HKSAR v. Milne John

HCCC 240/2020

[2021] HKCFI 3824

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CRIMINAL CASE NO 240 OF 2020

______________

______________

Before: Hon Campbell‑Moffat J in Court

Dates of Hearing:  16 and 17 December 2021

Date of Ruling:  17 December 2021

______________

R U L I N G

______________

1.The defendant faces one count of Trafficking in a Dangerous Drug contrary to s4(1)(a) & (3) of the Dangerous Drugs Ordinance, Cap 134. The prosecution seek to rely upon photoshots of WhatsApp messages found within the memory of his iPhone X [P60][1] and taken on 15 and 17 September 2019; alternatively digital evidence recovered from P60 by Acting Chief Customs Officer Chan at the Customs & Excise Computer Forensics Laboratory (“the Laboratory”).

2.It has become common practice for investigating authorities to rely heavily upon digital evidence in criminal trials.  It has increased to the stage that the vast majority of trials substantially rely upon this evidence.  It has also become increasingly common for prosecuting authorities to rely upon ‘short cuts’ to this evidence and counsel, whether prosecuting or defence, have fallen into the habit of agreeing evidence which is often, or may be, inadmissible.

3.Whenever someone’s liberty is at stake, the rules of evidence should be strictly complied with.  There should be no place for short cuts.  Witness statements should not omit large gaps in the handling of exhibits, as has happened here.  The prosecution brings the proceedings. The prosecution therefore has the burden of proving it and they have the burden of doing so to a very high standard.  At present it is unfortunately taking up to three years or more for defendants to come to trial.  That, in itself is a travesty, however it is all the more disturbing to note that frequently parties are coming to trial and their evidence is not in order.  This case is a prime example and despite two case management hearings and considerable direction, it is still not in order.

4.For the purposes of this Ruling on digital evidence I will attempt to use language easily understood by the parties to these proceedings as the technical language used by the expert witnesses can be confusing.

The Nature of the Digital Evidence Relied Upon

5.The “WhatsApp” evidence, which the prosecution seek to rely upon in this case, falls into two categories as described above, but also falls to be analysed under two separate methods of investigation and two separate periods of time.  Firstly, the seizure and handling of P60 from the time of arrest to the time of handing over for forensic examination and secondly, the period of time it was held by the laboratory and thereafter forensically examined.

The Provenance of the exhibit P60

6.The defendant was arrested on 10 September 2019.  P60 was initially part of the defendant’s personal property and as such would have been under the supervision of C&E.  Immediately after arrest, the defendant agreed to take part in a controlled delivery.  For that purpose his phone was used and would have had access to the internet.  There were several transmissions over a number of hours.  During that controlled delivery CO12200 took photographs of some of the WhatsApp messages upon the telephone. I presume these were later used for the purpose of the CRI but they have not been identified as such.  The phone (item 52) was not sealed with the other exhibits and remained open to use during the interview.  It appears to have been opened and accessed at that time.  The defendant was the subject of a video recorded interview at 17:57 hours to 20:40 hours on 11 September 2019.  The phone was finally sealed in a TEPE by CO1795 at 21:15 hours on 11 September 2019.  There is no record of when that TEPE was opened but we know that on the 15 September and 17 September CO12200 opened it and accessed the telephone in order to take more screen shots.  It appears that what is now P60 was then sealed once more in a new TEPE on 17 September 2019 and placed in the exhibit store.  In the event that a phone is accessed by an investigating officer, I understand from ACCO Chan that it is C&E practice that it should be placed in airplane mode and the SIM card taken out. Mr Poon points out that in some of the screen shots at P81, P82 and P83 that is the case.  Those exhibits refer, I believe, to the exercise on 15 and 17 September by CO12200.

7.The integrity of an exhibit should be paramount.  Whenever the phone is accessed the hash[2] value of the phone will inevitably be altered because the underlying data contained within the phone has been affected by the operation of the phone itself.  It should be reiterated at this point, that a phone is a computer for the purposes of s22A of the Evidence Ordinance, Cap 221. If it is to be accessed at any stage, those investigating its contents should seek to ensure that the data contained within it is secured and cannot be corrupted in any way.  Just as a lap top or desk top computer should not be interrogated without first freezing, securely copying or encasing the data within it, so too should a telephone.  Where that is not done, then it is incumbent upon those accessing it to make a record of when and in what manner they have done so and that should be made available to the defence.  It has come to pass in this case, as no doubt is done in others, that P60 was accessed on multiple occasions without such a record being made.  Witness statements at first blush suggest there has been no access whereas the truth is quite different.  Where that access is without the security of the Faraday box used inside the laboratory, it is all the more important that it should be carried out with data integrity in mind and a record should always be made because each and every access will affect the hash value of the phone and clearly any access in an internet environment allows for the transmission and reception of other data automatically.  Put simply, photographs are routinely taken of each stage of the discovery and seizure of drugs in order to avoid any suggestion of improper interference with the exhibit.  Why then is it not done with digital evidence which is often the most compelling evidence against a defendant who may face up to 20 or 30 years in prison?

8.On 23 October 2020, ASCO Cheung handed over P60 to ACCO Chan in the laboratory.  ACCO Chan’s original witness statement dated 12 January 2021 makes no reference to any access or analysis of P60 between that date and 2 November 2020, when Inspector Kwan inspects the data extraction.  Nor does it state how that extraction was made and with what forensic software.  It merely stated that Inspector Kwan requested part of the data extracted and that it was copied onto an optical disc.  Only at this stage was a hash value taken i.e. of the optical disc and in respect of the selected material only.  Thereafter further copies were made and their hash value verified.  At this point, I have to remark that taking the hash value of each disc was a pointless exercise akin to confirming photocopy D is the same as photocopy B and ignoring whether it is an accurate photocopy of the original document.  Thereafter, ACCO Chan merely states that he sealed the discs and handed over all of the exhibits to ASCO Cheung once more on 12 January 2021.

9.Needless to say, this witness statement was very far from adequate.  In answer to matters raised by this Court, a further witness statement was made dated 28 October 2021.  In it, the officer confirmed no image had been retained by C&E of the original forensic examination of the phone (although we later found out that it was) and it follows, on that basis if it had been correct, that the officer would not have been able to confirm the phone is in exactly the same state now as it was then. Indeed, on the voire dire, his evidence was that data would be altered in some way albeit he believed it would not affect the WhatsApp messages to be relied upon.  It is interesting to note that the OC case can request that a copy of the original data extraction is kept and this Court believes that should be done in all instances.  It appears that there was an administrative policy not to do so because of the size of the data.  If the C&E choose to take that course in future then they lay themselves open to an application by the defence for abuse as there is no possible way the defence could be in a position to access a phone (or for that matter a laptop or desktop) in the exact same state as it was when recovered.  Some thought needs to be given to extracting e.g. WhatsApp messages and freezing the data extracted in order to avoid any suggestion that it cannot be relied upon and is therefore inadmissible.

10.In answer to the Court’s request for confirmation that a hash value had been obtained at the beginning of the process of examination, ACCO Chan simply answered that “the hash value was produced by the forensic tools” and ultimately, in this voire dire, I was provided with a record from the software itself of the hash value logged by the software on 29 October 2020.  Unfortunately, in evidence, this was not the first access to the phone.  The phone had been accessed prior to that date and an attempt to forensically examine it with the Celebrite software had been unsuccessful.  What effect that attempt had on P60, we do not know.  This unsuccessful attempt to read the telephone (via the back door as the officer put it) was not disclosed within the first witness statement.  It should have been.

11.ACCO Chan made a further witness statement on 19 November 2021, after the 2^nd CMH, to cover the unsuccessful attempt to use Celebrite on the phone.  He does not say when he did this.  He could not say why it was unsuccessful.  The witness statement infers that the alternative forensic software “Hancom” was employed at that time.  In evidence it appears that the Hancom software was used on a different date, which appears to have been 29 October 2020.  In evidence, ACCO Chan explained that this software could not extract a 100% of the data contained within a phone.  He was not able to provide an average figure for what could be recovered but explained that because of this difficulty, any further analysis of the data required both the Hancom extraction image and the phone to be accessed once again, thus affecting once more the hash value.  Once again, in his witness statement and without any reference to dates, ACCO Chan referred to an inspection by Inspector Kwan and the copying of selected data.  It came to pass in his evidence that this was not a single exercise and that ACCO Chan accessed the phone many times thereafter without a record of such access being made available to the defence.  He did so in order to verify what had been selected from the extracted data against what he could see upon the phone.  Record keeping in the C&E laboratory is not acceptable.  Why has it come to pass that it is acceptable to allow officers to hold exhibits in their personal drawers for days and even weeks on it without any other supervision?  It is not sufficient that they are lockable drawers.  A record should be made at all times of access to exhibits in criminal trials.

The Forensic Examination of P60

12.ACCO Chan gave evidence on the Voire Dire as to his forensic examination of P60, some of which has been referred to above.  He received the iPhone on 23 October 2020.  He first accessed it at some time before 29 October 2020 and attempted to use the Celebrite software to retrieve data but could not do so.  On 29 October 2020, he used the Hancom software.  In gist, he stated that it is not possible (indeed impossible) to extract 100% of the data from a phone because the forensic software enters the phone through the ‘back door’.  The percentage of the data which can be retrieved depends upon the operating software and the forensic software used.  In this instance, with P60, which was an iPhone X, it had a storage capacity of 64GB of which approximately 40GB had been used.  The log shows the size of the extracted data was 19.7GB, which is approximately half.  This is because the tool could only extract 19GB.  To do this one must turn on the phone in a secure ‘wifi free’ environment.

13.As for the hash value, having taken an image or copy of the data on the phone using the Hancom software, the software itself would log the access and calculate a value but he did not keep a hard copy of that record at the time and only did so later when the Court requested the record on 8 November 2021.

14.The data originally extracted from P60 was kept on an external hard disc at his personal work station.  As for the hash value recorded in the automatically generated log, taken at the time of the extraction through his work station on 29 October 2020, it was retained by copying it onto a different external hard disc.  We have had no explanation as to why that should be the case.

15.As we have seen, more than one C&E officer had already opened the phone prior to handing it over to the laboratory and ACCO Chan had already been told what data was to be extracted eg WhatsApp messages, before he accessed the phone on 29 October 2020 although he states that the log report of 19GB covers all of the data extracted as well as the WhatsApp’s.  This is all that could be extracted through Hancom.  But within that extracted data, the data covering the WhatsApp’s alone was still too large and so the OC case was invited to inspect it and select what he wanted.  For that selection, ACCO Chan opened the Hancom software, and reproduced the data extracted by Hancom and retained on a hard disc as visible data and also opened the iPhone in order to verify one against the other.  A selection was made by the OC Case to be put into the report.  Thereafter, ACCO Chan analysed what had been identified by the OC Case and confirmed once more that it existed in the phone by opening the phone on several occasions, and then produced the examination report now produced as P84 in Excel format.  That data was then copied onto an optical disc and all exhibits were handed back.

16.As for the hash value of the phone itself, ACCO Chan explained that the current smartphone has NAND flash[3] memory which could move the data inside the device automatically and will definitely vary the hash value each time it is accessed.  The attempt to access the phone prior to 29 October could have done so as well as the exercises on 29 October and on 2 November 2020.  The iPhone was also accessed for verification purposes on multiple occasions thereafter.  No record is made of this or of the hash value. This change to the hash value is caused by the operating system of the phone not by the forensic tool used.  However, because this is done securely within the Faraday box, there can be no external interference.  ACCO Chan states that this activity would not affect the WhatsApp messages.  But this exercise, if carried out without the secure Faraday box, could affect the data on a phone because of the automatic functions of the phone.

Conclusion

17.The provenance of the physical iPhone P60 is questionable.  There is no proper record of when a sealed exhibit is retrieved and unsealed and what occurs to it over several days when that has occurred.  It was a painful exercise seeking to do so.  The taking of photoshots from the phone at this stage has not been properly documented nor exhibited and they may not be adduced in trial.  The prosecution has been given fair warning that there was a problem and it is now too late to correct what has been a poor supervision of evidence.  In any event, the reality is that the prosecution seeks to rely upon the content of such shots as evidence of the truth of their contents and the prosecution has provided no admissible route to place these before the Court given that the information relied upon is derived from a computer.  ACCO Chan has said he could not provide such a certificate for what occurred prior to receipt of the phone and he has not been asked to provide one upon receipt, even if he could do so.

18.My findings in that respect are in any event overtaken by the subsequent handling of the phone and its contents.  There is no system in place to secure the data on a mobile phone which preserves the integrity of the data within.  No secure and unassailable copy is made of the data retrieved and, in any event, a significant amount of data is not and cannot be retrieved.  This results in a substantial prejudice to the defence who have little idea of these shortcomings until a long way into the investigation by which time the harm has been done and the costs of seeking to unravel that harm would be significant.  It is no answer for the C&E to say the data retrieved is too great or that the whole of the data cannot be recovered.  If they wish to rely e.g. on WhatsApp messages then they must satisfy the Court to the requisite standard that all of the WhatsApp messages have been recovered and provided to the defence and that there has been no interference with either the content of that data or the date/time application.  None of that had been addressed in this case.

19.None of the data recovered from the mobile phone P60 may be adduced.  It follows that the prosecution must now liaise with the defence to consider the effect of this ruling upon the content of the video recorded interview where photoshots and the contents of the phone have been put to the defendant without any proper record being made and after insecure access to the phone prior to interview.

Mr Jackson Poon, counsel on fiat, for HKSAR

Mr Richard Donald, instructed by Morley Chow Seto, assigned by Director of Legal Aid, and Ms Zoe McCoy, instructed by Morley Chow Seto, on pro bono basis, for the defendant