by Hans Henseler
UK Law Enforcement agencies are facing significant challenges related to digital evidence disclosure in criminal prosecution cases. Suspects who are charged with a crime must have access to all relevant evidence to ensure a fair trial, even if the evidence can undermine the prosecution. To avoid disclosure errors and ensure that digital evidence is admissible in court, the UK Crown Prosecution Service (CPS) revised the Disclosure Manual in December 2018 and addressed the following topics:
- Reasonable lines of enquiry
- Identifying relevant material
- Disclosure documentation
- Legal professional privilege (LPP)
- Copying disclosable material
In this article, I will cover what each of the CPS disclosure manual topics mean and provide seven principles that will help streamline the review of digital material so that it better fits within the context of UK Disclosure requirements. Our recommendations are as follows:
- Early review of digital material can assist with the evaluation of reasonable lines of enquiry.
- Filter digital material proportionally to the facts.
- Ensure searches are targeted.
- Document your investigation strategy before and during reviewing.
- Automatically record all hits that were not examined and document why.
- Isolate and or redact LPP material.
- Use technology to assist with the disclosure of large quantities of digital evidence.
These principles can be used to augment your investigation workflow and ensure that it complies with the new disclosure guidelines.
1. Introduction to Disclosure
Due to high profile legal challenges, Law Enforcement agencies in the UK are struggling with how to sufficiently disclose evidence related to criminal prosecution cases[1]. Not only are they dealing with more digital evidence than ever before, they’re also isn’t a clear guide on how to properly disclose this evidence to ensure that findings are admissible in court. To understand what is causing these problems, it’s important to understand how “Disclosure” in the UK criminal prosecution system is defined:
Disclosure is the process in a criminal case by which someone charged with a crime is provided with copies of, or access to, material from the investigation that is capable of undermining the prosecution case against them and/or assisting their defence. Without this process taking place a trial would not be fair.[2]
Evidence material is collected by the police throughout the course of an investigation and some of this material will be relevant to the case that they are investigating[3]. The Crown Prosecution Service disclosure manual explains that “material may be relevant to an investigation if it appears […] that it has some bearing on any offence under investigation or any person being investigated, or on the surrounding circumstances of the case, unless it is incapable of having any impact on the case.”
Relevant material falls into one of two major categories:
i) Used material that is relied upon by the Crown to inform or uphold the prosecution case. For example, Witness statements, Interview tapes, Photos of injuries, Exhibits – e.g. knives, CCTV, drugs, Emails, phone, social media messages, and browser history records used as evidence.
ii) Unused material that is relevant material within the possession of the prosecution but which the prosecution does not intend to use. For example, The crime report itself, Custody imaging photograph, Copies of bail forms, Pre-interview disclosure to a solicitor, PNCB forms, CAD/incident logs, CCTV viewing requests, Search warrants, Copies of notebooks, PNC printouts on victims, Emails, phone, chat messages, Internet browser history, records not used as evidence.
2. Disclosure Requirements for Digital Evidence
Chapter 30 of the CPS Disclosure Manual[4] provides an overview on several topics related to digital evidence, specifically focusing on:
- Reasonable lines of enquiry
- Identifying relevant material
- Disclosure documentation
- Legal professional privilege
- Copying disclosable material
Other topics mentioned in this chapter include search & seizure, scheduling, defence engagement, retention of seized material and engagement with the court—topics that are not directly relevant for digital evidence review but are certainly interesting for other digital evidence management matters, e.g., forensic case management.
2.1 Reasonable Lines of Enquiry
What amounts to a reasonable line of enquiry will depend on the circumstances of each case. Prosecutors should work closely with investigators, disclosure officers, and digital forensic experts to ensure all reasonable lines of enquiry are followed and that digital material is properly assessed for relevance, revelation, and disclosure.
As with all communication evidence, the prosecution must be able to explain to the defence and the court what they are doing as well as, what they will not be doing.
Transparency on the approach that was taken in every case is of paramount importance. The prosecution should engage in an early dialogue with the defence about what they consider to be reasonable for each case and should make explicit reference to the approach that was taken in a Disclosure Management Document.
The CPS guide to “reasonable lines of enquiry” and communications evidence[5] discusses the analysis of material. In examining the contents of a mobile device download, the investigator may set parameters relating to specific timeframes that are proportionate to the facts. For example, the investigator could focus on a specific time—like the date the complainant and suspect met to a month after the suspect’s arrest. If there are messages that are potentially undermining/assisting at either end of the window of time searched, then the search should be extended further.
As with all communication evidence, the prosecution must be able to explain to the defence and the court what they are doing as well as, what they will not be doing.
Below is an example of how this might be recorded in the Disclosure Record Sheet (DRS) and Disclosure Management Document (DMD):
The following mobile devices were seized and have been examined, and download reports prepared:
Description: iPhone X
Reference: ABC/1
Obtained from: Suspect
Telephone number: XXXXX XXXXXX
Download report reference: DEF/1
Description: Nokia X
Reference: ABC/2
Obtained from: Complainant
Telephone number: XXXXX XXXXXX
Download report reference: DEF/2
The contents of the download in respect of the telephone ABC/1 between 1/1/2017 and 1/7/2017 have been examined for the following;
Level 2 Mobile Device Examination:
(i) Logical Capture and Preservation of case defined and verified data (from Handset, Tablet, (U)SIM or Memory Card) using selected tool(s) in a laboratory environment to report that data.
(ii) Physical Capture and Preservation of data (from Handset, Tablet or Memory Card) using selected tool(s) in a laboratory environment to report defined data types.
The timeframe selected is considered to be a proportionate and reasonable line of enquiry, and represents [e.g. the date that the complainant first met the suspect to a month after the suspect’s arrest].
The device has been examined for communications between the complainant and the suspect that relate to [insert parameters of the search that has been made e.g. communications about the offence or appear relevant to an issue in the case such as previous sexual behaviour between them, issues raised in interview, material that points away from the offence].
2.2 Identifying Relevant Material
Digital material involved in today’s investigations is likely to be extensive. As a result, there will be a considerable amount of data held on a digital device which may not be ‘relevant’ to the case. The disclosure officer/investigator may utilize key words, time and date filters, sampling or other appropriate search tools and analytical techniques to locate relevant passages, phrases and identifiers. The purpose of applying such techniques is to reduce the total amount of evidence for review and to identify the relevant material on each device.
Where key word searches are applied, there should be an agreement with the investigator/disclosure officer. They should be designed to capture not only evidential material but also material likely to pass the test for relevance. Search terms that are too general or too many search terms may generate a large number of hits, containing material that may not be relevant and may complicate the disclosure exercise. It is essential that search terms are selected with care, are not too generic, and are targeted. Here is an example list of search terms for a case related to a fraud investigation:
Agency, Aggressive, Aid, Arrange, Asset, Backdate, Bad, Blackmail, Bogus, Bonus, Bribe, Budget, Case Bonus, Counterfeit, Deceive, Embezzle, Ethic, Expense, Fabricate, Fake, False, Falsify, Fictitious, Fine, Fraud, Payoff, Petty Cash, Pressure, Scam, Special Payment, Steal, Whistleblower.
2.3 Disclosure Documentation
The disclosure officer should keep a record or log of all digital material seized, imaged and subsequently retained as relevant to the investigation. This log should be shared with the prosecutor to ensure they are aware of the nature and extent of digital material in the case, where the evidence was seized, and what was done with it.
In every case, it is important that any searching or analytical processing of digital material, as well as the data identified by that process, is properly recorded.
In cases with very large quantities of data, a case record should be made of the strategy and the analytical techniques used to search the data. To build this record, the officer in charge of the investigation must develop a strategy that sets out how the material should be analysed or searched to identify categories of data. This record should include details on the person who completed the investigation, demonstrate that they followed the process, and identify all relevant dates and times related to the case. In such cases, the strategy should record the reasons why certain categories have been searched for (such as names, companies, dates etc).
In every case, it is important that any searching or analytical processing of digital material, as well as the data identified by that process, is properly recorded. So far as practicable, what is required is a record of the terms of the searches or processing that has been carried out. The Disclosure Manual specially lists the following details that should be recorded:
- A record of all searches carried out, including the date of each search and the person(s) who conducted it.
- A record of all search words or terms used on each search. Where it is impracticable to record each word or terms (such as where Boolean searches or search strings or conceptual searches are used) it is usually sufficient to record each broad category of search.
- A log of the key judgements made while refining the search strategy in light of what is found or deciding not to carry out further searches.
- Where material relating to a ‘hit’ is not examined, the decision not to examine should be explained in the record of examination or in a statement.
2.4 Legal Professional Privilege
The prosecutor should be aware that digital material may include material which is subject to legal professional privilege (LPP). If such material is seized, the investigator must arrange for it to be isolated from other seized material and any other investigation material in the possession of the investigating authority. It is recommended that investigators allow independent counsel to be present during a search.
Where material potentially subject to LPP is thought to be on a device, analysis of file structures and search terms can be applied to identify the material likely to be LPP. The defence should be invited to assist in the process. Material which responds to the search terms or other techniques and which may be subject to LPP can then be referred to independent counsel.
2.5 Copying Disclosable Material
When dealing with large quantities of digital evidence that must be disclosed, care must be taken to avoid inadvertently disclosing confidential or sensitive material to the defence.
Where the disclosure officer or investigator have concerns about differential disclosure of confidential information between co-accused, they should bring these concerns to the attention of the prosecutor. The prosecutor should then seek agreement with the defence, and where appropriate the court, as to how disclosure may be made.
It may be appropriate to ask owners of data if any breach of confidentiality will occur should the data be disclosed to any accused.
When dealing with large quantities of digital evidence that must be disclosed, care must be taken to avoid inadvertently disclosing confidential or sensitive material to the defence.
3. Review Principles
Based on the disclosure requirements summarized above, we have identified the seven principles that will be helpful in streamlining review of digital material so that it better fits within the context of UK Disclosure requirements.
- The prosecution is encouraged to enter in an early dialog with defence regarding their investigation approach. Early access for investigators who are reviewing digital materials will be helpful in assisting a prosecutor to identify which lines of enquiry are reasonable and which ones are not.
- When examining the contents of all digital evidence, the investigator may set parameters relating to timeframes that are proportionate to the facts, for example between the date the complainant and suspect met to a month after the suspect’s arrest.
- When identifying relevant material through search by key words, filtering or other search tools or analytical techniques It is essential that search terms are selected with care, are not too generic and are targeted.
- A record should be made of the strategy and the analytical techniques used to search the data. The record should include details of the person who has carried out the process, and the date and time it was carried out. This record should also include the reasons why certain categories were searched.
- A record of all hits that were not examined and the reasons why they were not followed up on must also be kept. While this may be cumbersome it can also help investigators to refine their search strategy and select search terms with care.
- Digital material may include material which is subject to legal professional privilege (LPP). If such material is seized, the investigator must arrange for it to be isolated.
- When dealing with large quantities of digital evidence that requires disclosure, care must be taken to avoid inadvertently disclosing confidential or sensitive material to the defence.
4. Conclusion
UK Crown Prosecution (CPS) updated several official guidelines with respect to Disclosure in December 2018. Disclosure affects all stages of prosecution and is not restricted to review of digital materials alone. However, when reading the chapter on digital material in the CPS disclosure manual, there are several disclosure topics that suggest basic principles for review of digital material. These principles can be used to design new features in existing digital forensics tools and evidence review platforms that assist with the implementation of procedures as described in the disclosure guidelines. Some of these principles may require manual note taking by investigators while other principles could be implemented using automated recording of case activity with associated reporting dashboards that are tailored to disclosure requirements.
About The Author
Hans Henseler is the Director of Digital Evidence Review at Magnet Forensics. If you’d like to learn more about how Magnet REVIEW can help you analyze all the digital evidence in your investigation and satisfy disclosure requirements, visit MagnetForensics.com.
This article has also been published as a Magnet Forensics whitepaper. A PDF version can be requested here.
References
[1] See for example https://www.telegraph.co.uk/news/2018/07/12/policeand-prosecution-lawyers-fail-correctly-disclose-evidence/
[2] Copied from “Review of the efficiency and effectiveness of disclosure in the criminal justice system”, UK Attorney General’s Office , November 2018, downloaded from https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/756436/ Attorney_General_s_Disclosure_Review.pdf
[3] For example, see paragraphs 120-127 of Justice Committee, ‘Disclosure of evidence in criminal cases inquiry’ (July 2018) and the published supporting evidence. https://www.parliament.uk/business/committees/committees-a-z/commons-select/justice-committee/inquiries/ parliament-2017/disclosure-criminal-cases-17-19/
[4] Disclosure Manual, CPS, pages 90-94, Revised: 14 December 2018, https://www.cps.gov.uk/legal-guidance/disclosure-manual
[5] Disclosure – A guide to “reasonable lines of enquiry” and communications evidence. CPS publication. July 24, 2018. See https://www.cps.gov.uk/legal-guidance/disclosure-guide-reasonable-lines-enquiry-and-communications-evidence
© 2019 Magnet Forensics Inc. All rights reserved. Magnet Forensics® and related trademarks are the property of Magnet Forensics Inc. and used in countries around the world.
