law of evidence relating to it and forensic issues

8/19/2019 Law of Evidence Relating to IT and Forensic Issues

http://slidepdf.com/reader/full/law-of-evidence-relating-to-it-and-forensic-issues 1/5

Law of Evidence relating to IT and forensic issuesby Sunil D. B. Abeyaratne

The Information Technology revolution has introduced the computer and it has entered

into almost all aspects of our lives during the past few decades. Any computer on the

internet can access another computer on any network. eg. ATMs facilitate withdrawal of

money from an account from any place in the world. With the development of mobile

phone technology m-Commerce has been improved eg. mobile banking reservation of air

tickets through mobile phones etc. All computer related systems are vulnerable to intrusion

and destruction. !erhaps interruption of such system could lead to a total disruption of

daily life. "g. hospitals transport etc.

Trends are developing to shift the nature of crimes from traditional to hi-tech with thedevelopment of hi-tech technology. Computers may be used as a storage container or a

tool to commit a crime. It is estimated that in the near future almost all crimes in the

world will be computer related crimes# documents will be computer based documents.

Therefore application of new methodology to investigate and sei$ure of data in computer

hardware software communication devices computer peripherals in any other form and

storing of them are essential. Its forensic issues and introduction of new laws relating to

computer evidence play a vital role in forwarding evidence before Courts of law.

Discovery of Electronic Evidence

A considerable number of institutions in the world stores their documentation in digitalform in computers. They communicate through e-mail electronic voice mail systems etc.

using computers. As a result burden of proof of such evidence before Courts also can be

complicated eg. reconstructing restoring and searching data.

%iscovery of evidence is the most essential part to prove a case and various &urisdictions

have faced common and different types of difficulties uni'ue to relevant legal systems due

to its own nature (of laws) procedures etc. When the sub&ect matter is discussed with

*electronic evidence* it will be a more complicated issue compared to discovery of a non

electronic evidence. With development of technology evidence takes a new form and e-

mail chat room transcripts databases spreadsheets web browser history files information

through system backup tapes have been replacing conventional paper documents.

Computer evidence may be stored in hidden files as there is a great deal of left over data

stored in the disk drives of a computer. +ome institutions may store their data at a distant

server different website etc.

%igital discovery tends to be voluminous as electronic data is cheaper and easier to copy

archive and distribute. "lectronic data unlike their conventional counterparts do not

disappear easily and are difficult to delete (or destroy). ,nlike a paper document digital

documents have increased the number of locations where potentially discoverable

documents may be found. Cost factor relating to digital discover is a serious problem dueto its nature for eample +attar vs. Motorola Inc. /0 1/d-23 (4th Cir.550) 6ational



,nion "lectric Co rp.vs. Matsu sh ita "lectric Industrial Co. 353 1. +upp. 784 ("% 509).

!rivacy issues will be another aspect under digital discovery since courts can allow access

to email records of websites visited transcripts of chat room discussions etc. to discover

such evidence.

In general the opposing party is allowed to re'uest relevant material from the proposed

party to produce such evidence. :owever one cannot apply rules relating to traditional

discovery methods as it is for discovery of electronic evidence due to its nature.

The standard of knowledge and competence of investigators and their ability to eplain the

relevance of electronic forensic analysing tools used for discovery of electronic evidence

also might open doors for different levels of acceptability of such evidence in court trials.

It is the duty of the forensic eperts to ensure that nothing has been added to or deleted

from electronic evidence recovered from the scene of crime;place.

Law relating to electronic evidence in Sri Lanka

!rior to introduction of the "vidence +pecial !rovisions Act in +ri <anka there was no

provision under the <aw of "vidence to admit computer evidence. In =enwell vs. >epublic

of +ri <anka (540-45) +ri <anka <aw >eports ?ol.7 it was held that Computer

Evidence is in a category of its own. It is neither original evidence nor derivative

evidence. Under the law of Sri an!a" computer evidence is not admissible under section

#$ of the Evidence %rdinance or under any other section of the Evidence %rdinance.

"vidence +pecial !rovisions Act 6o. 3 of 558 Information Technology Act 6o.74 of799/ and "lectronic Transactions Act in 7992 have introduced etending support to admit

IT related evidence in +ri <anka.

>ecently "lectronic Transactions Act 6o.5 of 7992 introduced to recognise and facilitate

the formation of contracts the creation and echange of data message electronic

documents electronic records and other communication in electronic form in +ri <anka.

+ections 7 and 77 are the governing sections >ules @overning "vidence under the Act.

+ection 7 of the Act states *6otwithstanding anything to the contrary in the "vidence

Brdinance or any other written law the provisions of the section shall be applicable for the

purpose of the same Act.*

+ection 77 *6otwithstanding contained in the "vidence (+pecial !rovisions) Act 6o. 3

of 558 shall apply to and in relation to any data message electronic document electronic

record or other document on which the provisions of this Act applies.*

"vidence +pecial !rovisions Act 6o 3 of 558 has been introduced to manage computer

based evidence efficiently and legally (+ub&ect to section 77 of the said e-Transactions

Act).

Bn the other hand when there is no provision to handle law relating to evidence in +ri<anka the , law is applicable under section 99 of the "vidence Brdinance.



1urthermore any other law is applicable in +ri <anka under section / of the "vidence

+pecial !rovisions Act when there is no provision to handle law relating to evidence under

same Act or "vidence Brdinance. Therefore +ri <ankan <aw will be benefited with the

development of IT related "vidence in other countries.

"vidence +pecial !rovisions Act - +ection 7 of the Act - !rovisions of this Act shall be

applicable in respect of any matter provided in the Act notwithstanding anything contained

to the contrary (i) in the "vidence Brdinance or (ii) any other written <aw.

+ection / ( ) of the Act When this Act does not provide provisions

(a) "vidence Brdinance

(b) Any other law shall be adopted and applied where appropriate and with suitable

adaptations as the &ustice of the case may re'uire.

+ection /(7) of the Act When this Act does not provide for the determination in the case

of a recording reproduction statement or other evidence under this Act.

(a) provisions relating to documents or governing like matter in the "vidence Brdinance or

(b) such other law shall with suitable adaptations as the &ustice of the case may re'uire be

adopted and applied.

It is clear that provisions under Chapter ? (+ections 2-59) and +ection 28 of the

"vidence Brdinance shall be applicable when there is no provision under the "vidence+pecial !rovisions Act to deal with evidence relating to Information Technology in +ri

<anka and when there is no provisions under the said Act and the "vidence Brdinance for

same the , law is applicable under section 99 of the same Brdinance as usual. 1urther

the sub-+ections /(l) and /(7) of the "vidence +pecial !rovisions Act have accommodated

to apply <aw of "vidence relating to Information Technology in other countries also in +ri

<anka. Therefore <aw of "vidence in +ri <anka relating to Information Technology will

be benefited with the development of the same sub&ect in other countries.

It is also clear that the legislature has adopted a fleible attitude for accepting and adopting

of evidence relating to Information Technology compared to other evidence before Courts

under section /(/) of the Act.

*Computer "vidence* has been recognised in +ri <anka under +ection 8 of the "vidence

+pecial !rovisions Act and in any proceedings where direct oral evidence of a fact would

be admissible any information contained in any statment produced by a computer and

tending to establish that fact shall be admissible as evidence of that fact with the

satisfaction of the conditions eplained in the same section.

+ection 4 provides provisions regarding 6otices to have access to inspect evidence sought

to be produced machine device or computer any records relating to the production of the

evidence or the system used in such production and the steps to be taken by the other



Co. tnc. et 2/ <. k >. M (=6A) 7329 (,+%C Minn. 555).

These matters were discussed in a number of international conferences and the

international community is still struggling to remove uncertainty regarding same. It is clear

that a new approach must be introduced globally to maintain uniformity among all nations

to minimise the said practical problems on this sub&ect.

*+afe :arbour* principles (a set of principles that ,+ companies would sign up to on a

voluntary basis but to which they would then be bound and which the Commission would

find *ade'uate* under Article 78.2 of the data protection directive) adopted by ,+;",

bridging the different approaches to data protection are a good eample to the rest of the

world.

The Convention on Cyber Crimes was signed in =udapest on 7/rd 6ovember 799 by //

countries and entered into force on .4.7993. Title I? of the same provides that "ach !artyshall adopt legislative and other measures as may be necessary to empower its competent

authorities to search or similar access a computer system computer data stored computer-

data storage medium sei$e or similarly secure computer data accessed to order any person

who has knowledge about the functioning of the computer system or measures applied to

protect the computer data therein to provide the necessary information compel a service

provider to collect or record data to co-operate and assist the competent authorities in

collection or recording of traffic data in real-time associated with specified

communications in its territory transmitted by means of a computer system.

+ee the conference report on Cybercrime <egislation and "nforcement Capacity =uilding

!ro&ect 7nd Conference of "perts and Training +eminar 78-74 August 7993 :anoi?ietnam.

Conclusion

It is high time for the <AWA+IA countries and finally the entire world to apply and

maintain uniform technical conditions and laws for procedure on sei$ure and storing of IT

related evidence. 1urthermore all nations should comply with subpoenas and order for

discovery record keeping re'uirements reviewing recordkeeping practices and privacy

policies as universal laws and rules.

The writer (LLM [London], Dip. in Forensic Medicine Science and Toxicology

[Colomo]!, is and "ttorney#at#Law, and Secretary, $ar "ssociation o% Sri Lan&a and

Chairman, 'T Committee, $"SL

law of evidence relating to it and forensic issues

Documents