Jump to content

Remotely wiping a seized phone - Perverting the course of justice and case law


Equin0x
 Share

Recommended Posts

From what I understand when a device is seized it's turned off and then only examined inside a faraday cage to prevent this, but it seems that sometimes devices are remotely wiped while in custody

https://www.bbc.com/news/technology-29464889

The general agreement seems to be that doing this would (understandably) fall under perverting the course of justice. But looking at the points to prove, I'm not sure how that would be established. For perverting the course of justice you need to have someone

 

  • does an act or series of acts;
  • which has or have a tendency to pervert; and
  • which is or are intended to pervert;
  • the course of public justice.

Now if someone manages to remotely wipe their seized phone, aren't they just going to say there was no evidence of criminal activity on the phone in the first place and therefore wiping it can't possibly have perverted the course of justice? Is there case law showing how to counter such a defence being raised?

Edited by Equin0x
Link to comment
Share on other sites

I'd argue that there's more to justice than securing guilt. No evidence of guilt might show that no offence was committed. If destruction of that proof of innocence occurred then I think the perverting offence is still made out.

Wiping a phone or burning a shoe box full of documents, it makes no odds. The effect is the same... destruction of evidence of either : guilt or innocence.

  • Like 1
Link to comment
Share on other sites

5 hours ago, Equin0x said:

From what I understand when a device is seized it's turned off and then only examined inside a faraday cage to prevent this, but it seems that sometimes devices are remotely wiped while in custody

https://www.bbc.com/news/technology-29464889

The general agreement seems to be that doing this would (understandably) fall under perverting the course of justice. But looking at the points to prove, I'm not sure how that would be established. For perverting the course of justice you need to have someone

 

  • does an act or series of acts;
  • which has or have a tendency to pervert; and
  • which is or are intended to pervert;
  • the course of public justice.

Now if someone manages to remotely wipe their seized phone, aren't they just going to say there was no evidence of criminal activity on the phone in the first place and therefore wiping it can't possibly have perverted the course of justice? Is there case law showing how to counter such a defence being raised?

Smart phones are a nightmare, however this is why the SIM card is removed at the point of seizure, this prevents access to the network and subsequent remote wiping. 
 

Lots of cops don’t bother, but the digital forensic guidance is to remove the SIM. It’s recently changed it’s guidance in regards to wether the phone should remain on or be turned off. It’s also why we have faraday bags. 
 

It’s highly likely incriminating data can be recovered even if it’s wiped as people rarely store it solely in the phone. 
 

The prosecution would need to prove the phone was wiped post arrest to make a case of perverting the course along with the suspects ability to do so. Which may be difficult if they are still in custody. 

Edited by Ether
Link to comment
Share on other sites

The phone wiping would not necessarily have to be post-arrest, post-charge or the like. R v Kiffin (1994) is a case where the defendant knew that the police wished to see certain documents in order to ascertain whether he has committed any offence and had obtained an order for them under S9 PACE, so removed them from the UK in order to prevent this from happening and whose appeal against his perverting the course conviction failed. R v T (2011) is a case where the defendant deleted files from a memory stick she had been told contained indecent images of children in order to prevent the police examining them and prosecuting her husband for possessing them. The mere prospect of an investigation occurring would be sufficient, R v Rafique & Ors (1993), R v Cotter, Clair & Wynn (2002), and it is not even necessary to identify the precise proceedings anticipated, R v Sinha (1995). 

Proving who actually wiped the phone would be the most difficult part - whose fingers were on the buttons of the device which sent the instruction to wipe it, especially if it happens whilst the main defendant is in custody? Assuming that person knew it had been seized by the police at the time, then after that it is more straightforward to prove that their act had a tendency to pervert with the course of public justice, and was intended to do so. 

As @Ether + says, better training around digital forensic security is the solution to stop this happening in the first place. 

  • Like 1
Link to comment
Share on other sites

22 hours ago, Ether said:

Smart phones are a nightmare, however this is why the SIM card is removed at the point of seizure, this prevents access to the network and subsequent remote wiping. 
 

Lots of cops don’t bother, but the digital forensic guidance is to remove the SIM. It’s recently changed it’s guidance in regards to wether the phone should remain on or be turned off. It’s also why we have faraday bags. 
 

It’s highly likely incriminating data can be recovered even if it’s wiped as people rarely store it solely in the phone. 
 

The prosecution would need to prove the phone was wiped post arrest to make a case of perverting the course along with the suspects ability to do so. Which may be difficult if they are still in custody. 

I’ve had a recent input ref packaging phones.

Aeroplane mode, turn it off and stick it in a box. Nothing mentioned about sims. Faraday bags are apparently pretty useless too. 

Odd how advice differs place to place.

Link to comment
Share on other sites

23 minutes ago, Jeebs said:

I’ve had a recent input ref packaging phones.

Aeroplane mode, turn it off and stick it in a box. Nothing mentioned about sims. Faraday bags are apparently pretty useless too. 

Odd how advice differs place to place.

That is odd, but by no means surprising. 

I will try and dig the recent guidance out on Monday. I know there are some new issues with software and turning phones off as we used to can cause the loss of data. 

Link to comment
Share on other sites

55 minutes ago, Ether said:

That is odd, but by no means surprising. 

I will try and dig the recent guidance out on Monday. I know there are some new issues with software and turning phones off as we used to can cause the loss of data. 

Most phones have encryption enabled straight out of the box now. Forensics can extract the keys from a device that's already on, but once it's turned off that clears the keys and you're stuck trying to either guess the passcode or RIPA-ing your way in.

Link to comment
Share on other sites

52 minutes ago, Equin0x said:

Most phones have encryption enabled straight out of the box now. Forensics can extract the keys from a device that's already on, but once it's turned off that clears the keys and you're stuck trying to either guess the passcode or RIPA-ing your way in.

None of which are great options in comparison, which I can only imagine is one of the factors for the change in guidance 

Link to comment
Share on other sites

On 26/11/2021 at 16:55, Ether said:

That is odd, but by no means surprising. 

I will try and dig the recent guidance out on Monday. I know there are some new issues with software and turning phones off as we used to can cause the loss of data. 

Were you able to find it? Wouldn't mind a look if its not restricted/protected info.

Link to comment
Share on other sites

3 hours ago, Equin0x said:

Were you able to find it? Wouldn't mind a look if its not restricted/protected info.

Totally forgot, I will try and dig it out. 
 

 

Link to comment
Share on other sites

  • 2 weeks later...
On 02/12/2021 at 17:44, Ether said:

Totally forgot, I will try and dig it out. 
 

 

Anything?

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

×
×
  • Create New...

Police Community is a forum that is supported financially through advertisements. It is a breach of our standard use policy to use Adblock plugins/software on our site. 

In order to continue using our site you will need to disable Adblock across our site. Alternatively you can purchase a membership package from our online store to remove adverts as part of the membership subscription. 

https://police.community/remove-adverts/

Thank you for your support.

I have disabled Adblock