The Authenticity of Digital Evidence in Criminal Proof

Digital evidence is any electronic information that has the strength or evidentiary value that is stored, transmitted, extracted, or taken from computers or information networks and the like, in the form of magnetic or electrical fields or pulses that can be collected and analyzed using special technological devices, programs or applications.

Digital evidence is one of the most prominent developments of the modern era in keeping with the scientific and technological revolution in all legal systems, accompanied by the development of criminal thought and the emergence of a new type of crime known as computer crimes.

Digital evidence is of great importance in criminal proceedings due to its particular characteristics, and digital nature, which is not present in traditional sources of evidence since this lacks the ability to translate magnetic and electrical pulses into data and information which can be used as evidence.

As long as proof of the crime is established and attributed to the perpetrator through evidence provided by the police and examined by the Public Prosecutor’s Office for veracity, a judge can be assured that the incident presented to him is done so on the basis of authentic evidence.

The Executive Regulation of the Law for Combating Information Technology Crimes No. 175 of 2018, stipulates several controls that must be met together in totality for digital evidence to possess the same value and weight as material forensic evidence in criminal proceedings, which are as follows:

• The process of collecting, acquiring, extracting or deriving the digital evidence in question is carried out using techniques that guarantee not to change, update, erase or distort writing, data and information, information systems and programs, or electronic supports and others. Including, in particular, Digital Images Hash, Write Blocker, and other similar technologies.

•The digital evidence is relevant to the fact and within the context of the subject matter to be proved or denied, in accordance with the scope of the decision of the investigating body or the competent court.

•To collect, extract, preserve and guard digital evidence by judicial control officers authorized to deal with such evidence, or by specialized experts assigned by investigative or trial bodies; on the condition to be indicated in the records of the seizure, or technical reports, of the type and specifications of the programs, tools, devices and equipment that have been used, and shall document the Hash code and algorithm resulting from the extraction of a similar and identical copy of the original from the digital directory with the recording record or technical inspection report and ensure that the asset continues without tampering with it.

•In the event that the copy of the digital directory or equipment in question cannot be checked for any of the reasons which are found in the check or inspection report.

• That the digital evidence be documented with a record of procedures by the specialist before the examination and analysis operations for it, as well as documenting the place of its seizure, the place of its preservation, the place of dealing with it and its specifications.

Since one of the primary determinants in criminal judgments is the emotional conviction of the criminal judge and his discretion in accepting or excluding evidence according to what is reassuring to him; Failure to comply with any of the aforementioned digital evidence regulations loses the argument in criminal evidence, and it cannot be relied upon as evidence when ruling in the case.

Herein, we refer to one of the matters handled by our firm, where an individual was brought to criminal trial by the Public Prosecutor’s Office because he used a private social media account. With a view to committing the crime described in the indictment (insult and libel involving insulting against honor), based on the report of the technical examination issued by the General Directorate of Information Technology (DGIT) has been submitted.

Maher Milad Iskandar, the lawyer in charge, insisted that the technical examination report was invalid because the actual user of the mobile phone number that was used to send messages was not determined, and those police investigations were not a substitute for that.

The court ruled in favor of acquittal, on the grounds that the technical report was insufficient to affect the degree of conviction.

To find out more, please fill the form or email us at: info@eg.andersen.com

Contact Us