4.1 The aim of this chapter is to illustrate how software code can affect the examination and introduction of electronic evidence in legal proceedings. The topic is considered in the context of software code as the ‘witness’. It is important to understand how software can affect an assessment of the truth in any given set of facts, and software code can be written deliberately to deceive.¹ Failure to appreciate this can lead to unfairness in legal proceedings and incorrect decisions.

4.2 A digital computer is like a mechanical device, where switches replace gears, and the switches are miniaturized. However, it is impossible to build a mechanical device that reflects the functionality of a modern digital computer, because such a device would require both a machine built on a colossal scale and the use of materials beyond the strengths or machine tolerances of what is possible to manufacture mechanically. To complete the picture, physical digital devices, as indicated in Chapter 1, cannot work without the software written by programmers and the input by users.

4.3 It follows that electronic evidence could be treated as a joint statement that is:

4.4 For this reason, there is an argument, as proposed by Steven W. Teppler, that all forms of evidence in digital form remain hearsay,¹ because software code conveys information.² Teppler³ gives us the example of United States Patent Office Number 5,619,571, which includes some uncompiled source code that contains the following lines of code in the application:

4.5 What this comment indicates is an acknowledgment of the possibility of a weakness in the software code that has been written, not that the software code is or will be at fault. In this regard, it is useful to understand more fully the nature of source code. For instance, Svein Willassen explains the complex nature of software as follows:

4.6 In the Australian case of Computer Edge Pty Limited v Apple Computer Inc,¹ Gibbs CJ offered the following explanation of the various parts of a computer program:

4.7 The term ‘source code’ is also the subject of a commentary in the case of Ibcos Computers Ltd v Barclays Mercantile Highland Finance Ltd¹ by Jacob J:

4.8 There is a distinction between the code written by programmers that provides instructions to the computer and the comments made by the programmer writing the code. If the software code is inaccurate, or if an instruction written by a programmer acts on information or a further instruction that is incorrect, then the code will probably fail to instruct the computer in the way the programmer intended. However, comments by a programmer that do not form part of the instructions cannot necessarily be considered to be part of the code.

The classification of digital data

4.9 The starting point for this analysis is an attempt at classifying software code as digital data. To this end, Professor Ormerod, the commentator in a report on the case of R. v Skinner (Philip),¹ suggested there were three questions to consider for every type of digital data:

4.10 In Elf Caledonia Ltd v London Bridge Engineering Ltd, Lord Caplan noted the following:

4.11 Based on this categorization, Professor Ormerod noted that some types of computer-generated representations do not infringe the hearsay rule.¹ If a computer carries out the instructions of the program that has been written by humans to create such data, it may be right to suggest that such data are probably accurate without the need to test whether they are correct. But if the time as noted by a clock on a camera linked to an ATM is to be offered into evidence to link the accused to the murder of the person whose card was used in the ATM, then the time as data will have to be adduced as to its truth, as in the case of Liser v Smith,² and there will be a need to validate the clock, and verify the time and date set by a human being.³

4.12 To the same end, Professor Smith distinguished between the types of representation that the code in a device can make,¹ and argued that where the computer is instructed to perform certain functions, many of which are performed in a mechanical way (such as the addition of the time and date on an email), in such circumstances the computer is producing real evidence, not hearsay. In illustrating the point he was making, Professor Smith gave a number of examples where evidence is not hearsay.² One example was that of Six’s thermometer (commonly known as a maximum minimum thermometer), which he referred to as an instrument and not a machine. This is correct. The thermometer provides three readings: the current temperature, and the highest and the lowest temperatures reached since it was last reset. A human being can give evidence of his observation of the precise location of the mercury against the scale at a given time and date. The witness might be challenged as to the truthfulness of his recollection without calling into question the accuracy of the instrument. Such evidence will not be hearsay. Alternatively, the precision of the scale on the thermometer might be open to scrutiny, in which case it will be necessary to have the instrument tested by an appropriately qualified expert.³

4.13 Further examples considered by Professor Smith included a camera that records an image, a tape recorder that records sound and a radar speedmeter that records the speed of a vehicle. In 1981, each of these machines was mechanical in construction, with the exception of the radar speedmeter, which also incorporated components that were instruments. None of the examples involved devices controlled by software written by human beings. Although it is possible to alter the image from a camera or the sound from a tape recording, or for a human being to lie about the reading from a radar speedmeter, nevertheless the evidence from such devices would not be hearsay.

4.14 In respect of software, Professor Smith indicated that a programmer may make mistakes (errors are common, for which see Chapter 5 on ‘reliability’), but mistakes can also be made when deciding the scale on a thermometer. He went on to suggest that ‘[t]‌his consideration goes to weight rather than admissibility. In any event it certainly has nothing to do with the hearsay rule.’¹

4.15 Professor Seng proposed an analysis in 1997:

4.16 Steven Teppler also accepted that it is possible to categorize data into three types, treating digital data as hearsay:

4.17 Teppler has also suggested that a ‘fourth potential category, for which there has been no judicial analysis, has recently emerged as a consequence of computer programs that “listen and respond” to questions in natural language and with a “voice” that closely mimics a “real” human’.¹ Arguably, this category fits into category three, for which see below.

4.18 The authors of Archbold have also divided digital data into three categories:

4.19 It is proposed that the three categories outlined by Professor Seng, Steven Teppler and the authors of Archbold be slightly amended to read as follows:

Each of these categories is discussed below.

Category 1: Content written by one or more people

4.20 Records of electronic content that are written by one or more people include email messages, word processing files and instant messages. Unless the author of the software has included instructions to alter the content of the text that has been typed in by a human, the only function of the device is to store the information that has been input by the human being. However, Teppler suggests that all computer-generated information is hearsay of some sort, and that the data generated by an email program, for instance, remains hearsay because:

4.21 Conceptually this must be right, but the status of the instructions issued by the software code at the material time is rarely relevant. This category, artificial as it might appear to be, enables content that was input by the maker of the statement to be separated from content made by the author of the software program – in the same way that the printed notepaper with the name of the person or organization, together with other information such as address and telephone number, is created by the printer, but is distinct from the content of the letter.

4.22 The content of the software program will not be relevant unless there is a dispute as to what data were entered, when and where they were entered, and by whom. In such circumstances, the relevant witnesses can be called to give oral evidence to determine the truth, failing which a suitably qualified digital evidence practitioner might be called to give evidence about the metadata associated with the document to help ascertain answers to these technical questions.

4.23 By way of example, consider whether a letter typed into a computer is a document produced by a computer. Professor Smith took the view that if the human author printed the document and then read the contents to verify the text, the author authenticates the text. Given this set of facts, the computer is a mere tool. Where the author does not read the printout, the document remains computer output.¹ Professor Seng suggests that ‘it is difficult to see how reading what is clearly a computer-produced document converts it into one not produced by a computer. The printout remains clearly a document produced by a computer operated as a data storage device.’² Professor Smith indicates that the person can authenticate the text after it has been printed. This does not mean that the act of authentication takes away the fact that the document was created on and remains stored on the device. This distinction can be important, as in the case of electronic wills. The court must establish whether, in the absence of the testator authenticating the will, the testator actually wrote the will and intended it to be their last will and testament. In such cases, it might also be necessary to give consideration to both the content written by the human and the software code that makes up the metadata.

4.24 Professor Tapper pointed out that computers include such facilities as spell checkers, calculators and automatic paragraph numbering, among other tools. This suggests that a word file (such as a letter) is processed computer output.¹ In his discussion, Professor Smith also discussed the same document being produced by a human typing on a typewriter. If the text – for the sake of illustration, a letter – is written by hand, or typed on a typewriter, or typed into a computer, the resultant content will be the same, other than the type of print, typeface and such like used, although the author might cause the data to remain stored on the device if it was a computer.² The person writing the letter by hand or on a typewriter might use a dictionary to check their spelling in the same way that spelling can be checked on a computer using the spell checker. Whether the letter is written by hand, typed on a typewriter or on a computer, the letter will then be complete when printed (in the case of the computer) on paper. The method used to record words on paper must be irrelevant, providing that the only evidence to be relied upon is the text that is recorded on the paper. If other factors are in issue, such as the purported author of the document, then clearly an examination of the digital data might be instructive. Professor Seng takes issue with Professor Smith’s characterization that the evidential quality of a letter changes immediately when a recipient reads it, without taking into account any characterization of its source. In such a case, where the computer is behaving as a storage device, the rebuttable presumption is that the code operating to make it behave as such is reliable, and issues as to authentication of this code do not enter the evidential analysis, generally speaking. But there can be other software errors, for which see Chapter 5 on the ‘reliability’ of computers.

4.25 The Law Commission in their report¹ noted that the ‘present law draws a distinction according to whether the statement consists of, or is based upon, only what the machine itself has observed; or whether it incorporates, or is based upon, information supplied by a human being’.² It was further noted that the hearsay rule did not apply to tapes, films or photographs, or to documents produced by machines that automatically record an event or circumstance.³ This was because the court is not being asked to accept the truth of an assertion made by any person, and the evidence is real evidence, not hearsay.

4.26 That humans generally have control over a computer system is demonstrated in the case of Ferguson v British Gas Trading Limited,¹ in which the members of the Court of Appeal rejected arguments submitted that letters sent out automatically by a computer were not the fault of British Gas. Computers only work on instructions given to them, and it followed that a person in British Gas, or authorized by British Gas, must have instructed the computer to initiate the letters in question. In this case, British Gas sent letters to the claimant that the court held were capable of amounting to unlawful harassment contrary to the Protection from Harassment Act 1997. In the words of Jacob LJ: ‘British Gas says it has done nothing wrong; that it is perfectly all right for it to treat consumers in this way, at least if it is all just done by computer.’² Jacob LJ went on to indicate that he did not follow the reasoning of Martin Porter QC, counsel for British Gas, that ‘[as] the correspondence was computer generated … [the harassed victim] should not have taken it as seriously as if it had come from an individual’.³ Jacob LJ noted that computers operate on instructions given to them: ‘real people are responsible for programming and entering material into the computer. It is British Gas’s system which, at the very least, allowed the impugned conduct to happen.’⁴ Likewise, Sedley LJ roundly rejected the pathetic excuse offered by British Gas:

Category 2: Records generated by the software that have not had any input from a human

4.27 Examples of records generated by software controlling a computer without any input from a human include computer data logs for the purposes of tracking activity and diagnostics, number plate recognition software,¹ automatic connections made by telephone switches and the records of such calls made for billing purposes,² records of ATM transactions, machine translation,³ and objects connected to the Internet, known as Internet of Things.⁴ In one case, Antonio Boparan Singh was convicted of dangerous driving. Part of the evidence adduced by the prosecution included evidence from the event data recorder (EDR) – a device fitted to the airbag system of his vehicle. The EDR established that a force equivalent to 42 mph was lost in one-fifth of a second in the crash. This information helped the police to put Singh’s speed at around 72 mph.⁵

4.28 It does not follow that the automatic communications that occur between software code are accurate. For instance, the records from a telephone service provider might be admitted to show that calls were made and received,¹ but it does not follow that the same records can be used as a basis for showing that a SIM card used in a mobile telephone, and purportedly its user,² were at a particular location or moved from location to location.³

Category 3: Records comprising a mix of human input and calculations generated by software

4.29 An example of records comprising a mix of human input and calculations generated by software is that of a financial spreadsheet program that contains human statements (input to the spreadsheet program) and computer processing (mathematical calculations performed by the spreadsheet program). From an evidential point of view, the issue is whether the person or the software created the content of the record, and how much of the content was created by the software and how much by the human. It is possible that the quality of the software acts to undermine the authenticity of the data, which may in turn affect the truth of the statement tendered in evidence. The algorithms in spreadsheet programs are good examples of where the software code affects the truth of the statement. For a more detailed analysis, see Chapter 6 on authentication.

4.30 Professor Pattenden suggests that ‘most representations of fact require human intervention at some point’,¹ which must be right. The Law Commission report also indicated:

4.31 This comment distinguishes between information fed into a machine (the word ‘computer’ is not used, but the word ‘machine’ is presumably meant to include a computer or computer-like device) and the instructions contained in software code written by human beings that are essential for a device to work. Where a person inputs information into a computer, and that information is to be relied upon as to the truth of the statement, then the person should give oral evidence of this action. In contrast, the software code that might be used to transform the raw data into information that can be used is not necessarily relevant, depending on the purpose for which it is adduced in evidence. To this end, the Law Commission¹ compared the cases of R v Wood (Stanley William)² and R v Coventry Justices, Ex p Bullard.³ In Wood, the evidence of the analysis by a computer of tests carried out by chemists was not considered to be hearsay because the chemists gave oral evidence of the results of the tests. The calculations performed by the computer were carried out under the instructions of the person who wrote the software code. The chemists were able to give oral evidence of the results of the tests they performed, but the computer software carried out the actual analysis. The calculations relied upon the software code, which was created by a human being (in this case, a Mr Kellie). The software analysed the data in accordance with the instructions given to it by Mr Kellie. The computer was not capable of analysing the data without the software code. The chemists gave oral evidence of the results of the computer program. This means that the truth of the content of the output of the computer was predicated upon the software code created by Mr Kellie.

4.32 In comparison, the computer printout in R v Coventry Justices, Ex p Bullard included a statement that a person was in arrears with his community charge. This was held to be inadmissible hearsay because the content of the printout contained information that had been put into the computer by a human, and the printout had not been properly proved. The Law Commission, agreeing with the result, would propose a similar analysis as follows:

4.33 In Mehesz v Redman,¹ Zelling J concluded that the output of an auto-lab data analyser was hearsay, given that the analysis relied on software where the writer of the software had not been called, and where modifications had been made but the person responsible for the modifications had not been called either. A similar decision was made in Holt v Auckland City Council,² where evidence of the analysis of the amount of alcohol in a blood sample was excluded by the New Zealand Court of Appeal because the truth of the statement tendered was predicated upon the software code written by a programmer who was not called to give evidence, which meant there was a gap in the continuity of proof. In contrast, in Wood, the oral evidence of the results of the tests were read out by the chemists from printouts from the computer (which was real evidence), and if the results were to be challenged for their accuracy, then the integrity of the software program might need to be tested.

4.34 The instructions written by a human in the form of software code can, depending on the circumstances, be just that: instructions to the machine to perform a particular task. This is illustrated in the case of Maynard.¹ An item of software, called a trace, had been written to ascertain whether a particular employee was obtaining access to private information in a computer system, and if so, to record the time and date that the employee viewed the data. The employee was subsequently prosecuted. The magistrate refused to admit the evidence of the printout of the trace data, partly because he considered the record of the time and date to be hearsay. On appeal, Wright J rejected this analysis. The person who wrote the code gave evidence at trial, both as to the reason for writing the code and as to how it worked. The judge was of the following opinion:

4.35 Wright J then went on to illustrate the separate steps:

4.36 There was no evidence that suggested that the trace program modified any other programs in the computer, and if there were any such failings, the program designer could have been cross-examined on them. For this reason, the statement was not hearsay.

Challenging the code to test the truth of the statement

4.37 One of the most frequently mounted challenges to evidence in digital form is the admissibility of the output from breath-testing devices. Such challenges are attempted across jurisdictions, but the legislation put in place usually provides that where a device is authorized by an appropriate authority, judges do not have the power to require the prosecution to reveal the software code, or refuse to because, it is claimed, the defence do not provide sufficient evidence to support the challenge that the device might not be reliable.¹ However, in State of New Jersey v Chun the Supreme Court in New Jersey in the United States ordered the software of a new breath-testing device – the Alcotest 7100 MK111-C – to be reviewed in detail and tested for scientific validity.² After extensive testing, the court concluded that the Alcotest, using New Jersey Firmware version 3.11, ‘is generally scientifically reliable’, but ordered modifications to enable its results to be admitted into legal proceedings.³ The analysis of the source code indicated that there was a fault when a third breath sample was taken, which could cause the reading to be incorrect, and the court saw fit to order a change in one of the formulae used in the software. This is a significant decision because the court accepted, albeit implicitly, that the software that controlled the device, written by a human, was defective. This in turn meant that had the code not been remedied, the data relied upon for the truth of the statement would be defective and therefore this would affect the accuracy and truthfulness of the evidence.