The Originality of Digital Evidence and the Retention of Seized Digital Devices by Law Enforcement Officers in South Africa

Abstract

Information and communication technology (ICT) devices, including mobile phones, laptops, computers and data storage mediums, such as memory sticks, are being seized daily by law enforcement agents. These devices are seized for different reasons in terms of the provisions of sections 21 to 23 of the Criminal Procedure Act 51 of 1977 and now, in terms of the provisions of sections 28 and 29 of the Cybercrimes Act 19 of 2020. The seizure and extended retention of such devices by law enforcement can have a devastating impact on businesses and individuals. In virtually all cases, the main objective of seizing an ICT device is to secure its data for purposes of investigation and the collection of evidence. This excludes, inter alia, cases where a device contains contraband and cannot be handed back to the suspect or in a case where circumstances justify forfeiture to the state. This article is limited to cases where the physical device has no evidential value. It is contended that the content of the evidential data and the requirement of originality on an ICT device is met by scientifically created forensic duplicates of the data, which negate law enforcement from unnecessary seizure and retaining the original device. The authors contend that ICT devices should only be seized in situations where a forensic duplicate of the evidential data cannot be created on the scene and, if seized, the evidential data should be forensically duplicated, and the original device returned within a pre-determined period. An extension of the pre-determined period should only be granted by a magistrate upon application. It is recommended that the subject be researched further, to arrive at a reasonable, pre-determined period, and that the Criminal Procedure Act 51 of 1977 and Cybercrimes Act 19 of 2020 be amended accordingly.