IT evidence confuses courts

In IT-related cases criminal courts should be changed to include a court-appointed expert, or even an entire jury of technical...

In IT-related cases criminal courts should be changed to include a court-appointed expert, or even an entire jury of technical specialists, according to a BCS report, which also recommends a code of practice for handling computer evidence, writes John Kavanagh.

The BCS submission to a review of the criminal courts system, by the Lord Chancellor's Department, says the problems in such cases range from mishandling of evidence by police to the courts' lack of familiarity with computer evidence.

It says such issues need to be acted on because the range of criminal cases involving computer evidence is already very broad, and can be expected to widen with the development of the Internet and the introduction of the Regulation of Investigatory Powers (RIP) Act. This will enable the police to access e-mails and telephone calls through digital switches.

The BCS Computer Evidence Taskgroup, set up by the society's Legal Affairs Committee, highlights several problems in this area, and says courts are "generally unfamiliar with the subject of computer evidence".

The group says, "Criminal courts regularly underestimate the high level of technical complexity of cases involving computer evidence. Broadly stated prosecution allegations are often inadequately specified in technical terms.

"Criminal courts can easily underestimate the vast quantities of computer evidence. It is not unusual to find hundreds of thousands of files stored on the disc drive of a single PC, and many cases involve multiple drives and/or multiple computers and/or computer networks.

"A fundamental problem is the difficulty the criminal courts may have in understanding that all computer evidence is derived from binary data. That data cannot practically be examined or exhibited as evidence in a legal sense. It requires expert interpretation and presentation simply to be exhibited as evidence.

"A sequence of binary bits may be a fragment of a program or file. The precise significance of any sequence of binary bits can only be determined by interpretation within a specific context.

"The fact that expert interpretation is made using software, which may itself be unreliable, introduces further difficulties."

The group says investigators "regularly mishandle" computer evidence, in particular, failing to secure it.

It continues, "Prosecutions are quite frequently abandoned before trial as a result of contamination of computer evidence by careless handling."

The group adds, "It is simple to tamper with computer evidence. Tampering may leave no trace of having taken place."

The group calls for acceptance that computer evidence needs to be treated differently from traditional paper evidence. It also "strongly recommends" the preparation of a code of practice for handling, securing and preserving computer evidence.

BCS group warns firms that commercial disputes are not criminal cases

Companies could be abusing the legal system by getting commercial disputes, that are, in effect, private prosecutions, treated as criminal cases, according to the BCS Computer Evidence Taskgroup.

"We note with concern a small but growing number of cases involving computer evidence that may not belong in the criminal court process," the group says.

"Examples include software counterfeiting cases, typically brought by trading standards departments at the behest of powerful software publishers, and cases concerning confidential data or designs.

"In both cases, the underlying dispute is between commercial organisations over intellectual property rights. We are concerned that criminal cases are sometimes brought to save the cost of a civil case falling on the commercial organisation.

"Indeed, in some cases, criminal actions are only instigated when it becomes apparent that existing civil actions are doomed to fail."

The group continues, "A greater criticism arises where the prosecution evidence is largely provided by the commercial organisation and its employees. Not only is there little or no police investigation of the evidence, but the commercial organisation can be selective about the evidence ."

"We believe that such essentially civil cases may constitute a misuse of the criminal court process."

Read more on IT legislation and regulation