Section 14 and 15 of the Electronic Communications and Transactions Act, 2002 (ECTA) allows for the admission of documents which is of electronic origin on the same basis as documentary evidence and implicitly states that such documents may not be excluded merely because they are “duplicate originals” or emanates from electronic means.
The courts are facing an increase of evidence produced which is of an electronic nature. This includes proof of communication by parties such as emails/ whatsapp messages/ social media communications albeit Facebook/ Instagram etc)
The preferred mode of communication to conclude daily business transactions is email, as it is instantaneous. It is often the attachments to emails, which is simply printed out as proof that is becoming increasing sources of litigation. Our courts are becoming more accustomed and are accepting electronic communications more readily. As mentioned in an article by Cyanre in the Risk Bulletin in the De Rebus in September 2016 in relation to spoofing of emails, we see the development of case law, where service of documents are considered as properly served for courts to give judgements by default (including facebook service and whatsapp service- where proof of delivery is fairly easily confirmed.
Challenges arise when certain electronic evidence is tendered in evidence in courts. Many examples have come to the attention of Cyanre over the past year where for example, an email is handed in in court and the information in the heading is accepted by the court/ prosecution /applicant, only to find later that the document is in fact a fraudulently produced document or the email was sent via fraudulent means or, the information relied on to prove the case is simply not supported by the metadata. The same situation arises where printed copies of word documents are tendered in evidence.
Some courts and prosecutors have become more knowledgeable regarding the fact that computer printouts can contain valuable metadata (information regarding the document in question not visible on the face of the document, but ascertainable from the source data) But very often, this information is accepted at face value, without taking into consideration the context of the information and correct interpretation thereof: such as: the OS used to create the document (Word/ Mac/ the version of the document that was used to create the document and the version it was received by and printed from- all save the information in different formats and often the naming conventions of the header information can be misleading from one document to another). The metadata must therefore be carefully interpreted before accepting a printed document at face value.
A very simple example is where a document created on a windows based machine may at face value look different if sent to and printed from a Mac , although it is the same document as the formatting between the two systems is not always aligned and may depend on the application used to ‘translate’ the document to be read by a Mac OS from a Windows OS. The metadata can further be changed/ appear different if a system such as sharepoint is used.
Date and time settings must be carefully scrutinised in context of the metadata. A difference between two exhibits or your clients version could be attributed to the date and times of servers being out of sync, the device used to create or receive the document may have been backdated, the print-out you have in your possession may be a first draft, the “date created” may be incorrectly interpreted as the first date the document was created, but actually relate to the date it was saved to a new name after it was created from a previous template.
In our next article, we will explain the various “properties” of a document in relation to it’s metadata in more detail and suggest what to look out for.
Contributed by:
Ilse Grobler (Chief Administrative Officer)
CyanreCyanre, the Computer Forensic Lab (Pty)Ltd
Phone: 0126640066