances in which a cell phone search will be found to be incidental to arrest and therefore lawful. He noted:

  • Generally, even when a cell phone search is permitted because it is truly incidental to the arrest, only recently sent or drafted emails, texts, photos and the call log may be examined as in most cases only those sorts of items will have the necessary link to the purposes for which prompt examination of the device is permitted. [@ para 76]
  • Search of the entire contents of a cell phone or a download of its contents is not permitted as a search incident to arrest. [@ para 78]
  • Not all crimes justify the search of a cell phone incidental to arrest. The law enforcement objectives of the search will be most compelling in cases of violence or threats of violence, or that in some other way put public safety at risk, such as the robbery in this case, or serious property offences that involve readily disposable property, or drug trafficking. Conversely, a search of a cell phone incident to arrest will generally not be justified in relation to minor offences. [@ para 79]
  • When the purpose of the search is discovery of evidence, this will only be justified when the investigation will be stymied or significantly hampered absent the ability to promptly search the cell phone incident to arrest. For example, where there is reason to believe that there is another perpetrator who has not been located, the search of a cell phone for that purpose will be truly incidental to the arrest. On the other hand, where all suspects are in custody and any firearms or stolen property have been recovered, it is hard to see how police could show that the prompt search of a suspect’s cell phone could be considered truly incidental to the arrest as it serves no immediate investigative purpose. [@ para 80]
  • Put another way, the police must be able to explain why it was not practical (which, Justice Cromwell emphasized, does not mean impossible), in all the circumstances of the investigation, to postpone the search until they could obtain a warrant. [@ para 80]
  • The police are required to take detailed notes of the applications searched, the extent of the search, the time of the search, its purpose and its duration. [@ para 82]

3.2 Warrant Searches 

Where warrants are obtained the police must be diligent in ensuring the information to obtain [ITO] and warrant are similar in purpose and scope while not being overly broad. At the same time, the ITO and warrant must not be unnecessary restrictive as any unnecessary limitations on the scope of a search may limit the ability to discover evidence which is properly subject to discovery by the authorization. Helpful cases that discuss this issue include R v Jones, 2011 ONCA 632 and R v Rafferty, 2012 ONSC 703.  

_______

1 R v Stinchcombe, [1991] 3 SCR 326.

2 R v Cassidy, [2004] OJ No 39 at para 11 (CA).

3  Ibid.

4  Ibid at para 11-13. And see R v Radwanski, [2006] OJ No 5250 (SCJ).

5 Para 43.

6 Para 44.

7 Para 62.

8 Para 55.