Developing a framework for the search and seizure of digital evidence by forensic investigators in South Africa
Loading...
Date
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
North-West University (South Africa) , Potchefstroom Campus
Abstract
In cases involving digital forensics, lawyers and judges can find themselves reluctant
participants when experts are testifying about the high-level technicalities of digital evidence.
Litigators often find themselves in areas that are foreign to them being led by experts whose
credibility they cannot assess. In addition, litigators often cannot validate their opinions or
findings based on their own competencies (Kessler, 2010:2).
In 2002, Ball (2002:6) already observed that litigators could have been “damn good” litigators
without knowing the inner workings of a computer in 1992, but by 2002 it was a ticking time
bomb in practices without a sound knowledge of computers. A sound knowledge of computers
also relates to judges, magistrates, law enforcement officers and forensic investigators in their
respective fields.
Caloyannides (2003:89-91) together with Van Buskkirk and Liu (2006:25) independently stated
that a significant number of judges who admit digital evidence also tend to make the
unjustifiable leap in automatically assuming that digital evidence is reliable. This unwarranted
high level of reliability assigned to digital evidence by the judiciary can be ascribed to their
relative lack in relevant technical knowledge. Presiding officers can find themselves being
blindly led by experts without a full appreciation of the impact that a small modification or
alteration can have on the interpretation and credibility of evidence (Kessler, 2010:10).
In South Africa, very few cases were found where the technical aspects of digital evidence were
thoroughly tested in courts. The outcomes of some of these cases were not positive for the
State in that the search and seizures were set aside due to a number of unique difficulties that
digital evidence pose to conventional search and seizure methodology and statutes. This setting
aside of search and seizures can be attributed to the ill-advised application of out-dated
physical world rules in a digital world (McLain, 2007:1076).
This study considered the reasons why search and seizure warrants for digital evidence were
set aside internationally and in South African courts. Case law provides parameters on how
courts interpret and provide guidance as to the acceptability of mechanisms employed by
forensic investigators during search and seizures for obtaining digital evidence.
International guidelines were researched to establish how the unique complexities of digital
evidence in search and seizures by global law enforcement agencies are managed while the
fundamental principles of digital forensics, such as integrity and reliability of evidence, are
maintained. The research study proposes a framework for forensic investigators with regard to the search
and seizure of digital evidence, which adheres to the parameters of the South African legislative
framework. Although the study is limited to search and seizure under auspices of search and
seizure warrants in terms of the provisions of the Criminal Procedure Act (51 of 1977), the
parameters found can be applied to all regulatory statutes, which mandate the inspection,
search or seizure of data − privately, departmentally and civilly. This study, therefore, addressed
all law enforcement officers, government inspectors/investigators and fraud investigators as
forensic investigators.
The proposed framework sets out the grounds for why the seizure of computers containing all
data should be permitted and provides a comprehensive approach for forensic investigators to
position authorised officers to apply their mind when evaluating if sufficient ground exists to
permit the required infringement of the rights of suspects. The framework shows that although
search and seizures are permitted, strict measures should be employed to ensure that forensic
investigators do not gain access to more data than authorised in terms of search and seizure
warrants
Description
MCom (Forensic Accountancy), North-West University, Potchefstroom Campus, 2017