A discussion re ‘Use of evidence generated by software in criminal proceedings: Call for Evidence’
Abstract
On 21 January 2025 the Government launched a twelve-week consultation on what could conceivably result in one of the biggest changes to the obligations placed on prosecutors in a generation. The call for evidence had a preamble from[1], Sarah Sackman KC MP, which included[2]:
“This Government is committed to a justice system that works for everyone who relies on it, delivering just outcomes in a timely and fair manner.
For that to remain the case, the law and criminal procedure must evolve to reflect the world we live in today.
Current principles around the use of evidence generated by computer software in criminal proceedings were established over two decades ago, with the common law presumption that a computer was operating correctly unless there is evidence to the contrary. In simple terms, ‘the computer is always right’, unless someone can show it is not.
The limitations of this presumption have been highlighted starkly by the Post Office Horizon scandal, which saw hundreds of sub-postmasters wrongly convicted. These convictions were based on evidence which we now know to have been false, due to faults in the Horizon accounting software system, clearly demonstrating the fallibility of evidence produced by software.
Over the twenty-five years since the presumption was last looked at the use of computers and software has evolved beyond all recognition. We live in an increasingly digital and networked world, where software has become highly specialised and complex. The Government believes the time is right to re-examine this important area, to ensure it is fit for purpose.
I welcome the views of all those with an interest in this area of criminal procedure, and hope that your insights will help us to ensure the criminal justice system is fair and effective, both now, and for years to come.”
For reasons described below, this article will argue:
- The matter is not one readily capable of being distilled into “simple terms”, and is incredibly complex, requiring earnest consideration by all stakeholders (including the Law Commission) in slower time; and
- That the lessons to be drawn from the civil and criminal litigation, Public Inquiry and masses of evidence generated by the Post Office/Horizon Scandal are not that the current state of the law relating to computer generated documents is deficient; rather that individual lawyers, corporations and third parties repeatedly and egregiously failed to meet their existing disclosure obligations, resulting in wrongful convictions; and
- That changes in the law because of the scandal need careful thought and that the legal maxim ‘Hard Cases Make Bad Law’ is apt- to rush through changes to a legal principle of such consequence is inimical to justice.
- That those who seek to ignore legal requirements such as disclosure obligations will likely continue to ignore it whether it is changed or not
Background
Prior to the turn of the century the admissibility of “computer evidence” was subject to s.69 of the Police and Criminal Evidence Act 1984 (‘PACE’).
The relevant part of S.69 (1) PACE said[3] [with my annotation]:
(1) In any [criminal] proceedings, a statement in a document produced by a computer shall not be admissible as evidence of any fact stated therein unless it is shown—
(a) that there are no reasonable grounds for believing that the statement is inaccurate because of improper use of the computer;
(b) that at all material times the computer was operating properly, or if not, that any respect in which it was not operating properly or was out of operation was not such as to affect the production of the document or the accuracy of its contents
Following a formal consultation, in 1997 the Law Commission published a report recommending s.69 be repealed without replacement and it was indeed repealed[4]. In turn, a common law presumption that the computer was operating correctly at the material time took its place[5]. The presumption is a rebuttable one: meaning that if it can be shown that the software may not have been functioning correctly, then the burden shifts to whoever is seeking to rely on the evidence to prove that it was [6]. Debate continues as to how, in practice, the defence may raise suitable grounds to rebut the presumption, and it will be interesting to see practitioner responses on that element.
As the Government concedes, the scope of “a statement in a document produced by a computer” has exponentially widened between 1984 and 2025:
“Digital material now proliferates in criminal cases particularly in cases concerning fraud, rape and serious sexual offences. What constitutes digital material has evolved significantly since s.69 was introduced in 1984. If reinstated today, it could now be construed to include everything from the complex accounting software used by commercial banks to text messages, email chains and social media posts.”
As Joshua Rozenberg noted in his erudite blog on the subject: “The Ministry of Justice suggested that removing or changing the current presumption could mean defendants would be better equipped to interrogate computer evidence against them. But there would be more work for prosecutors to ensure that digital evidence stood up to scrutiny. That could increase the cost and length of criminal trials”[7]. The resource implication will clearly be a factor which the CPS, SFO and other interested parties rely upon to resist wholesale change to the law, but the risks go beyond a significant cost and resource implication.
The potential to inadvertently open Pandora’s Box by reverting to the PACE provision is obviously increased by the sheer computing power and digital interactions involved in our everyday lives. The machine I am writing this on is many times more powerful than the most powerful of commercially available computers in 1984; whilst our phones, watches, cameras, cars and fridges are widely ‘smart’ and interconnected. Hence, a ‘document produced by a computer’ could potentially include everything from screenshots of WhatsApp messages, to cell site data and CCTV, through to social media posts, bank statements and crypto/blockchain evidence.
Indeed, the Government in its comments on the consultation notes that “any reform must be well thought out and future proofed”[8] and argues that evidence “which is merely captured or recorded by a device should be excluded” – they suggest:
- Digital communications between people such as text messages, messages sent through web- based messaging services, social media posts, emails
- Digital photographs and video footage
- Breathalyser readouts
- Mobile phone extraction reports
ought to be left out of scope. Conversely, they believe the following types of examples ought to be within scope:
- accounting programmes such as the Horizon system used by the Post Office
- automated fraud or plagiarism detection software
- automated reporting based on records entered into devices, such as handheld devices for entering patient interactions in a hospital
Distinctions
There are inherent problems in attempting to distinguish which forms of evidence, ‘produced by’ which forms of ‘computer’, ought to be subject to a duty by the prosecutor, and which ought to be subject to a rebuttable presumption, not least due to the competing agendas of different stakeholders. To reference the government’s list of ‘computers’ which it feels should be out of scope – how many defence solicitors would like to challenge the sacrosanct nature of breathalyser or speed gun evidence, and why should they be excluded?
Further, how does one define a suitable test, (which fits to criminal procedure), when the pace of technology is exponentially evolving month to month, in the ‘Age of AI’?
By example, a mass of jurisprudence was (quite understandably) generated following the use of EncroChat evidence intercepted by the French and Dutch authorities and provided to the NCA from April 2020. This was subsequently used by the CPS and others to prosecute hundreds of offenders, resulting in thousands of years of imprisonment and millions of pounds confiscated. The technical aspects of the ‘intercept’ were bitterly dissected by the defence and vigorously defended by the NCA and prosecution, resulting in a variety of criminal appeals and separate civil litigation including on the continent.
Eventually the arguments as to admissibility of the EncroChat material came before the Court of Appeal[9], where the LCJ, Edis LJ and Whipple J considered the competing arguments at length. In a detailed, 70 paragraph judgment[10], the court concluded that the EncroChat data was not ‘intercepted’ (as would have been unlawful per section 56 of the Investigatory Powers Act 2016).
It is difficult to comprehend the additional hurdles, (both disclosure and technical) which the authorities would have had to overcome in bringing Encro cases, were s.69 PACE still in force in 2020. Frankly, it is possible the cases would not have been brought due to the likely resource implication of proving a ‘computer system’ so highly secret, innovative and operated by a third party was “operating properly”. What would “properly” have meant?
Would the jealous defence of the technology and its creator’s confidentiality by the NCA (indeed, even from prosecutors in the early phase) have resulted in abandonment of those cases due to non-disclosure, akin to a prosecutor unable to satisfy themselves as to the source of information and the police unwilling to confirm it or a PII case? It seems likely.
Post Office/Horizon IT Scandal
The argument that the government relies upon is inexorably linked to the ‘Horizon IT scandal’ and the perception that the failures of that computer system led directly to innocent sub-post masters being convicted and sent to prison in error.
The reality is more nuanced than this. The evidence of the High Court litigation on the subject[11], and from the ongoing Public Inquiry, appears to lead to the inference that not only were there serious flaws with the Horizon system[12], but that a combination of a) opacity about such flaws and later b) failures to disclose such flaws, led to miscarriages of justice. That is to say, the errors of the computer accounting software were compounded, defended and ignored by human error and clearly malfeasance which led to those miscarriages.
It is arguable that if the evidence leads to the inference that individual lawyers and managers within the Post Office and Fujitsu turned a blind eye to the errors of the system, and later went so far as to hide clearly disclosable and undermining evidence, a change in the burden of proof would have made no difference. Those who act with malfeasance would ignore the law, whatever it said.
That is very different from suggesting that any computer system – be it proprietary, mass-market, custom-built or highly secret – might malfunction and lead to evidence produced as a result of its functions being flawed. Moreover, the question remains in such circumstance – how can the prosecutor or disclosure officer make themselves suitably certain that the system is functioning normally – especially in instances where the system is completely separate from their oversight?
Warnings from the past
There is a legal maxim that “hard cases make bad laws” – meaning, prosaically, that there is a risk of knee-jerk reactions to incidents (such as the Post Office Horizon IT Scandal) which shock the public consciousness, which might lead to unforeseen problems later. It is arguable that when such public outrage occurs, a rush to legislate or otherwise change legal principles might lead to error or further problems.
One such example might be the Dangerous Dogs Act 1991, which attempted to legislate on the basis of genetic characteristics said to be indicative of dangerous breeds. Over the years the efficacy of that Act[13], and the draconian results which can follow when Judges are left with little discretion, have been criticised by legal commentators and derided by criminal lawyers. The nature of the Act has led to dog breed experts being necessary to argue and overcome points in court, leading to further cost to the taxpayer[14].
Clearly, there is a tension between what the public want at any given moment, and what the objective evidence suggests is a sensible approach.
Summary
The need for nuance, expertise, and a range of reasoned opinions before deciding wholesale changes in the law and practice seems trite. It may be that the current status quo needs to be changed, and that a blanket assumption that a computer was working properly at the time of producing a document in evidence is antiquated and likely to lead to error. On the other hand, the range of work and evidence produced on or by computers has grown exponentially since the repeal of s69 PACE.
Clearly, any change in the presumption will lead to a significant resource implication for the key public prosecution stakeholders, and for private prosecutions alike. Perhaps a 12-week consultation is not the best route, and that the Law Commission is the best placed objective body able to gather such evidence and report on a way forward suitable to all stakeholders – as it did in 1997.
Joe Nahal-Macdonald – Feb 2025
[1] Sarah Sackman appointed as Solicitor General and elected as MP for Finchley and Golders Green – Matrix Chambers
[2] https://www.gov.uk/government/calls-for-evidence/use-of-evidence-generated-by-software-in-criminal-proceedings/use-of-evidence-generated-by-software-in-criminal-proceedings-call-for-evidence
[3] https://www.legislation.gov.uk/ukpga/1984/60/section/69/1991-02-01
[4] Youth Justice and Criminal Evidence Act 1999
[5] See the line of cases including Tingle Jacobs & Co. (A Firm) v Kennedy [1964] 1 W.L.R. 638 and Castle v. Cross [1984] 1 W.L.R. 1372 (DC)
[6] Sarah O’Sullivan v The Director of Public Prosecutions (DC), unreported, 27 March 2000 at [22]
[7] https://rozenberg.substack.com/p/computer-says-nothing
[8] https://www.lawgazette.co.uk/news/government-rethinks-computer-must-be-right-rule/5122083.article
[9] ABC&D v R [2021] EWCA Crim 128
[10] https://www.judiciary.uk/wp-content/uploads/2022/07/A-v-R.pdf
[11] Bates v The Post Office Ltd (No 6: Horizon Issues) Rev 1 [2019] EWHC 3408 (QB)
[12] https://www.counselmagazine.co.uk/articles/the-presumption-that-computers-are-reliable
[13] https://www.bbc.co.uk/news/uk-england-devon-37037799
[14] The writer recalls writing to the LAA on rejection of one dog breed expert and submitting that his ‘pedigree was second to none, my good chum’ – the LAA overturned its decision.
