Production of mobile phones, computers necessary for conducting investigations

Order issued by presidential commission inquiring into treasury bond issuance



article_image

These statutory provisions reflect the desirability of permitting a person against whom digital data or digital evidence or electronic evidence obtained from a device is to be used, to examine the process of obtaining that digital data or digital evidence or electronic evidence. Those provisions also show the desirability of ensuring the confidentiality of the information contained in the devices and to ensure that the process of obtaining that digital data or digital evidence or electronic evidence causes as little disruption as is possible.


Continued from yesterday


The documents titled "Forensic Examination of Digital Evidence: A Guide for Law Enforcement" and ‘ACPO Good Practice Guide for Digital Evidence" provided to us by Mr Kodagoda, PC, and particularly the Budapest Convention which, inter alia, refers to procedural issues relating to the search and seizure of mobile communication devices and mobile computer devices [Article 19 of the Budapest Convention which the Government of Sri Lanka ratified in the year 2015] and the examination of data in such devices show that, these best practices to be adhered to at the stage of extracting and copying data on mobile devices, include:


= documenting the hardware and software configurations of the equipment used for extraction and copying of data before the extraction and copying of data on the mobile devices is commenced;


= obtaining a record of the data files in the mobile devices before the extraction of data commences;


= carrying out the extraction and copying of data on the mobile devices as quickly as possible and without unnecessary or delay;


= maintaining an audit trail and comprehensive log of all processes that are engaged in during the extraction and copying of data and such audit trail and comprehensive log being capable of revealing any alteration or manipulation or damaging of data, in the event such has taken place;


= obtaining a record of the data files in the mobile devices at the end of the extraction and copying of data; and including all the aforesaid records, audit trails and logs in the copies obtained.


In this background, we are of the view that, when digital data contained in a mobile device is extracted and copied for the purpose of examination in the course of an investigation or inquiry:


a. The owner or user of that mobile device has the right to be assured, as far as is reasonably possible, that such best practices are followed when the process of extracting and copying digital data from his mobile devices as far as possible;


b. Ensure the integrity of that digital data and preserve that digital data;


c. The owner or user of that mobile device has the right to be assured, as far as is reasonably possible, that any risk of the digital data and digital evidence or electronic evidence being subject to alternation or manipulation or damage is excluded, as far as is reasonably possible;


d. The owner or user of that mobile device has the right to be assured that, an adequate and comprehensive record will be maintained of the process of extraction and copying of data on the mobile devices and that a copy of that record can be made available to him if he wishes to examine that record, to ascertain whether the integrity of the data has been preserved during the process of the extraction and copying of the data.


In making this Order, we also take note of the fact that, mobile communication devices and mobile computer devices could contain data relating to the owner’s or user’s personal or private or family life and professional activities which are not directly connected to the matters which are being investigated and inquired.


In the lightof this possibility, the principle of "proportionality" should be preserved when data is extracted and copied for the purposes of an investigation and inquiry. Therefore, as far as is reasonably possible, only data which is relevant for the purposes of the inquiry and investigation should be extracted and copied and examined in order to respect the said principle of "proportionality" which is clearly recognized by the Budapest Convention. Therefore, we are of the view that, when digital data contained in mobile communication devices and mobile computer devices is extracted and copied for the purpose of examination in the course of an investigation or inquiry, the owner or user of that mobile device has the right to be assured, as far as is reasonably possible, that only data which is relevant for the purposes of the inquiry and investigation is extracted and copied.


It is to be noted that, if we are to make an Order allowing the aforesaid request made by learned counsel for Mr. Mahendran and Mr. Palisena, we must be first satisfied that, permitting the legal representative to be present is not prohibited by the law or is not contrary to the aforesaid best practices and does not compromise the process of the extraction and copying of data or prejudice this investigation and inquiry.


In this regard, no legislation or regulation which applies in Sri Lanka and is relevant to the issue before us has been brought to our attention by counsel. We are also not aware of any legislation or regulation which in Sri Lanka which is directly applicable to the issue before us. However, we may be able to obtain some guidance from statutory provisions in enactments which relate to evidence obtained from computers and other electronic devices which store and process data.


In the absence of directly applicable legislation or regulations, we must have recourse to relevant material from international sources and should endeavor to reach a decision based on common sense And equity and which seeks to preserve, as far as possible, the rights of the persons concerned and also ensures, the effectiveness of the investigation and inquiry we are engaged in.


In this regard, the documents titled "Forensic Examination of Digital Evidence: A Guide for Law Enforcement" and ‘ACPO Good Practice Guide for Digital Evidence" tendered to us by Mr.Kodagoda, PC, do not suggest that we should refrain from permitting Mr. Mahendran’s and Mr. Palisena’s legal representative to be present during the process of the extraction and copying of data. In fact, these documents emphasize the importance of protecting the interests of the owner or user of the devices which are examined.


The decisions submitted to us by Mr. De Livera,PC refer to the examination of Heroin and other substances and objects. However, the processes to be followed when Heroin and other such substances or objects are subject to a forensic examination cannot be compared to the forensic examination of digital data contained in a mobile communication device or mobile computer device. That is because of the danger of the integrity of the digital data and the digital evidence or electronic evidence obtained from the latter process being compromised during the process of the extraction and copying of digital data from the mobile device. Therefore, the risks that are present and must be guarded against in the latter process and the considerations which must be taken into account in the latter process are entirely different from the risks and considerations relevant to the forensic examination of Heroin and other substances and objects. Thus, we do think the decisions submitted to us by Mr. De Livera,PC are of assistance when deciding the issue before us.


At this stage it is important to note that, section 7 of the Evidence (Special Provisions) Act No. 14 of 1994 enables a party against whom "Computer Evidence" is to be led, have access to and inspect the machine, device or computer which is used to produce such "Computer Evidence". We also note that, section 18 of the Computer Crime Act No. 24 of 2007 stipulates that where data contained in electronic or similar devices having information processing abilities is searched in the course of an investigation, the investigators should endeavour to ensure, as far as possible, that the search does not hamper the ordinary course of legitimate business for which that device is used. Section 9 of the Payment Devices Frauds Act No. 30 of 2006 is comparable to section 18 of the Computer Crime Act. Further, Section 24 of that Act emphasizes the necessity of maintaining strict confidentiality with regard to all information that comes to knowledge of an investigator in the course of searches of such devices.


These statutory provisions reflect the desirability of permitting a person against whom digital data or digital evidence or electronic evidence obtained from a device is to be used, to examine the process of obtaining that digital data or digital evidence or electronic evidence. Those provisions also show the desirability of ensuring the confidentiality of the information contained in the devices and to ensure that the process of obtaining that digital data or digital evidence or electronic evidence causes as little disruption as is possible.


In the light of the aforesaid considerations, we are satisfied that, permitting the legal representatives of Mr. Mahendran and Mr. Palisena to be present when the data on the mobile devices is extracted and copied at the Criminal Investigation Department, is not prohibited by the law and is not contrary to the aforesaid best practices.


We also cannot see how the presence of the legal representatives of Mr. Mahendran and Mr. Palisena, at the time the data on the mobile devices is extracted at the Criminal Investigation Department, will compromise the process of the extraction and copying of data or prejudice this investigation and inquiry.


In fact, to the contrary, in the light of the aforesaid considerations and in pursuance of our duty to act in a manner which is fair and equitable and preserves the rights of individuals and also ensures the effectiveness of this investigation and inquiry, we consider that it is desirable that the legal representatives of Mr. Mahendran and Mr. Palisena are present when the data on the mobile devices is extracted at the Criminal Investigation Department. We believe that permitting their presence will further our efforts to ensure that, this investigation and inquiry is carried out fairly, and lawfully and in an impartial and transparent manner.


Accordingly, we are of the considered view that, we should direct that, the extraction and copying of data from Mr.Mahendran’s and Mr. Palisena’s mobile communication devices and mobile computer devices should be done only in the presence of and in the view of an Attorney-at-Law who represents Mr. Mahendran or Mr. Palisena. That representative is only permitted to be present and observe the process of the extraction and copying of data. He is prohibited from interfering in or obstructing that process. He is only permitted to take written notes. He is not permitted to photograph or video record the process. An officer of the Hon. Attorney General’s Department is also entitled to be present, if he considers it necessary;


Further, in the light of the aforesaid considerations with regard to the principle of proportionality, we consider it necessary to issue a direction that, as far as is technically possible and practical, only data relevant or connected to the matters which this Commission of Inquiry is investigating and inquiring into under and in terms of the Mandate issued to us, is extracted and copied when the extraction and copying of data on Mr. Mahendran’s and Mr. Palisena’s mobile devices is carried out at the Criminal Investigation Department.


In pursuance of the aforesaid, we make further Orders as follows:


(i) Mr.Mahendran’s and Mr. Palisena’s mobile communication devices and mobile computer device should be handed to officers of the Criminal Investigation Department in the presence of the Secretary of this Commission of Inquiry and an. Attorney-at-Law who represents Mr.Mahendran or Mr. Palisena;


(ii) The officers of the Criminal Investigations Department who are extracting and copying the data on these mobile communication devices and mobile computer device should, as far as is possible, confine the process to the extraction and immediate copying of the data. These officers should not independently examine the data other than in.’s() far as is required for the process of the extraction and copying of the data;


(iii) Throughout the process of the copying and extraction of data at the Criminal Investigation Department, the relevant best practices should be followed including, at a minimum, the best practices referred to earlier;


(iv) Only three copies of the extracted data should be obtained on three compact discs or other data storage medium. These three compact discs or other storage medium should be immediately sealed and handed over to the Secretary of this Commission of Inquiry in three separate sealed envelopes in the presence of the legal representative of Mr.Mahendran or Mr. Palisena;


(v) Once the process of extraction and copying of data is completed, Mr.Mahendran’s and Mr. Palisena’s mobile communication devices and -mobile computer devices should be immediately sealed and handed over to the Secretary of this Commission of Inquiry in sealed envelopes in the presence of the legal representative of Mr. Mahendran or Mr. Palisena. These mobile computer devices will be retained in those sealed envelopes in the custody of the Secretary of this Commission of Inquiry until Mr. Mahendran or Mr. Palisena complete giving evidence since a need to examine these devices may arise in the course of their evidence. These mobile communication devices and mobile computer device will be handed back to Mr. Mahendran or Mr. Palisena when this Commission of Inquiry so directs;


(vi) A accurate and comprehensive record of all procedures followed in the process of the extraction and copying of data should be made available to the Commission of Inquiry, if called for;


(vii) Two of the compact discs or other data storage medium are to be retained by the Secretary of this Commission of Inquiry, under sealed cover as received by him at the Criminal Investigation Department. One such compact disc or other data storage medium will be made available to Mr. Mahendran or Mr. Palisena by the Secretary of this Commission of Inquiry, upon request.


(viii) As agreed between counsel, the other compact disc or other data storage medium is to be handed by the Secretary of this Commission of Inquiry, under sealed cover as received by him at the Criminal Investigation Department, to Mr. Kodagoda, PC, Additional Solicitor General, for examination by him and by the members of this Commission of Inquiry with his assistance.


Before concluding this Order, we wish to mention that, in the event of evidence obtained from the process of extracting and copying data from mobile communication devices and mobile computer; device being placed before this Commission of Inquiry, the value of any such evidence will be dependent on this Commission of Inquiry being satisfied with regard to the integrity and reliability of any such evidence obtained from a process of extraction and copying.


It must be clearly understood that this order and the procedure and entitlements referred to herein is confined in scope and applicability to only these proceedings before this Commission of Inquiry under Act No. 17 of 1948, as amended, and the examination of mobile communication devices and mobile computer devices under the provisions of the said Act for the purpose of carrying out the mandate of this Commission of Inquiry.


This order has no application or relevance whatsoever to any proceedings in any court of law under the Code of Criminal Procedure Act or Civil Procedure Code or other Law or the interpretation or application of other legislation.


Justice K.T.Chitrasiri


Chairman


Commission of Inquiry


Justice Prasanna Jayawardena,


Member


Mr.K.Velupillai


Member


  


 


 


 
 
 
 
 
 
 
 
 
 
animated gif
Processing Request
Please Wait...