TENDERING DIGITALLY RECORDED EVIDENCE IN CRIMINAL TRIALS

“Nadar Elevating Photography to the Height of an Art”

Honoré Daumier (1808 - 1879)

Many people record videos, still frames and audio recordings in their mobile devices. You can use it in a court case if you follow certain procedural rules in our Evidence Act 1950. If you do not follow the correct procedure, the Court can reject it on the basis of documentary hearsay, relevancy or some other reason depending on the defect. I have done this write-up to show what has worked for me and what has not. If you have not seen one before, or forgotten how they look like, I have also shared some scans of actual 90A certificates that have been exhibited in Court, objected and otherwise. In day to day criminal practice, 90A is generally a mundane thing that is seldom the determining factor of guilt - it seldom proves your case nor saves your client's life. But who knows when that day will come when that one piece of evidence plays a crucial role. In writing this, I have benefitted from trial and error, input from colleagues and a few scholarly articles.   Our discussion revolves around Section 90A of the Evidence Act 1950 for conventional criminal cases. Section 90A operates similarly for civil cases too, except for some aspects such as subsection 90A(7). 

Section 90A is no Big Mystery

There is not much to it. You just need to read what Section 90A says. It is all there, line by line. Just make sure that the witness who fulfils the criteria set out in the provision can testify on facts exactly fulfilling the requirements and you exhibit should be good to go. There is no mystery to Section 90A certs. There is no specific form. Just make sure that your document and your physical and virtual exhibit matches the semantic requirements of the provision. For the overwhelming majority of your cases, this is not one of those provisions that you need to cross-refer to 3 different subparagraphs in multiple legislations. It is all there in one place.

Do you need to call the maker? Who do you call actually?

The whole point of the 90A certificate is so that you need not call the actual original maker to testify. That is in the very first subsection in 90A(1), which ends with, "...whether or not the person tendering the same is the maker of such document or statement". The person who signs the certificate does not need to be the maker. It can be someone else who is not called to court. That person shall state in the Section 90A certificate that they are responsible for the management of the computer and they state that the document (and they should state what document by specific name and not merely by generic description) was produced by that computer in its ordinary use.  The law provides a procedure for you to tender the computer-produced exhibit through someone who is not the maker, such as the investigation officer or bank officer, with the assistance of the Section 90A certificate. It is a bit quaint that Prosecutors still call the maker to Court to testify on oath and still ask them to produce the Section 90A certificates. 

This part of the Court of Appeal judgment in HANAFI MAT HASSAN v PP [2006] 1 MLRA 706 was quoted in at least 6 leading cases:

[23] A careful perusal of s 90A(1) reveals that in order for a document produced by a computer to be admitted in evidence it must have been produced by the computer in the course of its ordinary use. It is therefore a condition precedent to be established before such a document can be admitted in evidence under s 90A(1). The manner of establishing this condition has been prescribed. It can be proved by tendering in evidence a certificate as stipulated by s 90A(2) read with s 90A(3). Once the certificate is tendered in evidence the presumption contained in s 90A(4) is activated to establish that the computer referred to in the certificate was in good working order and was operating properly in all respects throughout the material part of the period during which the document was produced. Section 90A(4) must therefore be given its full effect as it has a significant role to play in the interpretation and application of s 90A. Ordinarily a certificate under s 90A(2)must be tendered in evidence in order to rely on the provisions of s 90A(3) and (4). However, the use of the words "may be proved" in s 90A(2) indicates that the tendering of a certificate is not a mandatory requirement in all cases. In PP v. Chia Leong Foo [2000] 1 MLRH 764; [2000] 6 MLJ 705; [2000] 4 CLJ 649 a plethora of authorities was referred to in ruling that facts to be presumed can, instead, be proved by other admissible evidence which is available. Thus the use of the certificate can be substituted with oral evidence as demonstrated in R v. Shepherd [1993] 1 All ER 225 in dealing with a provision of law similar to s 90A. Needless to say, such oral evidence must have the same effect as in the case of the use of a certificate. It follows that where oral evidence is adduced to establish the requirements of s 90A(1)in lieuof the certificate the presumptions attached to it, in particular, the matters presumed under s 90A(4) must also be proved by oral evidence.

There are publications that distinguish between electronic evidence, digital evidence, computer produced vs computer generated evidence. I am aware of such discussions but am avoiding them here. I wish to focus on tendering only.

The most widely recognised types of digitally recorded evidence are visual (still photos / frames and motion videos) and audio recordings, as well as videos plus audio. These categories are continuously evolving. Sophisticated volumetric holographic displays, 3 dimensional sculpted prints, geospatial locators could predictably fill these categories as they arise more frequently in disputed cases. That is why I would not lose sleep in the debate over computer produced vs computer generated; or electronic evidence vs digital evidence. 10 years ago there were discussions distinguishing them, but as technologies became more intergrated and converged, you hear those discussions less and less and Judges spend less time on them too. It is good that Courts are open to consider more and more categories of devices with the advancement of technology. Perhaps we got the drafting right the first time.

We saw over the last dozen-over years that you do not need a Section 90A certificate just because your exhibit came out of a printer. If your opponent or the Court insists you comply with every part of Section 90A just because your document came out of a computer, please refer to APPROFIT SDN BHD v. KENT SING CONSTRUCTION SDN BHD & ORS [2001] 6 MLRH 749. 20 years on, it is still good law. At paragraph 15 of the said judgment, Richard Malanjum J (as the former Chief Justice then was) opined:

19. On perusal of the said document I am of the view that it may have been printed using a computer. But I do not think it is in the same category as a computer generated document as ordinarily understood. ID-15 is nothing but an invoice that can also be printed by other means. It differs from the document discussed in Gnanasegaran's case in that there it was a statement of accounts. Obviously the contents were generated from the data stored in the computer and that the print was produced in the ordinary use of the said computer. That in my view is the intention of section 90A of the Act. Otherwise it could mean that any document would be admitted regardless of it authenticity or contents if it could be shown that it was printed by a computer. In other words, a document printed by a computer vide a word-processing software would be included. With respect, I do not think section 90A should be extended that far.

Under the Evidence Act 1950, the meaning of document, including a document produced by a computer, is wider than its plain language meaning. A document includes digital video and sound recording. It’s all defined in the Act. I guess even a digitally imprinted tatoo or retina laser etching (like in a spy movie) could fall within this definition.

The law says:

“document” means any matter expressed, described, or howsoever represented, upon any substance, material, thing or article, including any matter embodied in a disc, tape, film, sound track or other device whatsoever, by means of— 

1.     (a)  letters, figures, marks, symbols, signals, signs, or other forms of expression, description, or representation whatsoever; 

2.     (b)  any visual recording (whether of still or moving images); 

3.     (c)  any sound recording, or any electronic, magnetic, mechanical or other recording whatsoever and howsoever made, or any sounds, electronic impulses, or other data whatsoever; 

4.     (d)  a recording, or transmission, over a distance of any matter by any, or any combination, of the means mentioned in paragraph (a), (b) or (c), 

COMPUTER GENERATED vs COMPUTER PRODUCED DOCUMENT?

For the purpose of this writing, I am keeping this to a minimum because people have already commented on this. I am not sure how far this distinction truly helps you in a criminal trial, in a practical way.  “Computer generated document” is not a term used in the Evidence Act 1950 but it is found in some judgments. The correct statutory term is a document produced by a computer. 

The law says:

“computer” means any device for recording, storing, processing, retrieving or producing any information or other matter, or for performing any one or more of those functions, by whatever name or description such device is called; and where two or more computers carry out any one or more of those functions in combination or in succession or otherwise howsoever conjointly, they shall be treated as a single computer;”

This includes your handphone, laptop and pendrive. The law is descriptive and looks at the function and not actual computing power. Would an electric typewriter be considered a computer? After all it is involved in “producing any information or other matter” and contemporary printers even perform “computing” functions and interact with other devices like a computer. All the the important issues on point are contained in just a few cases (Gnanasegaran, Mat Hanafi and Ahmad Najib Aris, the rest build on them).

So you do not need to tender a 90A certificate with every typed and printed letter (with or without signature – but that goes to authentication -- please see Public Prosecutor v Abdul Rahim Abdul Sattar [1989] 2 MLRH 790, Wan Yahya J) or every lakaran kasar that came out of a printer. I'm thankful to my learned friend T Chelvakumar who shared this case with me almost 10 years ago, literally from the next cubicle. I do not mean to digress, but this case is useful for prosecutors and defence counsel. The judgment came about very close to that of Lin Lian Chen, and the latter has enjoyed much fame. But Sattar is also useful tactically.

The heart of the argument is that Section 90A is intended to cover those documents that came out of the computer from a scrambled mass of code, data, values and formulas, like a bank account print out or a share price movement print out. According to the United States National Institute of Justice, "Digital evidence is information stored or transmitted in binary form that may be relied on in court" (https://nij.ojp.gov/digital-evidence-and-forensics).

Computer generated is supposed to mean that through some intervention of some algorhythm or function, coded stuff in a computer system, which untrained human eyes cannot see nor interpret meaningfully, undergo a process whereby such material is recoded and arranged and made out into charts, numbers and words. 

The discussion on computer generated versus computer produced is kind of arbitrary because there is in reality, at one level, no difference between the two, and at another level, there exist many permutations between the two. 

PROVING PHYSICAL EXHIBITS THROUGH DIGITALLY RECORDED PHOTOGRAPHS

It is respectfully submitted that 90A is not a surrogate for proof of chain of evidence or chain of custody of physical exhibits that may change its descriptive characteristics (colour, shape, packaging) on its way from the crime scene to the chemist and back.

90A does not underwrite the actuality of whatever is depicted in the photo. It only underwrites the integrity of the data produced by a computer in a printed form and then exhibited on a piece of A4 paper.

If you use a digital camera to record a picture of fake drugs, fake injuries, fake victims or fake evidence, all that a 90A cert can tell you is that the photo was printed on a piece of paper based on data stored in a computer that was working correctly at the time of the printing. It does not prove the object it captured visually. In my humble opinion, the presumption in 90A works differently from a presumption under Section 399 of the Criminal Procedure Code for example, whereby when service is proved, the analysis of experts may be established. Section 399 relates to proof of the thing analysed itself. Because often, it is the expert’s analysis that proves what the thing is (dangerous drugs, matching DNA). In the context of digital photographs, section 90A only helps prove the conditions surrounding the production of pictures of the thing but it does not prove the thing being pictured. It takes a human being to prove what was photographed. Even if a Section 90A cert stated that “the photograph of a purple rose was produced by a computer in the course of its ordinary use”, the Court is still entitled to inquire into and consider challenges as to whether the thing is actually purple, or actually a rose, or actually a purple rose. This is because it was a human being who described it as a purple rose. Fortunately, in most of the cases I handled involving digital photography evidence, the descriptive terms were file names. Sometimes the 90A certs used descriptive terms such as “gambar tempat kejadian”, which I trust most courts would not assign any probative meaning.

Therefore, I think that the Court should not be satisfied with anything less than actual proof that the raiding team identified the physical drugs in court (usually based on markings). Since the condition of the exhibits change during the course of investigation, the identity of the drugs should be proved based on markings as well as images of the actual drugs in its original form at the time of seizure. Remember that the offence relates to possession or trafficking in dangerous drugs and not markings or packaging. But even if the photos were lost or never recorded, I think the prosecution could still prove the identity of the exhibits — but there needs to be more care in the description of the type, number, condition of the seals, and other aspects. If it helps, the photos recorded by the chemist before, during and after analysis could be produced. The proof must be established by evidence elicited from the mouths of witnesses and not from the lack of cross examination by counsel. As per the term “accepted” used in the judgment of the oft relied case Wong Swee Chin, for criminal cases I do not think that the Court is bound to admit evidence even if it were accepted by the defence.

I am thankful for the discussion with counsel who handled the appeal in ABDUL RAHMAN MOHD v PP [2021] MLRAU 102 decided on 10 May 2021. Encik Nik Mohamed Ikhwan bin Nik Mahamud informed that the matter is presently on appeal to the Federal Court. The Court of Appeal found:

[26] The photographs were taken with a digital camera which stored the images in a memory card. The images were subsequently copied to a compact disc. The images were also printed using a Fujifilm printer. All these details are stated in the two certificates issued under s 90A of the Evidence Act 1950 that was signed by the police photographer. Copies of the photographs were made available to the defence prior to trial. Counsel for the appellant submitted that the s 90Acertificates only proved that the photographs were printed in the ordinary use of the computer and nothing else. He submitted that the police photographer should have been called to identify the photographs. We find no merit in this ground of appeal. Our reasons are as follows.

[27] The head of the raiding team (SP2) was shown the photographs in question when he gave evidence. He identified all the photographs as representing the drugs, the sling bag, the motorcycle and the scene of arrest in relation to the instant case. During cross-examination, no challenge was made by counsel for the appellant that the photographs do not depict the exhibits and the scene of arrest pertaining to this case. In fact, counsel for the appellant at one point during the trial cross-examined SP2 in relation to the location of the motorcycle by relying on the very same photographs. No suggestion was ever made that the photographs were not photographs of the scene of arrest. Similarly, when the investigating officer (SP3) gave evidence that it was he who instructed the police photographer to take the photographs in question, no suggestion was made that the photographs did not depict the exhibits or the scene of arrest.

CONFRONTING 90A CERTIFICATES?

Tracing back the case law to even before Section 90A was legislated, it seems as though the main concern was the integrity of the information / image. That computers are fragile and can be tampered.

From Black’s Law Dictionary, Ninth Edition:

tamper, vb. (16c) 1. To meddle so as to alter (a thing); esp., to make changes that are illegal, corrupting, or perverting. 2. To interfere improperly; to meddle.

I really do not know how a piece of paper that the Koperal Jurufoto typed up and signed himself is accepted as certifying the document is assured to tamper free as to that document describing the reality of the computer printout and the reality of his relationship to it. We just accept it because the law says so. And even when the Section 90A cert has been destroyed in cross examination, the oral testimony is still accepted. I’m sure there have been cases out there where some piece of crucial evidence, the deciding factor of a case, could only be proved through 90A. I have not faced such a case. But due to the rarity, perhaps that is why Parliament saw it fit to allow us to wing it. That being said, like most other statutory presumptions and deeming provisions, it is rebuttable.

Prosecutors tender evidence in accordance with the tried and tested Section 90A certificates day in and day out. On the day of the trial, a police photographer attends court and produces a certificate with faded Royal Malaysia Police logo printed in faded ink. It is faded yet still fresh because he (or his office mate) printed it that morning. The document is creased because it was unfolded out of his pocket. It is signed by himself. It contains several mistakes. It gets the dates and reference numbers wrong or omits them entirely. Experienced counsel do not bother to object because they know courts will admit and mark them anyway. It is just unclassy to pick on the jurufoto who does not know anything about the case. Please stop all this needless overkill cross-examination of the Jurufoto. Jurufoto are good fillers, stopgap witnesses in between important witnesses. Bonus points if there are 3 jurufoto : One for the crime scene (which may be wrong because the IO did not give proper directions to the jurufoto, assuming the IO did actually arrive at the crime scene), one of the exhibits and one of the cadaver or other relevant  subject. But they are actually redundant – the IO can produce the same exhibits and tender the 90A certificate. If the DPP wants to call the IO and tender the 90A, let her do it.

Subsection (3)(b) provides that “A certificate given under subsection (2) shall be admissible in evidence as prima facie proof of all matters stated in it without proof of signature of the person who gave the certificate.” There you have it, it is redundant to call the Jurufoto.

 IOs should prepare all the digital exhibits themselves to minimise “necessary explanations” needed to provide to the court. Preparing the digital exhibits includes proper cataloguing, transferring from the recording device to another platform such as a laptop, transferring it to another storage device such as a pen drive or optical disc, printing it, arranging and gluing the photos on sheets of A4-sized paper, labelling the photos, preparing a cover page with the correct police report number and the correct name of the IO, labelling the photos.  Due to their heavy workload, IOs delegate such task to the jurufoto. Thus in one of my trials, one of the exhibits were a collection of photographs of a crime scene at Lembaga Zakar Selangor (her typo not mine). The intended target was a parking ticket machine but the wrong ticket machine was photographed, presumably because the jurufoto was guided by vague information provided.

 DO NOT GET EXCITED

Sometimes we get a bit excited when we have recorded a conversation, an altercation or a criminal incident. Do not get carried away – as valuable as it is, contemporaneous recording can betray things about you that you may not realise, things that may tarnish the court’s impression of you. The reason for such caution is because of our concern that the recording of your argumentative voice, tone of voice, harsh words used, may work against you.

Believe it, this is the quality of the CCTV recordings in some of our leading shopping complexes. Please note the time stamp. In this case, it did not match the time printed purchase receipt. The only real nexus connecting the Accused to the purchase was the cashier’s testimony that a male of particular ethnicity bought the knife. The Court must be satisfied that any discrepancies are explained and not take fallible testimony at face value. Unless the time stamp is linked to International Atomic Time, the Metrology Institute Malaysia or some impressive legally-binding mechanism.

In court, the IO insisted that the video images clearly showed the Accused, and that the print-out exhibited is unclear. This despite the maker (the forensic analyst herself), who analysed over a thousand cases, having testified that the persons in the video are unidentifiable. The IO alleged he saw the Accused in the security room monitor which he claimed was clearer than these printed images. Should the court accept what he said without being shown what he saw in the security room monitor? Furthermore, prosecutors often must make decisions on cases based on such evidence. They know best.

DON’T DO THIS

A while back, I prosecuted a cheating case where a young man used some cloned credit cards to buy goods from an electrical appliances shop. I had evidence of the entire transaction in the form of the CCTV recording but I did not wish to use it against him because the shop owner fudged the chain of custody. I disclosed the fact that we had CCTV and I was open about its technical problems. We even gave my opponent a copy of the CCTV recording in a compact disc format. My opponent could not resist the opportunity to study the content of my CCTV recording by having it played in view of the court. I objected. The court overruled my objection and allowed the defence counsel to put the CCTV recording forward. He was already adducing evidence through cross examination. I knew exactly the part that would favour my case: at one point of the recording, you could clearly see that the accused signed the payment slip (it was a duplicate customer and merchant’s copy). My opponent had denied his client signed it. As the CCTV rolled on, I could see from my opponent’s posture that he was super confident that I had no evidence and that the CCTV would show that his client did not sign anything. I knew the exact time stamp and I was saying in my heart, “Oh please, please, please ….” 

Because Napoleon said:

 “Never interrupt an enemy when he is making a mistake.”

My opponent was cross examining the complainant with a flourish, almost celebrating.

Then the CCTV video clearly showed his client take up a pen and sign the duplicate slip, then hand the same slip to the cashier. My opponent stopped smiling. Without looking directly at him I knew exactly when he stopped smiling.

Speechless and silent for one full minute. From the corner of my eye I saw him turn and glare at his client. I refrained from any gloating, which would be unethical and unbecoming of crown counsel.

One of my former bosses, Datuk Noorin Badaruddin (now a judge) advised us, never display nor exhort your wins or successes, keep it inside. Never celebrate a win. Hold it in. You can celebrate in your quiet moments or among close friends out of everyone’s earshot.

I was celebrating like it was 1999, but only at the conceptual, digital level of course.

DO YOU NEED TO PROVE THE RELIABILITY AND SECURITY FEATURES OF THE DEVICE?

We may have no real issue with documents produced from the analysis of the Chemistry Department, or printouts from price movement of the capital markets regulator. We may, however, want to scrutinise the integrity and reliability of data from “less conventional” sources, such as amateur video, hacked data, and perhaps conventional but potentially not as well-maintained systems such as the ticketing machine from a passenger bus, or the enter/exit log records of a condominium, or the GPS-synchronised flight path of a flying drone. 

Section 90A is a statutory presumption, which means that the Court is not obliged to accept it at face value even if the Prosecutor has ticked all the boxes in the 90A certificate. There are other laws that use the word “shall”. So the Court could still require more proof or scrutiny if it considers it appropriate. Lawyers should of course not take the 90A certificates for granted — especially for those less conventional or less well-maintained sources mentioned above. The Court should be satisfied that the integrity of the system checks out according to certain standards and there are control mechanisms to ensure the data is accurate and can be cross-referenced to the facts in issue in a meaningful, relevant way. Thus if the time-stamp is off, many types of data become irrelevant because the  completion of almost all crimes are linked to space and time. The Court should need to be satisfied of any explanations for the time lag by evidence from the Prosecutor. In a murder trial, I cross examined the technical staff of a shopping complex, who disclosed that the time-stamp did not match. The Prosecution did not produce any evidence to cover such deficit. Instead they adduced testimony from a cashier on site who described a male of a particular ethnicity who purchased the impugned items. I challenged the evidence in cross examination because there was nothing before the Court to link any male of any ethnicity with the purported time stamp with the man in the dock. This approach I had taken is a very typical challenge that a defence counsel would be expected to mount in comparable scenarios. It’s not like the cashier checked his wrist watch every time a customer made a purchase, to make sure that the time printed on the sales receipt was correct, or that the CCTV recording’s time stamp was likewise correct. 

Asst Prof Dr Duryana Mohamad writes [2]:

Forensic analysis must present accurate result to the court. In order to do so the computer forensic expert must have good skills and knowledge on the computer forensic and also digital forensic science. Their findings will be considered by the court as expert opinion and their role is recognized not only in Malaysia but also other countries. Therefore, forensic examiners must be able to explain in detail about the analysis conducted and learn how to quantify and account for the resulting uncertainties which include the system clock of the computer which represents the time, date and sequence of events. However, determining whether the system clock is accurate can be a challenging task in a network environment.

Dr Ani Munirah Mohamed studied the UK position on the issue of how far the sources of digital information must be authenticated and verified — I am of the view that the Court can still and should scrutinise information sources that are not so conventional or not so well maintained. In her article “ADMISSIBILITY AND AUTHENTICITY OF ELECTRONIC EVIDENCE IN THE COURTS OF MALAYSIA AND UNITED KINGDOM” published in 2019 at page 126 of the International Journal of Law, Government and Communication:

Admittedly, computer evidence can be easily and potentially modified, overwritten or deleted, thus posing challenges where sources of digital information must be authenticated and verified. The authenticity of computer-generated and computer-stored information is potentially open to security vulnerabilities in operating systems and programs that could give rise to threats to the integrity of the digital information.

The susceptibility of digital information to manipulation has been considered by court in the case of Re VeeVinhnee, Debtor American Express Travel Related Services Company, Inc v VeeVinhnee, 336 BR 437 (9th Cir BAP, December 16, 2006). In that case, it was emphasised that when introducing electronic evidence, with emphasis on ‘the need to show the accuracy of the computer in the retention and retrieval of the information at issue.’ The admissibility of computer-generated information (such as log file records) detailing the activities on a computer, network, or other device may be open to challenge when the system generating the information does not have robust security controls (Chaikin, 2006) [1].

Sample 2 of a Section 90A Certificate produced by a police photographer and then exhibited in Court. Were the recording device (camera), storage (memory card) and secondary storage (compact disc) referenced in this certificate? Do they operate together as one singular computer? Did the officer omit any interceding process or device? Does it matter to the appellate court, in the large scheme of things?

Section 90A is no Big Mystery

There is not much to it. You just need to read what Section 90A says. It is all there, line by line. Just make sure that the witness who fulfils the criteria set out in the provision can testify on facts exactly fulfilling the requirements and you exhibit should be good to go. There is no mystery to Section 90A certs. There is no specific form. Just make sure that your document and your physical and virtual exhibit matches the semantic requirements of the provision. For the overwhelming majority of your cases, this is not one of those provisions that you need to cross-refer to 3 different subparagraphs in multiple legislations. It is all there in one place.

Do you need to call the maker? Who do you call actually?

The law provides a procedure for you to tender the computer-produced exhibit through someone who is not the maker, such as the investigation officer or bank officer, with the assistance of the Section 90A certificate. It is a bit quaint that some parties still call the maker to Court to testify on oath and still ask them to produce the Section 90A certificates. One Judge, I believe it was Augustine Paul, remarked it was superfluous to do so. The whole point of the certificate is so that you need not call the actual maker to testify. The person who signs the certificate does not need to be the maker. It can be someone else who is not called to court. That person shall state in the Section 90A certificate that they are responsible for the management of the computer and they state that the document (and they should state what document by specific name and not merely by generic description) was produced by that computer in its ordinary use.  Even though that person who signed the 90A cert was not called to Court, you will still need to prove other things such as the chain of evidence needed to prove the exhibit and its connection to the Accused or to whatever you need to prove.

I repeat again: You still need to prove how the exhibit relates to the Accused or to whatever you need to prove.

So you still need to prove that the thing or person whose image was recorded, sound was digitalised, movement was tracked, weight was measured, etc was in fact relevant to the thing.

There are publications that distinguish between electronic evidence, digital evidence, computer produced vs computer generated evidence. I am aware of such discussions but am avoiding them here. I wish to focus on tendering only.

The most widely recognised types of digitally recorded evidence are visual (still photos / frames and motion videos) and audio recordings, as well as videos plus audio. These categories are continuously evolving. Sophisticated volumetric holographic displays, 3 dimensional sculpted prints, geospatial locators could predictably fill these categories as they arise more frequently in disputed cases. That is why I would not lose sleep in the debate over computer produced vs computer generated; or electronic evidence vs digital evidence. 10 years ago there were discussions distinguishing them, but as technologies became more intergrated and converged, you hear those discussions less and less and Judges spend less time on them too. It is good that Courts are open to consider more and more categories of devices with the advancement of technology. Perhaps we got the drafting right the first time.

We saw over the last dozen-over years that you do not need a Section 90A certificate just because your exhibit came out of a printer. If your opponent or the Court insists you comply with every part of Section 90A just because your document came out of a computer, please refer to APPROFIT SDN BHD v. KENT SING CONSTRUCTION SDN BHD & ORS [2001] 6 MLRH 749. 20 years on, it is still good law. At paragraph 15 of the said judgment, Richard Malanjum J (as the former Chief Justice then was) opined:

19. On perusal of the said document I am of the view that it may have been printed using a computer. But I do not think it is in the same category as a computer generated document as ordinarily understood. ID-15 is nothing but an invoice that can also be printed by other means. It differs from the document discussed in Gnanasegaran's case in that there it was a statement of accounts. Obviously the contents were generated from the data stored in the computer and that the print was produced in the ordinary use of the said computer. That in my view is the intention of section 90A of the Act. Otherwise it could mean that any document would be admitted regardless of it authenticity or contents if it could be shown that it was printed by a computer. In other words, a document printed by a computer vide a word-processing software would be included. With respect, I do not think section 90A should be extended that far.

Under the Evidence Act 1950, the meaning of document, including a document produced by a computer, is wider than its plain language meaning. A document includes digital video and sound recording. It’s all defined in the Act. I guess even a digitally imprinted tatoo or retina laser etching (like in a spy movie) could fall within this definition.

The law says:

“document” means any matter expressed, described, or howsoever represented, upon any substance, material, thing or article, including any matter embodied in a disc, tape, film, sound track or other device whatsoever, by means of— 

1.     (a)  letters, figures, marks, symbols, signals, signs, or other forms of expression, description, or representation whatsoever; 

2.     (b)  any visual recording (whether of still or moving images); 

3.     (c)  any sound recording, or any electronic, magnetic, mechanical or other recording whatsoever and howsoever made, or any sounds, electronic impulses, or other data whatsoever; 

4.     (d)  a recording, or transmission, over a distance of any matter by any, or any combination, of the means mentioned in paragraph (a), (b) or (c), 

COMPUTER GENERATED vs COMPUTER PRODUCED DOCUMENT?

For the purpose of this writing, I am keeping this to a minimum because people have already commented on this. I am not sure how far this distinction truly helps you in a criminal trial, in a practical way.  “Computer generated document” is not a term used in the Evidence Act 1950 but it is found in some judgments. The correct statutory term is a document produced by a computer. 

The law says:

“computer” means any device for recording, storing, processing, retrieving or producing any information or other matter, or for performing any one or more of those functions, by whatever name or description such device is called; and where two or more computers carry out any one or more of those functions in combination or in succession or otherwise howsoever conjointly, they shall be treated as a single computer;”

This includes your handphone, laptop and pendrive. The law is descriptive and looks at the function and not actual computing power. Would an electric typewriter be considered a computer? After all it is involved in “producing any information or other matter” and contemporary printers even perform “computing” functions and interact with other devices like a computer. All the the important issues on point are contained in just a few cases (Gnanasegaran, Mat Hanafi and Ahmad Najib Aris, the rest build on them).

So you do not need to tender a 90A certificate with every typed and printed letter (with or without signature – but that goes to authentication -- please see Public Prosecutor v Abdul Rahim Abdul Sattar [1989] 2 MLRH 790, Wan Yahya J) or every lakaran kasar that came out of a printer. I'm thankful to my learned friend T Chelvakumar who shared this case with me almost 10 years ago, literally from the next cubicle. I do not mean to digress, but this case is useful for prosecutors and defence counsel. The judgment came about very close to that of Lin Lian Chen, and the latter has enjoyed much fame. But Sattar is also useful tactically.

The heart of the argument is that Section 90A is intended to cover those documents that came out of the computer from a scrambled mass of code, data, values and formulas, like a bank account print out or a share price movement print out. According to the United States National Institute of Justice, "Digital evidence is information stored or transmitted in binary form that may be relied on in court" (https://nij.ojp.gov/digital-evidence-and-forensics).

Computer generated is supposed to mean that through some intervention of some algorhythm or function, coded stuff in a computer system, which untrained human eyes cannot see nor interpret meaningfully, undergo a process whereby such material is recoded and arranged and made out into charts, numbers and words. 

The discussion on computer generated versus computer produced is kind of arbitrary because there is in reality, at one level, no difference between the two, and at another level, there exist many permutations between the two. 

PROVING PHYSICAL EXHIBITS THROUGH DIGITALLY RECORDED PHOTOGRAPHS

It is respectfully submitted that 90A is not a surrogate for proof of chain of evidence or chain of custody of physical exhibits that may change its descriptive characteristics (colour, shape, packaging) on its way from the crime scene to the chemist and back.

90A does not underwrite the actuality of whatever is depicted in the photo. It only underwrites the integrity of the data produced by a computer in a printed form and then exhibited on a piece of A4 paper.

If you use a digital camera to record a picture of fake drugs, fake injuries, fake victims or fake evidence, all that a 90A cert can tell you is that the photo was printed on a piece of paper based on data stored in a computer that was working correctly at the time of the printing. It does not prove the object it captured visually. In my humble opinion, the presumption in 90A works differently from a presumption under Section 399 of the Criminal Procedure Code for example, whereby when service is proved, the analysis of experts may be established. Section 399 relates to proof of the thing analysed itself. Because often, it is the expert’s analysis that proves what the thing is (dangerous drugs, matching DNA). In the context of digital photographs, section 90A only helps prove the conditions surrounding the production of pictures of the thing but it does not prove the thing being pictured. It takes a human being to prove what was photographed. Even if a Section 90A cert stated that “the photograph of a purple rose was produced by a computer in the course of its ordinary use”, the Court is still entitled to inquire into and consider challenges as to whether the thing is actually purple, or actually a rose, or actually a purple rose. This is because it was a human being who described it as a purple rose. Fortunately, in most of the cases I handled involving digital photography evidence, the descriptive terms were file names. Sometimes the 90A certs used descriptive terms such as “gambar tempat kejadian”, which I trust most courts would not assign any probative meaning.

Therefore, I think that the Court should not be satisfied with anything less than actual proof that the raiding team identified the physical drugs in court (usually based on markings). Since the condition of the exhibits change during the course of investigation, the identity of the drugs should be proved based on markings as well as images of the actual drugs in its original form at the time of seizure. Remember that the offence relates to possession or trafficking in dangerous drugs and not markings or packaging. But even if the photos were lost or never recorded, I think the prosecution could still prove the identity of the exhibits — but there needs to be more care in the description of the type, number, condition of the seals, and other aspects. If it helps, the photos recorded by the chemist before, during and after analysis could be produced. The proof must be established by evidence elicited from the mouths of witnesses and not from the lack of cross examination by counsel. As per the term “accepted” used in the judgment of the oft relied case Wong Swee Chin, for criminal cases I do not think that the Court is bound to admit evidence even if it were accepted by the defence.

I am thankful for the discussion with counsel who handled the appeal in ABDUL RAHMAN MOHD v PP [2021] MLRAU 102 decided on 10 May 2021. Encik Nik Mohamed Ikhwan bin Nik Mahamud informed that the matter is presently on appeal to the Federal Court. The Court of Appeal found:

[26] The photographs were taken with a digital camera which stored the images in a memory card. The images were subsequently copied to a compact disc. The images were also printed using a Fujifilm printer. All these details are stated in the two certificates issued under s 90A of the Evidence Act 1950 that was signed by the police photographer. Copies of the photographs were made available to the defence prior to trial. Counsel for the appellant submitted that the s 90Acertificates only proved that the photographs were printed in the ordinary use of the computer and nothing else. He submitted that the police photographer should have been called to identify the photographs. We find no merit in this ground of appeal. Our reasons are as follows.

[27] The head of the raiding team (SP2) was shown the photographs in question when he gave evidence. He identified all the photographs as representing the drugs, the sling bag, the motorcycle and the scene of arrest in relation to the instant case. During cross-examination, no challenge was made by counsel for the appellant that the photographs do not depict the exhibits and the scene of arrest pertaining to this case. In fact, counsel for the appellant at one point during the trial cross-examined SP2 in relation to the location of the motorcycle by relying on the very same photographs. No suggestion was ever made that the photographs were not photographs of the scene of arrest. Similarly, when the investigating officer (SP3) gave evidence that it was he who instructed the police photographer to take the photographs in question, no suggestion was made that the photographs did not depict the exhibits or the scene of arrest.

CONFRONTING 90A CERTIFICATES?

Tracing back the case law to even before Section 90A was legislated, it seems as though the main concern was the integrity of the information / image. That computers are fragile and can be tampered.

From Black’s Law Dictionary, Ninth Edition:

tamper, vb. (16c) 1. To meddle so as to alter (a thing); esp., to make changes that are illegal, corrupting, or perverting. 2. To interfere improperly; to meddle.

I really do not know how a piece of paper that the Koperal Jurufoto typed up and signed himself is accepted as certifying the document is assured to tamper free as to that document describing the reality of the computer printout and the reality of his relationship to it. We just accept it because the law says so. And even when the Section 90A cert has been destroyed in cross examination, the oral testimony is still accepted. I’m sure there have been cases out there where some piece of crucial evidence, the deciding factor of a case, could only be proved through 90A. I have not faced such a case. But due to the rarity, perhaps that is why Parliament saw it fit to allow us to wing it. That being said, like most other statutory presumptions and deeming provisions, it is rebuttable.

Prosecutors tender evidence in accordance with the tried and tested Section 90A certificates day in and day out. On the day of the trial, a police photographer attends court and produces a certificate with faded Royal Malaysia Police logo printed in faded ink. It is faded yet still fresh because he (or his office mate) printed it that morning. The document is creased because it was unfolded out of his pocket. It is signed by himself. It contains several mistakes. It gets the dates and reference numbers wrong or omits them entirely. Experienced counsel do not bother to object because they know courts will admit and mark them anyway. It is just unclassy to pick on the jurufoto who does not know anything about the case. Please stop all this needless overkill cross-examination of the Jurufoto. Jurufoto are good fillers, stopgap witnesses in between important witnesses. Bonus points if there are 3 jurufoto : One for the crime scene (which may be wrong because the IO did not give proper directions to the jurufoto, assuming the IO did actually arrive at the crime scene), one of the exhibits and one of the cadaver or other relevant  subject. But they are actually redundant – the IO can produce the same exhibits and tender the 90A certificate. If the DPP wants to call the IO and tender the 90A, let her do it.

Subsection (3)(b) provides that “A certificate given under subsection (2) shall be admissible in evidence as prima facie proof of all matters stated in it without proof of signature of the person who gave the certificate.” There you have it, it is redundant to call the Jurufoto.

 IOs should prepare all the digital exhibits themselves to minimise “necessary explanations” needed to provide to the court. Preparing the digital exhibits includes proper cataloguing, transferring from the recording device to another platform such as a laptop, transferring it to another storage device such as a pen drive or optical disc, printing it, arranging and gluing the photos on sheets of A4-sized paper, labelling the photos, preparing a cover page with the correct police report number and the correct name of the IO, labelling the photos.  Due to their heavy workload, IOs delegate such task to the jurufoto. Thus in one of my trials, one of the exhibits were a collection of photographs of a crime scene at Lembaga Zakar Selangor (her typo not mine). The intended target was a parking ticket machine but the wrong ticket machine was photographed, presumably because the jurufoto was guided by vague information provided.

 DO NOT GET EXCITED

Sometimes we get a bit excited when we have recorded a conversation, an altercation or a criminal incident. Do not get carried away – as valuable as it is, contemporaneous recording can betray things about you that you may not realise, things that may tarnish the court’s impression of you. The reason for such caution is because of our concern that the recording of your argumentative voice, tone of voice, harsh words used, may work against you.

DON’T DO THIS

A while back, I prosecuted a cheating case where a young man used some cloned credit cards to buy goods from an electrical appliances shop. I had evidence of the entire transaction in the form of the CCTV recording but I did not wish to use it against him because the shop owner fudged the chain of custody. I disclosed the fact that we had CCTV and I was open about its technical problems. We even gave my opponent a copy of the CCTV recording in a compact disc format. My opponent could not resist the opportunity to study the content of my CCTV recording by having it played in view of the court. I objected. The court overruled my objection and allowed the defence counsel to put the CCTV recording forward. He was already adducing evidence through cross examination. I knew exactly the part that would favour my case: at one point of the recording, you could clearly see that the accused signed the payment slip (it was a duplicate customer and merchant’s copy). My opponent had denied his client signed it. As the CCTV rolled on, I could see from my opponent’s posture that he was super confident that I had no evidence and that the CCTV would show that his client did not sign anything. I knew the exact time stamp and I was saying in my heart, “Oh please, please, please ….” 

Because Napoleon said:

 “Never interrupt an enemy when he is making a mistake.”

My opponent was cross examining the complainant with a flourish, almost celebrating.

Then the CCTV video clearly showed his client take up a pen and sign the duplicate slip, then hand the same slip to the cashier. My opponent stopped smiling. Without looking directly at him I knew exactly when he stopped smiling.

Speechless and silent for one full minute. From the corner of my eye I saw him turn and glare at his client. I refrained from any gloating, which would be unethical and unbecoming of crown counsel.

One of my former bosses, Datuk Noorin Badaruddin (now a judge) advised us, never display nor exhort your wins or successes, keep it inside. Never celebrate a win. Hold it in. You can celebrate in your quiet moments or among close friends out of everyone’s earshot.

I was celebrating like it was 1999, but only at the conceptual, digital level of course.

DO YOU NEED TO PROVE THE RELIABILITY AND SECURITY FEATURES OF THE DEVICE?

We may have no real issue with documents produced from the analysis of the Chemistry Department, or printouts from price movement of the capital markets regulator. We may, however, want to scrutinise the integrity and reliability of data from “less conventional” sources, such as amateur video, hacked data, and perhaps conventional but potentially not as well-maintained systems such as the ticketing machine from a passenger bus, or the enter/exit log records of a condominium, or the GPS-synchronised flight path of a flying drone. 

Section 90A is a statutory presumption, which means that the Court is not obliged to accept it at face value even if the Prosecutor has ticked all the boxes in the 90A certificate. It MAY presume the fact was proved. There are other laws that use the word “shall”. So the Court could still require more proof or scrutiny if it considers it appropriate. Lawyers should of course not take the 90A certificates for granted — especially for those less conventional or less well-maintained sources mentioned above. The Court should be satisfied that the integrity of the system checks out according to certain standards and there are control mechanisms to ensure the data is accurate and can be cross-referenced to the facts in issue in a meaningful, relevant way. Thus if the time-stamp is off, many types of data become irrelevant because the  completion of almost all crimes are linked to space and time. The Court should need to be satisfied of any explanations for the time lag by evidence from the Prosecutor. In a murder trial, I cross examined the technical staff of a shopping complex, who disclosed that the time-stamp did not match. The Prosecution did not produce any evidence to cover such deficit. Instead they adduced testimony from a cashier on site who described a male of a particular ethnicity who purchased the impugned items. I challenged the evidence in cross examination because there was nothing before the Court to link any male of any ethnicity with the purported time stamp with the man in the dock. This approach I had taken is a very typical challenge that a defence counsel would be expected to mount in comparable scenarios. It’s not like the cashier checked his wrist watch every time a customer made a purchase, to make sure that the time printed on the sales receipt was correct, or that the CCTV recording’s time stamp was likewise correct. 

Asst Prof Dr Duryana Mohamad writes [2]:

Forensic analysis must present accurate result to the court. In order to do so the computer forensic expert must have good skills and knowledge on the computer forensic and also digital forensic science. Their findings will be considered by the court as expert opinion and their role is recognized not only in Malaysia but also other countries. Therefore, forensic examiners must be able to explain in detail about the analysis conducted and learn how to quantify and account for the resulting uncertainties which include the system clock of the computer which represents the time, date and sequence of events. However, determining whether the system clock is accurate can be a challenging task in a network environment.

Dr Ani Munirah Mohamed studied the UK position on the issue of how far the sources of digital information must be authenticated and verified — I am of the view that the Court can still and should scrutinise information sources that are not so conventional or not so well maintained. In her article “ADMISSIBILITY AND AUTHENTICITY OF ELECTRONIC EVIDENCE IN THE COURTS OF MALAYSIA AND UNITED KINGDOM” published in 2019 at page 126 of the International Journal of Law, Government and Communication:

Admittedly, computer evidence can be easily and potentially modified, overwritten or deleted, thus posing challenges where sources of digital information must be authenticated and verified. The authenticity of computer-generated and computer-stored information is potentially open to security vulnerabilities in operating systems and programs that could give rise to threats to the integrity of the digital information.

The susceptibility of digital information to manipulation has been considered by court in the case of Re VeeVinhnee, Debtor American Express Travel Related Services Company, Inc v VeeVinhnee, 336 BR 437 (9th Cir BAP, December 16, 2006). In that case, it was emphasised that when introducing electronic evidence, with emphasis on ‘the need to show the accuracy of the computer in the retention and retrieval of the information at issue.’ The admissibility of computer-generated information (such as log file records) detailing the activities on a computer, network, or other device may be open to challenge when the system generating the information does not have robust security controls (Chaikin, 2006) [1].

Adolph Von Menzel (1886) Adolph Von Menzel graphische Kunst, Verlag Ernst Arnold, Dresden (1920).

PREPARING THE EXHIBITS FOR COURT

The still frames are produced like any other documentary evidence. Because the still frames were printed from a digital recording device (your handphone), you will need to prepare to explain to the court the process that you printed it: 

• That you recorded the frames from your handphone, that your handphone was operating normally, that you transferred the frame to your laptop for the purpose of printing, that your laptop was operating normally, that you printed the same frame from your printer;

• That you are the owner and responsible for the proper functioning of all 3 devices (phone, laptop and printer);

• The frames were produced by the devices in the course of their ordinary use; and

• That you never altered nor tampered with the frames.

Other aspects of the evidence:

• You will need to be prepared to exhibit your phone and laptop used in the printing if required. If you are still using it to make a living, or that it is otherwise something that should not be left in storage of the court or the IO's locker, ask permission to take it back.

• The individuals in the frames, and if it is audio recording, the voices, must be identified.

• The DPP may raise an objection under Section 90A(7) of the Evidence Act 1950, which suggests that documents produced by the accused’s computer are inadmissible in court. My comments on this below.

We should not react to every contradiction. It has to be a head-on, clear contradiction that goes to the truth of the charge. If we pick every contradiction, including the minor ones, the court may be overloaded with information and may not take the defence seriously if too many minor discrepancies are offered.

The High Court in PERKASA JAUHARI SDN BHD v YS CHONG ENTERPRISE SDN BHD [2020] MLRHU 1253 ruled that “[37] At this juncture, it is crucial to note the reminder administered by Siti Norma Yaakob JCA (as she then was) in the Court of Appeal case of GUAN TEIK SDN BHD v HJ MOHD NOOR HJ YAKOB & ORS [2000] 4 MLJ 433; [2000] 4 CLJ 324, that 'when there is a conflict between contemporaneous documentary evidence and self-serving oral evidence, the court should accept the former.”

TIME STAMP AND WEIGHTAGE

Get this right. Make sure you can prove that the time and date is accurate. If it is not, it is ok, you just need to find a way to account for it. This is of course on a case by case basis. The Court is not going to throw out the charge or reject your defence just because the time stamp does not align with reality. A defence counsel must show why this thing being challenged is relevant to disproving the fact in issue. 

The Court may consider the value of the tendered evidence in terms of weight, even if the dates or time does not match (Section 90B). 

Asst Prof Dr Duryana Mohamad wrote in “COMPUTER EVIDENCE: ISSUES AND CHALLENGES IN THE PRESENT AND IN THE FUTURE”: 

“Section 90B focuses on the weight to be attached to a document, or a statement in a document, admitted by s90A. These include the manner and purpose of the creation as well as the accuracy of the document, the interval of time between the occurrence or existence of facts mentioned and also the supply of the information including the real intention of the person who supplies or had custody of the document.” [2]

Therefore a defence counsel needs to really lay the foundations in cross examination to dissect the data recording system in question. This is to support the submissions that the non-alignment of the time stamp is so disconnected with the alleged facts that it becomes irrelevant. Section 11 of the Evidence Act 1950 could help. If the challenge is unsuccessful, the Court may still admit the fact but mark it down on weight, which is not good enough if you are fighting to save your client’s life.

TRANSCRIPT

Evidence of human speech in the video and audio recordings ideally should be transcribed. You should be prepared to pay for this transcript, because this enables the court to objectively read the script. The court can “see” the content of your pendrive / device.

The transcript should be prepared professionally by a neutral party, and is not cheap. 

I have heard that there were courts that required the maker of the transcript to attend court and produce the transcript like any other witness. I have also heard of courts that did not; they adopted it as part and parcel of the court proceedings – i.e. as though the Magistrate heard the recording and typed out the dialogue herself. Call the maker to be on the safe side.

The Court of Appeal decided this year a case that included evidence contained in a recorded conversation. This was a civil case but on the issue of transcripts it referred to 2 criminal cases. This is a long excerpt , but we can extract some general principles that would guide the Magistrate for our case:

LIM PENG HOCK & ANOR v CHUAH PENG SAN & ANOR [2021] MLRAU 31

Sample Transcript of a translated WhatsApp message. The Court interpreter prepared it. What is the value of a translation of a WhatsApp message and what kind of weight could be assigned? (This is not from the Lim Peng Hock case quoted)

The Alleged Recorded Conversations (ID8A & ID8B, ID9, ID10 & ID11 And ID12A & ID12B

[55] The Plaintiff in their submission also referring to the conversation that alleged to have taken place in the 1st defendant's office between the 1st plaintiff and the 1st defendant 28 May 2014 and 4 June 2014 to support 1st plaintiff's evidence regarding the loan RM90,000.00 given by the 1st defendant to 1st plaintiff. The alleged conversations were recorded by the 1st plaintiff on his mobile phone, transferred to pen- drive and later transferred to CD by PW3. The 1st plaintiff also tendered ID8A as the translation and transcription by PW2 of the audio recording on 23 May 2014 and ID8B as the translation and transcription by PW2 of the video recording on 4 June 2014. The 1st plaintiff tendered ID 12A and ID 12B as the 'pen-drives' and ID9 as the CD. The 1st plaintiff also referred to ID10 and ID11 as translation and transcription. The plaintiff is submitting that the recording of the conversation between the 1st defendant and the 1st plaintiff are contained in ID8A and ID 8B (transcript) as ID10 and ID11 (transcripts) are admissible and urged this Court to admit under s 90A of Evidence Act. The trial judge has failed to do so.

[56] The 1st defendant's counsel agreed that it was in the submission. The trial judge has considered the IDDs as inadmissible therefore, is irrelevant. The 1st defendant submitted that ID8A & ID8B, ID9, ID10 & ID11 and ID12A & ID12B remain inadmissible for reasons that the material facts in regards to the purported audio & video recordings on 23 May 2014 & 4 June 2014 were not pleaded in the pleadings. The authenticity and genuineness of the said audio and video recordings are being challenged and therefore they were placed under Disputed Bundle (Part C). The plaintiffs have failed to prove that the recordings are in the condition of authenticated whereby it resulted in pen drives, CD and the transcripts and translations derived therefore remain inadmissible. Failure to produce hand phone is fatal.

[57] The plaintiffs are introducing digital evidence or computer evidence. We agree with the defendants, firstly, the issue is not pleaded. Secondly, under s 90A of the Evidence Act 1950, a document can be any matter expressed upon any substance, which include letters, figures, symbols and other forms of expression on any material ranging from a paper tape, film, store and wood to visual or audio recording and electronic impulses. In this conversation, it was recorded vide a hand phone and subsequently saved in a pen drive and transferred to CD. In Malaysia, digital evidence is admissible as documentary evidence and primary evidence. The admissibility of digital evidence is established under ss 90A, 90B and 90C of the Evidence Act 1950. We cannot view it lightly as to this evidence because digital evidence is also very fragile and could easily be altered. Therefore the issues of authenticity and reliability are important for digital evidence. Thirdly, no evidence was adduced that the document was produced by the computer in the course of the ordinary use. The procedure laid down in the case of Mohd Ali Jaafar v. PP[1998] 1 MLRH 671; [1998] 4 MLJ 210 was not strictly followed and issues of nontampering had not been proven by the plaintiffs.

[58] Applying this principle, it is incumbent upon the Plaintiff to transcribe in the original language (Chinese Language) so that everyone can see the contents. Then, only then a transcript in Malay must be put in. The Audio and Video Recording, Audio and Video Translation & Transcriptions are in English language (Rekod Rayuan, Bhg C, Jilid 4, p 825-929). The IDs are not admissible. The accuracy of the transcript of the said conversation cannot be verified by court and cannot be challenged by 1st defendant when the CD is not played. The law requires the voice of the speaker to be duly identified and since the 1st defendant disputer, strict proof required to determine the identity of the speaker (Court of Appeal, PP v ZUL HASSAN & YANG LAIN [2013] 5 MLRA 567; [2013] 5 MLJ 489; [2013] 7 CLJ 141, at p 159 and 160). Since the issue is not pleaded and the IDs are not admissible, we find there is no error on the part of the trial judge for not admitting the IDs.

The above decision suggested that failure to produce the device in court is fatal. Like many things in our legal regime, this works on a case by case basis. Many courts do not require you to produce the device. Some only want to hear you mention it, its model number, the software used. Some only want you to show it in court but not exhibit/mark it. If you mark it the device, please request permission from the court to release it and return it for use by the police department. Strictly this should not be permitted because it could affect the integrity of the device and there would be changes in the content. But I would not make a big issue out of this. Let's be reasonable about this and choose our battles.

SELECTED PRACTICAL ISSUES

SECTION 90A(7) EVIDENCE ACT 1950

One of my least favourite provisions in the entire statute is this gremlin. Essentially it bars the accused from producing evidence that came out of his device in a criminal trial. I have only faced this issue once in 2008 where I objected to the defence producing something (which I cannot remember -- I think it was a fax print-out that originated from a fax number belonging to the accused) but the court allowed it anyway. It was a case where a car dealership allegedly cheated some investors into lending them money – dressed up as investment with fixed returns.

Some notes on handling this situation below:

1. 90A(7) does not stop the defence from producing such evidence through other witnesses, whether prosecution or defence witnesses.Adduce evidence through the IO using this win-win process. But you need to confirm your client's instructions that there is indeed favourable evidence in the device. Do not use this method if your instructions are insecure. Write to the IO inform them that you have the recordings. Number and tabulate them. Let's call this an intimation. Make sure you have an acknowledgment of receipt from the IO or her boss or someone in her office whose job it is to receive correspondence. If the IO or their office is avoiding/discouraging service, you could do it in open court and notify the court as you do it so that the judge puts it on record (if they want to). But this means that the handover is to the prosecutor, whom you cannot call as a witness and therefore your intimation remains untenderable (at least in the conventional sense of ID and P). Your goal is to elicit the evidence through the IO. It is kind of win-win for the defence because if the IO acts on the intimation and seizes the evidence, you can elicit evidence about its contents by cross examining the IO. If the IO ignores your intimation, just establish through cross examination of the IO that they ignored your intimation and exhibit the acknowledgment copy of your letter to the IO. Foreseeing that the IO would ignore your intimation, address the letter to their immediate boss. The target is to make your letter tender-able through the IO and marked as D. If some random police civilian clerk signed off the acknowledgment, the IO may claim they do not recognise the person and you cannot mark it as even an identified exhibit (ID). Do not assume that the court will allow the intimation to be marked through the IO just because the acknowledgement chop/stamp of the IO or their boss or their office is still wet with ink. It has to be the signature of a human being. I've not yet articulated the point in recent times, but a long while back, several courts accepted my argument where I related it to Section 47 (credit to my seniors at Unit Jenayah Perdagangan). Looking back, I surmise that Section 47 does not deal with identification of documents per se just because it involves human signatures.  That being said, my point is that the IO cannot shy away from identifying their boss's signature or the signature of their boss's PA. Give this a shot, it is win-win or close to it. Unfortunately, in 2 recent cases, I was unsuccessful in achieving the right finding-- an alleged paedophile case and a murder case. Both are reported and I can share the reference on your request, but it is not helpful to explain my point because the grounds do not even consider it "in the right perspective" to borrow a phrase from one of the grounds. The murder case was worse, because the IO even testified that it was not necessary for him to investigate the defence put forward, and the learned Judge let him go. On the other hand, I am presently handling another murder case where in view of the prohibition in Section 90(7), I elicited favourable evidence from the IO who alleged to have studied the entire contents of my client's handphone but only exhibited 15 screenshots. There were potentially hundreds of other screenshots. Because the forensic analyst was not instructed to look at all the contents (but merely extract them), even the said analyst was no help. So I adduced secondary evidence of the contents of my client's handphone which was not printed. I was barred from adducing the contents under Section 90A(7) but I still obtained the evidence I wanted through cross examination because under the provision on secondary evidence, it was established that my client's handphone was in the custody of the IO. Furthermore, I sent the DPP a notice to produce. Please read the combined effect of Section 65(1)(a) and 66 of the Evidence Act 1950. To set this up you still need to issue a Notice to Produce because the proviso in 65(1)(a) provides, "and when after the notice mentioned in section 66 such person does not produce it".  In addition, Ooi Choo Hock v PP decided by the Court of Appeal could be helpful if played right – IO should act on your information and record your statement. If the IO does not, it could amount to an obstruction of justice. Work your way towards a Section 114(g) argument in submissions. Lay all the above one by one. The argument in Ooi Choo Hock does not seem to be, with a lack of a better word, tactically feasible in trial. It is pointless to use it in trial. Save it for appeal.

2.     Despite what Section 90A(7) says, I would still give it a go. Try some of these arguments.

• If the recording includes what the accused says or does, it comprises part of his statement.

• Lin Lian Chen. Go on the principle of the right and duty of the defence to present its case. No need to emphasise the principle that the IO could tender it because he has custody of the exhibit – what if your IO (tactically) refused to seize the pen-drive (refer to my points above -- but the situation is distinguishable from Ooi Choo Hock).

• There are many cases on the effect of failure to investigate. Consider Lee Kwon Woh v PP [2009] 2 MLRA 286 and Chu Tak Fai v PP [2006] 2 MLRA 317.

If you have any other experience on how to deal with this issue, or relevant precedents on point, please let me know and if it worked I will acknowledge you. Thank you.

ADMISSION OF PHOTOS OF HANDPHONE DISPLAYS AND SCREENSHOTS

Documents are primary evidence. To prove documents, you need to produce the actual document. In the context of digital evidence from a device that means showing the court the device, with display turned on and directed to the relevant text message or image or sound or information, in court. The witness tendering such evidence needs to prove that what was displayed on the date of testimony, was the same thing displayed at the material time. I do not think it is a simple matter of saying that the Court can presume that whatever displayed on the date of trial was the same thing that was displayed at the material time. I do not think the presumption under Section 114 of the Evidence Act 1950 stretches that far. We need a clear provision from Parliament to permit that.

HANDLING DIGITAL EVIDENCE BY THE IO

Chain of Evidence

It goes without saying that the chain of evidence remains an important issue of proof even for documents produced by a computer. In this context, I do not mean chain of evidence like that of a drugs case where even the storekeeper is called to prove that the exhibit brought to Court was the exhibit submitted by the IO (notwithstanding case law that chain of evidence is most important up to the Chemist and less so afterwards). I also do not refer to the chain of evidence of that piece of paper that came out of the maker’s printer. What I meant is the chain of evidence to prove the information at the time that it is captured by the system all the way until it is represented on the sheet of A4 paper. All those stages in between need to be in order. Section 90A itself does not state that the Prosecution needs to prove all these unknowable stages. Section 90A seems to focus on the role of the person tendering the A4 piece of paper and how he is situated with the original source of information. The Prosecution can actually wing it safely with a properly drafted Section 90A cert or written statement that ticks all the boxes of 90A. It can be done without the Court or defence knowing what actually happened behind the scenes (or backroom, say the technically inclined). The Defence often does not have the means to have the computer system independently tested by a third party forensics analyst. Who knows, perhaps someday a determined, financially strong Accused is permitted by a permissive Court, to submit the computer system to a reputable, independent lab that exposes the true reliability of the facts purported in that 90A cert. This is not one of those things in which the defence counsel can rely on a hunch. You really need to show the Court a basis for doing this. 

The Court, Prosecutors and Defence Counsel should be careful that the Section 90A certificate describes the device, processes and output properly and the time and date all line up logically. Sometimes the IO or the maker of the document prepared a 90A cert based on their own non-legal understanding, thus omitting certain parts of the chain of evidence. In my view this is repairable by oral testimony but it must be from the right witness. The maker runs into trouble if the production of the document involves multiple input from multiple human users. Just because a fact in the chain of evidence was omitted in the 90A cert does not mean that the Prosecution needs to call every witness in that chain. As mentioned earlier, the thinking behind section 90A is to assist the Prosecution with legal fiction, which is taken that one person can certify multiple devices working in concert. We know that in real life, this is sometimes true and sometimes false. But we accept it because the law accepts it. I would suggest, unless the omission is glaring or if you have evidence that can contradict the 90A cert, learned defence counsel need not expend too much time on this issue of chain of evidence. If the witness’s testimony ticks the boxes spelled out in 90A, leave him alone. Even if they faked it all, you would not have anything better to catch them with — so by all means attack if you have something substantial with which to challenge the witness or else the Court may lose patience with you.

90A Certificate does not Substitute Technical Expertise

Due to the realities and difficulties in preserving digital evidence in criminal cases, IOs have attempted several methods of ensuring the evidence, i.e. the content of such text messages, are transferred to a medium that can be appended into the investigation papers and exhibited in Court. They do this by transferring the contents into data storage such as an optical disc, flash drive and/or printing to paper. 90A needs to be complied for each layer of transfer, not just once. Whenever a specialised software is used, you need to establish the expertise of the user to so that the court is comforted that he knew what he was doing. Even if all it took was to click a button. For example, if the data is “vacuumed” using a software such as the so-called XRY (I am merely quoting what a Digital Forensic Analyst stated, without the benefit of the technical knowledge myself) and emplaced into a DVD, then that requires a 90A plus expertise. More on XRY below. So 90A does not replace expertise. Maybe someday when everyone is using home versions of XRY, the courts will realise that no expertise is required. Like how lift operators we once an urban profession. When the data from a DVD is printed to a sheet of A4 paper for court, that should require another separate exercise of 90A. This is because multiple devices, each one characterised as a “computer” under the Act, are used and not just one device. My view is the party intending to establish compliance of 90A should prove its compliance at each layer of transfer. This is notwithstanding the law itself treats multiple devices working together as one singular computer — may I reiterate the excerpt from the last limb of the definition of “computer” under Section 3 of the Evidence Act 1950:

"and where two or more computers carry out any one or more of those functions in combination or in succession or otherwise howsoever conjointly, they shall be treated as a single computer".

Imagine how handy it would be to have a portable “Section 90A” machine that extracts the contents of a device (either remotely by something like Bluetooth or a physical connector), authenticate it according to a legal standard, and print it into sheets of paper in one continuous, uninterrupted process, together with something similar to a QR code that can confirm the authenticity, and print the 90A cert too.

This is what the High Court found in  ARIFIN (SPRM) v DRAHMAN [2016] MLRHU 1194: 

“[24]In the 4th ground of appeal, the Appellant contended that the learned Sessions Court Judge erred in law and in fact when he decided that the Appellant's failure to establish that PW5 is an expert is fatal.

[25] PW5 testified that his scope of duty is to conduct a forensic investigation on hand phones, SIM cards and memory cards. He also confirmed that he had analyzed a Sony Ericson hand phone [Exh P4] which was handed to him for analysis and his finding was reduced into a report [Exh P5]. PW5 testified that he used XRY to analyze the SIM card and the hand phone.

[26] This Court finds from the Notes of Proceedings, that the Appellant had failed to establish that PW5 had the necessary experience or the expertise in using forensic tools like XRY in his analysis on the SIM card and the hand phone and/or was an expert in this particular field. Thus the Appellant had failed to establish the requisite foundation for the admission of PW5's expert opinion evidence pursuant to s 45 of the Evidence Act 1950.”

(More on extraction methods below, specifically what is called XRY)

In September 2021, I conducted the defence of a murder accused, where one of the relevant pieces of evidence was the phone text communication between two lovers. In my objection, I submitted that the screenshots should be made to comply with Section 90A because the screenshot images of the WhatsApp dialogue, printed on sheets of paper by the IO, were basically secondary evidence of what was displayed on the screen of the phone, among other things.

The learned Judicial Commissioner informed the parties from the Bench that for drugs cases, Her Ladyship had admitted photographs taken of messages displayed on the screen of handphones. That meant, screen prints from a police camera that was aimed on an activated handphone with the display lit. I had some comments about that, but defence was called anyway for murder. We will see what kind of ruling was arrived at in the grounds.

I recall a few general crimes cases I prosecuted where, somehow the court admitted photos of handphones that displayed SMS texts. They were not crucial evidence but I do not know how they got in but they did. This happens because the police failed to preserve the evidence with more forensically-acceptable techniques. 

In the above two examples, photographing whatever was displayed on a handphone at any one time should be accepted as no more than a photograph by a jurufoto at a particular point in time of a display and no more than that. It should not be accepted as proof of contents, and it should not be allowed to circumvent the rules prescribed under Section 90A of the Evidence Act 1950. The original document was the display itself, so that means that a photo on top of the handphone is secondary evidence of the original. 

I believe the digital forensics team at the Malaysia Communications and Multimedia Commission have more reliable, resilient, objective and untamperable methods of preserving and presenting court-ready evidence, with the use of special software and tools. The Court, especially the criminal courts, should not accept anything less than this.

XRY and other (Selective?) Extraction Methods

The process of extracting information from a storage like compact disc, flash memory, cloud, requires the witness to establish how he did it to ensure that the evidence is the right evidence (relevant) and not the wrong evidence (irrelevant).

In all fairness, I have seen many investigations properly their forensic analyst correctly for trial. But in these paragraphs below I wish to highlight a curious practice that helps protect the investigation.

Sometimes IOs refer devices to police forensics analysts to extract contents or to transfer them to other more tenderable mediums such as compact discs. Usually the IO then prints it to renderable A4 size sheets of paper. As mentioned earlier, if it is audio speech it should be transcribed.

I found it interesting that in a few cases I handled, the forensic analyst is only instructed to transfer the content to another medium but not analyse it. Analysis is omitted from the request form issued by the IO to the analyst. Please study this request form -- it is analogous to a Pol 31 and sometimes reveals blindspots in the investigation. It is made to appear as though no forensic expertise is required to do this. They plug it into what they call a software called XRY and it ‘vacuums’ the contents and transfers it to a device which then burns it into a CD. Cleverly the analyst is not asked to even peek at its contents to make sure they are not just blank white pictures, blank white videos or white noise audio. So when we cross examine the analyst we just get blank white stares. This curious practice enables them to avoid having to ID the contents. Tactically, it means one less witness for the prosecutor to ensure consistency and one less witness for the defence counsel to look for contradictions. More interesting is, the IO does not even use the contents of that CD for investigation. That’s what they say so we take it at face value. He just prints the contents of the device using unscientific methods such as taking photos of the handphone display or printing the contents directly from his personal laptop. So what is the point of having referred the exhibits to the forensic analyst? Why call the forensic analyst to testify? 

CONCLUSION

1.     Digitally recorded evidence is sexy but it still requires the same care and scrutiny as any other evidence. Fight the urge to present a dramatic audio recording without studying it – to avoid any backfire against you.

2.     Choose your battles. You need not object to every single non-compliance in the certificate. 

Word of Thanks

In transferring my thoughts to this write up, I am grateful to all my seniors in Unit Jenayah Perdagangan and Unit Rayuan in the former C3 and C7 respectively who taught me how to use these provisions, and all those trial judges who told me how not to. I will never forget those times Tuan Deva unexpectedly summoned me into his room as I walked past with his booming voice and told me what 90A was about. Tuan Awang generously and ably deconstructed the provision for me and tested me.

[1] Mohamad, A. M. (2019). Admissibility and Authenticity of Electronic Evidence in the Courts of Malaysia and United Kingdom. International Journal of Law, Government and Communication, 4(15), 121-129.

[2] DB Mohamed (2011). COMPUTER EVIDENCE: ISSUES AND CHALLENGES IN THE PRESENT AND IN THE FUTURE. Submitted to the Sixth UUM International Legal Conference, 2011. http://irep.iium.edu.my/8122/2/full_paper_submitted_for_6th_UUM_ILC_2011_Dr_Duryana_Mohamed_29th_July_2011.pdf