Digital Evidence

• Author: Matthew Gourlay/Brock Jones/Jill D. Makepeace/Glen Crisp/Renee Pomerance
• Pages: 537-569

CHAPTER 12

DIGITAL EVIDENCE

I. Introduction ..................................................... 

II. Authentication ................................................... 

A. Canada Evidence Act: Definitions ................................ 

B. Canada Evidence Act: Section . .............................. 

C. Concerns Surrounding Tampering or Alteration of DigitalEvidence... 

III. Best Evidence Rule ................................................ 

A. Canada Evidence Act: Section . .............................. 

IV. Computer Byproduct Information or Metadata........................ 

V. Hearsay Exceptions ............................................... 

A. Party Admissions .............................................. 

B. Business Records .............................................. 

C. Res Gestae ................................................... 

VI. Misapprehension of Digital Evidence ................................ 

VII. Judicial Notice of Technology ...................................... 

VIII. Expert Witnesses.................................................. 

IX. Probative Value of Digital Evidence.................................. 

A. Social Media Accounts of Witnesses ............................. 

B. Statements or Admissions from the Accused ...................... 

C. Identification Evidence via Social Media .......................... 

D. Voice Recognition............................................. 

X. Understanding Common Digital Evidence Terminology ................ 

A. A Primer on Digital Forensics .................................... 

B. Hash Values .................................................. 

C. Unallocated Clusters........................................... 

D. Malware...................................................... 

E. Peer-to-Peer File Sharing ....................................... 

537

Copyright © 2022 Emond Montgomery Publications. All Rights Reserved.

I. INTRODUCTION

Vast amounts of information that once existed o nly in a physical form are now increas-

ingly digitized and saved on person al electronic devices or stored onlin e. This has pre-

sented police forces with seemingly limitless volum es of information to explore when

investigating a crime. Once charges are laid, it s imilarly provides prosecutors with com-

pelling forms of evidence to present as pa rt of their cases at trial. But digital eviden ce may

also assist defence counsel , presenting them with opportunities to challenge th e strength

of the prosecution’s case or even exonerate a client. Whethe r and how this information

can be tendered in a courtroom, h owever, is still subject to the rules of evi dence.

As noted by Paciocco JA of the Ontario Court of Ap peal, the law of evidence has

its roots in a time when the prima ry source of information came from the testi mony

of witnesses and documents we re created by hand.1 It was not desi gned to handle the

technology that now dominates our live s. Adapting these rules to modern technologies

has presented courts with uniqu e challenges. But the rules and p rinciples of evidence

have, for the most part, be en able to cope with technological develop ment, as this

chapter will explain.

Staying attuned to modern technologies has become a core professional respon-

sibility of all Crown prosecutors and criminal defe nce counsel. Personal electron ic

devices, such as smartphon es, are now owned by nearly all Can adians.2 As these

devices continue to proliferate, the amount of time Cana dians spend online using them

also increases. Recent estim ates suggest that the average Cana dian spends at least

3-4hours online every day, engaged in var ious activities including emailing, using social

media networks, conducting business, or viewing online content.3

As we live an increasing share of our lives o nline, we create a digital footprint, which

includes all traces of our online ac tivity. Sometimes this is purposefully created through

one’s deliberate choices on the Internet; for exam ple, a user might intentionally com-

ment on a news article viewed onl ine. But other times this information is passively, and

perhaps unknowingly, created simply by virtu e of visiting a website or using an app. A

mere click can create a digital record of your entire online h istory, allowing an investiga-

tor to determine not only what you were doing, but whe n and for how long. Any of this

information could be relevant in a criminal tria l.

This chapter outlines the rules of evid ence that are commonly invoked to address

digital evidence. It will review, wherever app ropriate, any special concerns presented

by this evidence for both Crown prosecutors and defence couns el. It also contains

practice tips for how counsel should ap proach the admissibility of di gital evidence in

a courtroom, and a review of how digita l evidence may be relevant in most crimin al

cases. It concludes with a primer o n digital forensics, including a review of some of the

more common digital evidence terms couns el are likely to encounter and need to be

familiar with.

1 D Paciocco (then of the O ntario Court of Justice), “ Proof and Progress: Coping wi th the Law of Evidence

in a Technological Ag e” (2013) 11:2 CJLT 181 at 181.

2 A 2018 survey by the Consume r Technology Associatio n determined that 86 per cent of Canadians owne d

a smartphon e or similar mobile device: Cons umer Technology Associatio n, CTA 3rd Annual Consumer

Technology Owner ship and Market Potential Stud y: Canada (Arlington: C TA, October 2018).

3 Canadian Internet Regis tration Authority (CIR A), “Canada’s Internet Factboo k,” 2019, online: <htt ps: //cir a

.ca/resources/corporate/factbook/canadas-internet-factbook-2019>.

538 MODERN CRIMINAL EVIDENCE

Copyright © 2022 Emond Montgomery Publications. All Rights Reserved.

II. AUTHENTICATION

Questions often surround th e authenticity of digital evidence. Just as one could fraudu-

lently alter a diary, ledger, or other written document , the same can be done with electronic

information, including social me dia content.4 Indeed, these concerns m ay be amplified

with all forms of digital information, since it ca n typically be altered or manip ulated far

more easily than ordinary d ocuments.5 It does not take considerable techn ological sophis-

tication to distort a digital image us ing readily available online software. Recently, the rise

of “deepfake” technology to combine a nd superimpose existing ima ges or videos using

artificial intelligence has resulted in au dio/visual recordings that appear to be entirely real

but are in fact fraudulent misrep resentations of the persons depicted in them.6

Therefore, before digital eviden ce may be admitted in a criminal proceeding, it must be

authenticated. As noted by Goldstein J of th e Ontario Superior Court of Justice, the Intern et

in particular contains “wheat as we ll as chaff,” and courts must be vigilant when conside ring

the threshold question of authenticity.7 A court may be satisf ied that the digital evidence

in question has met the stan dard of authenticity, but that does not necessarily mean it will

be ultimately admissible. Authentic docum ents may be deemed inadmissible under other

evidentiary rules (e.g., hears ay).8 But authenticity is a necessary precondition to admissibil ity.

The onus lies on the par ty tendering the evidence to establish “some evidence” that

the item is what it purports to be.9 This s tandard is, at most, akin to a bala nce of prob-

abilities, and various cour ts have suggested that it is in fact not even that on erous.10

However, the Ontario Court of Appeal recently noted that tri al judges must always be

“rigorous in their evaluation” of digital evi dence, “both in terms of its reliabilit y and its

probative value.”11 A failure to engage in that rigorous analysis will justify appell ate review.12

A. CANADA EVIDENCE ACT: DEFINITIONS

Sections 31.1 to 31.8 of the Canada Evidence Act13 contain provisions related to the admi s-

sibility of “electronic docume nts.” The definition is broad eno ugh to capture all manner

of documents commonly stored in a computer or p ersonal electronic device, including

emails, text messag es, social media post s (including tweets), pictures, an d videos. Sec-

tion31.8 defines “electronic d ocument” and several other important terms as follows:

Electronic document means data that i s recorded or stored on any medium in or by a com-

puter system or other sim ilar device and that ca n be read or perceived by a pe rson or a

4 See Lorraine v Markel A merican Insurance Co, 241 FRD 534 (D M d 2007) for a comprehensi ve review of the

potential frailties associated with electronically stored information.

5 Rv Soh, 2014 NBQB 20 at para 23.

6 Tom Chivers, “ What Do We Do About Deepfake V ideo?” (23 June 2019), online: The Guardian <h ttp s://

www.theguardian.com/technology/2019/jun/23/what-do-we-do-about-deepfake-video-ai-facebook>.

7 Rv Ghaleenovee, 2015 O NSC 1707 at para 20.

8 Rv Seruhungo, 2015 ABCA 189 at par a 32.

9 Rv Ball, 2019 BCCA 32 at para 67; Rv Hirsch, 2017 SKC A 14 at para 18; Rv Evans, [1993] 3 SCR 653.

10 Rv Martin, 2021 NLCA 1 at pa ra 49; Rv Farouk, 2019 ONCA 662 at para 60; H irsch, ibid.

11 R v Aslami, 2021 ONCA 249 at par a 30.

12 Ibid at para 52.

13 RSC 1985, c C-5.

Chapter 12 Digital Evidence 539

Copyright © 2022 Emond Montgomery Publications. All Rights Reserved.