RESOURCES FOR HUMAN RIGHTS DOCUMENTERS
Chain of Custody
This section is aimed at providing human rights documenters with guidance around Chain of Custody, and was written by PILPG.
What is Chain of Custody?
Chain of custody is a legal concept that refers to the “journey” that a piece of evidence takes from the time it is collected through its presentation in court. During this journey, it is shared with others, and its maintenance is important to ensure the accused a fair trial.
Proper chain of custody guarantees that such evidence used against him or her has not been manipulated or tampered with, or that when evidence is presented, it is in the same condition as when it was first collected. Specifically, it refers to the sequential record of custody, control, transfer, analysis, and disposition of materials.
In other words, a preserved chain of custody helps to prove the authenticity and reliability of a piece of evidence. For any piece of information or object to be used as evidence, the chain of custody must remain intact and records of this chain should be available when needed. It legitimises the evidence to both the court and to all relevant parties that it has not been tampered with.
In human rights documentation, chain of custody indicates:
- The location of a piece of information (including documentary, forensic, and testimonial information) from the moment it is collected until it is introduced at trial;
- All individuals who handled the information over that period; and,
- The purpose for which they handled it (i.e. Did they analyse it? Did they transfer it?).
Why is Preserving Chain of Custody Important?
A perfect chain of custody may not be necessary for data to be admitted. However, a strong chain of custody increases the weight that judges place on the admitted evidence.
This enhances the probative value of information. Probative value is a legal concept used to describe the extent to which a piece of information tends to prove something material about the crime alleged. A piece of evidence has probative value and is reliable when the evidence is “voluntary, truthful and trustworthy.”
Preserving the Chain of Custody of Digital Evidence
In the early days of investigation and documentation, investigators would attach “evidence logs” or chain of custody forms to each piece of evidence. These documents would be used to record every individual that handled, analysed, or modified the evidence in any way. A sample of one of these forms can be found in section 15 of PILPG’s documentation field guide.
Increasingly, perpetrators, victims, and witnesses of serious human rights violations create, store, and/or share information and evidence in digital form rather than hard copy. Digital evidence can be defined as “information transmitted or stored in a digital format that a party to a case may use at a proceeding,”¹ and may come in various forms, including:
- Metadata
- Audio and video recorded testimony
- Digital photography
- Video documentation
- Email and networked communication
- Text messages or SMS communication
- Posts on social media or news broadcasting platforms.²
As with any other type of information presented in court as evidence, digital information will be subjected to scrutiny to determine its probative value. While precedent is still being developed on standards for the admissibility of digital evidence in international courts, a few courts have offered guidance that aligns with the standards for physical evidence. The International Criminal Tribunal for the Former Yugoslavia (ICTY), for example, noted that proof of authorship still “assumes the greatest importance in the Trial Chamber’s assessment of the weight to be attached to individual pieces of evidence.”³
Ad hoc tribunals (such as the ICTY) have generally favoured the corroboration of digital evidence through external indicators such as expert testimony or multiple types of evidence.
The International Criminal Tribunal of Rwanda (ICTR), for example, held that radio announcements calling for the apprehension of Tutsis were authentic after an expert witness testified that following the announcements, people actively sought out Tutsis. Two additional witnesses corroborated the experts’ testimony by describing the events that preceded and succeeded the announcements.
1. See Eoghan Casey, Digital Evidence and Computer Crime (3d ed. 2011).
2. Salzburg Workshop in Cyber Investigations, An Overview of the Use of Digital Evisence in International Criminal Courts (Oct. 2013) at 1
3. Prosecutor v. Brdanin and Talic, Case No. IT-99-36-T, Order on the Standards Governing the Admission of Evidence, ¶ 18 (International Criminal Tribunal for the Former Yugoslavia, Feb. 15, 2002).
Although courts may not have shared a clear cut set of guidelines for admitting digital evidence and how documenters are best to maintain chain of custody, the following factors have been consistently applied across the ICTY, ICTR, and other international tribunals:
- Method of evidence collection employed by civil actors
- Number and quality of sources collected
- Degree of corroboration between civil actors
- Degree of neutrality of civil actors
- Degree of proximity of civil actors to the evidence to be collected
- Contemporaneity with events, and
- Degree of compliance with procedural requirements.
When it comes to admitting digital photo or video evidence in particular, this data can usually be authenticated by corroborating witness testimony. However, without a live witness – most likely the photographer – to testify to the accuracy of the photo, there are other considerations that courts may take into account. Documenters can, for example, authenticate photos or videos they wish to admit as evidence by embedding metadata.
Metadata is information that describes a digital resource by some of its basic characteristics, such as its creator and the date of its creation. It may be created external to the resource it describes, or it may be embedded automatically in the resource itself. A common method of creating metadata manually is by completing a form, either in writing or electronically, using predefined categories and vocabularies.
Metadata is important because it verifies the reliability of the data being presented, proving that it is what a lawyer is claiming it to be. A time stamp on a photo or video, for example, can verify that the image or recording was taken at the time being claimed.
More resources on Chain of Custody
- The International Criminal Court has a document titled the Unified Technical Protocol, or “E‐court Protocol,” to offer documenters and investigators guidance on the standards digital data must meet to be admitted as evidence to the Court. The Protocol requires metadata to be attached, including the chain of custody in chronological order, the identity of the source, the original author and recipient information, as well as both the author’s and recipient’s respective organisations.
- Watch a 2022 expert roundtable discussion on the use of digital evidence in international courts, with perspectives from prosecutorial, defensive, and academic perspectives.