A large number of recent criminal trials have been concerned with the possession and viewing of child pornography on personal computers. In most such cases, the evidence presented by the prosecution includes copies of the actual pictures, which may be still colour photographs (usually in JPEG file format) or video sequences (usually in MPEG format).
A special feature of such trials is that such evidence has to be handled with particular care and viewed by only those who need to see it, under carefully controlled conditions. This control is particularly exercised by the police. A recent criminal trial (which for clarity I shall call Case B) raised a number of issues about how this control is applied, particularly to expert witnesses instructed by the defence. Events occurred, the results of which were to:
• extend the duration of the proceedings, from charge to final judgment, to almost three years,
• stay the proceedings at the end,
• affect the defendant’s trial on another charge and
• involve heavy costs.
Clearly such an outcome is highly undesirable. The purpose of this article is, first, to record the events and, second, to make recommendations so that similar problems may be avoided by others. Because the defendant has not been convicted, all names and places have been anonymised.
Effect of the Sexual Offences Act 2003
Until the Sexual Offences Act 2003 came into force, both police and defence experts who analysed computers in such cases were committing a crime. Neither was ever prosecuted because it would have been against the public interest to do so. However it was an uneasy situation within which to work.
Prior to the Sexual Offences Act 2003, the defence expert and defence counsel in Case B had acted in a previous child pornography case (which I shall call Case A), in a completely different part of the country, in which the police had refused to provide copies of the data on the computers. At a preliminary hearing, defence counsel had argued that the case should be stayed because the defence expert could not do what was required for just such a fear: that the “making” copies of the pictures in the process of his analysis might amount to an offence. In that case the judge ordered the police to provide the required data and also authorised the defence expert to carry out his necessary working practice. It was a relief to all involved when the Sexual Offences Act 2003 clearly legitimised this type of work by analysts and expert witnesses.
The Seizures and Charges
In Case B, the defendant, X, was a middle-aged father of several children charged with rape of his step-daughter. The only evidence was the complainant’s testimony. As a result, two computers were seized by the police from the defendant’s home. They were subsequently analysed and indecent pictures of children were found on them. These were shown to the defendant during a police interview but no copies were provided to the defendant’s solicitor. Further charges followed: of making and possessing these pictures.
The rape and the indecent pictures were the subject of separate trials, with the latter listed earlier. The prosecution were relying upon a conviction in this matter to supplement the meagre evidence in the rape trial.
Defence Examination and Memorandum of Undertaking
The defence appointed a computer expert to examine the two computers and a report on them produced by the police analyst. In line with standard practice in many police forces, before he was given access to these computers, the defence expert was required to, and did, sign a “memorandum of undertaking”. This is a document (originally drawn up by ACPO – the Association of Chief Police Officers) concerning his management and control of this data.
The defence expert did not himself at this stage examine any of the exhibits but provided the police analyst with a large hard disc which the analyst returned bearing copies of the forensic images of both computers. These are sets of data files which, when fed into suitable software, create a computer model of the suspect hard discs, which can be examined in detail with no risk of altering the original. The defence expert duly examined the data and produced his report which was sent to his instructing solicitor for circulation. He also produced a single copy of a reference document. This listed the charges, with details of each file (dates, filename, file location or “path”, file size, etc) and a copy of the picture, printed in monochrome at the same size as it would have appeared had it been displayed on the defendant’s computer screen. A large warning notice was fixed to this reference document, front and back, and it was never circulated but was used during meetings with defence counsel and solicitor. The defendant decided to plead not guilty and the matter went to trial.
First Trial Vacated
At the child pornography trial of X, after the prosecution’s computer expert had taken all day over evidence in chief, the judge directed that the experts should meet, nothwithstanding that the witness was still under oath. They initially met alone and started drafting the agreed facts and the few matters on which they did not agree. They met the following morning to finalise it and both prosecution and defence counsel attended this session.
During this meeting, a question arose about the size of some of the pictures. The defence expert stated that they were only thumbnails and had been enlarged by the police when displayed in interview. The police expert was unable to display these pictures, stating that force rules did not permit such copies to be carried. The defence expert therefore showed his reference document and the sizes of the pictures were agreed on this basis.
An acrimonious dispute then arose because prosecution counsel undertook to print out the experts’ agreement using his laptop but at one point refused to add certain words. The defence expert told him it was “improper for counsel to attempt to dictate what was agreed by experts at a meeting of experts” and that he would not agree to a document which did not include those words. The words were then included and the document was finalised and agreed.
When the trial continued the prosecution analyst had some difficulties under cross-examination and the prosecution called in a very experienced, well-known police computer expert. He quickly submitted a report giving opinions on some of the technical details. It also contained his CV.
The defence expert’s report contained copies of family snapshots, retrieved from one of the computers, showing the defendant’s home. This was provided as evidence that it was a busy, congested home, full of children and with nowhere that pornography could be viewed in secret. During the trial these were shown to the jury. A juror informed the judge that he knew one of the people in these pictures and, as a result, the trial was stopped, to be retried on a future date with a different jury.
The experienced prosecution expert never gave evidence but was expected to do so at the new trial.
Seizure of Defence Document
As the defence counsel and expert were leaving the courtroom they were approached by the police OIC (officer in the case) who demanded a meeting. The officer asserted that the defence expert’s reference document breached the memorandum of undertaking and was therefore to be seized. The defence expert insisted that it was essential, to enable him to advise defence counsel during the future trial, but the officer was adamant. Defence counsel asked the OIC what would happen next and the OIC said that would be decided by a superior officer. Defence counsel asked the officer whether prosecuting counsel was aware of this matter and was told that he was “not concerned about it and has no views”. At one stage prosecuting counsel briefly entered and left the room on another matter.
Expert Withdraws
Subsequently a police detective inspector wrote to the defence expert and concluded the letter: “on this occasion it has been decided that you will not be liable for prosecution”. The defence expert consulted his instructing solicitor, saying he felt intimidated by the police and should withdraw from the case. He was asked to produce a statement for the court. In that statement he explained that, during and before the trial, he needed to show the pictures listed in the indictment to his instructing solicitor and counsel, to assist them in deciding:
i. whether the pictures are the same as relied on and produced by the police
ii. whether the pictures are indecent and of children
iii. whether the pictures produced by the police are in fact to be found on the defendant’s computer
iv. whether the size of the pictures was as claimed by the prosecution
v. whether any information in the pictures might be helpful, such as a web address embedded in the graphic, or a personality or location known from another picture or another case.
He asserted that, during any cross-examination, access to these matters must be very rapid and this can best be provided by a paper document. Having them as data on a laptop would be too slow and cumbersome.
He also pointed out that the memorandum of undertaking required any disputes to be settled by the court. The officer had had ample opportunity to challenge the legality of the reference document in front of the trial judge but had instead used police power of seizure. Although, under the Sexual Offences Act 2003, what the expert needed to do in the case was entirely lawful, nonetheless it was plain that the police were prepared to use their awesome powers without regard to the court. They could arrest him, search his offices, seize his computers and files on numerous other cases and cause untold trouble.
He could therefore no longer provide all the evidence needed for the defence without fear of police action, so must, reluctantly, withdraw from the case.
First Application to Stay
Following his expert’s withdrawal, defence counsel made his first application to the court to have the case stayed. The trial judge refused the application and instructed that the defence should seek an alternative expert. In his judgment he observed: “It is not possible for me to say . . . that the police acted illegally. It may also be difficult to say that they acted even improperly. They might well however have gone about dealing with the difficulty as they saw it in a different and more measured and considered way”.
Who Controls the Exhibits?
By chance the same defence expert was shortly after instructed in a similar case, Case C, involving the same OIC in the same police force. The defence expert requested access to the computer data which was refused. The matter was heard in the same court by the Recorder.
The defence expert explained that, following the events in Case B, he would not sign the identical memorandum of undertaking but submitted a slightly amended version which had been accepted by another police force in another case. The judge, having enquired into the defence expert’s security arrangements (which the police had checked and were satisfied with), ordered that the police provide access and spelled out the relevant law on the subject of access by defence experts to exhibits:
1. The exhibit or material is to be regarded as being in the possession of the court. For convenience, or safety, or, as here, for security reasons, such exhibits or material are entrusted to the safe keeping of the prosecution who must take care of them, co-operate with the defence to allow them access to them and to produce them at trial: see R v Lambeth Stipendiary, ex parte McComb [1983] QB 551 at 564G per Sir John Donaldson MR.
2. The defence are entitled to a copy of any documentary exhibit, see the Magistrates’ Courts Act 1980, s 5(3)(b) and also R v DPP, ex parte J [2000] 1 WLR 1215 at 1221B.
3. Material such as the defence expert in Case B would wish to see is a document within the meaning of the Magistrates’ Courts Act 1980, s 5B.
4. There may be good reason (as there was in R v DPP, ex parte J) to withhold or restrict access to exhibits.
Second Application to Have the Case Stayed
In Case B, X’s defence solicitors now wrote to all the computer experts listed on the British Computer Society’s Register of Expert Witnesses. All declined to act in the case. The defence therefore made a further application to have the case stayed. The prosecution brought to court details of several potential alternative computer experts, whom they asserted were competent to act for the defence. This application was also heard by the Recorder who, in his judgment, made the following points among others:
• That the memorandum of undertaking is a “practical document for the assistance of the Police. It is of no legal effect.”
• “Whether an expert wants to run the risk of being prosecuted for doing essentially what is his expert’s job is a matter for the expert, it is not a matter for me to lay down, or indeed for the Crown to lay down. . . . In my judgement he is entitled to operate within such limits as he wishes to impose himself, subject of course in cases of this sort to having proper security. . . .”
Again the judge refused the application and instructed that the defence should continue to seek an alternative expert. However he made it plain that the history of the case, and the reason for the first expert’s withdrawal, must be made plain to any expert approached.
Seeking an Alternative Expert
Defence solicitors wrote to each of the potential alternative experts proposed by the prosecution. Each was asked to explain how they would provide the prompt advice that counsel would need (for example during cross-examination) without contravening any memorandum of undertaking that the police might impose. Each was also asked for a CV.
None of the replies contained a realistic solution to the problem with the memorandum of undertaking. Analysis was made of the skills, experience and qualifications listed in the CVs. Similar analysis was made of the CV appended to the report from the very experienced prosecution expert. Comparison showed that none of the potential alternative experts could match the very experienced expert. Towards the end of this process, the CRFP (Council for the Registration of Forensic Practitioners) started to register computer practitioners. The initial CRFP registrations mirrored this analysis with remarkable fidelity: the very experienced prosecution expert and the original defence expert were fully registered for all computer specialisms but none of the prosecution’s potential alternative experts were registered for any specialism.
Acquittal in Rape Trial
These events took a long time. In the meantime the trial of X for rape took place. There was no computer evidence, in fact no evidence other than the complainant’s testimony, and X was acquitted.
Offer to the Police
Aware of the difficulties the defence was experiencing in finding a replacement, and their concern as to the effect this would have on the defendant’s case, the original defence expert made one last bid to enable him to act. He wrote to the police inspector quoting the judgments in the case and offering that, if the police would cancel the memorandum of undertaking, withdraw any threat of prosecution and restore to him the seized document, he would resume acting. He received a letter saying that the Inspector had not yet read the judgment but that “no senior officer including myself would provide a letter giving you immunity from prosecution”. In consequence he made no offer to resume acting and provided the court with a further statement of the reasons for this.
Trial Stayed
The defence again applied to have the child pornography case against X stayed on the grounds that none of the potential alternative experts matched the experienced prosecution expert and none of them had demonstrated that they could provide the service the defence required without breaching the memorandum of undertaking. The prosecution argued that the defence was using this as an excuse. In a verbal judgment, the judge rejected this argument, felt that the defence had done everything possible and granted the application. He was also extremely critical of the situation that had triggered the whole sequence of events: the presence of counsel at a meeting of experts.
The defendant walked free from the court.
What lessons can be distilled from these extraordinary events?
Lessons for Computer Expert Witnesses
For computer expert witnesses instructed in such cases, the first rule is not to sign a police memorandum of undertaking if it contains any restriction that may inhibit examination, report and actions at trial. This may prove difficult as the demand to sign it comes before you can make even a preliminary examination of the data. So it is difficult to anticipate where conflicts may occur.
To be safe, assume the worst! Before you sign, delete from the memorandum any restriction that you are not confident, from past experience, you can work within. Alternatively, rewrite the memorandum completely.
Experts work in different ways. This article will not debate the merits or drawbacks of different techniques. However an example is use of the Internet. The ACPO memorandum insists data must only be examined on a stand-alone computer, not networked to others. However some analysts insist that a case which involves pictures downloaded from the Internet must be tested using a computer that interacts with Internet resources. Clearly the memorandum prevents this and so must be rejected.
The author has composed an alternative memorandum. It declares, unequivocally, his commitment to keeping the evidence secure but does not restrict his examination. When asked to sign the ACPO memorandum he instead offers this version. If the police decline and refuse access to the data, the matter is submitted to the court. Defence solicitors and counsel, in my experience, relish this sort of challenge. To date every application I have made to a court for access to data has been granted and my alternative wording has been accepted. If you find yourself restricted by a memorandum that you have already signed, invite the police to agree a variation and explain why it is needed. If it is refused, ask your instructing solicitor to apply to the court.
When are Copies of Pictures Needed?
In some cases, for example when they are present on a computer in their thousands, copies are not needed because the significance of any single picture is dwarfed by the scale of the offence. However there may be a defence to a charge relating to a single picture if it is a thumbnail (because this can indicate how it came to be on the computer), when it has text, such as a website address, embedded in the graphic, when subjects are nude but not indecent (this follows a recent Appeal Court judgment on the Sentencing Advisory Committee’s recommendations on the Copine scale) or when a subject is known (often because of another picture) to be over the legal age.
Speed of access to a picture may be important, particularly in course of cross-examination. I have met police analysts so expert with their laptop that they could retrieve any picture within a few seconds. I have no such digital adroitness so prefer to rely on printed documents with the laptop held in reserve. So I will no longer accept any memorandum of undertaking that forbids me to print hard copy. Printed documents are arguably more secure than electronic ones. The latter can not only be distributed over the Internet – they also leave hidden copies on any computer on which they are viewed.
Physical and Electronic Security
The judges quoted above made it very plain that any expert engaged in this kind of work was expected to have solid security arrangements. This means a safe, a shredder, door and window locks to British Standards, a monitored burglar alarm and computer screens positioned so they cannot be overlooked, ideally on an upper floor. One police security specialist recommended a device that would fill my office with white fog if the alarm was triggered but I have not gone to that extreme.
Clearly electronic security is vital. This almost always requires an independent security specialist to examine the expert’s installations and conduct penetration tests. Thereafter the expert needs to perform regular procedures: apply operating system upgrades, keep virus checking current, close unnecessary ports, disable processes that create vulnerabilities and so on.
Lessons for the Police
The key conclusion is that if police use their awesome powers against an expert witness who is only “doing essentially what is his expert’s job”, they will not be supported by the court. They may, in addition, jeopardise their entire case and possibly associated cases.
In demanding that a memorandum of undertaking be signed, the police act as if they “owned” the data from the defendant’s computer. They do not. The court owns it and the court is quite capable of restraining any inappropriate behaviour by an expert witness.
If the police wish to challenge how an expert (or any other member of a defence team) is handling such data or keeping it secure, they can raise the matter with the court and it should be apparent that they occupy a privileged position in their ease of access to the court.
As well as the events described above, I have encountered multiple instances of inappropriate behaviour by the police over the handling of this kind of data. For example, I have encountered the following.
— Insistence on an application to the court as a matter of routine, before they will release the data. This clutters the courts in order to “pass the buck” and shows ignorance of the 2003 Act.
— Vetting of an expert before releasing data – this coerces the defence in its choice of expert. One police force that followed this practice used their standard vetting procedure for firms applying to be police contractors. The procedure asked many useless questions and many that were intrusive and offensive, for example about my late parents!
— Many forces will not allow DVDs to be transported by couriers: one force employed two detective constables to drive 200 miles to my office and back to deliver them. No wonder there is a manpower deficit and a carbon surplus!
I wholeheartedly agree that police should enquire about, and even inspect, premises where indecent pictures will be held, check on the reputation of those applying to hold them and use secure methods of transport. My objection is when these practices are mindless or disproportionate!
Lessons for Instructing Solicitors
Most solicitors are well-informed about the laws that guarantee the defence access to evidence. In computer cases however they may be bemused by technicalities and sometimes are less assertive than they might be.
So first, when a defendant is interviewed in a computer child pornography case, and (as commonly happens) the police display the pictures on a laptop in the interview room, the attending solicitor should insist on a written list showing the filename and path name for every picture shown, with an index number for each. Each index number should be announced for the tape. The typed record of the interview then becomes meaningful; each section can be matched with the picture that was being displayed – once the expert has obtained the data.
Second, for this and other reasons, instruct your expert early; don’t wait for counsel’s advice. A defence expert who is instructed late, so working to a tight deadline, will be less ready to resist police pressures. So he may accept restrictions that seriously impair his subsequent report and/or oral evidence.
Third, and this is better understood in the civil courts, keep out of meetings of experts. By all means give them instructions before the meeting, but then leave them to get on with it.
Lessons for Judges
Complex computer evidence can be a serious problem for judge, jury and counsel. When it also involves indecent pictures, it is further complicated. Meetings of experts are well established in the civil courts but are less common in criminal cases. Yet it is frequently possible to reduce the points of disagreement to one or two key matters and to list the points of agreement in non-technical language. This is best done if the experts meet, in their offices not at court, a couple of weeks before the trial. Meetings on court premises, particularly after a day spent in an adversarial atmosphere, are not conducive to careful, constructive agreements. An early enquiry as to whether technical computer evidence is anticipated will enable the judge to order such a meeting well in advance. He may also deem it prudent to guide both counsel to keep clear of it and not attempt to influence the notes that are issued from it.
Jon Vogler has worked with computers for 40 years. He is a Chartered Engineer, a Fellow of the British Computer Society and a Certified Forensic Practitioner. He runs his own company: Active Backup Ltd: jon@vogler.demon.co.uk
