Abbas v Commissioner of NSW Police - [2023] NSWSC 946 - NSWSC 2023 case summary — Zoe

NSWNSWSC

Abbas v Commissioner of NSW Police

[2023] NSWSC 946

Supreme Court of NSW|2023-08-08|Before: Harrison J

View original source

At a glance

Source facts

Court

Supreme Court of NSW

Decision date

2023-08-08

Before

Harrison J

Source

Original judgment source is linked above.

Judgment (5 paragraphs)

[1]

JUDGMENT

HIS HONOUR: By his amended summons dated 31 July 2023, Mahmoud Abbas sought the following orders and relief: 1. A declaration that the plaintiff's Samsung Galaxy s22 ultra (black) mobile phone was unlawfully seized on 26 July 2023. Particulars of unlawful seizure a) The seizure of the plaintiff's mobile phone was not consented to by the plaintiff; and b) There was no lawful power authorising the NSW Police Force to seize the plaintiff's phone in the absence of the plaintiff's consent. 2. A declaration that the following exhibits seized from the plaintiff's premises at xxx xxx, Greenacre ("the plaintiff's premises") pursuant to a crime scene warrant issued on 26 July 2023 with respect to the Plaintiff's premises, was unlawful: B173811 Item 1 - purple coloured iPhone B173811 Item 2- Lenovo Desktop computer B173811 Item 3 - Samsung mobile phone B173811 Item 4 - white Apple iPhone B173811 Item 5 - Samsung s22 ultra box IMEI 356737570727336 B173811 Item 6 - 5 x USBs & 2 x SD cards B173811 Item 7 - iPad in purple case B173811 Item 8- 1 USB with tag B173812 Item 12 - 1 green bag "Koko Black" Particulars of unlawful seizure a) The exhibits will not provide the NSW Police with evidence of the commission of an offence; and b) The crime scene warrant issued over the plaintiff's premises did not authorise the seizure of the exhibits from the plaintiff's premises. 3. NSW Police Force immediately deliver to the plaintiff the plaintiff's mobile phone seized on 26 July 2023. 4. NSW Police Force immediately deliver to the plaintiff the following exhibits, being property belonging to Plaintiff: B173811 Item 1 - purple coloured iPhone B173811 Item 2- Lenovo Desktop computer B173811 Item 3 - Samsung mobile phone B173811 Item 4 - white Apple iPhone B173811 Item 5 - Samsung s22 ultra box IMEI 356737570727336 B173811 Item 6 - 5 x USBs & 2 x SD cards B173811 Item 7 - iPad in purple case B173811 Item 8- 1 USB with tag B173812 Item 12 - 1 green bag "Koko Black" 5. Costs.
In the events that have since occurred, Mr Abbas now seeks only the relief referred to in prayers 3 and 4 of the amended summons. His claims arise out of the following circumstances.

It is not in dispute that the electronic devices that are the subject of these proceedings are property to which these provisions apply. There would, however, appear to be some doubt concerning the proposition that the information stored on the devices also amounts to a form of property. In Joukhador v Commissioner of Police [2020] NSWSC 227, Beech-Jones J said this at [63] and [65]: "[63] In his supplementary submissions, Mr Joukhador pointed to various provisions of the Crimes Act and LEPRA as supporting the contention that 'information recorded or converted into computer data' falls within the above definition of property. In relation to the Crimes Act, Mr Joukhador relies on the provisions of Part 6 of the Crimes Act which specifies various offences involving computers as support for the proposition that the Crimes Act treats electronic 'data' as property. Thus, it was noted that s 308D(1) creates an offence where there is an unauthorised modification of data with intent to cause impairment. This is an alternative verdict for an offence of destroying or damaging property under s 195 (s 308D(2)(a)). However making s 308D(1) an alternative to s 195 is consistent with 'data' not being a form of property. A charge under s 195 might fail where the only 'damage' or alteration that was proven was to the data and not the chattel that it was stored in. The submissions also noted that under s 308F(2) of the Crimes Act data was 'capable of being possessed or controlled'. In fact, s 308F(2) contains an inclusive definition of a person as being in 'possession or control of data' if they possess a computer or data storage device that holds or contains the data or they have control of data held in a computer that is in the possession of another person. The definition does not advance the argument that the 'information recorded or converted into computer data' falls within the definition of 'property'. … [65] [Section 75B of LEPRA] does not provide any support for the suggestion that 'information recorded or converted into computer data is included' in the definition of property. However, it does provide (considerable) support for the proposition that 'data' is a 'thing' that can be seized under a warrant. This appears to what is contemplated by s 75B(1). If data was not such a 'thing' then that would only beg the question as to what was the authority to obtain electronic data pursuant to the April 2017 warrants in the first place?. On this basis, and irrespective whether it amounts to a form of 'property', any such electronic data obtained under a warrant could be 'a thing' that was seized by a police officer in exercising a function conferred by or under LEPRA and thus be the subject of an application under s 218(1). In that regard, in determining whether the 'thing' could be returned to the 'person who had lawful possession of the thing', then the Crimes Act offences and definitions may be apposite."

On the other hand, the police maintain that retention of the physical devices is important for their purposes for a number of reasons. First, even though the data on the seized devices have been captured by use of the Cellebrite Extraction, the police retain concerns about whether that process has been completely successful. Senior Constable Nathan Costick refers to this in his 3 August 2023 affidavit as follows: "5. I am an Electronic Evidence Specialist with the New South Wales Police Force, Digital Forensics Unit (DFU). I have specialised knowledge based on training, study, qualifications and experience in the identification, preservation, analysis and presentation of electronic evidence… 6. On 2 August 2023, I received a request about whether the content of the Cellebrite report prepared in respect of Exhibit X0003581374 (which I have since been informed is [Mr Abbas'] mobile telephone) contained all available data from the mobile handset. 7. I have not reviewed either the exhibit or the Cellebrite report in question. However, I am informed that, in the course of a legal review of the report for X0003581374 alongside the original exhibit, police observed that the exhibit had encrypted apps on it which were not observed in the Cellebrite Report. 8. This can happen because, after the examination of a mobile device is completed using the forensic tools, the raw extraction data obtained is 'parsed' into a human readable format. However, there are over 1 million applications available for mobile devices and as such it is impossible to automatically parse the data for every application. Accordingly, there may be data which is extracted by the forensics tool which is not viewable such that the data can only be viewed on the original device. 9. With time and development more applications are supported by forensic tools for such an automated 'parsing' process. This can occur over the life of an investigation and criminal prosecution. 10. Generally, once a device has been extracted and parsed, a validation process will occur to confirm that the relevant data is readable and accurate. This process is generally completed by a comparison of the extraction to the physical device. 11. Sometimes, as I understand is the case in this matter, a report may be created which does not contain all available data in a human readable form and further examination of the extracted data, as well as the physical device, is required to ensure all information and possible evidence is identified and presented in a human readable format. 12. Depending on the significance of the data identified within a device, further analysis of the original device may be required over the life of an investigation and prosecution. In such matters the case will be referred to a Digital Forensics Unit analyst who will further interrogate the extracted data and physical handset to validate the data. 13. Importantly, should an issue arise in the course of a criminal investigation and any subsequent prosecution about the completeness or accuracy of the data presented, the best way to verify the accuracy of the information, or to further interrogate the device, is to retain the original physical device until conclusion of the criminal proceedings. 14. A forensic report is not a substitute for an original exhibit. It is a forensically sound evidentiary tool designed to present the data to the court and assist the prosecution with its disclosure obligations while protecting the integrity of the original exhibit. Whilst some investigators may return devices prior to the completion of a matter for various reasons, as a Digital Forensics Specialist my opinion is that it is extremely important to retain an original exhibit until an investigation is complete and all relevant matters are finalised at court."

Secondly, quite apart from the question of whether or not the data extraction process has been completely successful, Detective Senior Constable Nathan Blake expressed additional concerns about the evidentiary strength of data recovered from the seized devices, without the devices themselves being available for tender in any later criminal proceedings concerning the shooting. Detective Blake's affidavit of 4 August 2023 referred to this concern: "105. To date, investigators have reviewed approximately one fortnight's worth of data from before the shooting. Investigators want to explore communications on the handset and laptop, specifically those pertaining to the times of incidents reported to involve [Mr Abbas]. 106. This is a labour and resource intensive process. 107. In my opinion, the fact that discrepancies exist between the two data sources, gives rise to a serious concern regarding the continuity and reliability of any evidence collected. This could cause problems in the course of a future criminal prosecution, including in any subsequent criminal proceedings against those responsible for the attempted murder of [Mr Abbas]. 108. Given these discrepancies, I would expect that any legal representative of a future defendant would seek to have access to the raw material contained on the physical handset, to ensure that the context of conversations, times and dates, and the chronology of events can be relied upon as evidence that was contained on [Mr Abbas'] phone. 109. Should the phone be returned before a complete review can be performed, the strength of any future Crown case against the culprit(s) could be severely undermined. 110. With the ever-changing nature of the digital forensics, and the updating of software versions, and extraction tools, it is my experience that, as technology advances, the ability to 'back-capture' and further extend on extractions, of older devices is often achieved with the duration of time. 111. The return of [Mr Abbas'] phone, as it currently stands, would create a risk to future proceedings and the strength of any case put against a future defendant, or defendants, to any criminal proceedings. 112. It is my understanding that [Mr Abbas] requires the device to continue normal business activity. I am prepared to provide the sim card containing the business contacts of [Mr Abbas], so that a new device may be used to receive calls in relation to the business. I am also prepared to provide [him] with a full copy of the Cellebrite Extraction so that he may continue his business activities."

[2]

Judicial consideration

The Commissioner referred to several recent authorities in this Court and beyond. There was no contest before me that they accurately describe the principles that I am required to apply.
In McQueen v Hawi and Anor [2008] NSWSC 136 at [17], Adams J posed the following question for consideration concerning the police retention of blood stained shoes: "[17] The essential question that needs to be answered for present purposes is whether items of evidence having been lawfully obtained by virtue of a search warrant, the property can be held by police, against the demand for its return by its owner, for the purpose of investigating whether it might be implicated in some crime or other which had not been identified or indeed might not even yet have been discovered."
In the present case, there is no issue that the seized electronic devices might themselves be implicated in any crime which has not been identified or indeed in any crime at all. Their only significance for the purposes of investigating the crime perpetrated against Mr Abbas consists in the data that they contain.
Adams J answered his own question at [18]-[19] as follows: "[18] Were the shoes required for the purpose of investigating a specific crime it might well be that their retention would be justified. That, however, is very far from this case. In substance the respondent's argument amounts to this: the applicant is a criminal; he is involved in a criminal organisation; that organisation has committed a number of criminal offences; we suspect that the applicant also has but we do not know what they are; we are entitled to hold the shoes in case at some time it turns out that they might be relevant to a crime committed by him or his associates. [19] I do not regard this view as being at all unreasonable. To the contrary it strikes me as sensible. But it seems to me that a general wish to hold property belonging to someone else for the reason that it might turn out at some time or other to be material to some criminal activity about which we presently have no information is not a retention for the purposes of investigation within the terms of s 218 and it is not a basis for properly refusing an application for return of goods under s 219. The protection of the right of the citizen to his or her property is an important legal principle."
Adamson J considered the relevant provisions in Fantakis v Commissioner of Police [2013] NSWSC 685 at [27]-[31] as follows: "[27] The wording of s 218 provides context to the Court's power under s 219 to make orders regarding property in the custody of police. Whether seized property is required for investigation of a specific crime or is potentially required as evidence is a relevant factor in deciding if property, whether lawfully seized or otherwise, ought be returned to its owner: see the summary of authorities in Tye v Commissioner of Police (1995) 84 A Crim R 147 per Studdert J (Tye). [28] In Malone v Metropolitan Police Commissioner [1980] QB 49, cited with approval in Tye, a claim for the recovery of chattels was defeated by the need to preserve evidence for pending criminal proceedings. The plaintiff, who had been committed for trial on charges of conspiracy and of handling stolen property, began proceedings in detinue and sought a mandatory injunction for the return of certain banknotes that had been seized by police pursuant to a search warrant and which were not the subject of any charge. [29] Roskill LJ outlined the relevant principles that apply where goods seized are required either for a continuing investigation or for a trial: 'This appeal raises an important point of principle in relation to police powers. It is the duty of the courts to protect the freedom and property of the individual against arbitrary action by the executive, whatever the form which the particular action may take. But the courts, when performing that duty, must always have in mind that the administration of justice must not be hampered and that from time to time the rights of individuals have to yield to a wider public interest which requires the abridgment of individual rights. The appellant, the defendant in this action, the Commissioner of the Metropolitan Police, claims that the present is a case in which that wider interest must prevail over the private interest of the plaintiff, which is immediately to receive back a substantial sum which by concession is his but of the possession of which he was lawfully deprived at the time of his arrest in March 1977. . . ' (page 64) 'It is not difficult to envisage circumstances in which it might become highly material for that money to be produced, either on behalf of the prosecution or of the defence, even though the prosecution do not seek to say that the money itself was stolen and have not so far exhibited it as part of the police officer's evidence. I think, therefore, on this narrow ground the defendant is entitled to retain this money until the conclusion of the criminal proceedings against the plaintiff . . .' (page 72) [30] Where property is seized in the course of execution of a search warrant the police are not entitled to retain it for longer than is reasonably necessary in order to complete investigations or to preserve it for evidence: Gollan v Nugent [1988] HCA 59; 166 CLR 18 at 29; see also R v Elomar and Ors [No 11] [2009] NSWSC 385 at [54]-[55] per Whealy J and Ghani v Jones [1970] 1 QB 693 at 706 at 708-709 per Denning LJ. [31] Consistently with these principles, Adams J in McQueen v Hawi [2008] NSWSC 136 (Hawi) ordered a pair of blood-stained shoes to be returned, there being no identifiable charge or investigation to which they were relevant…".
The following consideration by the High Court in Smethurst and Another v Commissioner of Australian Federal Police and Another (2020) 272 CLR 177; [2020] HCA 14 should also be noted: "[101] The public interest in the investigation and prosecution of crimes, or more generally the enforcement of the criminal law, has been considered by the courts in connection with orders where the police might have been liable to return material seized under warrant. In Malone v Metropolitan Police Commissioner, the owner of bank notes seized by police acting under a search warrant sought their return. The police defended the claim on the ground that they were to be used as evidence in a prosecution. The original seizure had been valid but a reasonable time had passed since the seizure. The police would have been obliged to return them had the court not held that they were entitled to retain the money until the conclusion of the criminal proceedings. [102] Malone was referred to with approval by Deane, Dawson, Toohey and Gaudron JJ in Gollan v Nugent, which also concerned articles seized by the police. In the circumstances of that case, it was not suggested that there was to be any prosecution of the plaintiffs for an offence and therefore no issue was raised as to whether the articles were required as evidence in any future trial. However, their Honours unequivocally stated that in the event that the articles were required in any prospective trial there would be a legitimate ground for retention of the articles by the police. This statement reflects the practice which has been adopted in many cases involving things illegally seized. As Hill J observed in Puglisi v Australian Fisheries Management Authority, the preponderance of opinion in relation to the exercise of discretion tends to be in favour of refusing to order the return of things, even when they have been illegally seized, if there are criminal proceedings pending in which the items may be used as evidence. … [161] No doubt, it cannot yet be said, and it may not be, that the information will disclose criminality which it is in the public interest to reveal. So far, the Commissioner has been bound by undertaking - given shortly after the claim of unlawful seizure was first made - not to look at the information until the question of the lawfulness of the seizure is determined. But what can be said is that the information was seized because the executing officer considered that it related to the unlawful disclosure of secret information, which, if proved, would be a serious criminal offence of the kind inadequately described in the warrant, and that the Commissioner has offered to undertake - and, if needs be, can be enjoined to ensure - that the information is used only as if it had been seized lawfully under Pt IAA. Consequently, if, upon examination by the Commissioner, it appears to the Commissioner that the information does not assist in disclosing the commission of such an offence, the information will be returned to the first plaintiff as if it had been lawfully seized under Pt IAA, and no prejudice will have been caused to the first plaintiff. [162] On the other hand, if it is determined that there is to be a prosecution, a question may then arise as to the admissibility of the information into evidence. But, if so, that will be a question that falls to be determined by the trial judge in accordance with s 138 of the Evidence Act 1995 (Cth). Contrary to the way in which the grant of injunctive relief has been approached in some other cases of this kind, the potential application of s 138 is not a relevant consideration for the purposes of determining whether to grant or withhold injunctive relief - not least, but not only, because there is as yet too little information to determine whether s 138 would be engaged."

[3]

Consideration

Much of the argument before me emphasised what I might refer to as balance of convenience considerations. For example, Mr Abbas maintained that he required the seized devices to conduct his legal practice, without which he would be seriously inconvenienced and the rights of his clients potentially irrevocably compromised. The police in response offered to transfer all of the data held on these devices to alternative devices with similar characteristics so as entirely to obviate the asserted inconvenience. This was to be compared to difficulties that the police maintained they would experience if access to the data were to be restricted to the Cellebrite Extraction, or its equivalent, in association with police concerns that they may not as yet have secured access to all of the data contained on the devices. In particular, the police do not believe that their attempts to open Signal and Wickr applications on Mr Abbas' phone have so far been entirely successful.
The police are also concerned that, even after the data on the seized devices have all been secured, retention of the physical devices themselves is necessary lest some challenge is mounted at any subsequent criminal trial to the provenance of any material recovered from them. That concern seems to raise the spectre of the devices themselves becoming physical evidence in such proceedings. I confess not to understand that submission. There can hardly be a legitimate concern about the continuous possession or provenance of downloaded or recovered data if the police are able, as in my experience they regularly are, to give evidence of how and when they gained access to information on devices that they wish to rely on in court. It would be otherwise if the devices were said to be relevant in themselves, as opposed to the information that they contained, or that there were, for example, DNA traces or other forensic material attached to the devices that was to be relied upon as evidence.
I accept and adopt, with respect, the accuracy of the proposition expounded in Puglisi, that the preponderance of opinion in relation to the exercise of discretion tends to be in favour of refusing to order the return of things, even when they have been illegally seized, if there are criminal proceedings pending in which the items may be used as evidence. In the circumstances of the present case, I am not satisfied on the evidence before me that the seized devices will themselves be used as evidence in any proceedings that may in due course be commenced with respect to the attack upon Mr Abbas. In that respect, I place no importance upon the fact that such proceedings have not yet been commenced and are not pending. It is a reasonable assumption that such proceedings will, or may, be commenced when the police investigation appears to warrant such a course.
The single, and difficult, point of contention is whether, in circumstances where there is a doubt that all of the information which the seized devices contain has been retrieved, the police ought to be entitled to retain possession of those devices against the currently uncertain contingency that they might yet yield further data potentially relevant to their investigation. I accept that the "seized data" are required for investigation of a specific crime or are potentially required as evidence. I do not accept that the devices are required as evidence.
In the course of submissions, reference was made to the prospect that Mr Abbas might deliberately or inadvertently delete material from his devices so as to, or at least with the unintended consequence that it might, frustrate the police in their attempts to gain access to the suspected balance of the data which they were thought to contain. I discussed that prospect with Mr Ozen of senior counsel for Mr Abbas: "HIS HONOUR: That prospect, and you say there is none, of that occurring, could be protected, I suppose, by the requirement that if the phone was to be returned to Mr Abbas or any device was to be returned to him, that he'd give an undertaking not in any way to delete any material on it, and that would be an undertaking to the Court. OZEN: Yes, your Honour, and I have instructions that that is an undertaking Mr Abbas would be prepared to make [sic, give]".
As at 8 August 2023, the state of retrieval by the police of data from the seized devices, or what Detective Blake described as the estimated review status of each seized item, was said by him to be as follows: Exhibit Barcode Description Status X0003581374 Samsung Galaxy S22 (plaintiff's mobile phone) Review 90% complete. Requires approximately one further day of review X0004942277 Purple Apple iPhone Review 50% complete by female officer, at plaintiff's request. Requires approximately half a day further of review X0004942278 Lenovo Desktop Computer Yet to be completed as requires associated reader/executable file for review to be undertaken. DFU estimate approximately three days for the file reader to be included, and a further week for complete review X0004942279 Samsung Mobile Phone Device requires re-examination by DFU and preliminary handset examinations indicate there is material relevant to the investigation on the device. Investigators would seek to retain this evidence X0004942280 White Apple iPhone This device is yet to be extracted or reviewed X0004942282 5 x USBs and 2 x SD cards These items have been reviewed and returned to the plaintiff X0004942284 1 x USB with tag This item has been reviewed and returned to the plaintiff X0004942283 Apple iPad This item has been reviewed and returned to the plaintiff XF000761961 Laptop Review 80% complete. Requires approximately two days of further review. Relevant evidence has been identified, and device required to be retained XF000761962 1 x USB This device is yet to be reviewed