Computer Evidence


Before discussing the admissibility in criminal proceedings of evidence contained on or created by a computer, brief mention must be given to hearsay evidence, as this is of great significance in this area.  Hearsay, which is a statement made by someone other than the person giving oral testimony in proceedings, is generally not admissible in criminal proceedings as evidence of any fact or opinion contained in the statement.  (The rule against admitting hearsay in civil proceedings has been as good as abolished.)   The rule prevents evidence being given by someone who has insufficient knowledge of the evidence and so cannot be effectively questioned about it.  The rule is important when considering computer documents since it might not always be possible to identify who created the document.  Indeed, it is possible that several people may have contributed to the final version of a document.  Consequently, the law of evidence must reflect this, and other potential problems in this area, such as whether a computer was working correctly when the evidence which is sought to be admitted was created.  More information on hearsay can be found in the article Hearsay in Criminal Trials

Business and other documents

The admissibility of business and other documents is dealt with under s117 of the Criminal Justice Act 2003.  The section only applies to documents which are hearsay, that is, where the information was provided by a human being.  Evidence which has been recorded by a computer is not dealt with by this section.  Such evidence may be admissible as ‘real evidence’ (see below).  The provisions of s117 could apply, for example, where an office worker inputs details of staff wages into a spreadsheet, or to emails and text messages sent in the course of business or trade.  There is also an implication that the person who provided the information need not be expected to remember it, and so need not be expected to give oral testimony of it.  Having said that, it is always better for a person who provides information in a document which is regarded as containing hearsay to be called upon to give oral testimony on the information. 

Documents prepared for criminal proceedings

Under ss117(4) and (5) a document which has been prepared for the purposes of criminal proceedings may be admitted as evidence.  This can apply where the witness is unavailable under s116 because, for example, they are dead.  Alternatively, a document may be admitted if, under s117(5)(b) ‘the relevant person cannot reasonably be expected to have any recollection of the matters dealt with in the statement (having regard to the length of time since he supplied the information and all other circumstances).’

Court’s discretion not to admit documents

Under ss117(6) and (7) of the Criminal Justice Act 2003 the court has a discretion to refuse to admit a business or other document under certain circumstances.  It is possible under this section for a court to exclude a computer document if there are doubts about whether the computer was working correctly at the time the document was made, so that the document’s accuracy may be doubted.

Real evidence

Evidence which is automatically recorded by a computer or other device without additional human intervention is considered real evidence and is generally admissible.  CCTV images and an email time and date stamp are examples of real evidence.  In R (on application of O) v Coventry Justices [2004] credit card transactions and other information recorded automatically when the defendant tried to access a child pornography website was real evidence and admissible.  Nevertheless, the court always has discretion as to whether evidence should be admitted, even if on the face of it the evidence is admissible.  For example, at common law there is a presumption that a machine was working correctly at the material time unless proved otherwise.  Consequently, if it can be shown that a computer or other device was not working correctly at the material time, then the accuracy of the evidence it might contain may be doubted and the court would likely refuse to admit it.

Computer forensics

Since the courts have discretion whether to admit evidence, as far as computers and other devices are concerned it is important to maintain them so that they keep accurate records of information and so that this information can be easily retrieved.  Consulting an information technology expert may be advisable in cases where a severe loss or corruption of data is threatened.  The Association of Chief Police Officers has published a ‘Good Practice Guide for Computer Based Electronic Evidence’ which contains useful information on several topics including home networks and wireless technology, the principles of computer based electronic evidence, and the retrieval of video and CCTV evidence.  The Guide also contains a glossary of computing and information technology terms.  As far as computer forensics is concerned, the Guide stipulates four principles:

  1. Do not change data which may later be relied on in court

  2. If it is necessary to access original data, the person doing so must be competent and capable of giving evidence regarding their actions

  3. All processes applied to electronic evidence should be carefully recorded

  4. The person in charge of the investigation is responsible for ensuring that both the law and these principles are adhered to

As far as the police are concerned, it should be clear that the computer evidence they are adducing at court is exactly the same as when they first took custody of it.  The police should endeavour to document how the evidence was obtained and preserved so that an independent third party could use the same processes to reach the same results.