Computer-related Search Issues: Difference between revisions
No edit summary |
m 1 revision imported |
||
(No difference)
| |||
Revision as of 17:30, 22 February 2018
General Principles
Search warrants under s. 487 are the most typical manner of authorizing an officer to examine the contents of a computer.[1]
- ↑ R v Blazevic, 2011 ONSC 7549 (CanLII), at para 32, ("the police have the right to search computers with a search warrant under s. 487 of the Criminal Code to assist them in uncovering evidence associated with an offence.")
Singe Warrant for Multiple Zones of Privacy
A residential search warrant that authorizes the seizure of computer devices for its evidential value can also operate as an judicial authorization for the examination of the device.[1]
Due to the enhanced privacy interest, the authorization must specifically authorize the seizure of a computer before they can search it. The authorization for the device cannot be by implication.[2]
If a computer is found during a search under a warrant does not authorize the search of a computer, it can be seized until a computer search warrant is obtained.[3]
The initial seizure of the device and the later forensic examination is a separate police activity.[4]
Where a computer device is lawfully seized, the police are permitted to make a forensic copy of the data.[5]
- ↑
R v Vu, 2013 SCC 60 (CanLII)
see also R v Ballendine, 2011 BCCA 221 (CanLII)
c.f. R v Jones, 2011 ONCA 632 (CanLII)
- ↑
R v Vu 2013 SCC 60 (CanLII), [2013] S.C.J. No. 60 at para 3 ("...the requirement of specific, prior authorization means that if police intend to search computers found within a place with respect to which they seek a warrant, they must satisfy the authorizing justice that they have reasonable grounds to believe that any computers they discover will contain the things they are looking for.")
R v Butters, 2014 ONCJ 228 (CanLII), at para 25 aff'd 2015 ONCA 783 (CanLII)
- ↑ R v Vu, [2013] 3 SCR 657, 2013 SCC 60 (CanLII), at para 49
- ↑
R v Barwell, [2013] OJ 3743(*no CanLII links)
at para 18
- ↑
R v Eddy, 2016 ABQB 42 (CanLII) at paras 49 to 50
A "Locker Warrant"
There is some division in the case law in whether proper means of authorizing the examination a device lawfully seized and stored in an evidence locker.[1] There is a line of cases that suggest that the proper means of examining the device is to ask for a "locker warrant".[2]
Timing of Forensic Examination
A computer held under a s. 490 warrant can be examined at any time irrespective of the time specified in the warrant.[3]
- ↑
R v Townsend, 2017 ONSC 3435 (CanLII) at paras 61 to 73
- ↑
R v Eddy, 2016 ABQB 42 (CanLII), 2016 D.T.C. 5032 (Alta. Q.B.), per Rooke ACJQB
R v Nurse, 2014 ONSC 1779 (CanLII) per Coroza J
R v Barwell, [2013] O.J. No. 3743 (Ont. C.J.) per Paciocco J
- ↑
R v Nurse, 2014 ONSC 1779 (CanLII) at pars 41 to 49
R v Rafferty, 2012 ONSC 703 (CanLII) at para 39 to 48
R v Weir, 2001 ABCA 181 (CanLII) at paras 18 to 19
R v Ballendine, 2011 BCCA 221 (CanLII) at paras 64 to 70
Sufficiency of Computer Evidence
IP Address and RPG to Search
The connection of an IP address with an ISP account can form reasonable grounds to believe that a computer will be present at the address, but will often need something more.[1]
- ↑ see R v Weir 2001 ABCA 181 (CanLII), 156 CCC (3d) 188 (ABCA): ("While it is possible that the computer may have been at a different location than the billing address, it was not unreasonable to conclude that something as sensitive as child pornography would be kept on a computer in a person’s home.")
Manner of Search
When searching a computer, the manner of the search must be "reasonable" and is subject to implied restrictions.[1]
It is not permissible for police examiners to "scour the devices indiscriminately". They must "adhere to the rule that the manner of the search must be reasonable."[2]
The examiners should not conduct full "data dump" of the entire contents of the device and then simply give the entirety of the materials extracted to the investigator where they have the ability to narrow the scope of their search to better comply with the authorization.[3]
Limitations on search are guided by the type of evidence being sought, not any particular file format or file name.[4] Limitations based on locations within the device are not practical.[5] Examiners are entitled to examine any file or folder, in at least a cursory manner, to determine whether they are likely to contain evidence of the type they are seeking.[6]
Search Protocols
There is no need for the computer search warrant to set out a search "protocol" to limit what can be examined in the computer.[7]
- ↑ R v Vu, [2013] 3 SCR 657, 2013 SCC 60 (CanLII) at para 61
- ↑
Vu, ibid. at para 61
R v Jones, 2011 ONCA 632 (CanLII) at para 42
R v Fearon, [2014] 3 SCR 621, 2014 SCC 77 (CanLII) at para 20
R v Nurse and Plummer, 2014 ONSC 5989 (CanLII) at paras 24, 34
- ↑ R v Nurse, 2014 ONSC 5989 (CanLII)
- ↑
Jones, supra at para 43
see also R v Rafferty, 2012 ONSC 703 (CanLII)
- ↑ R v Cross, 2007 CanLII 64141 (ON SC), [2007] OJ 5384 (ONSC)
- ↑
Jones, supra at para 44
- ↑ Vu, ibid. at para 59 ("...my view is that search protocols are not, as a general rule, constitutionally required for pre-authorization of computer searches.")
Discovery of a New Offence
When executing a search warrant in relation to a certain offence and the examiner discovers evidence of another crime, the discovered evidence is admissible, but any further searches for further evidence of the new offence must be done after applying for a new warrant.[1]
Where a new authorization is needed, the proper procedure is to apply for a search warrant and not a general warrant.[2]There is nothing wrong with getting a second search warrant for a device that has already been seized and searched.[3]
- ↑
R v Jones, 2011 ONCA 632 (CanLII)
R v Vu, 2011 BCCA 536 (CanLII)
- ↑
R v KZ, 2014 ABQB 235 (CanLII), at para 32 - Note however that this case considers "computers to be "places" of search rather than the "thing" of search within the meaning of s. 487, which is somewhat contrary to numerous other cases
- ↑ KZ, ibid. at para 40
Child Pornography
The computer search warrant of a computer permitting the examination of the computer for specific types of child pornography, does not allow the analyst to examine all images.[1] The police should be limited to images containing the keywords and associated range of dates.
For details on the issue of dated information regarding the presence of CP on a computer, see Information to Obtain a Search Warrant#Currency of Information.
- ↑
R v Sop, 2014 ONSC 4610 (CanLII)
Search for Data Stored Outside of Computer
There is some suggestion that s. 487(2.1) and (2.2) permits a search of a computer to include search of data stored off-site.[1]
487.
...
Operation of computer system and copying equipment
(2.1) A person authorized under this section to search a computer system in a building or place for data may
- (a) use or cause to be used any computer system at the building or place to search any data contained in or available to the computer system;
- (b) reproduce or cause to be reproduced any data in the form of a print-out or other intelligible output;
- (c) seize the print-out or other output for examination or copying; and
- (d) use or cause to be used any copying equipment at the place to make copies of the data.
Duty of person in possession or control
(2.2) Every person who is in possession or control of any building or place in respect of which a search is carried out under this section shall, on presentation of the warrant, permit the person carrying out the search
- (a) to use or cause to be used any computer system at the building or place in order to search any data contained in or available to the computer system for data that the person is authorized by this section to search for;
- (b) to obtain a hard copy of the data and to seize it; and
- (c) to use or cause to be used any copying equipment at the place to make copies of the data.
...
R.S., 1985, c. C-46, s. 487; R.S., 1985, c. 27 (1st Supp.), s. 68; 1994, c. 44, s. 36; 1997, c. 18, s. 41, c. 23, s. 12; 1999, c. 5, s. 16; 2008, c. 18, s. 11.
– CCC
Jurisdiction
Generally speaking, where data is stored in a foreign country but is readily accessible through a network within the country, the location of the original data is irrelevant.[2]
- ↑
R v Vu, 2011 BCCA 536 (CanLII) at para 73 - obiter appealed on other issues to 2013 SCC 60 (CanLII)
- ↑
eBay Canada Ltd. v. M.N.R., [2010] 1 FCR 145, 2008 FCA 348 (CanLII), (the court of appeal stated “The location of the servers was irrelevant because electronically stored information relating to the PowerSellers was readily, lawfully, and instantaneously available in a variety of places to the appellants in Canada.”)
Police Undercover Investigations
The seizure of historical text messages will not be considered an "interception" requiring a Part VI wiretap warrant.[1]
An undercover peace officer posing as an underage officer does not amount to an intercept.[2]
The fact that the sender was under the mistaken belief as to the identity of the recipient does not amount an "interception".[3]
- ↑
R v Didechko, 2015 ABQB 642 (CanLII)
R v Vader, 2016 ABQB 309 (CanLII)
R v Rideout, 2016 CanLII 24896 (NL SCTD)
R v Jones, 2016 ONCA 543 (CanLII)
R v Scott, 2015 MBQB 87 (CanLII)
R v Mills, 2017 NLCA 12 (CanLII) leave to appeal granted 2017 CanLII 84238 (SCC)
c.f. R v Croft, 2015 ABQB 24 (CanLII)
- ↑
R v Allen, 2017 ONSC 1712 (CanLII)
R v Graff, 2015 ABQB 415 (CanLII)
R v Ghotra, [2015] OJ No 7253 (ONSC)(*no CanLII links)
- ↑ R v Mills, supra
Evidence
Operation of a Computer Device
It should not be necessary to have the investigator to give details on the "basic functions" of computer storage devices. Computer devices are to be treated as appliance and so no need of need of proof is necessary to establish basic functionality.[1]
- ↑
R v Wonitowy, 2010 SKQB 346 (CanLII) at para 46