Computer-related Search Issues: Difference between revisions

From Criminal Law Notebook
← Older editNewer edit →
VisualWikitext
No edit summary
No edit summary
Line 266: Line 266:
==Disclosing Passwords==
==Disclosing Passwords==
It remains an open question whether it is possible to use a general warrant to compel a person to disclose their device password.<ref>
It remains an open question whether it is possible to use a general warrant to compel a person to disclose their device password.<ref>
''In Re: Application for a General Warrant and s. 487.02 Assistance Order for Eric Talbot'' (2017){{NOCANLII}}
{{CanLIIRPC|In Re: Application for a General Warrant and s. 487.02 Assistance Order for Eric Talbo (2017)||}}
</ref>
</ref>


Revision as of 23:04, 7 March 2021

General Principles

See also: Special Search Issues

Search warrants under s. 487 are the most typical manner of authorizing an officer to examine the contents of a computer.[1]

  1. ↑ R v Blazevic, 2011 ONSC 7549 (CanLII), per PJL Smith J, at para 32, ("the police have the right to search computers with a search warrant under s. 487 of the Criminal Code to assist them in uncovering evidence associated with an offence.")

Warrant Issues

Single Warrant for Multiple Zones of Privacy

A residential search warrant that authorizes the seizure of computer devices for its evidential value can also operate as an judicial authorization for the examination of the device.[1]

Due to the enhanced privacy interest, the authorization must “specific[ally]” authorize the seizure of a computer before they can search it. The authorization for the device cannot be by implication.[2]

If a computer is found during a search under a warrant does not authorize the search of a computer, it can be seized until a computer search warrant is obtained.[3]

The initial seizure of the device and the later forensic examination is a separate police activity.[4]

Where a computer device is lawfully seized, the police are permitted to make a forensic copy of the data.[5]

The use of analogies comparing cupboards and computer devices is not appropriate for the analysis of lawfulness of computer searches.[6]

  1. ↑ R v Vu, 2013 SCC 60 (CanLII), per Cromwell J
    see also R v Ballendine, 2011 BCCA 221 (CanLII), per Frankel JA
    and cf. R v Jones, 2011 ONCA 632 (CanLII), per Blair JA
  2. ↑ Vu, supra, at para 3 ("...the requirement of specific, prior authorization means that if police intend to search computers found within a place with respect to which they seek a warrant, they must satisfy the authorizing justice that they have reasonable grounds to believe that any computers they discover will contain the things they are looking for.")
    R v Butters, 2014 ONCJ 228 (CanLII), per Paciocco J, at para 25 aff'd 2015 ONCA 783 (CanLII), per curiam
  3. ↑ Vu, supra, at para 49
  4. ↑ R v Barwell, [2013] OJ 3743(*no CanLII links) , per Paciocco J, at para 18
  5. ↑ R v Eddy, 2016 ABQB 42 (CanLII), per Rooke ACJ, at paras 49 to 50
  6. ↑ Vu, supra

Search of Third-Party Devices for Communications

The privacy rights follow and apply to "electronic conversations" whether or not stored on the sender's device. Accordingly, a communication, as it exists on a third-party devices, may be protected under s. 8 of the Charter.[1]

Search of an Electronic Conversation by Consent

There is some suggestion that a conversation may not accessed by the police without warrant on consent of one of the parties to that conversation.[2] There is no need for a consent where the conversation is between strangers as there is no expectation of privacy.[3]

  1. ↑ R v Marakah, 2017 SCC 59 (CanLII), per McLachlin CJ
  2. ↑ Marakah, ibid.
    see R v Reeves, 2018 SCC 56 (CanLII), per Karakatsanis J - relating to a search of the family computer on consent of wife
    R v Lim, 2019 ABPC 87 (CanLII), per Creagh J
    cf. R v Cairns, 2018 ONSC 6411(*no CanLII links) , per Sweeny J - The search of a facebook conversation with consent of one of the parties did not require a warrant
  3. ↑ R v Mills, 2019 SCC 22 (CanLII), per Brown J

A "Locker Warrant"

There is some division in the case law in whether proper means of authorizing the examination a device lawfully seized and stored in an evidence locker.[1] There is a line of cases that suggest that the proper means of examining the device is to ask for a "locker warrant." [2]

  1. ↑ R v Townsend, 2017 ONSC 3435 (CanLII), per Varpio J, at paras 61 to 73
  2. ↑ R v Eddy, 2016 ABQB 42 (CanLII), , 2016 D.T.C. 5032 (Alta. Q.B.), per Rooke ACJ
    R v Nurse, 2014 ONSC 1779 (CanLII), per Coroza J
    R v Barwell, [2013] OJ No 3743 (Ont. C.J.)(*no CanLII links) , per Paciocco J

Timing of Forensic Examination

A computer held under a s. 490 warrant can be examined at any time irrespective of the time specified in the warrant.[1]

  1. ↑ R v Nurse, 2014 ONSC 1779 (CanLII), per Coroza J at pars 41 to 49
    R v Rafferty, 2012 ONSC 703 (CanLII), per Heeney J, at paras 39 to 48
    R v Weir, 2001 ABCA 181 (CanLII), per curiam, at paras 18 to 19
    R v Ballendine, 2011 BCCA 221 (CanLII), per Frankel JA, at paras 64 to 70
    R v Yabarow, 2019 ONSC 3669 (CanLII), per Dambrot J, at para 49

Sufficiency of Computer Evidence

IP Address and RPG to Search

The connection of an IP address with an ISP account can form reasonable grounds to believe that a computer will be present at the address, but will often need something more.[1]

  1. ↑ see R v Weir, 2001 ABCA 181 (CanLII), , 156 CCC (3d) 188 (ABCA), per curiam ("While it is possible that the computer may have been at a different location than the billing address, it was not unreasonable to conclude that something as sensitive as child pornography would be kept on a computer in a person’s home.")

Manner of Search

When searching a computer, the manner of the search must be "reasonable" and is subject to implied restrictions.[1]

It is not permissible for police examiners to "scour the devices indiscriminately". They must "adhere to the rule that the manner of the search must be reasonable."[2]

The examiners should not conduct full "data dump" of the entire contents of the device and then simply give the entirety of the materials extracted to the investigator where they have the ability to narrow the scope of their search to better comply with the authorization.[3]

Limitations on search are guided by the type of evidence being sought, not any particular file format or file name.[4] Limitations based on locations within the device are not practical.[5] Examiners are entitled to examine any file or folder, in at least a cursory manner, to determine whether they are likely to contain evidence of the type they are seeking.[6]

Imaging of Device

The process of imaging a lawfully seized device does not amount to a search upon the privacy rights of the owner.[7] There is no obligation for the police to delete the image once the extraction is done.[8] There is no limitation on the number of times that the examiner can revisit the contents of a mirror-imaged device.[9]

Report to Justice on Extracted Data

There is a line of cases suggesting that it is required under s. 489.1 for the police to file a report to justice in relation to the extracted data.[10]

Search Protocols

There is no need for the computer search warrant to set out a search "protocol" to limit what can be examined in the computer.[11]

Note Taking

The person doing the examination of the device has an obligation to make notes absent unusual or exigent circumstances.[12] Failure to take notes will not necessarily result in a breach of s. 8, particularly where there is sufficient information provided through the expert's report.[13] Failure to take notes but there is no impediment to the accused to "meaningfully challenge" the search.[14]

  1. ↑ R v Vu, 2013 SCC 60 (CanLII), , [2013] 3 SCR 657, per Cromwell J, at para 61
  2. ↑ Vu, ibid., at para 61
    R v Jones, 2011 ONCA 632 (CanLII), per Blair JA, at para 42
    R v Fearon, 2014 SCC 77 (CanLII), , [2014] 3 SCR 621, per Fearon J, at para 20
    R v Nurse and Plummer, 2014 ONSC 5989 (CanLII), per Coroza J, at paras 24, 34
  3. ↑ Nurse, ibid.
  4. ↑ Jones, supra, at para 43
    see also R v Rafferty, 2012 ONSC 703 (CanLII), per Heeney J
  5. ↑ R v Cross, 2007 CanLII 64141 (ON SC), , [2007] OJ 5384 (ONSC), per Brennan J
  6. ↑ Jones, supra, at para 44
  7. ↑ R v Sinnappillai, 2019 ONSC 5000 (CanLII), per Boswell J, at paras 60 to 72
  8. ↑ Sinnappillai, ibid., at paras 73 to 80
  9. ↑ Sinnappillai, ibid., at para 80
    Nurse, supra
  10. ↑ Sinnappillai, ibid., at paras 93 to 100
    R v Merritt, 2017 ONSC 5245 (CanLII), per Dawson J, at paras 244 to 245
    R v Neill, 2018 ONSC 5323 (CanLII), per Coroza J, at paras 89 to 94
  11. ↑ Vu, supra, at para 59 ("...my view is that search protocols are not, as a general rule, constitutionally required for pre-authorization of computer searches.")
  12. ↑ Vu, supra, at para 70 (" That said, there are two somewhat disquieting aspects of the search of the computer. First, Sgt. Wilde admitted in his testimony that he intentionally did not take notes during the search so he would not have to testify about the details. This is clearly improper and cannot be condoned. Although I do not decide here that they are a constitutional prerequisite, notes of how a search is conducted should, in my view, be kept, absent unusual or exigent circumstances.")
  13. ↑ R v Schulz, 2018 ONCA 598 (CanLII), per Brown JA
  14. ↑ R v Villaroman, 2018 ABCA 220 (CanLII)(complete citation pending), per curiam (2:1) , at para 17 ("The forensic examiner testified at length about how he conducted the search. The failure to take detailed notes does not appear to have undermined the appellant’s ability to meaningfully challenge the reasonableness of the search.") appealed on different grounds at 2016 SCC 33.

Discovery of a New Offence

When executing a search warrant in relation to a certain offence and the examiner discovers evidence of another crime, the discovered evidence is admissible, but any further searches for further evidence of the new offence must be done after applying for a new warrant.[1]

Where a new authorization is needed, the proper procedure is to apply for a search warrant and not a general warrant.[2]There is nothing wrong with getting a second search warrant for a device that has already been seized and searched.[3]

  1. ↑ R v Jones, 2011 ONCA 632 (CanLII), per Blair JA
    R v Vu, 2011 BCCA 536 (CanLII), per Frankel JA appealed to 2013 SCC 60 (CanLII), per Cromwell J
  2. ↑ R v KZ, 2014 ABQB 235 (CanLII), per Hughes J, at para 32 - Note however that this case considers "computers to be "places" of search rather than the "thing" of search within the meaning of s. 487, which is somewhat contrary to numerous other cases
  3. ↑ KZ, ibid., at para 40

Child Pornography

See also: Child Pornography (Offence)

The computer search warrant of a computer permitting the examination of the computer for specific types of child pornography, does not allow the analyst to examine all images.[1] The police should be limited to images containing the keywords and associated range of dates.

For details on the issue of dated information regarding the presence of CP on a computer, see Information to Obtain a Search Warrant#Currency of Information.

  1. ↑ R v Sop, 2014 ONSC 4610 (CanLII), per Sloan J

Search for Data Stored Outside of Computer

There is some suggestion that s. 487(2.1) and (2.2) permits a search of a computer to include a search of data stored off-site.[1]

487.
...

Operation of computer system and copying equipment

(2.1) A person authorized under this section to search a computer system in a building or place for data may

(a) use or cause to be used any computer system at the building or place to search any data contained in or available to the computer system;
(b) reproduce or cause to be reproduced any data in the form of a print-out or other intelligible output;
(c) seize the print-out or other output for examination or copying; and
(d) use or cause to be used any copying equipment at the place to make copies of the data.
Duty of person in possession or control

(2.2) Every person who is in possession or control of any building or place in respect of which a search is carried out under this section shall, on presentation of the warrant, permit the person carrying out the search

(a) to use or cause to be used any computer system at the building or place in order to search any data contained in or available to the computer system for data that the person is authorized by this section to search for;
(b) to obtain a hard copy of the data and to seize it; and
(c) to use or cause to be used any copying equipment at the place to make copies of the data.

...
R.S., 1985, c. C-46, s. 487; R.S., 1985, c. 27 (1st Supp.), s. 68; 1994, c. 44, s. 36; 1997, c. 18, s. 41, c. 23, s. 12; 1999, c. 5, s. 16; 2008, c. 18, s. 11.

– CCC

Note up: 487(2.1) and (2.2)

Section 487(2.1) and (2.2) were enacted in 1997 with RSC 1997, c. 18.[2]

One possible problem with the use of s. 487(2.1) to permit off-site searches is that it does not take into account that s. 487 limits its authorization to search of a "place" that is different from the off-site "place" storing the "cloud" data. There is a possibility that the power authorized by s. 487 is limited to searches where the evidence is located within the geographical area of the "place" listed on the warrant.

Computer as "place" or "thing"

There is uncertainty as to where warrants under s. 487 to search for computers are generally framed as searching "places" to locate a computer device that is to be forensically examined once subject to a s. 490 detention order.[3]

Jurisdiction

Generally speaking, where data is stored in a foreign country but is readily accessible through a network within the country, the location of the original data is irrelevant.[4]


  1. ↑ R v Vu, 2011 BCCA 536 (CanLII), per Frankel JA, at para 73 - obiter appealed on other issues to 2013 SCC 60 (CanLII), per Cromwell J
  2. ↑ see List of Criminal Code Amendments (1984 to 1999)
  3. ↑ examples of computer as "thing":
    R v Nurse, 2014 ONSC 1779 (CanLII)(complete citation pending), per Coroza J at paras 41 to 49 – upheld on appeal on other grounds
    R v Weir, 2001 ABCA 181 (CanLII), per curiam, at paras 18 to 19
    R v Ballendine, 2011 BCCA 221 (CanLII), per Frankel JA, at paras 64 to 70
    R v Yabarow, 2019 ONSC 3669 (CanLII), per Dambrot J, at para 49
    R v Townsend, 2017 ONSC 3435 (CanLII), per Varpio J, at paras 61 to 73
    R v Eddy, 2016 ABQB 42 (CanLII), 2016 D.T.C. 5032 (Alta. Q.B.), per Rooke ACJ
    R v Rafferty, 2012 ONSC 703 (CanLII), per Heeney J, at paras 39 to 48 – re vehicle
    R v Barwell, [2013] OJ No 3743 (Ont. C.J.), per Paciocco J
    R v Viscomi, 2016 ONSC 5423 (CanLII) per McCombs J
    examples of computer as "place":
    R v D’Souza, 2016 ONSC 5855 (CanLII) per McCarthy J
    R v Salmon, 2018 ONSC 5670 (CanLII) per Conlan J
    R v Marek, 2016 ABQB 18 (CanLII) per Moreau J
    R v KZ, 2014 ABQB 235 (CanLII), per Hughes J, at para 32
    R v Tyler Perkins, 2013 ONSC 1807 (CanLII) R v Little, 2009 CanLII 41212 (ON SC), per Fuerst J
  4. ↑ eBay Canada Ltd v MNR, 2008 FCA 348 (CanLII), per Evans JA, (the court of appeal stated “The location of the servers was irrelevant because electronically stored information relating to the PowerSellers was readily, lawfully, and instantaneously available in a variety of places to the appellants in Canada.”)

Police Undercover Investigations

See also: Wiretaps

The seizure of historical text messages will not be considered an "interception" requiring a Part VI wiretap warrant.[1]

An undercover peace officer posing as an underage officer does not amount to an intercept.[2]

The fact that the sender was under the mistaken belief as to the identity of the recipient does not amount an "interception".[3]

  1. ↑ R v Didechko, 2015 ABQB 642 (CanLII), per Schutz J
    R v Vader, 2016 ABQB 309 (CanLII), per DRG Thomas J
    R v Rideout, 2016 CanLII 24896 (NL SCTD), per Burrage J
    R v Jones, 2017 SCC 60 (CanLII), per Cote J
    R v Scott, 2015 MBQB 87 (CanLII), per Edmond J
    R v Mills, 2017 NLCA 12 (CanLII), per Welsh JA leave to appeal granted 2017 CanLII 84238 (SCC), per McLachlin CJ
    cf. R v Croft, 2015 ABQB 24 (CanLII), per Burrows J
  2. ↑ R v Allen, 2017 ONSC 1712 (CanLII)
    R v Graff, 2015 ABQB 415 (CanLII), per Neilsen J
    R v Ghotra, [2015] OJ No 7253 (ONSC)(*no CanLII links)
  3. ↑ Mills, supra

Disclosing Passwords

It remains an open question whether it is possible to use a general warrant to compel a person to disclose their device password.[1]

  1. ↑ In Re: Application for a General Warrant and s. 487.02 Assistance Order for Eric Talbo (2017), [1], {{{4}}}

Evidence

Operation of a Computer Device

It should not be necessary to have the investigator to give details on the "basic functions" of computer storage devices. Computer devices are to be treated as appliance and so no need of need of proof is necessary to establish basic functionality.[1]

Extraction Reports

Cell phone extraction reports primarily are classified as "real evidence".[2]

These extraction results do not require independent testing or verification since they simply copy and organize data found on the device without drawing inferences.[3]

Inferring Location From Cellphone Evidence

It is generally accepted that a "call to or from a cell phone will usually register at the tower closest to that cell phone", which is determined by which tower has the strongest signal. This is usually but not always the tower with the closest tower.[4]

Geographic evidence is typically tendered through use of a "propagation map" that "despict[s] the relative coverage areas of cell phone towers located at various places in a geographical area".[5]

There will be times where the closest tower rule will not apply such as where:[6] • the closest tower is at capacity • there is a body of water between the phone and the closest tower • there is a large obstruction between the phone and the closest tower.

Geographic evidence need not be proven by expert testimony.[7]

Given the imperfect and limited strength of geographic evidence, a single text message from a phone may be insufficiently probative to outweigh the prejudicial value of the accused location.[8]

Inferences from Browsing and Search History

Inferences from internet browsing and search history must be considered in the context of all the evidence.[9]

  1. ↑ R v Wonitowy, 2010 SKQB 346 (CanLII), per Dufour J, at para 46
  2. ↑ R v Bernard, 2016 NSSC 358 (CanLII), per Gogan J, at para 26 ("I find that the content of both Exhibits 9 and 10 [full extraction reports] are electronic real evidence.")
  3. ↑ R v Miro, 2016 ONSC 4982 (CanLII), per Fitzpatrick J, at para 39 ("The software and devices he used copied or removed files out of the seized devices and then organized them so D/C Dunhill, and not the software, could draw conclusions about what was present.")
  4. ↑ R v MacGarvie, 2017 ONSC 2834 (CanLII), per Reid J, at para 12
  5. ↑ R v Cyr, 2012 ONCA 919 (CanLII), per Watt JA, at para 86
  6. ↑ R v Hamilton, 2011 ONCA 399 (CanLII), per curiam, at para 239
    MacGarvie, supra, at para 14
  7. ↑ Hamilton, supra, at para 277
  8. ↑ R v Oland, 2015 NBQB 244 (CanLII), per Walsh J, at paras 77 to 78
  9. ↑ R v Howley, 2015 ONSC 7816(*no CanLII links) , at paras 97, 105

Canadian Border Searches

There are two sources of authority for a warrantless search of an electronic device.

Section 99(1)(a) of the Customs Act states in part that:

Examination of goods

99 (1) An officer may

(a) at any time up to the time of release, examine any goods that have been imported and open or cause to be opened any package or container of imported goods and take samples of imported goods in reasonable amounts;


...
R.S., 1985, c. 1 (2nd Supp.), s. 99; 1988, c. 65, s. 79; 2001, c. 25, s. 59; 2017, c. 7, s. 52.

Section 139(1) of the Immigration and Refugee Protection Act states in part that:

Search

139 (1) An officer may search any person seeking to come into Canada and may search their luggage and personal effects and the means of transportation that conveyed the person to Canada if the officer believes on reasonable grounds that the person

(a) has not revealed their identity or has hidden on or about their person documents that are relevant to their admissibility; or
(b) has committed, or possesses documents that may be used in the commission of, an offence referred to in section 117, 118 or 122.


...

– IRPA

"Goods" Under Customs Act

The term "goods" is defined in s. 2(1) of the Customs Act as "conveyances, animals and any document in any form." This includes information found on computers and cellphones.[1]

This can include any data that is in "actual possession of or in accompanying baggage of traveller at time they arrive at border and commence dealings with customs officers", but does not include records stored remotely and accessible from the device.[2]

NB: the definition goods under s. 2 as it relates to electronic devices has been declared invalid with a suspension for one year.[3]

Expectation of Privacy

International travelers have a diminished expectation of privacy while crossing international borders.[4]

Warrantless Search of Phones

It has been found that warrantless searches of phones are permitted at borders.[5]

It is not necessary that the border agent first form reasonable grounds before engaging in such a "routine search" of electronic devices.[6]

  1. ↑ R v Buss, 2014 BCPC 16 (CanLII), per Oulton J
    R v Moroz, 2012 ONSC 5642 (CanLII), per Desotti J
    R v Whittaker, 2010 NBPC 32 (CanLII), per Jackson J
  2. ↑ R v Gibson, 2017 BCPC 237 (CanLII), per Gillespie ACJ
  3. ↑ R v Canfield, 2020 ABCA 383 (CanLII), per curiam
  4. ↑ R v Simmons, 1988 CanLII 12 (SCC), , [1988] 2 SCR 495, per Dickson CJ
  5. ↑ Buss, supra
    Moroz, supra
    Whittaker, supra
    contra Canfield, supra
  6. ↑ R v Sekhon, 2009 BCCA 187 (CanLII), per Ryan JA
    R v Leask, 2008 ONCJ 25 (CanLII), per Nadel J
    See CBSA policy on electronic devices: OB PRG-2015-31
Retrieved from "https://criminalnotebook.ca/index.php?title=Computer-related_Search_Issues&oldid=64278"