This judgment provides more detailed reasons for my ruling given on 4 September 2024 that the Cellebrite report depicting the activity sensor data recorded on an Apple iPhone should not be admitted into evidence in the trial of the accused for the offence of murder. I note at the outset that the objection to this evidence was made well into the trial, and it was assumed by the Crown, prior to that objection, that there was no contest to the evidence. Accordingly, the Crown attempted to adduce the evidence without any expert, purportedly pursuant to s 146 of the Evidence Act 1995 (NSW). As can be seen from the following analysis, in my view, this evidence does not easily fit within any of the provisions of the Evidence Act.
[2]
Background
On 30 November 2020, at approximately 2:35am, the deceased, Adnan Salameh, was shot and killed at the home of his girlfriend, Ms Smith (a pseudonym), in Tregear. Two men dressed in black with their faces covered are said to have kicked in the front door of the residence. One of the men fatally shot the deceased in the right shoulder and right thigh with a shot gun. The deceased and Ms Smith were drug users (who also sometimes supplied drugs). At the time of his death, the deceased had allegedly accrued some debts to drug suppliers and others. It is alleged that Ms Smith had accrued a debt to the accused whom she only knew as "B".
The accused was arrested for the murder of the deceased one year and nine months after his death, on 31 August 2022. The case against the accused is largely circumstantial. The Crown alleges that Ms Smith had accrued a $1500 drug debt to the accused, after acquiring cocaine on credit from him several weeks before the death of the deceased. The accused is said to have put increasing pressure on Ms Smith to recover the debt including eventually threatening her and her child (a child who lived with their father, but who sometimes visited Ms Smith). Ms Smith determined that because the accused had threatened her child, she would not repay the debt.
On 8 November 2020, it is alleged that with the help of Ms Smith, the deceased broke into the home of two friends and ex-work colleagues of Ms Smith (Ms Williams (a pseudonym) and Ms Jones (a pseudonym)) and stole several thousand dollars. Ms Williams and Ms Jones had in their home a cash box which contained cash earnings from their work. Ms Smith had also kept her cash earnings in that cash box. It is alleged that the accused knew all three women and had supplied them with cocaine.
After the robbery, Ms Jones posted a Snapchat story which published her belief regarding the deceased and Ms Smith's involvement in the robbery. After the posting of the Snapchat story, the accused contacted Ms Jones and Ms Williams saying that he wanted his money back from Ms Smith.
It is alleged the accused went around to Ms Smith's residence in Tregear by car, with another man, about two weeks before the deceased's death, and the accused spoke with Ms Smith and the deceased outside the residence on the street. Ms Smith stated that she told the accused she would not pay him back because of the threat to her child, and the accused appeared to accept that. She did not hear from the accused after that discussion, although the accused was messaging the deceased after that meeting.
[3]
The Cellebrite report
Part of the circumstantial case against the accused includes evidence that in the hours leading up to the murder, a car very similar to the car he owned was seen circling around streets surrounding Ms Smith's home at Tregear. Further, in the hours leading up to the killing a phone in his name was "pinging" off phone towers in the area. In particular, and importantly, at around the time of the shooting, the phone was "pinging" off two towers which covered the area which included Ms Smith's house. The phone records also indicated that the accused's phone left the area very shortly after the shooting. A speeding fine issued about 1 hour and 20 minutes later was incurred in relation to the accused's car in an area which aligned with where the phone tower evidence indicated his phone was located at the time. The infringement notice relating to this fine was found at the accused's home and had been paid by his mother. In short, it is alleged by the Crown that the movements of the phone and the car align on the evening of 29 November 2020 and the morning of 30 November 2020 and that those records put the accused in the area of the shooting leading up to, and at, the relevant time. At the time of my ruling, it was also anticipated that there would be evidence from Ms Jones as to certain admissions made by the accused on the morning in question (albeit the Crown did not open on all these admissions).
When the accused was arrested and his home searched on 31 August 2021, a number of iPhones were located and subsequently analysed. Two of the phones (an iPhone 8 and an iPhone 11 Pro) contained identical data in the "Health Application" relating to the time of the shooting.
The Crown sought to adduce evidence of this data, based on a Cellebrite download report (which produces information from each phone in the form of a written report). The report produced data from the activity sensor within the phone between 2am and 3am on 30 November 2020 in relation to steps, distance travelled (in metres) and flights climbed (in number of floors). No expert evidence from the manufacturer of the iPhone, or from anyone else, was sought to be led to explain this data, other than some evidence from Acting Sergeant Tillott in relation to the production of the Cellebrite report.
Acting Sergeant Tillott provided his understanding of the software which extracted data from the iPhones. The examination is conducted using software, known as a UFED examination or extraction, produced by the company Cellebrite. Police generally refer to the data extraction report as a Cellebrite download. Acting Sergeant Tillott was not sure what UFED stood for but said it may stand for Universal Forensic Extracted Data. He stated that there were a number of different pathways to extract the data from a device, but ultimately the device was connected to a computer which had software on it, and the computer is instructed to download relevant material.
The document sought to be tendered was a Cellebrite extract entitled "Extraction Report - Apple iOS Full File system" with a subheading "Activity Sensor Data (1)" ("the Cellebrite report"). Other information contained within the Cellebrite report showed it related to 2am to 3am on 30 November 2020 in relation to "measurements" of steps, distance travelled and flights climbed.
In particular, the data initially sought to be relied upon by the Crown within that report was set out in the Crown Case statement - that on 30 November 2020:
(1) 68 steps were taken covering 46.58 metres at 2:24:52am
(2) 71 steps were taken covering 93.68 metres at 2:35:15am
(3) 70 steps were taken covering 41.32 metres at 2:46:51am.
I note that the Crown opened very broadly on this topic as follows: "the health application data record[ed] movements on 30 November 2020 around the time of the shooting". As noted below, the evidence in relation to the distance covered was ultimately not pressed.
[4]
Submissions
The Crown relied upon s 146 of the Evidence Act for the admission of the evidence which reads:
146 Evidence produced by processes, machines and other devices
(1) This section applies to a document or thing -
(a) that is produced wholly or partly by a device or process, and
(b) that is tendered by a party who asserts that, in producing the document or thing, the device or process has produced a particular outcome.
(2) If it is reasonably open to find that the device or process is one that, or is of a kind that, if properly used, ordinarily produces that outcome, it is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) that, in producing the document or thing on the occasion in question, the device or process produced that outcome.
Note -
Example:
It would not be necessary to call evidence to prove that a photocopier normally produced complete copies of documents and that it was working properly when it was used to photocopy a particular document.
The defence argued that the evidence should be excluded essentially on the basis that there was no expert evidence explaining how the data was produced by the iPhone, and there was no evidence as to its reliability.
Before the argument was fully developed, I located an article on the Internet which was provided to the parties for their consideration, by J Peter van Zandwijk and A Boztas, "The iPhone Health App from a forensic perspective: can steps and distances registered during walking and running be used as digital evidence?" (2019) 28 Digital Investigations S126-S133 ("the article"). Those authors are from the Netherlands Forensic Institute in The Hague, the Netherlands. This article appeared to me be a serious article underpinned by verifiable research.
It can be noted at this point that after this article was provided to the parties, the Crown indicated that it no longer pressed the distance data from the Cellebrite report because the article indicated the data was unreliable.
[5]
Consideration
It would appear that a number of sections of the Evidence Act may be relevant to the consideration of this evidence which go beyond s 146, namely also ss 48(1)(d), 69, 144(1)(b), 147 and 183, together with the definition of "document" in the Dictionary to the Evidence Act.
Section 48(1) contains the following provision in relation to proof of the contents of documents:
48 Proof of contents of documents
(1) A party may adduce evidence of the contents of a document in question by tendering the document in question or by any one or more of the following methods -
[…]
(d) if the document in question is an article or thing on or in which information is stored in such a way that it cannot be used by the court unless a device is used to retrieve, produce or collate it - tendering a document that was or purports to have been produced by use of the device […]
In the Dictionary of the Evidence Act, the following definition appears:
Dictionary
Part 1 Definitions
[…]
document means any record of information, and includes -
(a) anything on which there is writing, or
(b) anything on which there are marks, figures, symbols or perforations having a meaning for persons qualified to interpret them, or
(c) anything from which sounds, images or writings can be reproduced with or without the aid of anything else, or
(d) a map, plan, drawing or photograph.
The Cellebrite report is a document that purports to have been produced by the use of a computer using particular software, extracting the activity sensor data from the iPhone. It would appear that section 48(1)(d) allows the sensor data (if otherwise admissible) to be adduced by way of a written document (being the Cellebrite report).
Sections 146 and 147 provide a presumption in certain circumstances. First, though, as I understand it, the evidence must be admissible pursuant to Chapter 3. If the data is to be relied upon for its accuracy, the evidence is otherwise inadmissible as hearsay unless it falls under an exception to the hearsay rule. Whilst not necessarily obviously falling into the business records provisions of s 69, I will assume for the purposes of this judgment that the record of the activity sensor data is a business record of Apple (the manufacturer of the iPhone and its software). I note that no submissions were made in relation to this issue, or indeed any provision of the Evidence Act other than s 146. This judgment must be read in that light.
As noted, the Crown referred to s 146 as the section upon which it relied. However, if, as the first step, the record of the activity sensor data is to be regarded as a business record, it would appear that s 147 would instead potentially apply. Accordingly, I will consider the evidence in the context of s 147.
Section s 147 reads as follows:
147 Documents produced by processes, machines and other devices in the course of business
(1) This section applies to a document -
(a) that is produced wholly or partly by a device or process, and
(b) that is tendered by a party who asserts that, in producing the document, the device or process has produced a particular outcome.
(2) If -
(a) the document is, or was at the time it was produced, part of the records of, or kept for the purpose of, a business (whether or not the business is still in existence), and
(b) the device or process is or was at that time used for the purposes of the business,
it is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) that, in producing the document on the occasion in question, the device or process produced that outcome.
(3) Subsection (2) does not apply to the contents of a document that was produced -
(a) for the purpose of conducting, or for or in contemplation of or in connection with, an Australian or overseas proceeding, or
(b) in connection with an investigation relating or leading to a criminal proceeding.
Note -
Section 182 of the Commonwealth Act gives section 147 of the Commonwealth Act a wider application in relation to Commonwealth records and certain Commonwealth documents.
Section 147(1)(a) itself states that the section applies to "a document that is produced wholly or partly by a device or process". From the evidence before me, it would appear that the digital record of the iPhone activity sensor data fits within this subsection. The "document" for the purposes of s 147 is the digital record of the iPhone activity sensor data (fitting within the par (c) definition of "document" within the Dictionary to the Evidence Act) because it is a record of information which can be produced with the aid of something else (being the UFED software). It is also fair to infer that the digital record of the data is produced by a device - being the activity sensor within the iPhone.
Section 147(1)(b) provides further, that the document "is tendered by a party who asserts that, in producing the document, the device or process has produced a particular outcome".
I take from the combination of s 48(1)(d), par (c) of the Dictionary definition of "document" and s 147(1) to mean that the record of the activity sensor data (contained in the Cellebrite report) is being tendered to assert that the activity sensor has produced a particular outcome. I will come to what "a particular outcome" means shortly.
Turning to s 147(2), if the document is, relevantly, a business record, and the device (the activity sensor) is, or was at the time, used for the purposes of the business, it is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) that, in producing the document on the occasion in question, the device or process produced that outcome. As noted above, I am presuming that the digital record of the activity sensor data is a business record of Apple.
It is not immediately obvious, in the context of s 147, how the term "a particular outcome" is to be understood.
I note that the "example" appearing below the relevantly similar s 146 is this:
It would not be necessary to call evidence to prove that a photocopier normally produced complete copies of documents and that it was working properly when it was used to photocopy a particular document.
This example is of limited assistance in these circumstances.
On the most straightforward reading of the section, the "particular outcome" is simply the data set out in paragraph 12 above. If that is the case, s 147 provides a presumption that the activity sensor produced that data as there described. So much can, perhaps, be accepted. That says nothing, however, about the meaning or accuracy of the data. If the data is not an accurate depiction of the steps taken at the time recorded, it is difficult to see how the data could be relevant and admissible pursuant to ss 55 and 56 of the Evidence Act.
Clearly, if there were expert evidence explaining how the activity sensor worked, how it produced its data, and what the words and numbers meant, it would be easier to determine whether the data produced was an accurate record of the number of steps taken, proximate to the times indicated in the report. As noted, there is no such expert evidence, no doubt explicable by the late notice given to the Crown as to the contest of the evidence. However, in considering the question, s 144 of the Evidence Act can probably be utilised, together with s 183.
It can be observed that s 144 (which appears within a different Part of the Evidence Act (Part 4.2 Judicial notice)) provides that "[p]roof is not required about knowledge that is not reasonably open to question", and is -
(a) common knowledge in the locality in which the proceeding is being held or generally, or
(b) capable of verification by reference to a document the authority of which cannot reasonably be questioned.
It can be observed that step counters, in various different devices, including watches and mobile phones, have been used for several years now. Accordingly, the way these devices work could perhaps amount to "common knowledge […] generally". However, after even minimal reflection, it is clearly unlikely that the workings of the device and the accuracy of its output could really be regarded as "common knowledge". That being said, the article referred to above, on a generous interpretation, is one which may be able to be described as "a document the authority of which cannot reasonably be questioned", and thus would potentially be able to verify (or otherwise) the accuracy of the data.
The article, published in 2019, provides information in relation to results from experiments using an iPhone 6, iPhone 7 and iPhone 8, using three men and two women as subjects. Their steps and distance measured by the iPhone was compared to manual tracking data. The subjects all covered three distances at least twice in walking speed and at least twice in running speed, as well as some other series of experiments. Approximately 600 trials were run by the five subjects together. More than 144,000 steps were manually counted and a total distance of 130kms was travelled.
As noted, the study revealed significant variation in the distances registered, and as a result, the Crown determined no longer to press the evidence of distance travelled.
The "Abstract" of the article included that steps registered by the iPhone Health App agree very closely to those measured manually with an averaged error of about 2%.
However, the conclusion of the study in relation to the steps count was that:
"[…] it is possible to use this data from the Health App for forensic purposes in cases where it is known (or assumed) that walking or running has taken place. It is important to note that the converse need not always be necessarily true: if steps or distances are registered by the Health App, this need not necessarily indicate that walking or running has taken place while carrying the telephone, since under specific conditions there might be false positive registrations in the Health App. For instances, initial research at [the research institute] indicates that sometimes steps can be registered when driving in a car over speed bumps.
[…] it remains to be seen to what extent activities of daily living affect the accuracy of number of steps and distances registered by the iPhone Health App. In cases where it is known that a significant amount of walking has taken place, however, it seems justified to use the results from the study."
In my view, this information is enough to show that the step count data is not necessarily an accurate representation of steps taken by the person with the iPhone in the case before me. First, it is not known, nor can it be assumed, that the holder of the iPhone in question was walking at the times recorded on 30 November 2020. Further, the risk of false positives, arising from speed bumps, for instance, cannot be excluded.
Secondly, if one examines the Cellebrite report, even if one assumes the steps referred to in it refer to actual steps taken, it can immediately be seen that the data is recorded at approximately 11 minute intervals. It can be inferred from that pattern that the steps were taken at some time in the 11 minutes leading up to each data reading. However, there is no indication at what point or points of time within the 11 minute window the steps were taken.
In my view, therefore, the data recorded by the device cannot be said to be an accurate record of the number of steps taken by the person in possession of the iPhone at a time proximate to the time at which they were taken. Accordingly, on this analysis, the data is not relevant.
If I am wrong, and s 146 rather than s 147 is regarded as the relevantly applicable section, I would come to the same conclusion (albeit via a slightly different analysis).
Further, if I am wrong about both ss 146 and 147, and the data is to be regarded as relevant and admissible, I am of the view that the evidence should, in any event, be excluded under s 135(b) of the Evidence Act on the basis that the probative value of the evidence is substantially outweighed by the danger that the evidence might be misleading. This is because even if one accepted some sort of movement was indicated by the data, as noted above, one would not know when this movement was taken within the 11 minute window between each of the data downloads. The "steps" (or movement) recorded could have been "taken" as much as 10 or 11 minutes before the data was recorded. To take just one example. The shooting is alleged to have occurred at 2:35am, and one of the data readings on the Cellebrite report shows that 71 steps were taken at 2:35:15am. If, in fact, any "steps" were taken (or movement occurred) which was recorded at this time, the steps or movement may have happened up to as much as 10 or so minutes before the shooting. The danger that the evidence might be misleading is obvious.
Accordingly, I determined that I would exclude the Cellebrite report purportedly depicting the activity sensor data recorded on the Apple iPhone.
[6]
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 08 October 2024