The Principles of Electronic Evidence

Including the APCO Good Practice Guide



Menu:

Related Definitions

APCO: Association of Chief Police Officers

Digital Evidence: Information stored or transmitted in binary form that may be relied upon in court.

Electronic Evidence: Electronic evidence is information and data of investigative value that is stored on or transmitted by an electronic device.

Evidence: The means by which something is proved.

About Us:

The Legal Practitioner is an encyclopedic reference point intended to define and explain many of the terms and concepts relating to the legal aspects of information technology governance and management.

It is part of the Practitioner.Com portal, which is a hub of expertise for professional practitioners acress a range of IT subject topics.

Coming Soon:

The Practitioner Blog, which will include information and commentary on current incidents and events.

Electronic Evidence: Legislative Considerations

Each different jurisdiction has differing principles of electronic evidence but they are all similar to the ones defined by the Association of Chief Police Officers (ACPO) in the UK ‘Good Practice Guide for Computer Based Evidence’ (Version 3) defines the four principles of Electronic Evidence:

Principle 1: No action taken by law enforcement agencies or their agents should change data held on a computer or other media which may subsequently be relied upon in court;

Principle 2: In exceptional circumstances, where a person finds it necessary to access original data held on a computer or storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions;

Principle 3: An audit trail or other record of all processes applied to computer based evidence should be created and preserved. An independent third party should be able to repeat those processes and achieve the same result;

Principle 4: The person in charge of the investigation (the Incident Manager or the Laboratory Manager) has overall responsibility for ensuring that the law and these principles are adhered to.

APCO - Association of Chief Police Officers

The ACPO guidelines expand the four principles above with the following explanation: ‘Computer based evidence is no different from text contained within a document. For this reason, the evidence is subject to the same rules and laws that apply to documentary evidence.'

The doctrine of documentary evidence may be explained as:- The onus is on the prosecution to show to the court that the evidence produced is no more and no less now than when it was first taken into the possession of police.