Trost, Jeremy --- "In or out? The inadmissibility of 'internet-based' evidence" [2016] PrecedentAULA 9; (2016) 132 Precedent 34

IN OR OUT?

THE ADMISSIBILITY OF ‘INTERNET-BASED’ EVIDENCE

By Jeremy Trost

There is no doubt that the internet has resulted in a virtually immeasurable increase in the availability of information. But it is not correct to say that any of this information is internet-based. As Justice Blue has very recently stated in the South Australian Supreme Court, ‘The internet... is a system of globally linked computer networks that communicate using a standardised protocol.’^[1]

Thus, information is communicated via the internet, rather than being ‘based’ on it. Some of that information is stored by a host and is available for download, including websites viewable using browsers (and sometimes requiring other software). A great deal of information is pushed over the internet without necessarily being stored – emails, chat room discussions, video discussions (like Skype and Facetime), VOIP, online games, etc. And some information is hosted in ‘peer-to-peer’ networks – where multiple users act as hosts (often movie or song files, often without holding the relevant copyright) and software co-ordinates downloads of that information from one or more of those hosts. The recent Dallas Buyers Club case, discussed below, focused on information sharing over such networks.

Information is also created as a result of internet (and other) communications – metadata. Metadata may incorporate a variety of information including location, time, device details, source, destination and user information (though generally not content). This information may be attached to a communication, or just stored by the internet service provider (ISP). Since October 2015, all Australian ISPs and telcos are required to begin storing two years of metadata pursuant to the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 (Cth). This information is available to about 85 police and security agencies without warrant.^[2] It also creates a large pool of potential evidence in civil disputes.

As can be seen, a great deal of information, of seemingly ever-expanding scope, is being communicated via the internet or being created by reason of such communication. Thus, the ‘internet evidence’ may be the information itself or, indeed, details of the communication. Evidence of the actual communication is especially important in matters where publication, communication or receipt of information is a fact in issue (for example, defamation matters, copyright disputes and criminal proceedings related to the receipt of illegal material).

ADMISSIBILITY IN GENERAL

As most legal practitioners will be aware, the rules of evidence differ, to varying degrees, across the Australian jurisdictions. It is beyond the scope of this article to discuss all the relevant rules of admissibility as they apply to each separate Australian jurisdiction. Instead, I have based this article on the common provisions of the ‘Uniform Evidence Acts’ (being the Evidence Acts of 1995 (Commonwealth), 1995 (NSW) and 2008 (Victoria)), as well as the Evidence Act 1977 (Queensland). Of course, any person attempting to determine the applicable rules in any specific jurisdiction should obtain local advice (both as to the substantive rules including applicable common law rules, as well as to the relevant procedural practices).

Internet evidence as documents

Internet evidence is, for the most part, and like other forms of ‘electronic evidence’, a type of documentary evidence. The inclusion of ‘any record of information’ in the definitions of ‘document’ in the Uniform Evidence Acts and the Evidence Act 1977 (QLD) is sufficiently broad to capture most forms of electronic evidence. As such, the principles of admissibility that apply to documents are essentially the same as those that apply to internet evidence.

There is some ‘internet evidence’, however, that does not necessarily become a document. Where data is communicated over the internet, but is not stored – such as the images and spoken words in a video conversation – there is no document (as defined in the relevant legislation) able to be produced to prove the content of that communication. Instead, evidence of the content would need to be adduced as testimonial evidence. Nevertheless, documentary evidence of the details of the communication via the internet – that is, the metadata – may, where it is relevant, provide valuable supporting evidence (or, perhaps, rebuttal of concocted evidence). This is essentially the same situation that applies to, for instance, phone conversations and text messages that have not been recorded/stored and are not recoverable from the phones.

Relevance

As with all forms of evidence, the first hurdle for admissibility is relevance. This is not (in general, though always subject to qualification) a difficult element to establish – if it would have a rational effect on the determination of a fact in issue, such evidence will usually be relevant.^[3] For any type of evidence, difficulties may still arise in assessing relevance, or indeed what is a fact in issue. However, in the case of internet evidence the issue of relevance will often turn on its reliability and authenticity – if such a document is concocted or adduced to prove something it cannot prove, it is not relevant. It is open to an opposing party (or the court) to object to the admission of evidence that has such clouds hanging over it, or at least object to its admission without further proof as to its authenticity.

Authentication

Section 57 of the Uniform Evidence Acts specifically provides for a process of authentication. The court may find the evidence is relevant subject to further evidence being admitted to verify its accuracy and reliability. Section 98 of the Evidence Act 1977 (Qld) gives the court a broad power to exclude evidence ‘in the interests of justice’ that would otherwise be admissible under Part 6 of that Act. Section 95 is contained in Part 6 and provides for the admission of computer records where they are appropriately authenticated.

In the context of internet evidence, it may be the case where a copy of the electronic document is intended to be adduced, it may not be readily apparent that such a copy is an accurate representation of the underlying record. Furthermore, the provenance of the data in that document may not be apparent without a complete explanation of how the document came to be created and stored. As a result, a legal adviser should ask the same questions of a client that the court may ask in relation to whether evidence is admissible. Where an explanation of the workings of a computer program that has produced the data is required, and where the way such data can be used is not immediately apparent, expert evidence may be necessary.

Authentication: a case study

Although not dealing with admissibility of evidence in a trial, the preliminary discovery decision of Perram J in Dallas Buyers Club LLC and others v iiNet [2015] FCA 317 highlights the advantages of appropriate authentication. Dallas Buyers Club LLC (DBC) had obtained 4,726 ‘IP addresses’ of the subscribers to various Australian ISPs who had used ‘BitTorrent’ software to ‘share’ a digital copy of the movie, Dallas Buyers Club. BitTorrent software allows access to ‘peer-to-peer’ networks in order to share files (most commonly music and movie files) via the internet. DBC utilised a software program called ‘Maverik Monitor’ to obtain the IP addresses while participating in the sharing. From these IP addresses, DBC could identify the ISPs (such as iiNet) of the participants; but only the ISPs could identify the individual subscribers by matching the IP addresses with the subscribers they were assigned to at the particular time.

In order to comply with the rules on preliminary discovery, DBC needed to establish that the information from iiNet was necessary in order to ascertain whether it had an action against prospective respondents for breach of copyright. As part of this process, DBC obtained expert evidence from a software expert on the workings of the Maverik Monitor software and BitTorrent software, and how they interacted to identify IP addresses. It also addressed questions as to the accuracy of the times recorded by Maverick Monitor and issues related to dynamic IP addresses. Another witness gave evidence as to how he had used the software to collect the 4,726 IP addresses. The ISPs attempted to assert that this information was not reliable by attacking the reliability of Maverick Monitor in relation to the time stamps and dynamic IP addresses. However, they did not cross examine the expert evidence, instead attempting to attack the evidence of the user of the software, and thus ‘they were surrendering the right to suggest that Maverik Monitor was deficient in those respects’.^[4]

Despite the complexities involved in proving the authenticity of evidence of IP addresses obtained through specialised software, ultimately admissibility was not meaningfully challenged. The court accepted the method of obtaining the IP addresses and ordered discovery (albeit subject to a stay pending the provision of further information by DBC). One might expect, however, that without such expert evidence, a court would not have readily accepted merely a list of IP addresses and times. This situation highlights some of the evidentiary difficulties copyright owners face in simply identifying a potential infringer (another difficulty is identifying a specific user when there may be many users sharing an internet connection in a household or at a business).

EXCLUSIONARY RULES AND EXCEPTIONS

Perhaps the most common exclusionary rule for documentary evidence is hearsay. Where a document is adduced to prove its contents, it is hearsay. Hearsay is inadmissible unless it fits within an exception. Such exceptions are diverse (including admissions, first-hand hearsay, certain declarations by a deceased, etc) and vary depending on the relevant jurisdiction. The full scope of the rule and its exceptions is beyond the scope of this article. However, a legal practitioner should explore all options to establish or rebut such exceptions in advance of a hearing.

Where the Uniform Evidence Acts apply, evidence adduced for a relevant non-hearsay purpose will be admissible and then may be relied on as proof of the facts stated (though this does not apply to admissions in criminal trials).^[5] There is no similar provision in the Evidence Act 1977 (Qld). In the context of internet evidence, which will generally be computer-generated, there are a number of provisions (in the Uniform Evidence Acts and the Queensland Act), designed to streamline admissibility, that should be considered at the outset.

Section 71 of the Uniform Evidence Acts automatically exempts details of the identity of the sender, the time of sending and the destination of an email from the application of the hearsay rule. Although this does not apply to the content of the email, the details of the communication may still be relevant evidence.

Section 69 of the Uniform Evidence Acts and s92 of the Evidence Act 1977 (Qld) provide for the admissibility of business records, provided certain criteria are met. These provisions may assist in admitting the contents of emails, even where such emails are not between parties to the proceedings: Aqua-Marine Marketing Pty Ltd v Pacific Reef Fisheries (Australia) Pty Ltd (No. 4) [2011] FCA 578. In Aqua-Marine, Collier J also set out a number of principles relating to emails and their admissibility as business records in general. However, ‘... In the case of material on websites, the author of which is often not identified, it may be difficult to reach satisfaction that the information had its source in a person who had or might reasonably be supposed to have had personal knowledge of the asserted fact.’^[6] Perram J has also noted that ‘generally speaking, the published output of a business by way of journal, website or other literary form will not be a business record’.^[7] Thus, it is likely to be more difficult (depending on the business in question) to admit a website as a business record without obtaining further evidence to prove that it falls within the relevant exception.

Certain other provisions should also be considered in the context of business records. In the Uniform Evidence Acts, s48(1)(e), relating to the manner of adducing such documents, ss146-147, creating presumptions regarding evidence produced by a ‘device or process’, and s161 creating presumptions regarding electronic communications may also be relevant. In the Queensland Act, s95 may provide an alternative means of admitting computer records, especially where they do not form part of a business record, while ss84-91 specifically provide for admissibility of ‘books of account’.

Other exclusions and exceptions should also be considered (including privilege and opinion exclusions), but the scope of their potential applicability is beyond the remit of this article.

DISCRETION TO EXCLUDE

Sections 135-8 of the Uniform Evidence Acts provide several bases for exclusion of evidence, generally where such evidence would be of low probative value and/or unfairly prejudicial. Section 98 of the Evidence Act 1977 (Qld) provides a similar discretion with respect to evidence proposed to be admitted under Part 6 of the Act (though it should be noted that evidence admitted ‘otherwise than by virtue of this part’ is not subject to that discretion).

OTHER CONSIDERATIONS

Constant changes

In R v Matthews [2015] QCA 82, the Queensland Court of Appeal held that there had been a miscarriage of justice because a profile page was admitted into evidence despite that page containing comments from a third party that were (a) posted after the date of the alleged offences; and (b) highly prejudicial to the defendant. In this case, it was simple to determine that the webpage was not the same one that was relevant to the time of the offence, although that is not always the case. The content of a website at a particular time can be highly relevant, although (understandably given the ease of updating a website) it is only sometimes recorded.^[8]

Forgery and tampering

Internet evidence is prone to being tampered with. Websites, emails and other electronic messages can be amended or created from scratch, and it can be very difficult to prove that they never existed. In these situations, a party should demand that the other party authenticates its documentation and should consider obtaining expert evidence or contradictory evidence that highlights the lack of reliability. I have seen the output of software creating iPhone messages, although it contained tell-tale signs highlighting a lack of authenticity. It has also become easier to simulate another person in communications via dishonestly accessing email and social media accounts. Such practices should not be ruled out.

Duty to the court, duty to your client

Given the issues that internet evidence may raise, it is important to educate yourself as much as possible in relation to the evidence that may be presented. If you have not taken steps to authenticate your client’s evidence and it is later exposed to be fake or misrepresentative, some difficult questions may need to be answered.

In Jackson v Macek (2015) 296 FLR 219, the Full Court of the Family Court allowed an appeal where the trial judge had incorrectly assumed that information from the website of the ‘Australian Breastfeeding Association’ could be taken as ‘judicial knowledge’ pursuant to s144(1)(b) of the Evidence Act 1995 (Cth). During the trial, the mother’s lawyer was asked if she agreed that the information fell within that section, which she readily accepted. While this may not be a usual occurrence, it highlights (a) the need to be aware of pitfalls in relying on seemingly authoritative sources of information – especially as so much of it may be available online; and (b) the need to protect a client’s interests by challenging such ‘evidence’.

CONCLUSION

There is no doubt that the scope of internet evidence will continue to expand. However, the principles that apply to documentary evidence are readily adaptable. The starting point for any question of admissibility is establishing relevance. A practitioner should then consider how it can be admitted by determining the steps needed to establish its authenticity and whether there are any provisions that may assist in the process. The process may seem difficult in the context of internet evidence where the workings of the internet and related software are not necessarily widely understood, but fundamental principles of evidence law (and a growing body of case law) provide solid foundations.

Jeremy Trost is a barrister located in Brisbane. PHONE [phone] EMAIL [e-mail].

---

^[1] Duffy v Google Inc [2015] SASC 170, para [23].

^[2] Scott, Elise, ‘Senate passes controversial metadata laws’, Sydney Morning Herald, March 27, 2015, http://www.smh.com.au/federal-politics/political-news/senate-passes-controversial-metadata-laws-20150326-1m8q3v.html, accessed 29 November 2015.

^[3] See, for example, ss55-56 Uniform Evidence Acts; Forbes, JRA, Evidence Law in Queensland, 8^th ed, 2010 Thomson Reuters at [A.124].

^[4] Dallas Buyers Club LLC and others v iiNet [2015] FCA 317 at [13].

^[5] Section 60, Uniform Evidence Acts.

^[6] Barton Property Partnership No. 2 & Anor v Foote & Ors (No. 1) [2015] ACTSC 203 at [12].

^[7] Australian Competition and Consumer Commission (ACCC) v Air New Zealand Ltd [2012] FCA 1479; (2012) 301 ALR 352 at [15].

^[8] For a useful discussion on archived internet pages and the ‘Wayback Machine’, I recommend: Soars, Julie and Lee, Carmel. Tweets, texts, forged emails and changing webpages: Emerging issues and practical examples, LSJ: Law Society of NSW Journal, Vol. 2, No. 2, Mar 2015: 74-5.

---