Exculpatory Evidence and Computer Crimes
Very often, the focus for prosecuting investigators, is the discovery of incriminating evidence.
However, procedural rules in criminal jurisprudence, in most common law jurisdictions, require the prosecution or investigatory authorities to also provide details of any evidence that would seem to support the case of the defence.
As we know in the real world of criminal practice, this demand for fairness required by the rules, is better observed on paper than in practice.
It is therefore the job of the defence team to conduct its own investigation in other to determine the presence or otherwise of exculpatory evidence.
No defence team must leave unchallenged, the digital evidence presented by the prosecution in a criminal proceeding.
Such challenge, will apart from confirming or denying the position adopted by the prosecution also provide an opportunity for the discovery of exculpatory evidence.
Exculpatory evidence would amount to any piece of digital evidence that would seem to throw doubt on the case of the prosecution and particularly, any evidence that will aid the case theory of the defendant.
Although the rules require the digital expert to be fair and balanced in their investigation and testimony, it is often the case, that the investigation and report provided by the prosecutions digital expert is slanted towards providing responses to the remit of the instructions by the instructing party.
The resultant effect, is that the final product of an investigation or expert report is often confined to the issues raised by the prosecuting party for the benefit of the prosecutions case theory.
In my years of practice as a digital forensic consultant, I am yet to see a remit of instruction by the prosecution to its expert that includes - locating any exculpatory evidence that may reside within the exhibit that supports the case of the defence.
The practical reality, is that issues that may be of interest to the defence are very often, not given attention or sometimes just a bare nodding reference.
The prosecuting team will always have at its disposal the use of digital experts and the use of expert reports when they require one.
This much can not be said for the defence team.
The defence team is often constrained by several factors in this area, chief amongst which is the non availability of funds to secure the use of an expert especially where the conduct of the case is not funded via legal aid.
The defence in such limited circumstances, are compelled to rely on the expert report provided by the prosecution.
And as observed previously, these reports are in terms of scope slanted towards the needs of the prosecution.
The defence will in these circumstances, require very large reading magnifiers to identify points of interest that may support its case theory.
For example, many successful prosecutions have taken place for crimes that involve the possession of offending images located within the computer of suspects.
And it is a good thing that offending culprits face the long arm of the law.
However, there is the very real possibility of innocent individuals finding themselves on the wrong side of the law because of the peculiar nuances associated with how the internet process works.
For example, when a user visits a particular web site on the internet, there is the real possibility that computer programmes called scripts may be activated on the users computer thus resulting in the download of offending, pictures, 3rd party web links and audio files onto the user's computer.
The user in this circumstance will not be aware of the download sub activities going on in the background.
Consequently a search of the users computer may reveal the presence of offending pictures, documents or audio files downloaded from the internet.
In this scenario, the prosecution is interested in showing that offending pictures as a fact, exist on the computer of the suspect.
The prosecutions computer expert will provide a report showing the location, dates and times of the offending files on the users computer.
The point here is, that the prosecution expert will only be concerned with showing that these offending pictures or documents exist on the defendant's computer.
Very often, the prosecution expert's report does not go as far as to investigate the possibility that the defendant may have had no knowledge of the presence of the offending files.
It is therefore the job of the defence team to explore the presence of exculpatory evidence to show the absence of the requisite knowledge on the part of the defendant.
Now, for a section of the criminal law that requires the proof of the defendant's knowledge as it concerns the presence of incriminating pictures or documents on a computer, it will be necessary for the defence to show, that although these documents and pictures exist on the defendants computer as a fact, they got there without the knowledge of the defendant.
A digital forensic expert, employed by the defendant, in the circumstances being examined, should conduct an investigation that includes examining the defendants computer for: 1.
The presence of malicious download scripts on the suspects computer, 2.
The possibility that the created, accessed and modified date and times of all the offending files are the same or just fractions of a minute apart.
(This means, the defendant could not have had any opportunity to see the contents of the offending files).
3.
The fact that the offending files are located in an area, within the computer, usually not accessible to the user.
For example temporary folders created by the automated routine of the computer or the unallocated segment of the computer hard disk.
A successful proof of the above 3 points by the defence, should provide empirical facts to support the lack of knowledge by the suspect, that these files were in his possession.
In addition the defence would have moved from mere assertion of the existence of exculpatory evidence to providing empirical evidence that needs to be refuted by the prosecution.
The take-away here, is that the defence must not rely solely on the prosecution expert evidence, no matter how compelling it seems.
In the same vein, it will be a faulty strategy to rely solely on introducing such rebuttal evidence during the cross examination of the prosecution expert.
The defence must endeavour to provide its own expert report that explores and shows the existence of exculpatory evidence.
It is not enough to merely assert the possible presence of exculpatory evidence without proof.
However, procedural rules in criminal jurisprudence, in most common law jurisdictions, require the prosecution or investigatory authorities to also provide details of any evidence that would seem to support the case of the defence.
As we know in the real world of criminal practice, this demand for fairness required by the rules, is better observed on paper than in practice.
It is therefore the job of the defence team to conduct its own investigation in other to determine the presence or otherwise of exculpatory evidence.
No defence team must leave unchallenged, the digital evidence presented by the prosecution in a criminal proceeding.
Such challenge, will apart from confirming or denying the position adopted by the prosecution also provide an opportunity for the discovery of exculpatory evidence.
Exculpatory evidence would amount to any piece of digital evidence that would seem to throw doubt on the case of the prosecution and particularly, any evidence that will aid the case theory of the defendant.
Although the rules require the digital expert to be fair and balanced in their investigation and testimony, it is often the case, that the investigation and report provided by the prosecutions digital expert is slanted towards providing responses to the remit of the instructions by the instructing party.
The resultant effect, is that the final product of an investigation or expert report is often confined to the issues raised by the prosecuting party for the benefit of the prosecutions case theory.
In my years of practice as a digital forensic consultant, I am yet to see a remit of instruction by the prosecution to its expert that includes - locating any exculpatory evidence that may reside within the exhibit that supports the case of the defence.
The practical reality, is that issues that may be of interest to the defence are very often, not given attention or sometimes just a bare nodding reference.
The prosecuting team will always have at its disposal the use of digital experts and the use of expert reports when they require one.
This much can not be said for the defence team.
The defence team is often constrained by several factors in this area, chief amongst which is the non availability of funds to secure the use of an expert especially where the conduct of the case is not funded via legal aid.
The defence in such limited circumstances, are compelled to rely on the expert report provided by the prosecution.
And as observed previously, these reports are in terms of scope slanted towards the needs of the prosecution.
The defence will in these circumstances, require very large reading magnifiers to identify points of interest that may support its case theory.
For example, many successful prosecutions have taken place for crimes that involve the possession of offending images located within the computer of suspects.
And it is a good thing that offending culprits face the long arm of the law.
However, there is the very real possibility of innocent individuals finding themselves on the wrong side of the law because of the peculiar nuances associated with how the internet process works.
For example, when a user visits a particular web site on the internet, there is the real possibility that computer programmes called scripts may be activated on the users computer thus resulting in the download of offending, pictures, 3rd party web links and audio files onto the user's computer.
The user in this circumstance will not be aware of the download sub activities going on in the background.
Consequently a search of the users computer may reveal the presence of offending pictures, documents or audio files downloaded from the internet.
In this scenario, the prosecution is interested in showing that offending pictures as a fact, exist on the computer of the suspect.
The prosecutions computer expert will provide a report showing the location, dates and times of the offending files on the users computer.
The point here is, that the prosecution expert will only be concerned with showing that these offending pictures or documents exist on the defendant's computer.
Very often, the prosecution expert's report does not go as far as to investigate the possibility that the defendant may have had no knowledge of the presence of the offending files.
It is therefore the job of the defence team to explore the presence of exculpatory evidence to show the absence of the requisite knowledge on the part of the defendant.
Now, for a section of the criminal law that requires the proof of the defendant's knowledge as it concerns the presence of incriminating pictures or documents on a computer, it will be necessary for the defence to show, that although these documents and pictures exist on the defendants computer as a fact, they got there without the knowledge of the defendant.
A digital forensic expert, employed by the defendant, in the circumstances being examined, should conduct an investigation that includes examining the defendants computer for: 1.
The presence of malicious download scripts on the suspects computer, 2.
The possibility that the created, accessed and modified date and times of all the offending files are the same or just fractions of a minute apart.
(This means, the defendant could not have had any opportunity to see the contents of the offending files).
3.
The fact that the offending files are located in an area, within the computer, usually not accessible to the user.
For example temporary folders created by the automated routine of the computer or the unallocated segment of the computer hard disk.
A successful proof of the above 3 points by the defence, should provide empirical facts to support the lack of knowledge by the suspect, that these files were in his possession.
In addition the defence would have moved from mere assertion of the existence of exculpatory evidence to providing empirical evidence that needs to be refuted by the prosecution.
The take-away here, is that the defence must not rely solely on the prosecution expert evidence, no matter how compelling it seems.
In the same vein, it will be a faulty strategy to rely solely on introducing such rebuttal evidence during the cross examination of the prosecution expert.
The defence must endeavour to provide its own expert report that explores and shows the existence of exculpatory evidence.
It is not enough to merely assert the possible presence of exculpatory evidence without proof.
