Computer and Digital Evidence in Criminal Trials

There is legislation that specifically applies to computer evidence. Under section 5 of the Civil Evidence Act 1968, for instance, a computer produced document will be admissible as evidence of the statement contained in it, so long as its reliability and authenticity is demonstrated.

Under section 69 of the Police and Criminal Evidence Act 1984, computer-produced evidence is admissible as long as there are no reasonable grounds for believing that the statement it contains is inaccurate because of improper use of the computer. In addition, at all material times it must have been operating properly (or any malfunction did not affect the production of the document or the accuracy of the statement).

The issue of hearsay evidence is significant in this area.  Hearsay evidence in criminal proceedings, which is a statement made by someone other than the person giving oral testimony in proceedings, is generally not admissible in criminal proceedings as evidence of any fact or opinion contained in the statement.  The rule prevents evidence being given by someone who has insufficient knowledge of the evidence and so cannot be effectively questioned about it.  For more information on Hearsay in Criminal Trials read here. 

The general rule against hearsay evidence is important in the context computer evidence since it might not always be possible to identify who created it.  The reality is that several people may have contributed to the final version of a computer document, so there could be potential problems as to admissibility.

The general admissibility of business and other documents is dealt with under section 117 of the Criminal Justice Act 2003. However, this only applies to documents which are hearsay – where the information was provided by a human being.  It does not cover evidence which has been recorded by a computer. 

Computer evidence may be admissible as ‘real evidence’ (see below).  Section 117 could apply, for example, where an office worker inputs details of staff wages into a spreadsheet, or to emails and text messages sent in the course of business or trade.  There is also an implication that the person who provided the information need not be expected to remember it, and so need not be expected to give oral testimony of it.  Having said that, it is always better for a person who provides information in a document which is regarded as containing hearsay to be called upon to give oral testimony on the information. 

Under sections 117(4) and (5), a document which has been prepared for the purposes of criminal proceedings may be admitted as evidence.  This can apply where the witness is unavailable under section 116 because, for example, they have died.  Alternatively, a document may be admitted if, under section 117(5)(b) “the relevant person cannot reasonably be expected to have any recollection of the matters dealt with in the statement (having regard to the length of time since he supplied the information and all other circumstances)”.

Under the Criminal Justice Act 2003, the court has a discretion to refuse to admit a business or other document under certain circumstances.  It is, therefore, possible for the court to exclude a computer document if there are doubts as to whether the computer was working correctly at the time the document was made, so that the document’s accuracy may be in doubt.

Evidence which is automatically recorded by a computer or other device without additional human intervention is considered real evidence, and is generally admissible.  CCTV images, and an email time and date stamp, are examples of real evidence.  For instance, in R (on application of O) v Coventry Justices (2004), credit card transactions and other information recorded automatically when the defendant tried to access a child pornography website was real evidence and admissible. 

Nevertheless, the court always has discretion as to whether evidence should be admitted, even if, on the face of it, the evidence is admissible.  For example, at common law there is a presumption that a machine was working correctly at the material time unless proved otherwise.  Consequently, if it can be shown that a computer or other device was not working correctly at the material time, then the accuracy of the evidence it might contain may be doubted and the court may refuse to admit it.

Where retrieving digital information to be used as evidence, consulting an information technology expert may be required in cases where, for instance, it is difficult to retrieve the material, or a severe loss or corruption of data is threatened.  The Association of Chief Police Officers has published a Good Practice Guide for Computer Based Electronic Evidence which gives useful information on several topics, including home networks and wireless technology, the principles of computer based electronic evidence, and the retrieval of video and CCTV evidence.  The Guide also contains a glossary of computing and information technology terms. 

As far as computer forensics is concerned, the Guide stipulates four principles:

• Do not change data which may later be relied on in court
• If it is necessary to access original data, the person doing so must be competent and capable of giving evidence regarding their actions
• All processes applied to electronic evidence should be carefully recorded
• The person in charge of the investigation is responsible for ensuring that both the law and these principles are adhered to

As far as the police are concerned, it should be clear that the computer evidence they are adducing in court is exactly the same as when they first took custody of it.  The police should endeavour to document how the evidence was obtained and preserved so that an independent third party could use the same processes to reach the same results.