1

Meet Bob. Bob was at a pub when a brawl broke out and when police attended he was still filming it including the arrests on his phone.

Meet Alice. Alice was at a protest when someone started accosting threatening and mildly assaulting her all of which she filmed on her phone. She went to police to report this, mentioning to them that she has video evidence of the crimes on her phone.

As I understand it police have the power to and will occasionally seize phones that possess video evidence of things that may be the subject of court proceedings.

A) how do they retrieve the data when the phone is encrypted?

B) in each case, do Bob and Alice always have an option to amicably transfer or transmit or submit the relevant video evidence to police computer systems rather than have their phones taken?

Suppose that as the police are going to seize his phone he offers right then and there to upload it using the YouTube app on his phone so that they may access it from the internet. Or Alice attends the police station willing and planning to send the file as an email attachment or airdrop it to a constables device so that they may use it in a form which they see to be fit. Under what circumstances and at what point to they lose the ability to keep hold of their devices and send the relevant data in a less drastic way?

5
  • Related: law.stackexchange.com/a/63652/35069
    – user35069
    Sep 27, 2022 at 20:46
  • “Uploading to YouTube” likely doesn’t upload the unmodified contents, which is bad for use in a trial. Most likely you can transfer photos or videos directly to a computer of choice of the police.
    – gnasher729
    Sep 28, 2022 at 7:02
  • 1
    @Rick it is indeed related however it pertains to when the owner of the phone has committed a crime. Alice and Bob here are innocent as a witness and victim respectively, not a suspect. Sep 28, 2022 at 8:00
  • @gnasher729 what does that mean? Why would they be modified? The more likely concern to me would be that Alice could delete them before the police have a chance to download it if they even know how to download it from YouTube which doesn't intend to allow such action. Sep 28, 2022 at 8:01
  • Technically there is zero guarantee that what my phone uploads to youtube is what my phone's camera recorded. It is most likely in normal use, but here we have a court case where at least one person is very likely interested in modifying the video data.
    – gnasher729
    Nov 18 at 13:59

1 Answer 1

1

(although I imagine the rest of the UK is similar in these respects):

The police will prefer direct access to the device to help maintain chain of custody and reduce risk of the defence asserting the evidence was edited or otherwise interfered with.

police powers

Police may consider using statutory powers (eg PACE or CJPA (see sections 2.1.1 and 2.1.2)) to seize a device with a view to examining its contents, in particular if they find a device in the possession of a suspect that they believe may contain evidence relevant to the investigation of a criminal offence.

These statutory powers may be used to obtain evidence but they do not determine appropriate lines of enquiry. This is a decision to be made under Part II of the CPIA and the code of practice issued under s23(1) of that Act.

In the case of complainants or witnesses, investigators may consider it more appropriate to request that the owner of a phone consents63 to handing over their device to the police in order for it to be examined for evidence. As with statutory powers, this must be justified as a reasonable line of enquiry to obtain evidence. ...

63 This application of the word ‘consent’ is intended to have the plain English meaning of agreement and should not be confused with the lawful basis of Consent for processing personal data as defined in DPA 2018.

technical methods

Level 1 mobile device examination provides a “logical” extraction. A “logical” extraction provides the live data that is readily available on device, probably all of the data you could see if you were able to turn on the device and browse through it. A logical extraction will extract the live data that is supported by the extraction software. This could vary by handset, operating system and types of applications. It may not extract all of the data present and will not usually extract deleted material.

Level 2 mobile device examination can be either a “logical” extraction using selected tools in a laboratory environment to report that data or a “physical” extraction, which recovers a bit for bit copy of the data held on the memory chip of the device. “Physical” downloads can extract deleted data, although again capabilities vary depending on the nature of the device, operating system, types of applications and whether they are supported by the extraction software.

Level 3 mobile device examinations are usually expert and bespoke methods to tackle complex issues or damaged devices. Examples include specialist evaluation and interpretation of digital data or Level 1, 2, or 3 data extraction.

Also:

It would be prudent to retain a complainant’s phone until there has been an opportunity to provide the accused with an opportunity to comment on the allegation, either through an interview or through liaison with defence representatives. This precaution itself will be fact sensitive, in that there may be cases where the delay to the return of a phone to a complainant would be disproportionate, but that consideration must be judged cautiously, with the benefit of the doubt resolved in favour of retaining the phone until an informed decision as to the level of necessary phone examination can be made.

1
  • The police can use reasonable force to make somebody use their biometrics to unlock their device. Devices using a PIN can be cracked in a matter or weeks of months. Only a long and complex password prevents the police getting into a phone, provided it is powered off before seizure. (I work in forensics.) Oct 24, 2022 at 19:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .