HKSAR v. Lau Ting Yin

HCCC 174/2020

[2021] HKCFI 1582

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CRIMINAL CASE NO 174 OF 2020

______________

______________

Before:  Hon Campbell‑Moffat J in Court

Dates of Hearing:  24-28 & 31 May 2021

Date of Decision:  1 June 2021

__________________________________________

R E A S O N S  F O R  D E C I S I O N

__________________________________________

The Application

1.This is an application originally made by Mr Chong on behalf of the defendant on 3 May 2021, but adopted and enhanced by Ms Alva, who now represents him.  The defendant objects to the digital evidence sought to be adduced by the prosecution.  These purport to be a WhatsApp Call Log and a selection of WhatsApp messages taken from the iPhone of the defendant [P71].  The WhatsApp messages are alleged to be between the defendant and Choi Yue‑sing (“Ah Sing”), who was D1 in these proceedings; between the defendant and someone referred to as Ah Hung and between the defendant and someone referred to as @ping ping.

2.At present the Call Log and WhatsApp messages have not been attributed any individual exhibit numbers.  The digital evidence, in the form of the WhatsApp messages only, was originally identified as MFI/1-3 at the beginning of the trial.  This was served in a different and much fuller form within the first AE Bdl at pp AE26-163, without reference to whom it was that was adducing it.  It included for the first and only time, a Call Log at AE26-43 (“the Call Log”).  The certified translation of the Whatsapp messages was served within AE Bdl 2 at AE 164-302.  It was finally served, but in a different format, within AE Bdl 3 at AE312-347 which was sought to be adduced through DPC 16239.  For the purposes of this application, it is presumed that the prosecution seeks to rely upon the contents of AE Bundle 3, which was the last in time to be served.  According to DPC 16239, he was tasked with handling the digital evidence which he obtained from exhibits P79(a) & 80(a), which are two CD ROMs, and which were adduced before the Court in the voire dire, by SPC 54124.

3.The main thrust of Ms Alva’s submission goes to the methodology adopted by the Narcotics Bureau and CSTCB[1] in extracting the digital data but she also has much to say about the handling of the exhibit P71 and the handling of the data after extraction.  In the alternative however, the defence submit that if the Court were to find the WhatsApp Call Log and the WhatsApp messages both relevant and admissible, then the WhatsApp messages should nevertheless be edited to excise the messages which fall outside of 9 February 2019 as they are too remote; speculative in nature; may be indicative of uncharged acts; their prejudicial effect outweighs their probative value and finally, in the Court’s discretion to ensure a fair trial.

Digital Evidence

4.S22, 22A and 22B of the Evidence Ordinance, Cap 8, were last amended in 1984 and followed the law of England and Wales as it was at that time.  They purport to lay down the conditions of admissibility of documentary and computer produced evidence where such evidence is sought to be adduced as prima facie evidence of any fact stated therein[2].  S22 deals with documentary evidence and s22A with documentary evidence produced from a computer[3]. They are statutory exceptions to the rule against hearsay, where that rule is applicable.  Where the evidence is sought to be adduced for a non-hearsay purpose, s22A is not engaged[4].

5.The rules of evidence are complex, none more so than the rule against hearsay, which has yet to be amended in Hong Kong in line with other common law jurisdictions.  Often, in criminal trials, more than one rule of evidence may apply to the same piece of evidence.  Which rule to apply and in what order they should be considered can be confusing, especially when applying old rules formulated in the last century, to new and developing circumstances.  S22A falls into this category.  Computer produced evidence is not what it was when the original legislation was drafted.  At that stage the concerns were whether a computer could be said to be operating properly where there was human input at some stage in its operation.  Today, and where s22A is applicable, it is not just a question of assessing the possibility of misuse by a user but also the potential corruption of data by third parties completely unconnected to proceedings, by the technology itself, or by those seeking to examine it.  This issue is relevant in circumstances where it is relied upon as hearsay or non-hearsay evidence.

6.In a criminal trial it is especially important that only relevant admissible evidence is before the Court.  The provenance and integrity of that evidence also has to be assessed in order to establish whether it should be admitted and if so, what weight should be attributed to it.  Where defendants are at risk of losing their liberty, that responsibility should weigh heavily with the court.

The Evidence Sought to be Relied Upon

7.In this case, the prosecution seeks to adduce digital evidence taken from the memory contained within the mobile phone belonging to the defendant [P71].  It is not seeking to adduce any evidence from the sim card operator or data held outside of the physical phone itself which is accessible through the medium of the phone.  The digital evidence which this Court is concerned with falls into four categories:

(i)  A WhatsApp Call Log at AE 26-43, which includes calls between the number 52447542 and 97928545 from 5 February to 9 February 2019.

(ii)  WhatsApp messages between 52447542 and 97928545 from 7 January to 9 February 2019 at AE44-67[5].

(iii)  WhatsApp messages between 52447542 and 54062149 on 9 February 2019 at AE68-90[6].

(iv)  WhatsApp messages between 52447542 and 67499386 from 4 January to 9 February 2019 at AE 91-163[7].

8.For what purpose does the prosecution seek to rely upon items (i) to (iv) above?  Mr Laskey puts his case in the alternative.  Firstly, he relies upon them as evidence of their truth.  He says it shows the involvement of the defendant with both Ah Hung, Ah Sing and an unidentified third party.  He says the part he played in the substantive offence can be inferred from this, which he says is ‘more than merely preparatory’.  For these purposes the prosecution accept s22A is triggered. In the alternative however, either if the Court were to find that s22A did not apply or that the prosecution had failed to comply with the requirements thereunder, Mr Laskey submits the prosecution can rely upon them as real or non-hearsay evidence.  In this regard he submits they show ownership of the phone itself and the defendant’s sole use of the iPhone, for which he also relies upon the admissions within the VRI at Counters 91-92 and 99-102. He has not suggested any other non-hearsay purpose for which he wishes to place the digital evidence before the Court.

9.The defence objects.  Ms Alva, on behalf of the defendant, submits that s22A, is clearly triggered on the true purpose as outlined by the prosecution and they have failed to comply with it.  If the Court were to find that to be the case, then none of the digital evidence can be admitted.  If the court were not with the defence on that point, Ms Alva submits that it should nevertheless be excluded on the bases outlined above or, at the very least, be appropriately edited.

Procedure for the Admission of Digital Evidence – Hearsay and Non-Hearsay Evidence

10.I agree with Ms Alva on the true purpose for which the prosecution seeks to rely upon this evidence.  Mr Laskey accepts that and his alternative submission was not forcefully argued.  Where the prosecution or defence seek to rely upon data obtained from an electronic device for a hearsay purpose, whether that be a computer, telephone or some other applicable device[8], such evidence must be adduced properly, either through a human being who is a percipient witness as to its creation, use or receipt; or by way of a statutory exception.  S22A is engaged if the evidence is sought to be adduced as prima facie evidence of a fact stated therein i.e. for the truth of its contents. This is the primary purpose of the evidence in this case.  In such circumstances the requirements of s22A are to be complied with.  It is not open to the parties to agree such evidence by way of admitted facts in order to circumvent the requirements of that section as has become the practice in these Courts[9]. However, for the avoidance of doubt, s22A and s22B also provide guidance for how the Court should consider the integrity of such evidence even if produced for a non‑hearsay purpose.  This is the prosecution’s argument in the alternative, albeit not a strong one.  In the same way that a Court would not unilaterally accept a written document for a non‑hearsay purpose unless it was satisfied it was genuine, e.g. written by a certain person, or received by another and recognised as genuine, so the Court should consider the integrity of data.  It is relevant to ask how it came into being, who is said to have created it and whether its digital profile can be relied upon.  If so, to what extent it can be relied upon and what weight should be attached to it.

Where s22A is engaged

11.Where s22A is engaged because the party adducing it seek to rely upon it for a hearsay purpose, the first question which the Court should ask itself is whether direct oral evidence of any such fact sought to be adduced would be admissible in trial[10].

12.Only after s22A(1)(a) has been satisfied need the Court go on to consider the conditions to be met under s22A(1)(b) as defined in s22A(2).  Those are:

“(a) that the computer was used to store, process or retrieve information for the purposes of any activities carried on by any body or individual;

(b) that the information contained in the statement reproduces or is derived from the information supplied to the computer in the course of those activities; and

(c) that while the computer was so used in the course of those activities –

(i) appropriate measures were in force for preventing unauthorised interference with the computer; and

(ii) the computer was operating properly or, if not, that any respect in which it was not operating properly or was out of operation was not such as to affect the production of the document or the accuracy of its contents.”

13.In respect of telephone evidence, this is usually initially satisfied by the production of a s22A Certificate[11] from the mobile phone operator in reference to its server.  Such a certificate cannot usually seek to go beyond merely stating that a service was supplied to a mobile number and that such a number recorded outgoing and incoming calls, texts, voice messages on a certain date, at a certain time and for a specified duration.  It cannot be evidence of who made or received such calls without more.  That may have to be subject to the drawing of an irresistible inference e.g. from a VRI.  As for social media which is operated, and sometimes encrypted, by other service providers e.g. Facebook, WhatsApp, Telegram, Instagram etc the mobile phone certificate cannot certify the veracity of the contents.  In this case the certificate sought to be produced in respect of P72, the defendant’s sim card, at pp AE1-3 can only go so far as to state the commencement of service to an unregistered sim card.  Paragraph 7 of that certificate, which seeks to certify the proper operation of the computer, is of no value whatsoever in evidence as the data sought to be relied upon by the prosecution has been retrieved from P71, the defendant’s iPhone and not P72, his sim card.  For these purposes DPC 54124 was recalled.  He gave evidence that the digital evidence now sought to be relied upon was retrieved from the memory of the physical phone itself.  It was contained within its memory and there was no need to seek to use the phone to access that data from anywhere else.  By way of an aside, he reminded the court that the laboratory itself was secure and that he would not be able to do so in any event as there was no wifi and nor therefore would any outside body have the ability to access it.  So far as the operating system of the iPhone was concerned, he did not hold himself out as an expert as to that system and could not assist the court.  As Ms Alva has pointed out, there is no certificate before the Court in respect of the operating system of the iPhone which would satisfy s22A(2).  DPC 54124 however gave evidence that the server, which eventually contained the image of data retrieved from the iPhone, and which would satisfy s22A(3), was believed to be working properly as was the forensic tool employed to extract that image and that in his experience there was nothing to suggest the imaging process in respect of this iPhone was not carried out satisfactorily.

14.What the prosecution seek to do is to place the data, retrieved from P71 by way of forensic imaging, before the court.  It is that data, contained within the image retrieved, which the prosecution say can be adduced under s22A.  For the purposes of placing the content of such evidence before the Court i.e. the data retrieved from the iPhone and not data held by the service provider, s22A (3) comes into play.  That reads:

“(3)  Notwithstanding subsection (1), a statement contained in a document produced by a computer used over any period to store, process or retrieve information for the purposes of any activities (“the relevant activities”) carried on over that period shall be admitted in any criminal proceedings as prima facie evidence of any fact stated therein if –

(a)  direct oral evidence of that fact would be admissible in those proceedings;

(b)  It is shown that no person (other than a person charged with an offence to which such statement relates) who occupied a responsible position during that period in relation to the operation of the computer or the management of the relevant activities —

(i)  can be found; or

(ii)  if such a person is found, is willing and able to give evidence relating to the operation of the computer during that period;

(c)  the document so produced under the direction of a person having practical knowledge of and experience in the use of computers as a means of storing, processing and retrieving information; and

(d)  at the time that the document was so produced the computer was operating properly or, if not, any respect in which it was not operating properly or was out of operation was not such as to affect the production of the document or the accuracy of its contents,

but a statement contained in any such document which is tendered in evidence in criminal proceedings by or on behalf of any person charged with an offence to which such statement relates shall not be admissible under this subsection if that person occupied a responsible position during that period in relation to the operation of the computer or management of the relevant activities.”

This is usually placed before the Court by an expert from one of the specialised Cyber Security divisions of a government department or a privately instructed expert witness.  In all cases, the proper practice is to obtain an image of the digital evidence and attribute to it a hash number.  This should be done by the prosecuting authority as soon as possible after seizure to avoid the possibility of corruption of data.  The responsibility for the security and integrity of data (as with the security and integrity of exhibits) lies with the prosecution[12].  Once an image has been taken by means of the appropriate forensic software and a hash value calculated, it should be recorded formally.  In this case that was done by means of a POL 155 completed by DPC 54124.  The hash value is of considerable importance.  The image taken, which remains upon the police server, should be encrypted to secure it but in any event, whenever it is accessed thereafter the hash value should be calculated and confirmed.  A proper record should be maintained of that exercise.  There must be no change to that value.  If there is a change, it should be recorded.  A copy of the data should be made at the very first opportunity and not months or years later. At present that would be by downloading to a read only CD ROM or possibly an encrypted thumb drive, one of which should be retained as a master copy.  Further copies can be made by the same exercise at the same time for use by the prosecution and defence.  A soft copy should always be served upon the defence as the exercise of interrogating such data is a time consuming one and often delays court proceedings when it is not served but instead simply identified within the unused materials.  The expense and manpower taken to copy the data onto a CD ROM, in most cases, is negligible and service of that data places a duty upon the defence to consider it in a timely manner.  If there is any possibility that the data retrieved is to be used in evidence against the person charged, then this should be carried out as a matter of practice.  A considerable number of court hours and police manpower would be saved if this exercise were carried out as a matter of practice.  This case is an example of that.  We are now in day 14 of a 10‑day trial and have not yet empanelled a jury because of the lax practices of the prosecuting authority.

15.For practical purposes, not all data retrieved will be relied upon.  Where it is to be only partially retrieved and then transferred into a more user‑friendly form such as a log or schedule, a witness will be required to speak to how that was achieved.  This should not be an afterthought as it was here.  If the prosecution serves the data in a timely manner, it is likely that such a log, once proved, can be agreed.  It is far more difficult to do so if the service of material is left until close to or at the time of trial.  In this case there was a witness statement from someone who purported to carry out this exercise[13] but it was ineffective in properly dealing with how the exercise was carried out so as to ensure the integrity of both the data and its provenance.  Court time was therefore taken up with calling that witness.

16.Digital evidence from mobile phones falls into several categories.  These include, but are not limited to:

(i)  a call log of voice calls;

(ii)  text messages;

(iii)  voice messages;

(iv)  social media messaging; and/or

(v)  use of and content of other applications.

Whilst items (i) to (iii) can be provided in schedule form by the service provider and forensic expert, items (iv) and (v) cannot.  This data should be the subject of a certificate from the application provider if the contents are to be relied upon as evidence of the truth.  In the absence of a s22A certificate, the party seeking to adduce such evidence may however seek to rely upon s22A(3).  Where the content of more than one messaging platform is relied upon, it would be more intelligible to the court, after it has been formally produced, for a master chronology of messages to be created.  It is not acceptable to produce several different messaging streams covering a substantial number of pages and expect the finder of fact to cross reference them and place them in chronological order.  This is all the more important in a jury trial.  This can be produced as an agreed exhibit or as an aide memoir.

Chronology and Provenance

17.The original source of the data in this case is P71, the red iPhone (“P71”).  Some of the evidence in this case therefore pertains only to the Apple iPhone and its operating system and not to Android devices but the principles arising are generally the same.  P71 was seized by DPC 4980 at the time of arrest on 9 February 2019 along with its sim card P72 and they remained in his custody until the VRI later that night.  P71 was opened during the VRI in order to interrogate telephone numbers.  It is not clear whether there was a password on it at that time although it would be unusual for that not to be the case.  It is the defence case that it was locked with a password.  If the password is cleared at that stage in order to facilitate later access by an investigating officer or forensic technician, then this should be done within the VRI and on tape so that there is no question of improper behaviour.  After the VRI, P71 and P72 were sealed within a TEPE B2945184 (“the TEPE”) on 10 February 2019.  They were in the custody of DPC 4980 (in a locked desk drawer) until they were handed over to DPC 6123, the exhibits officer (“the EO”) on 12 February 2019.  The EO also kept the case exhibits locked in a drawer in his office.  On 15 February 2019, P71 & 72 were handed over to SPC 10129.  He gave evidence that they were received formally into the property store at that time.  He said that all property in and out of the Narcotics Bureau (“NB”) property store was recorded in the CMIS[14] system by individual exhibit reference [P82] and could not be handled without it being recorded. SPC 51753 drew out the exhibits from the NB property store on 9 July 2019 and handed them over to DPC 486, who delivered them on the same day to SPC 54124 at the CSTCB[15]. I will deal with his handling of the exhibits in more detail at paragraph 18 below but will continue to complete the chronology of the handling of the real exhibits first.  According to both SPC 54124 and DPC 8460, P71 and P72 were returned by SPC 54124 to DPC 8460 on 20 August 2019.  DPC 8460 gave evidence that he returned them to the NB, where he put them into his locked officer drawer.  He does not now recollect what he did with them thereafter, which is unfortunate because they were not placed back into the NB property store until a year later on 13 August 2020.  There is no evidence of what happened to either P71 or P72 in the intervening period save for DPC 8460 stating he believed they were still in his desk on 23 August 2019 when he made his second visit to CSTCB.

Forensic Analysis

18.SPC 54124 told the court that he opened the TEPE on 9 July 2019, to check for obvious damage to the phone and sim card.  There being none, he resealed the exhibits into a new clear plastic bag with a CSTCB tamper proof label s/n CA065831.  This system is not the same as the TEPE system and does not allow for any record to be made upon the bag itself of who took over the exhibits and who sealed the new CSTCB bag.  Indeed, according to the officer, no record is kept, which I find surprising.  On 15 August 2019, P71 and P72, were signed out and unsealed by SPC 54124 and P71 was charged for just four minutes.  It is his evidence that the phone had no password at this time although it appears to have had a password at the time of the VRI as the defendant was asked to use it.  If that was the case and if it is accepted that the TEPE had not been interfered with at any stage, the irresistible inference is that the password was deleted before the sealing of the TEPE at 02:01 hours on 10 February 2019 when it was in the possession of DPC 4980.  DPC 54124 gave evidence that once the phone had been accessed via a password, the user could delete the need for the password thereafter but there is no direct evidence before the court that this was done.

19.In his witness statement dated 5 September 2019 MFI/9, at paragraph 14, DPC 54124 stated that the date and time displayed when the iPhone was opened was 13 April and 1:42.  Such a time and date would indicate that the phone had been accessed by someone between the date of sealing the TEPE and the date it was opened by SPC 54124, although SPC 54124 stated that the TEPE was intact when he received it.  This anomaly was pointed out during early submissions and a further witness statement was made on 20 May 2021 by 54124, in order to correct three errors in his earlier statement.  According to the evidence before the Court and Exh P82 which is a CMIS record[16], the exhibits should have been in the NB property store at this time.  In his oral evidence, 54124 stated that the errors had occurred because he had used not one but two previous witness statements from which he cut and pasted his statement of 5 September 2019.  These two witness statements MFI/9a&b, were part of a collection of witness statements stored on an encrypted thumb drive, which he kept personally.  He maintains that he made errors when he carried out this exercise and did not alter certain passages correctly to reflect the facts of the case at hand.  He produced MFI/9a&b to show where and how this had occurred.  As Ms Alva pointed out in cross‑examination, and as can be seen by a comparison with those earlier statements, the text in Chinese used for the date and time at paragraph 14 of his 5 September 2019 witness statement (MFI/9) is not the same as that of the witness statement upon which he said he relied i.e. paragraph 12 of the statement of 12 June 2018 (MFI/9(a)).  He did not answer this.  In any event, on 15 August 2019, 54124 said he obtained an image of the data upon P71 using the Cellebrite forensic tool and thereafter calculated a hash value for the image which was retained upon the police server.  It is still there.

20.The real exhibits were never viewed again.  They were resealed with a new CSTCB label s/n CAO65857 and returned to DPC 8460 on 20 August 2019, when he attended to view the data image which was stored upon the CSTCB server.  He did so with the assistance of  DPC 54124, who confirmed that he checked the hash value of that data each time he accessed the server.  The exercise on 20 August 2019 was to interrogate the available data image.  As there was a large amount, DPC 8460 did not ask for a copy of any part of it at that stage.  He returned on 23 August 2019, when part of the data from P71 was downloaded onto 2 CD ROMs in excel format (P 79 & 79a) by DPC 54124 and which were handed over to DPC 8460.  On 4 September 2019 further data in excel format was downloaded onto two CD ROMs (P80&80a) and handed over to DPC 8460.  The fate of the Master Discs P79 & 80, and their respective working discs P79a & 80a is also unknown until the date they were required to be produced in court.  The data contained within Exh P79a and P80a (“the working discs”) was extracted by DPC 16239 at some time in January 2021.  He received the working discs at some point in December 2020 from DPC 8460.  Neither 8460 or 16239 told the Court when that was.  They did not remember and had no record.  In the intervening period, between December 2020 and January 2021, according to DPC 16239, they were held in a lockable drawer in the NB but as this was a communal drawer, the court presumes a number of people had access.  DPC 16239 told the court that he looked at the material on the working discs in January.  He could not say when in January.  He did not say what format it was in.  According to DPC 54124 it was downloaded in excel format but it is no longer in that format before the Court.  It is clear from the format now before the Court that the format of the data has changed over the intervening months as can be seen from a perusal of AE Bdls 1-3.  He said he had selected part of the data to be transcribed.  He did not say which part.  Having received those messages back, he then arranged to have part of them translated.  He identifies these.  At some stage he made his own table of the evidence he had selected.  He could not identify exactly what that was because he said he had not attached any such schedule to his statement.  At this point the prosecution were in considerable difficulty.  They wish to rely upon the schedules at AE312-347, which were attached to his witness statement. But the witness had not attached them to his witness statement.  He could not identify them as such because he could not refer to his statement to memory refresh.  It had not been made contemporaneously with events.  Nor had he made it from documents which had been made contemporaneously with events by him.  He had no record of what he had done with the data because he had destroyed it. He had no independent memory of this whole exercise, that was self-evident from the poor quality of his evidence.  If he had been provided with material to refresh his memory from NB documents or even his own witness statement with the attachments someone else had appended to it, he may have been able to answer for the discrepancies but he clearly could not and the prosecution’s hands were tied.  As a consequence, AE312-347 is not properly before the Court and is currently inadmissible as it cannot be verified from the moment the data was extracted from P79a and P80a to its current format within AE Bdl.  All is not lost however because the prosecution still retains the telephone P71 upon which the data is stored and have the image retained upon the server plus the original master copies of that image placed upon a read only CD ROM which DPC 54124 produced.  They will need to carry out this exercise again and this time do it properly.

Analysis

21.The prosecution maintains that the Call Log under AE 26‑43 (also at AE 164‑181), was extracted from the imaged data by SPC 54124 on 23 August 2019.  It remains upon the master disc P79.  It is a record by time and date of outgoing and incoming calls between two numbers, 52447542 and 97928545.  The defendant confirmed in his video recorded interview (“VRI”) at counters 94 and 310, that the phone he alone used was 52447542 and that he rang 97928545 to contact Ah Sing.  It is therefore relevant to the issue before the Court, which is whether the defendant carried out an act or acts which were more than merely preparatory to the trafficking in dangerous drugs which was carried out by Ah Sing.  From that Call Log it is open to Mr Laskey to ask the jury to infer that the defendant called Ah Sing on those dates at the recorded times.  Subject to the issue of provenance, which the prosecution has yet to comply with, I can see no reason why this evidence is inadmissible.  S22A is not triggered.  It is not needed to rely upon it as evidence of the truth of a fact therein.  It is relevant to show that there was contact between the defendant and Ah Sing but no more.  Of course, that is already available from the VRI and from DPC 4980.  It is no part of the defendant’s case that he does not know Ah Sing.

22.As for the Call Log, there are 18 calls between the two phones on 9 February 2019 up to the point at which Ah Sing was arrested at 19:37 hours.  11 of those calls could not be connected, and 5 of the remaining 7 calls were of 1 or 2 seconds duration.  Only 2 calls suggest a connection of 49 seconds and 3 minutes 50 seconds.  These were at 17:59 and 19:15 hours.  There were 12 calls between the two numbers on 8 February 2019, 4 calls on 7 February 2019, two of which appear not to have been connected and none at all on 5 or 6 February 2019.  Their value is clearly limited and highly speculative but they are admissible subject to provenance.

23.The WhatsApp messages between 52447542 and 97928545 and purportedly between the defendant and Ah Sing, cover the period from 7 January to 9 February 2019.  Mr Laskey seeks to rely upon them to infer the nature of the relationship between the defendant and Ah Sing.  He relies upon them as evidence of the truth e.g. that the defendant knew that Ah Sing had drugs in his possession on the evening of 9 February 2019 and s22A is triggered for this purpose.  The time period covered by these WhatsApp messages is not sufficiently proximate to the events relied upon, i.e. 9 February 2019.  The WhatsApp messages covering the period 7 January to 29 January 2019 inclusive, when read as a whole with other messages, suggest other possible uncharged acts and insufficient proximity to the actual TDD it is alleged that the defendant attempted to carry out.  Indeed, it could be read to suggest that the majority of the incriminating evidence within these calls relates only to other uncharged acts and not to the events of 9 February 2019 at all.  As a result, the content of the evidence within those dates must be excluded for this reason and because it follows that their prejudicial effect outweighs their probative value.  As for the WhatsApp messages which took place on 9 February 2019, subject to the Court’s findings upon provenance, they appear to be directly related to the TDD relied upon and are relevant and admissible.  There is a clear inference to be drawn that the defendant knew at that stage of the DD possessed by Ah Sing and that he was intending to visit Ah Sing to see them.

24.The WhatsApp messages between 52447542 and 54062149 on 9 February 2019 are at AE 71-90.  There is no evidence as to who is the user of 54062149.  For what purpose does the prosecution seek to rely upon the existence of communication between the defendant and an unknown third party?  Mr Laskey submits that these should be looked at along with the evidence contained in the other messages before the Court.  This is an unidentified third party and clearly suggests that the defendant intended to deal in the drugs held by Ah Sing.  The Court has a number of concerns.  Firstly, the third party is unidentified.  There is no evidence as to the role which this person played, whether they played any actual role at all in the material events, had any first‑hand experience of what occurred or was acting or reacting to hearsay.  Secondly, there are parts of the messages relating to that third party which are highly incriminating as to an uncharged act without sufficient nexus to the events at hand in and of themselves.  Thirdly, the defendant himself refers to other uncharged acts.  Fourthly, it refers to a future intention to carry out a criminal act not necessarily an act more than merely preparatory to this offending.  The admission of this evidence therefore requires inference upon inference from an unidentified source.  The whole of this evidence is unsatisfactory as it is speculative, relates to potential uncharged acts and its prejudicial effect outweighs its probative value.  It may not be placed before the jury.

25.The WhatsApp messages between 52447542 and 67499386 from 4 January to 9 February 2019 are at AE 101‑163.  The defendant admits to contacting Ah Hung upon this number.  Once again the WhatsApp messages between 4 January and 3 February 2019 could refer to other uncharged acts and are not sufficiently proximate to the substantive offence underlying this charge.  There are oblique references to the use of Ah Sing’s address and to using him as a courier but these refer to other uncharged acts and not specifically to the offence at hand.  Indeed, there are no messages after 3 February until 9 February 2019.  This break in communication suggests that the TDD carried out by Ah Sing was not done under the auspices of Ah Hung. Their prejudicial effect is overwhelming as they suggest a pervasive and ongoing exercise to traffic in other dangerous drugs.  Even subject to a strong direction to the jury there is a significant risk they will be prejudiced by this evidence, which is in any event highly speculative and without sufficient nexus to the events of 9 February 2019.  Subject to the issue of compliance with s22A, serial no. 1158 on AE331 relating to 9 February 2019 may be admissible.

Conclusion

26.Direct oral evidence from Ah Hung and Ah Sing of what they said to the defendant and what he said to them would be admissible before the Court.  The prosecution are not in a position to satisfy s22A(2) because the WhatsApp messages are on an operating platform for which no witness has been called and a s22A (5) certificate has not been served. S22A (3) therefore applies and the evidence of SPC 54124 and DPC 16239 is applicable. DPC 54124 was an unimpressive witness and the manner in which he wrote his witness statements is to be deprecated but he is not a dishonest witness and no doubt he has learned a hard lesson.  DPC 16239 was no better.  He came to this Court ill‑prepared.  This Court is not a disciplinary body for the police or other investigative authorities.  It does not and should not be seen to be admonishing the police for sloppy practice by ruling evidence inadmissible, where that practice has resulted in no unfair prejudice to the defendant such that he cannot have a fair trial[17]. It matters not what happened to the real exhibit P71 after the data image was extracted.  It was extracted on 15 August 2019.  There has been no suggestion that anything was deleted or added to the WhatsApp messages which form the basis of the evidence.  If there had been some credible evidence that such might have been the case then this evidence would surely have been rendered inadmissible as a result of the poor management by SPC 54124, DPC 16239 and DPC 8460, but also because of the poor exhibit handling which appears to be standard practice by all of the other officers.  Other than when an exhibit finally makes it way to the property store (if it ever does), the police force seems to consider it perfectly acceptable to lock it up in a desk drawer (at times indefinitely) without any record of doing so.  In this case for what appears to be over a year in respect of P71, 79 & 80. It must be added, the situation before the Court may have been far worse without the considerable efforts of those supporting Mr Laskey as witness after witness came ill‑prepared and frequently did an about face after being caught out with what at best the Court can only consider to be either laziness or poor management systems or both.  It is most unfortunate that the weaknesses in the case management of exhibits and digital data have been shown to be endemic but there is nothing before the Court which suggest that the data captured has been corrupted either deliberately or in any other way.  I find therefore that the data referred to above, as edited, is admissible under s22A as evidence of the facts contained within it if it is properly produced.

27.As the jury is to be empanelled and Mr Laskey is not yet in a position to put that evidence before the Court in proper form, as is the usual practice, he should not refer to it in opening.

Mr Edward Laskey, counsel‑on‑fiat, on behalf of the Department of Justice, for HKSAR

Ms Patricia E Alva, instructed by Tony Kan & Co, assigned by Director of Legal Aid, for the defendant