Disclosure Manual: Chapter 30 - Digital Material

Guidance

The guidance in this chapter is intended to supplement the principles now set out in Annex A of the Attorney General’s Guidance on Disclosure 2022. It is essential that prosecutors understand and adhere to these guidelines, as well as the Code of Practice. Prosecutors should also have reference to A guide to "reasonable lines of enquiry" and Communications Evidence and the principles set out by the Court of Appeal in R v E [2018] EWCA 2426 (Crim) and R v Bater-James [2020] EWCA Crim 790

Search and seizure of digital items

It is important for the prosecutor to have early discussions with investigators about the digital strategy to be adopted. In cases involving large amounts of digital material, the Attorney General’s Guidelines state that the investigator should consult the prosecutor, ideally before digital material is seized. It is essential for the prosecutor in all cases to ascertain which, if any, devices have been seized, where from, to whom they are attributed and an indication of the amount of data held. This basic information is required in order to advise on and develop the strategy of how devices are to be analysed both in terms of reasonable lines of enquiry and for disclosure purposes.

Investigators should consider disclosure from the earliest opportunity. In cases involving large amounts of digital material, investigators are encouraged to complete an investigation management document (IMD) to outline the approach they are taking to reasonable lines of enquiry. Digital disclosure is a time consuming and complex exercise, and unless completed at an early stage, it may not be possible for a prosecutor to be satisfied that the disclosure exercise can be completed properly and thoroughly in advance of trial. Unless the digital disclosure process is at a well-advanced stage prior to a charging decision, there may be insufficient time between charge and trial for the exercise to be properly completed. This should be possible unless the prosecution is as a result of a reactive investigation.

The complexity of digital disclosure is such that it may be necessary for additional resources to be applied by investigators. Specialist software may need to be sourced and additionally resourced to assist in the disclosure exercise. Any concerns over the amount of resources being applied to resourcing disclosure by investigators should be escalated.

The Police and Criminal Evidence Act 1984 (PACE) provides powers to seize and retain anything for which the search has been authorised, other than items attracting legal professional privilege (for more detail see below). In addition, there is a general power to seize anything which is on the premises if there are reasonable grounds to believe that it has been obtained in the commission of an offence, or that it is evidence which must be seized to prevent it being concealed, lost, altered or destroyed. There is another related power to require information which is stored in any electronic form accessible from the premises to be produced in a form in which it can be taken away, and in which it is visible and legible or from which it can readily be produced in a visible and legible form.

An image (a forensically sound copy) of the digital material may be taken at the location of the search. The seizure of computers may have a detrimental effect on the ability of a business to operate, and great care must be exercised. Where the investigator makes an image of the digital material at the location, the original need not be seized. Alternatively, when originals are taken, investigators must be prepared to copy or image the material for the owners when reasonably practicable in accordance with PACE 1984 Code B 7.17.

Where it is not possible, or reasonably practicable, to image the computer or hard drive, it will need to be removed from the location or premises for examination elsewhere. This allows the investigator to seize and sift material for the purpose of identifying that which meets the tests for retention in accordance with PACE.

Annex A of the AG’s guidelines make clear that where digital material is examined, the extent and manner of inspecting, viewing, or listening will depend on the nature of the material and its form.

Investigators should follow the general principles outline in the AG’s Guidelines in handling and examining material:

1. No action should be taken which changes data on a device which may subsequently be relied upon in court.
2. If it is necessary to access original data then that data should only be accessed by someone who is competent to do so and is able to explain the relevance and implications of their actions to a court.
3. An audit trail should be kept of all processes followed. Another practitioner should be able to follow the audit trail and achieve the same results.
4. The investigator in charge of the investigation has responsibility for ensuring that the law and these principles are followed.

It is not the duty of the prosecution to comb through all the material in its possession searching for anything which might conceivably or speculatively undermine the case or assist the defence. The duty of the prosecution is to disclose material which might reasonably be considered capable of undermining its case or assisting the case for the accused which they become aware of, or to which their attention is drawn. In R v Pearson and Cadman [2006] EWCA Crim 3366 in which there was digital material that would have taken at least a lifetime to read Hughes LJ VP confirmed that it was “perfectly proper for the Crown to search it by sample or, as here, by key words”.

In some cases, the sift may be conducted by an investigator and/or disclosure officer manually assessing the content of the computer or other digital material from its directory and determining which files are relevant and should be retained for evidence or unused material.

In other cases, such an approach may not be feasible. Where there is a large volume of material, it is perfectly proper for the investigator and/or disclosure officer to search by sample, key words, or other appropriate search tools or analytical techniques to locate relevant passages, phrases, and identifiers. For the avoidance of any doubt, mobile phones are capable of storing a large volume of material. Technology that takes the form of search tools which use unambiguous calculations to perform problem-solving operations, such as algorithms or predictive coding, are an acceptable method of examining and reviewing material for disclosure purposes.

Reasonable lines of enquiry

Lines of enquiry, of whatever kind, should be pursued only if they are reasonable in the context of the individual case. A thinking approach should always be maintained. Investigators must be able to articulate why a particular line of enquiry is being pursued.

The pursuit of reasonable lines of inquiry may include obtaining and analysing communication data originating from devices belonging to the suspect and on occasion the complainant, or third parties. It is important that investigators consider how best to obtain relevant material; a phased approach may be necessary. Investigators should consider using the NPCC issued Digital Processing Notice (DPN) when seeking access to digital devices belonging to a complainant or witness.

In the case of R v E [2018] EWCA Crim 2426, the President of the Queen’s Bench Division endorsed key CPS guidance ‘Guidelines on Communication Evidence’ and ‘A Guide to “reasonable lines of inquiry” and Communications Evidence’. This approach was endorsed and developed in R v Bater-James [2020] EWCA Crim 790, in which the Court of Appeal identified four principles relevant when reviewing a reasonable line of enquiry. Whilst these principles apply to all types of material, they are especially relevant in cases involving large quantities of digital data.

Principle One: Digital material should only be reviewed in pursuit of a reasonable line of inquiry and material should only be disclosed if it meets the disclosure test.

A reasonable line of inquiry will depend on the facts of, and the issues in, the individual case, including any potential defence. There is no presumption that a complainant or witness's mobile telephone or other devices should be inspected, retained, or downloaded, any more than there is a presumption that investigators will attempt to look through all material held in hard copy. There must be a properly identifiable foundation for the interrogation, not mere conjecture, or speculation. Where digital material is obtained, disclosure should only occur when it meets the disclosure test.

Principle Two: Investigators should adopt a staged and proportionate approach. Wholly irrelevant material should not be reviewed.

Investigators should consider whether the digital material can be reviewed without taking possession of the device. If a more extensive inquiry is necessary, the contents of the device should be downloaded with the minimum inconvenience to the complainant and, if possible, returned without any unnecessary delay. When reviewing the digital material, the investigator should also consider whether it is sufficient to view limited categories of data, such as an identified string of messages/emails or communication over a limited period.

Principle Three: The witness/complainant should be kept informed

The witness/complainant should be told that the prosecution will keep them informed about any decisions made about disclosure, including how long the investigators will keep the device; what it is planned to "extract" from it by copying; and what thereafter will be "examined", potentially leading to disclosure. They should also be informed that any content within the mobile telephone or other device will only be copied or inspected if there is no other method of discharging the prosecution's disclosure obligations; and material will only be provided to the defence if it meets the test for disclosure and has been suitably redacted.

Principle Four: The prosecutor and investigator should consider the consequences of refusal

If a witness does not give the investigator access to their mobile telephone or other device, the investigator should consider the circumstances and explain to the witness the procedure that will be followed if the device is made available. If they continue to refuse, consideration should also be given to whether it is appropriate to apply for a witness summons for the mobile telephone or other device to be produced.

Where the material is not provided or is deleted, the court may need to consider, if an application is made by the defendant, whether the proceedings should be stayed on the basis that it will be impossible for the accused to have a fair trial. A highly relevant or determinative consideration will be the adequacy of the trial process, and whether it will ensure there is fairness to the defendant, particularly by way of cross-examination of the witness, coupled with appropriate judicial directions (see also Charnock [2021] EWCA Crim 100). This situation is analogous to the cases in which there is a complaint that the prosecution failed to secure relevant evidence or evidence has been lost.

This case acknowledges that the surrender and loss of a device may in itself be an intrusion into an individual’s private life, in addition to the intrusion involved in the review of its content. Investigators need to consider whether relevant material can be obtained from other sources, including the suspect’s own devices.

Digital devices should not be obtained as a matter of course and the decision to obtain and examine a digital device will be a fact-specific decision to be made in each and every case. Where digital devices are obtained, relevant data should be extracted as soon as possible and the device returned once the extraction is complete (see Bater-James para 88).

Investigators should use the Digital Processing Notice and witness information sheet when considering seeking to review the contents of a digital device belonging to a complainant or witness. This requires a clear articulation of why such a review constitutes a reasonable line of enquiry and why other methods are not considered to be appropriate.

Prosecutors should work closely with investigators, disclosure officers and computer forensic experts to ensure all reasonable lines of enquiry are followed and that digital material is properly assessed for relevance, revelation, and disclosure. Early Advice is strongly recommended in cases where there are extensive volumes of digital data.

Transparency of the approach that has been taken in every case is of paramount importance. The prosecution should encourage early dialogue with the defence as to what has been considered reasonable in the particular circumstances of each case and should make explicit reference to the approach that has been taken in a Disclosure Management Document.

Identifying relevant material

Digital material is likely to be extensive. There will be a considerable amount of data held on a digital device which may not be 'relevant'. Where possible, targeted extraction should occur so that only potentially relevant data is obtained. The disclosure officer/investigator may search by key words, sample or other appropriate search tools or analytical techniques to locate relevant passages, phrases, and identifiers. The purpose of applying such techniques is in order to identify the relevant material on each device. Where key word searches are applied, these should be agreed with the investigator/disclosure officer and be designed to capture not only evidential material but also material likely to pass the test for relevance. Too general search terms or too many search terms may generate a large number of hits, containing much material which may not be relevant and which may complicate the disclosure exercise. It is essential that search terms are selected with care, are not too generic and are targeted. It is never appropriate to adopt an approach which simply supplies images of digital devices to the defence for the defence to conduct their own disclosure exercise. The defence should be invited to agree search parameters and identify potential search terms. This should be set out within the DMD.

Where a large number of hits have been generated, it will be necessary for the disclosure officer to consider these and decide whether or not the material is relevant material. A scoping assessment may be conducted to establish whether the search terms or other techniques have indeed been successful in capturing the relevant material. This could lead to the application of additional search terms or other techniques to strip out material which is not relevant and identify further material which is relevant.

Generally, once the material deemed to be relevant has been identified, all such material will be scheduled. There may however be exceptional situations where the amount of relevant material identified remains vast, so it may be necessary to apply additional techniques such as dip sampling. The court requires a carefully considered and intelligent approach to be adopted. Where dip sampling is used, it may yield more accurate results if concentrated over particular time periods or types of hit. Dip sampling, if used, must be conducted in a manner which is statistically robust and capable of repetition.

It may be necessary to carry out sampling and searches on more than one occasion, especially as there is a duty on the prosecutor to keep duties of disclosure under review, for example, upon receipt of a defence statement.

Documentation

The disclosure officer should keep a record or log of all digital material seized or imaged and subsequently retained as relevant to the investigation. Such a log should be shared with the prosecutor to ensure they are aware of the nature and extent of digital material in the case, from where it was seized, and what has been done with it.

In cases involving very large quantities of data, the digital strategy setting out how the material should be analysed or searched to identify categories of data should be set out in an IMD, and subsequently a DMD.  This should include the details of any sampling techniques used (including key word searches) and the software used; and how the material identified as a result was examined. The record should include details of the person who has carried out the process, and the date and time it was carried out. In such cases, the strategy should record the reasons why certain categories have been searched for (such as names, companies, dates etc.).

In every case, it is important that any searching or analytical processing of digital material, as well as the data identified by that process, is properly recorded. So far as practicable, what is required is a record of the terms of the searches or processing that has been carried out. This means that in principle the following details may be recorded:

• a record of all searches carried out, including the date of each search and the person(s) who conducted it;
• a record of all search words or terms used on each search. Where it is impracticable to record each word or terms (such as where Boolean searches or search strings or conceptual searches are used) it will usually be sufficient to record each broad category of search;
• a log of the key judgements made while refining the search strategy in the light of what is found, or deciding not to carry out further searches; and,
• where material relating to a 'hit' is not examined, the decision not to examine should be explained in the record of examination or in a statement. For instance, a large number of “hits” may be obtained in relation to a particular search word or term, but material relating to the “hits” is not examined because they do not appear to be relevant to the investigation. Any subsequent refinement of the search terms and further hits should also be noted and explained as above.

Just as it is not necessary for the investigator or prosecutor to produce records of every search made of hard copy material, it is not necessary to produce records of what may be many hundreds of searches or analyses that have been carried out on digitally stored material simply to demonstrate that these have been done. Instead, the investigator and the prosecutor should ensure that they are able to explain how the disclosure exercise has been approached and to give the accused or suspect’s legal representative an opportunity to participate in defining the reasonable searches to be made.

Scheduling

The disclosure officer should ensure that scheduling of relevant material is carried out in accordance with the principles outlined in this manual. It is acknowledged in the AG’s Guidelines that it will generally be disproportionate in cases involving large quantities of digital material to list each item of material separately. Unless necessary or otherwise appropriate, these may instead be listed in a block and described by quantity and generic title. Block listing needs to be applied sensibly and with logic to the type of material concerned. Even if the material is listed in a block, the search terms used and any items of material which might satisfy the disclosure test are required to be listed and described separately. In practical terms this will mean, where appropriate, cross referencing the schedules to the Disclosure Management Document.

Defence engagement

It is essential that efforts are made to engage with the defence, particularly with regards to digital disclosure in order to seek their views on the approach adopted, the search terms to be applied and to suggest additional search terms or other techniques to be used to identify material which could fall to be disclosed. If practicable, the defence can be approached for suggested search terms at a very early stage pre-charge in accordance with the AG’s Guidelines on pre-charge engagement (Annex B). The prosecution must be transparent with the defence and the courts about how the prosecution has approached complying with its disclosure obligations in the context of the individual case. It will usually be appropriate to provide to the accused and their legal representative with a copy of the reasonable search terms used, or to be used, and to invite them to suggest any further reasonable search terms. The final decision as to which search terms to apply rests with the disclosure officer. A Disclosure Management Document should be provided in advance of the Plea and Trial Preparation Hearing and updated thereafter, setting out what the prosecution has done in relation to digital disclosure and anything on-going.

The Attorney General's Guidelines and the ruling of the Court of Appeal in the case of R v R and Others [2015] EWCA Crim 1941 clearly envisage that the defence should provide early and meaningful engagement. The defence is expected to play their part in defining the real issues in the case and this should be addressed in the DMD.

A defence statement is an essential tool in case managing issues of digital disclosure. The defence should be reminded of their obligations to supply one (in Crown Court cases), setting out in detail the nature of the defence, what the issues in the case are and why the defence challenge these issues. A defence statement which fails to identify the issues should be rejected and a further defence statement should be sought. Failures of the defence to comply must be reported to the court.

Legal professional privilege

The prosecutor should be aware that digital material may include material which is subject to legal professional privilege (LPP). No digital material may be requested or seized which an investigator has reasonable grounds for believing to be subject to legal professional privilege (LPP), other than under the additional powers of seizure in the CJPA 2001. The CJPA 2001 enables an investigator to seize relevant items which contain LPP material where it is not reasonably practicable on the search premises to separate LPP material from non-LPP material.

If such material is seized, where it could not be separated or where it was seized inadvertently and discovered on review, the investigator must arrange for it to be isolated from other seized material and any other investigation material in the possession of the investigating authority. Consideration should be given to having independent counsel present during a search.

Where material has been identified as potentially containing LPP it must be reviewed by a lawyer independent of the prosecuting authority. No member of the investigative or prosecution team involved in the current investigation should have sight of or access to the LPP material.

If the material is voluminous, search terms or other filters may have to be used to identify the LPP material. If so, this will also have to be done by someone independent and not connected with the investigation.

The defence should be invited to engage to assist in the process.

Retention of seized material

Where material is seized under the powers conferred by PACE, the duty to retain it under the CPIA Code of Practice is subject to the provisions on retention under PACE s22. Material seized under sections 50 and 51 of the Criminal Justice and Police Act 2001 may be retained or returned in accordance with sections 53-58 of that Act. Under section 22 of PACE, an image of the digital device can be made and the device itself returned. However, care needs to be taken to ensure the device is returned to its correct owner and that doing so would not enable further offences to be committed.

Considerable caution needs to be exercised before digital devices which have not been imaged are returned. Prosecutors should liaise with investigators before the return of any such item to ensure a proper assessment of the relevance of the content of any such device has been conducted prior to its return. This may not be possible in many cases without an image having been taken and a proper digital analysis being conducted. Material which has been deemed not relevant may become relevant at a later date. Problems may occur where the data held on the returned device has changed.

Engagement with the court

The Disclosure Management Document should be shared with the defence and the court and the judge should be asked to approve the approach at the PTPH. Any issues should be raised with the court at an early stage, and if necessary, the judge should be invited to make further orders to ensure the efficient management of the digital disclosure exercise.

The duty of the court to actively manage the case is established by rule 3.2 of the Criminal Procedure Rules.

Copying disclosable material

When dealing with large quantities of digital product satisfying the disclosure test, care must be taken not to inadvertently disclose confidential or sensitive material to the defence. Prosecutors and investigators are reminded of their obligations to redact irrelevant personal and sensitive personal data.

Where the disclosure officer or investigator have concerns about differential disclosure of confidential information between co-accused, they should bring these concerns to the attention of the prosecutor. The prosecutor should seek agreement with the defence, and where appropriate the court, as to how disclosure may be made.

It may be appropriate to ask owners of data if any breach of confidentiality will occur should the data be disclosed to any accused.