HKSAR v. LEE KA TIN, CHRISTIAN AND ANOTHER

[English Translation – 英譯本]

HCCC 164/2022 & 255/2023
(Consolidated)

[2024] HKCFI 1171

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CRIMINAL CASE NOS 164 OF 2022 AND 255 OF 2023

(CONSOLIDATED)

__________________________

__________________________

__________________________

REASONS FOR DECISION ON
ADMISSIBILITY OF DIGITAL EVIDENCE

__________________________

Background

1.  D4 Lee Ka-tin, Christian and D5 Lai Chun-pong originally objected to the production of the relevant digital evidence on the ground that the prosecution failed to provide evidence of expert witness with regard to the relevant digital evidence. Subsequently, the prosecution provided expert evidence of Sergeant 8774 (hereinafter referred to as 8774) and D4 no longer raised objection to this issue. I only have to deal with the issue raised by D5.

Issues

2.  D5 disputed the admissibility of the relevant digital evidence as follows:

(1) the reliability of Cellebrite, the software used by the police, and

(2) some of the documents were irrelevant to this case.

3.  After hearing, I find that the prosecution can produce the relevant digital evidence. The following are my reasons.

Relevant legal principles

4.  Both the prosecution and the defence relied on the legal principles laid down by the Court of Final Appeal in HKSAR v Milne John[1]. When the court considers the admissibility of the messages on a defendant’s mobile phone (e.g. WhatsApp), the relevant standard is whether they are prima facie authentic.

5.  In dealing with the relevant issue, the court should not confuse the admissibility of evidence with its weight or reliability. The former is a matter to be considered by the judge while the latter is a matter to be considered by the jury.

6.  Although the parties have referred to other cases in their submissions, including the cases of Yip Fai[2], Ng Man Ho[3], Yim Yu Hang[4], Kwan Ka Yiu[5], etc., I am of the view that the factual circumstances of those cases are different from the present case and they are not of much assistance to me. All that I have to do is to apply the principles laid down by the Court of Final Appeal in Milne John to the present case to determine whether the prosecution has proved the relevant digital evidence is prima facie authentic.

D5’s submissions

7.  Ms Sabrina See and Mr Deryk Yue, counsel for D5, expressly indicated that D5 did not dispute that an iPhone (Exhibit P880) was found upon search at his office, nor did he dispute it was the same phone, i.e. Exhibit P880, which was handed to Police Constable 9273 (hereinafter referred to as 9273) for examination. The issues raised by D5 were:

(1) The actual ownership and user of the phone, Exhibit P880;

(2) the expert status of 8774 and his opinion; and

(3) the appropriateness and reliability of 9273’s way of extraction.

8.  D5 emphasized that in the present case, the police extracted data by using Cellebrite and converted it into a spreadsheet format for presentation. It was not the case that the investigating officer turned on the defendant’s mobile phone and used the camera to take images of the screen of the mobile phone directly. Therefore, it was different from the cases of Milne John and Kwan Ka Yiu relied upon by the prosecution. Furthermore, unlike the Kwan Ka Yiu case, D5 did not challenge as to whether the mobile phone was operating normally.

9.  D5 did not dispute that 8774 could give expert evidence in relation to Cellebrite’s process of extracting evidence, but disputed the acceptability of Cellebrite in the domain of digital forensics (i.e. within the industry), the reliability and stability of Cellebrite as a forensic tool, what the spreadsheet data converted from Cellebrite represented, and what the photo and video data converted from Cellebrite represented, etc.

10.  D5 also emphasized that 8774’s opinion on the reliability and stability of Cellebrite was based merely on his own use of Cellebrite on multiple occasions and that he had no knowledge of the development, maintenance and updating of Cellebrite devices or software, nor was it covered by the certificate course he had attended.

11.  D5 submitted that it was too arbitrary for the prosecution to aver that the Cellebrite software was reliable for the reason that the mode of presenting the evidence extracted by the forensic officer (i.e. Police Constable 9273) was consistent with the description given by 8774.

12.  D5 said the court could not take judicial notice of whether Cellebrite was internationally or industry recognized and widely accepted. The burden of proof was on the prosecution. The opinion of 8774 as to Cellebrite’s acceptability in the industry was based on hearsay evidence.

13.  D5 also submitted that some contents of the spreadsheets were incomplete, these included messages that had been deleted or retracted and blank messages, which affected the prima facie authenticity.

14.  D5 did not dispute that the prosecution could rely on circumstantial evidence to support whether the relevant digital evidence was prima facie authentic, but emphasized that the prosecution could not rely on the circumstantial evidence set out in its written submissions.[6]

15.  Regarding the Line application, D5 pointed out that the spreadsheets produced by Cellebrite on Line and Telegram were obviously different. The prosecution did not provide expert evidence on issues such as how the Line application operated, the principles and features of receiving and sending messages, account creation and login, etc.

16.  D5 emphasized that the court could not take judicial notice of the operation of Line. The court could not, by reason that Line was a social media, interpret the data in the spreadsheet in the absence of expert evidence. Moreover, it had no basis to judge or accept the spreadsheet of Line as prima facie authentic.

17.  D5 also complained about the reliability of the operation and function of the iOS. D5 said the prosecution had no evidence to explain what the digital data in the iOS represented, including the file path. Furthermore, the prosecution also had no evidence to explain, in relation to extracted contents, the installation circumstances of the relevant application, its status right before logged in and whether the browsing history showed any account login, etc.

18.  D5 said 8774 was not qualified to provide the relevant information. He had not received any professional training from Apple Inc., and the course he attended was not taught by Apple Inc.’s personnel. Therefore, his knowledge of the photos and videos in the Apple mobile phone was hearsay evidence.

19.  Regarding the issue of relevance, D5 complained that the prosecution had failed to state clearly how the co-conspirators rule would be applied. It seriously affected the way in which the defence assessed or disputed the evidence in the case.

20.  I have to point out that D5 initially said the conspiracy in this case ended with the arrest of D1 to D5 on 8 December 2019 at about 6:00 a.m.[7] Therefore, some of the documents which involved information or entries with relevant dates after the ending time of the conspiracy were irrelevant to this case. However, after the prosecution’s submission in reliance on the case of Cheung Ho-fai[8] that the Court of Appeal had pointed out that for the offence of conspiracy, the circumstantial evidence which the court may take into account includes evidence before and after the material time, and even the defendant’s words and behaviour before and after the material time so as to draw an inference as to whether he has committed the crime, then D5 no longer relied on this ground of objection.

Prosecution’s submissions

21.  Ms Juliana Chow, counsel on fiat for the prosecution and Mr Edward Lau and Mr Ng Wing-kit, Senior Public Prosecutors, submitted that although D5 claimed the operation of Cellebrite was unreliable to the extent that it affected the prima facie authenticity, D5 actually failed to give any basis concerning the unreliability of the operation of Cellebrite.

22.  The prosecution emphasized that the Telegram and Line messages found on D5’s iPhone (Exhibit P880) were completely normal in terms of time, date and chronology, and that the messages were contextually consistent and there was actually no evidence to suggest that the relevant messages were false or forged.

23.  The prosecution submitted that since D5 accepted 8774 as an expert to explain the use of Cellebrite for extraction of evidence, he also accepted that he had used Cellebrite on multiple occasions, this plainly showed there was a sound basis for 8774 to give expert evidence on the operation and reliability of Cellebrite. The prosecution pointed out that actually 8774 has started to handle forensic work since 2013 and has 11 years of experience so far. He has handled more than 600 cases, involving more than 4,000 digital mobile devices of different types which include mobile phones.[9]

24.  Regarding Cellebrite’s acceptability in the industry, the prosecution pointed out that 8774’s evidence was not based on hearsay, and that 8774 had in fact completed Cellebrite’s own digital forensic course on mobile devices and obtained the professional qualification of Cellebrite Certified Mobile Examiner. This showed that 8774’s opinion regarding Cellebrite’s acceptability or reliability in the industry was well grounded.

25.  In terms of circumstantial evidence, the prosecution relied on the circumstances that the same Telegram account named [“接完紙鶴未?”] (Finished folding (homonym) the paper crane(s)?) was found on D5’s mobile phone as well as on Wong Chun-keung’s and Ng Chi-hung’s mobile phones, and two of which showed the account’s unchangeable Telegram account number, which was [1008324484]. It could not be a coincidence. Also, extraction of Wong Chun-keung’s mobile phone was done by the police by filming, not by using Cellebrite.

26.  The prosecution stressed that actually Cellebrite was able to restore individual deleted messages, which gave a more complete account of the conversation and enhanced its prima facie authenticity.[10]

27.  The prosecution emphasized that whether the message was complete involved the issues of reliability and weight which should be considered and dealt with by the jury.

28.  The prosecution criticized D5 for accepting Apple as a world-renowned and widely used brand of mobile phone on the one hand while questioning the reliability of the operation of Apple’s iOS on the other hand.

My considerations

29.  Firstly, having read the written statement of 8774, I find 8774 could give expert opinion on digital evidence and give evidence as an expert witness.

30.  I took into account that the prosecution was only required to prove the relevant digital evidence was prima facie authentic and was not required to prove beyond reasonable doubt that the relevant digital evidence was correct.

31.  I accept the prosecution’s submissions that since D5 accepted 8774 to explain the use of Cellebrite for extraction of evidence as an expert, he also accepted that he had used Cellebrite on multiple occasions, this plainly showed that there was a sound basis for 8774 to give expert evidence on the operation and reliability of Cellebrite. I also agree that 8774 could, as an expert, give expert evidence on the acceptability of Cellebrite in the industry.

32.  Since the prosecution was only required to prove the relevant digital evidence was prima facie authentic and was not required to prove beyond reasonable doubt that it was authentic, it would be nitpicking to require the prosecution to call those who had developed Cellebrite or iOS, or those who had been directly taught or trained by them in the relevant programmes as expert witnesses to give evidence in court.

33.  I agree with the argument advanced by the prosecution in submission that circumstantial evidence could support whether the relevant digital evidence was prima facie authentic. What D5 raised was primarily concerned with the reliability of the messages, which was an aspect for the jury to consider.

34.  I find the prosecution has proved that the relevant digital evidence was prima facie authentic and therefore, it can be produced in court.

35.  It is true that even though the expert gave evidence, the jury must still consider whether to accept the expert’s evidence or not.

Translated by the Court Language Section of the Judiciary and vetted by Mr P Y Lo, Barrister-at-law.