The Digital Evidence Sitting in Your Pocket

Smartphones can be incredibly powerful tools for investigators trying to put together events leading up to a crime. Investigators will likely have the opportunity to review and analyze many aspects of your use of your smartphone, including messages (text), photographs, location information, web searches, application interactions, etc.

As a criminal defence lawyer, it is becoming increasingly common that the most valuable witness to an evening may be sitting in the defendant’s pocket.

Leaving a Trail of Evidence

Rupin Bal, the founder of Rupin Bal Law Professional Corporation defends clients charged with crimes throughout Ontario. According to Rupin, the value of a smartphone is not simply determined by what the user types into the device.

In addition to the actual content contained in a smartphone, there may also be additional evidence regarding when something occurred, where the phone was located, and possibly even what the phone's user was doing at a specific point in time.

Photographs can illustrate this. A photograph alone may seem somewhat innocuous. However, metadata related to the photograph could potentially establish when the photograph was created. Other phone activities immediately prior or subsequent to the creation of the photograph could then be analyzed to further build a timeline.

"As with digital evidence generally," according to Rupin Bal, "you typically are reviewing multiple records of information. A photograph, a text message or a location record may individually appear insignificant. When considered collectively, however, they can often provide a great deal of detail regarding the series of events which led to the commission of an offence."

Ultimately, both prosecutors and defence counsel may benefit from the analysis of digital evidence. Prosecutors may rely on the digital evidence which contradicts the defendant's version of events. Conversely, defence counsel may rely on digital evidence which establishes that the defendant was elsewhere, or that the event did occur at a different time.

The  Meaningful Nature of Communication

For Ahmad Karzai of Karzai Law, digital communications create another layer of complexity.

Texting and sending short-form messages via messaging apps differs significantly from formal conversations. Texts are frequently abbreviated. Humour can be lost or misinterpreted. Arguments can develop over many messages.

When investigators are called upon to interpret one particular message, it is possible for the investigator to misunderstand the intent behind the message.

"When a single message is extracted from a larger conversation," notes Ahmad Karzai, "it can appear particularly incriminating. Where digital communication plays an important role in a criminal proceeding, contextual relevance becomes crucial. You need to consider what preceded and followed the message in question and what was transpiring at the time of the message."

Similar issues arise with respect to digital communications via WhatsApp conversations, Instagram direct messages, email communications and other forms of electronic communication.

Although deleting a message may remove it from view on your phone and possibly in your account history, if another party had saved a copy, screenshotted it or made a backup, it may remain accessible to investigators. This situation can result in investigators having to review multiple versions of what appears to be substantially similar conversation(s).

Video and Photographs

Another massive class of evidence generated by mobile technology is photographs and videos.

According to Gurasish Pal Sandhu of GPS Criminal Law Firm, while photographs and videos used as evidence in prosecutions for offences often generate attention-grabbing images of an alleged offence, photographs and videos taken well before or after an alleged offence can also serve as useful evidence in helping investigators establish timelines and identify individuals involved in an alleged offence.

In addition to establishing identity and demeanour, photographs and videos can also demonstrate an individual's physical appearance.

Additionally, social media posts can also establish timing or location.

Even individuals unrelated to the alleged offence can inadvertently contribute to digital evidence which is deemed relevant to an investigation.

"People usually envision video evidence as capturing some form of footage depicting the incident itself. While this may be true, equally significant can be the video recorded 5-10 minutes prior to or following the incident because it can help identify participants and/or establish the timeline of events surrounding the incident."

Social media adds yet another dimension to this equation.

An individual may post from a bar, restaurant, concert or private gathering without realizing that their posting may ultimately aid in establishing their whereabouts. Additionally, friends may include them in posted photos or videos. Another person's video may depict them in the background.

The creator of this evidence may never recognize its significance.

Developing an Hour-by-Hour Timeline

Manbir Nirwal of Nirwal Law in Brampton states that one of the most compelling features of modern-day digital evidence lies in combining multiple disparate classes of evidence.

Suppose police are tasked with developing a timeline from 9 p.m. until midnight.

Possible entries on a timeline might include:

• Restaurant transaction at 9:08.

• Photo taken at 9:42.

• Message sent at 10:03.

• Location data captured shortly thereafter.

• Ride-sharing record captured at 10:47.

• Additional messages sent at 11:15.

On their own, each of these examples would likely be viewed as benign by most reasonable individuals.

However, when viewed collectively, they can begin forming a timeline.

"We are producing digital records continuously without giving it a second thought. In terms of investigating crimes, we ask ourselves how these separate digital records relate to one another. Oftentimes, it is not what is contained in a single piece of digital evidence that is so critical, but rather how individual pieces of digital evidence connect and form sequences."

Mr. Nirwal also notes that digital evidence cannot always confirm who specifically initiated actions on behalf of a user.

Messages may come from an account. Who was operating the device when this occurred?

Phones may be found near locations. Does this automatically establish who was carrying the phone?

Both distinctions are significant considerations when evaluating how much weight should be given to any particular piece of electronic evidence in connection with assessing liability.

What Police May Access

The fact that digital information exists does not automatically grant law enforcement access to that information.

Canadian courts have acknowledged the tremendous privacy implications resulting from the widespread adoption of mobile phones. The power of law enforcement to conduct searches for information stored on mobile phones depends largely on obtaining the device under proper authority and obtaining consent from others based on applicable statutes and regulations.

The Criminal Code sets forth specific investigative procedures allowing law enforcement agencies to request certain information from third-party service providers (e.g., tracking/transmission data), provided that applicable statutory requirements for judicial approval are met.

Veteran defence lawyer Calvin Barry of Calvin Barry Professional Corporation emphasizes this importance.

"Many individuals believe that once law enforcement obtain possession of a phone, they can access whatever information they desire. Nothing could be farther from the truth. As with all investigative procedures, there can be critical substantive legal issues concerning how evidence was collected (authority granted), how evidence was searched (limits of search) and whether any other laws were violated when conducting the search."

Questions regarding whether evidence was properly collected, whether authorities properly obtained the required authority to collect it and whether law enforcement exceeded permissible boundaries when collecting it can be just as important as finding meaningful evidence.

The Supreme Court has recognized that cellphone searches conducted pursuant to arrests pose serious privacy risks and thus searches conducted incident to arrest must comply with established limits set forth by law.