Canadian Court Admonishes Police for Submitting Facebook Screenshots as Evidence

In a terrorism case before the Supreme Court of British Columbia, a defendant currently faces charges for allegedly supporting and conspiring with the Islamic State of Iraq and Syria (“ISIS”). R v. Hamdan 2017 BCSC 626 (April 24, 2017). The charges are solely based on 85 Facebook posts made by the Accused, Othman Ayed Hamdan (“The Key Posts”). The RCMP investigators took screenshots of those posts, using “Snagit” and “Awesome Screenshot” tools, and the Crown Prosecutors sought to admit into evidence the 85 Key Posts as well as the captured Timelines from the Facebook pages and profiles that contain the Key Posts.

However, the Court noted that:

“The RCMP captured the Key Posts using non-forensic-grade software that failed to capture metadata or source code. As a result, the Facebook posts cannot be replicated and there is no assurance that the Electronic Documents are accurate. Further, the investigators often failed to open links or expand posts to ensure that all of the information that was available on the Facebook pages and profiles was captured. In addition, the screenshots were transferred numerous times between devices. The file formats were changed in the course of the transfers and the files may have been corrupted or altered. The Crown cannot prove that the Key Posts or captured Timelines are the same as those that would have been seen by someone accessing the pages or profiles. Indeed, it is readily apparent that the Timelines have been altered by the screenshot capture software as many of the captures have banner artifacts that cover up portions of the Timelines.”

The defense, in a pre-trial hearing, sought to have the evidence barred in advance of trial, asserting that “the RCMP should have used forensic software that is readily available at a modest cost to capture, preserve and authenticate the Facebook profiles and pages. By failing to use that software, the RCMP was negligent and Mr. Hamdan’s ability to make full answer and defense has been seriously impaired…” The defense expert specifically mentioned X1 Social Discovery as an acceptable tool that could have been used by the RCMP. R.v Hamdan, 2017 BCSC 676, at note 31.

The Court determined there was “ample evidence that the Snagit and Awesome Screenshot systems did not reliably capture the Facebook pages and profiles even when operating properly (emphasis added)” as they truncated information, did not preserve metadata and links, and did not generate hash values for authentication purposes. The Court ruled that “[g]iven the problems with the screen capture software and the way in which C.M. Spearman and Cst. Johnson used it, the Crown cannot rely on the presumption of integrity under the (Canada Evidence Act).”

However, the Court, in making clear its decision was a one-time exception based upon the circumstances of the case, did not ultimately exclude the evidence. Instead, the court required the prosecution to submit to several additional steps and showings of authenticity, without being able to take advantage of any presumptions in its favor. These steps included direct subpoenas of Facebook to match up IP addresses, live testimony from several witnesses, and extensive litigation of the issue through motions and a long Court hearing.

In finding an implied one-time escape clause for the prosecution, the Court noted that “C.M. Spearman and her superiors were not aware that better software was available; they simply did not consider that it might be necessary. It was not until long after Mr. Hamdan’s arrest that they realized their techniques had failed to capture potentially relevant information and that the Electronic Documents would be the evidence put before the Court.”

Finally, the Court provided this important admonishment to the RCMP as well as any Canadian litigant seeking to admit social media and website based evidence:

“This decision should not be seen as endorsing the use of less-than-forensic-grade software to capture and preserve social media evidence…. the collection and preservation of social media evidence by the police is a relatively new process and, prior to this case, there was no established RCMP policy or procedure and no legal standard for doing so. I expect that, if the police procedures do not improve, subsequent decisions may find the police action to be unreasonable.”

For eDiscovery and digital forensics practitioners, there are three key takeaways from R v. Hamdan:

1. This case is binding on trial courts in British Columbia and strongly applicable to all other Canadian trial courts. The decision provides persuasive authority to other Commonwealth nations such as England, Australia and New Zealand. R v. Hamdan may also serve as persuasive authority in the United States for courts considering the reliability of screen shots to collect web-based evidence.
2. The prosecution was not able to invoke the presumption of integrity under the Canada Evidence Act to admit the social media evidence, the court determined that the collection process used was not reliable. The application of the Canada Evidence Act in this case is analogous in many ways to the application of Federal Rule of Evidence 902(14), which will become effective on December 2017. I have covered FRE 902(14) extensively on this blog. See here and here.
3. X1 Social Discovery was favorably cited – by the defense! The assertion was that the RCMP should have used forensic grade software like X1 Social Discovery but did not. The court agreed, for cases going forward. This is a unique but very important development. Also very notable was the Court’s excoriation of Snagit and other screen shot tools as an unreliable evidence collection method.

And of course, this case underscores the importance and benefits of X1 Social Discovery. In addition to being fast and highly scalable, X1 Social provides enables the examiner to present the best case possible for authenticating social media evidence collected with the software. This includes collecting all available metadata, preserving links and other context, and generating a MD5 checksum or “hash value” of the preserved data for verification of evidence integrity.

A full copy of the court’s opinion in R vs Hamdan can be found here.