Developing a framework for the search and seizure of digital evidence by forensic investigators in South Africa

Abstract

In cases involving digital forensics, lawyers and judges can find themselves reluctant participants when experts are testifying about the high-level technicalities of digital evidence. Litigators often find themselves in areas that are foreign to them being led by experts whose credibility they cannot assess. In addition, litigators often cannot validate their opinions or findings based on their own competencies (Kessler, 2010:2). In 2002, Ball (2002:6) already observed that litigators could have been “damn good” litigators without knowing the inner workings of a computer in 1992, but by 2002 it was a ticking time bomb in practices without a sound knowledge of computers. A sound knowledge of computers also relates to judges, magistrates, law enforcement officers and forensic investigators in their respective fields. Caloyannides (2003:89-91) together with Van Buskkirk and Liu (2006:25) independently stated that a significant number of judges who admit digital evidence also tend to make the unjustifiable leap in automatically assuming that digital evidence is reliable. This unwarranted high level of reliability assigned to digital evidence by the judiciary can be ascribed to their relative lack in relevant technical knowledge. Presiding officers can find themselves being blindly led by experts without a full appreciation of the impact that a small modification or alteration can have on the interpretation and credibility of evidence (Kessler, 2010:10). In South Africa, very few cases were found where the technical aspects of digital evidence were thoroughly tested in courts. The outcomes of some of these cases were not positive for the State in that the search and seizures were set aside due to a number of unique difficulties that digital evidence pose to conventional search and seizure methodology and statutes. This setting aside of search and seizures can be attributed to the ill-advised application of out-dated physical world rules in a digital world (McLain, 2007:1076). This study considered the reasons why search and seizure warrants for digital evidence were set aside internationally and in South African courts. Case law provides parameters on how courts interpret and provide guidance as to the acceptability of mechanisms employed by forensic investigators during search and seizures for obtaining digital evidence. International guidelines were researched to establish how the unique complexities of digital evidence in search and seizures by global law enforcement agencies are managed while the fundamental principles of digital forensics, such as integrity and reliability of evidence, are maintained. The research study proposes a framework for forensic investigators with regard to the search and seizure of digital evidence, which adheres to the parameters of the South African legislative framework. Although the study is limited to search and seizure under auspices of search and seizure warrants in terms of the provisions of the Criminal Procedure Act (51 of 1977), the parameters found can be applied to all regulatory statutes, which mandate the inspection, search or seizure of data − privately, departmentally and civilly. This study, therefore, addressed all law enforcement officers, government inspectors/investigators and fraud investigators as forensic investigators. The proposed framework sets out the grounds for why the seizure of computers containing all data should be permitted and provides a comprehensive approach for forensic investigators to position authorised officers to apply their mind when evaluating if sufficient ground exists to permit the required infringement of the rights of suspects. The framework shows that although search and seizures are permitted, strict measures should be employed to ensure that forensic investigators do not gain access to more data than authorised in terms of search and seizure warrants