Problèmes de fouille informatique

Ang

Fr

Cette page a été mise à jour ou révisée de manière substantielle pour la dernière fois January 2023. (Rev. # 2267)

n.b.: Cette page est expérimentale. Si vous repérez une grammaire ou un texte anglais clairement incorrect, veuillez m'en informer à [email protected] et je le corrigerai dès que possible.

• < Fouilles, perquisitions et saisies
• < mandats de perquisitions

General Principles

Search warrants under s. 487 are the most typical manner of authorizing an officer to examine the contents of a computer.

Warrant Issues

Single Warrant for Multiple Zones of Privacy

A residential search warrant that authorizes the seizure of computer devices for its evidential value can also operate as an judicial authorization for the examination of the device. Due to the enhanced privacy interest, the authorization must “specific[ally]” authorize the seizure of a computer before they can search it. The authorization for the device cannot be by implication.

If a computer is found during a search under a warrant does not authorize the search of a computer, it can be seized until a computer search warrant is obtained.

The initial seizure of the device and the later forensic examination is a separate police activity.

Where a computer device is lawfully seized, the police are permitted to make a forensic copy of the data.

The use of analogies comparing cupboards and computer devices is not appropriate for the analysis of lawfulness of computer searches.

Search of Third-Party Devices for Communications

The privacy rights follow and apply to "electronic conversations" whether or not stored on the sender's device. Accordingly, a communication, as it exists on a third-party devices, may be protected under s. 8 of the Charter.

Search of an Electronic Conversation by Consent

There is some suggestion that a conversation may not accessed by the police without warrant on consent of one of the parties to that conversation. There is no need for a consent where the conversation is between strangers as there is no expectation of privacy.

A "Locker Warrant"

There is some division in the case law in whether proper means of authorizing the examination a device lawfully seized and stored in an evidence locker. There is a line of cases that suggest that the proper means of examining the device is to ask for a "locker warrant."

Timing of Forensic Examination

A computer held under a s. 490 warrant can be examined at any time irrespective of the time specified in the warrant.

Sufficiency of Computer Evidence

It is not necessary that the authorizing justice be satisfied that there is a specific device in the location to be searched, only that if a device is found it will contain evidence.

IP Address and RPG to Search

The connection of an IP address with an ISP account can form reasonable grounds to believe that a computer will be present at the address, but will often need something more.

Manner of Search

When searching a computer, the manner of the search must be "reasonable" and is subject to implied restrictions.

It is not permissible for police examiners to "scour the devices indiscriminately". They must "adhere to the rule that the manner of the search must be reasonable."

The examiners should not conduct full "data dump" of the entire contents of the device and then simply give the entirety of the materials extracted to the investigator where they have the ability to narrow the scope of their search to better comply with the authorization.

Limitations on search are guided by the type of evidence being sought, not any particular file format or file name. Limitations based on locations within the device are not practical. Examiners are entitled to examine any file or folder, in at least a cursory manner, to determine whether they are likely to contain evidence of the type they are seeking.

Imaging of Device

The process of imaging a lawfully seized device is a form of "seizure" under s. 8 of the Charter. There is no obligation for the police to delete the image once the extraction is done. There is no limitation on the number of times that the examiner can revisit the contents of a mirror-imaged device.

Report to Justice on Extracted Data

There is a line of cases suggesting that it is required under s. 489.1 for the police to file a report to justice in relation to the extracted data.

Search Protocols

There is no need for the computer search warrant to set out a search "protocol" to limit what can be examined in the computer.

Note Taking

The person doing the examination of the device has an obligation to make notes absent unusual or exigent circumstances. Failure to take notes will not necessarily result in a breach of s. 8, particularly where there is sufficient information provided through the expert's report. Failure to take notes but there is no impediment to the accused to "meaningfully challenge" the search.

Discovery of a New Offence

When executing a search warrant in relation to a certain offence and the examiner discovers evidence of another crime, the discovered evidence is admissible, but any further searches for further evidence of the new offence must be done after applying for a new warrant.

Where a new authorization is needed, the proper procedure is to apply for a search warrant and not a general warrant.There is nothing wrong with getting a second search warrant for a device that has already been seized and searched.

Consent Searches for Electronic Communications

Police may examine computer files that a complaint presents to them without engaging section 8 of the Charter. There are no obligations to inquire how the complainant obtained the files.

Child Pornography

Police are entitled to visually examine the full range of images across all date time-stamps as limiting the range would provide a culprit a "roadmap for concealment."

For details on the issue of dated information regarding the presence of CP on a computer, see Information to Obtain a Search Warrant#Currency of Information.

Search for Data Stored Outside of Computer

There is some suggestion that s. 487(2.1) and (2.2) permits a search of a computer to include a search of data stored off-site.

487
[omis (1) and (2)]

Operation of computer system and copying equipment

(2.1) A person authorized under this section to search a computer system in a building or place for data may

(a) use or cause to be used any computer system at the building or place to search any data contained in or available to the computer system;

(b) reproduce or cause to be reproduced any data in the form of a print-out or other intelligible output;

(c) seize the print-out or other output for examination or copying; and

(d) use or cause to be used any copying equipment at the place to make copies of the data.

Duty of person in possession or control

(2.2) Every person who is in possession or control of any building or place in respect of which a search is carried out under this section shall, on presentation of the warrant, permit the person carrying out the search

(a) to use or cause to be used any computer system at the building or place in order to search any data contained in or available to the computer system for data that the person is authorized by this section to search for;

(b) to obtain a hard copy of the data and to seize it; and

(c) to use or cause to be used any copying equipment at the place to make copies of the data.

[omis (3) and (4)]
R.S., 1985, c. C-46, s. 487; R.S., 1985, c. 27 (1st Supp.), s. 68; 1994, c. 44, s. 36; 1997, c. 18, s. 41, c. 23, s. 12; 1999, c. 5, s. 16; 2008, c. 18, s. 11; 2019, c. 25, s. 191; 2022, c. 17, s. 16.

– CCC (CanLII), (Jus.)

---

Section 487(2.1) and (2.2) were enacted in 1997 with RSC 1997, c. 18.

One possible problem with the use of s. 487(2.1) to permit off-site searches is that it does not take into account that s. 487 limits its authorization to search of a "place" that is different from the off-site "place" storing the "cloud" data. There is a possibility that the power authorized by s. 487 is limited to searches where the evidence is located within the geographical area of the "place" listed on the warrant.

There is some experience with using a general warrant to get access to a google account.

Computer as "place" or "thing"

There is uncertainty as to where warrants under s. 487 to search for computers are generally framed as searching "places" to locate a computer device that is to be forensically examined once subject to a s. 490 detention order. The extraction of data from computer has been analogized to the analysis of a blood sample, which suggests a "search" occurring at the time of seizure and not on analysis.

Jurisdiction

Generally speaking, where data is stored in a foreign country but is readily accessible through a network within the country, the location of the original data is irrelevant.

Police Undercover Investigations

The seizure of historical text messages will not be considered an "interception" requiring a Part VI wiretap warrant.

An undercover peace officer posing as an underage officer does not amount to an intercept.

The fact that the sender was under the mistaken belief as to the identity of the recipient does not amount an "interception."

Disclosing Passwords

It remains an open question whether it is possible to use a general warrant to compel a person to disclose their device password.

Evidence

Operation of a Computer Device

It should not be necessary to have the investigator to give details on the "basic functions" of computer storage devices. Computer devices are to be treated as appliance and so no need of need of proof is necessary to establish basic functionality.

Extraction Reports

Cell phone extraction reports primarily are classified as "real evidence."

These extraction results do not require independent testing or verification since they simply copy and organize data found on the device without drawing inferences.

Inferring Location From Cellphone Evidence

It is generally accepted that a "call to or from a cell phone will usually register at the tower closest to that cell phone", which is determined by which tower has the strongest signal. This is usually but not always the tower with the closest tower.

Geographic evidence is typically tendered through use of a "propagation map" that "despict[s] the relative coverage areas of cell phone towers located at various places in a geographical area."

There will be times where the closest tower rule will not apply such as where: • the closest tower is at capacity • there is a body of water between the phone and the closest tower • there is a large obstruction between the phone and the closest tower.

Geographic evidence need not be proven by expert testimony.

Given the imperfect and limited strength of geographic evidence, a single text message from a phone may be insufficiently probative to outweigh the prejudicial value of the accused location.

Inferences from Browsing and Search History

Inferences from internet browsing and search history must be considered in the context of all the evidence.

Canadian Border Searches

There are two sources of authority for a warrantless search of an electronic device.

Section 99(1)(a) of the Customs Act states in part that:

Examination of goods

99 (1) An officer may

(a) at any time up to the time of release, examine any goods that have been imported and open or cause to be opened any package or container of imported goods and take samples of imported goods in reasonable amounts;

...
R.S., 1985, c. 1 (2nd Supp.), s. 99; 1988, c. 65, s. 79; 2001, c. 25, s. 59; 2017, c. 7, s. 52.

– Customs Act

Section 139(1) of the Immigration and Refugee Protection Act states in part that:

Search

139 (1) An officer may search any person seeking to come into Canada and may search their luggage and personal effects and the means of transportation that conveyed the person to Canada if the officer believes on reasonable grounds that the person

(a) has not revealed their identity or has hidden on or about their person documents that are relevant to their admissibility; or

(b) has committed, or possesses documents that may be used in the commission of, an offence referred to in section 117, 118 or 122.

...

– IRPA

"Goods" Under Customs Act

The term "goods" is defined in s. 2(1) of the Customs Act as "conveyances, animals and any document in any form." This includes information found on computers and cellphones.

This can include any data that is in "actual possession of or in accompanying baggage of traveller at time they arrive at border and commence dealings with customs officers", but does not include records stored remotely and accessible from the device.

NB: the definition goods under s. 2 as it relates to electronic devices has been declared invalid with a suspension for one year.

Expectation of Privacy

International travelers have a diminished expectation of privacy while crossing international borders.

Warrantless Search of Phones

It has been found that warrantless searches of phones are permitted at borders.

It is not necessary that the border agent first form reasonable grounds before engaging in such a "routine search" of electronic devices.

See Also

• Fields of Expert Evidence (Computer-related_Forensics)