ONTARIO

SUPERIOR COURT OF JUSTICE

COURT FILE NO.: 10-5025

DATE: 20130729

BETWEEN:

HER MAJESTY THE QUEEN

– and –

David Eaton

Accused

James Cavanagh, for the Crown

Bruce Engel, for the Accused

HEARD: April 29, 2013 and May 13-14, 2013

ruling on qualifications of detective warren bulmer

Toscano Roccamo J. (orally)

[1] After a two day voir dire ending on May 13, 2013, the Crown sought to qualify Detective Warren Bulmer as an expert in the following areas:

1. On the operation of the Facebook website from an end user’s perspective, as this relates to number 4 below;

2. In particular, on the operation and appearance of the “News Feed” feature on Facebook as this relates to number 4 below;

3. On the nature and function of “hyperlinks” in HTML format internet websites including Facebook, and in the Microsoft Word, word processing program, as this relates to number 4 below;

4. To provide evidence regarding “copy” and “paste” functions from HTML format on an internet website, specifically Facebook, into different versions of the Microsoft Word programs, and the operation of the “auto-correct” feature of the different versions of the Microsoft Word programs, again from the perspective and experience of an end user; and

5. Assuming that the “Joose Chabot” entry in Exhibit “A” was copied from a Facebook News Feed and pasted into a Microsoft Word document, would the expert expect the auto-correct feature of the Microsoft Word program to change the spelling of the name from “Josée Chabot” to “Joose Chabot.”

[2] At the conclusion of argument in the voir dire, I qualified Detective Bulmer as an expert in the noted areas, with written reasons to follow, as set out below.

Background

[3] The Crown retained Detective Bulmer to offer an opinion as to the Facebook features which bear on the validity of the News Feed post from “Joose Chabot” found in Exhibit “A” filed at trial. This document was put to the Complainant, Marie-Josée Chabot, in cross-examination, and purported to be a hard copy of posted comments made by her and others in April 2009, to the Accused’s Facebook News Feed. Ms. Chabot was specifically referred to a post, dated April 15, 2009, from “Joose Chabot” to the Accused as evidence of communications between them in which they discussed vacationing together only ten days prior to an alleged sexual assault on the night of April 25, 2009. Ms. Chabot admitted that a similar communication may have occurred at some point, but denied any serious conversation on the subject, and denied any romantic interest in the Accused. Secondly, she denied having any Facebook profile under the name of “Joose Chabot”, or ever having spelled her name that way. Finally, after the allegations were made which gave rise to the criminal charge against the Accused, Ms. Chabot took steps to block the Accused from being among her Facebook friends.

[4] Pursuant to an admission made under s. 655 of the Criminal Code, R.S.C. 1985, c. C-46, and entered as Exhibit 20 at trial, the Accused explained the process by which he was able to generate a hard copy of Exhibit “A”.

The Position of the Crown

[5] The Crown took the position that Detective Bulmer is qualified to provide expert opinion in the areas proposed, based upon the training and the practical experience he acquired in the course of police investigations. In addition, the Crown argued that Detective Bulmer offers important testimony with respect to a series of experiments he carried out, specifically in regard to this case, in an attempt to re-create Exhibit “A”. The results of these experiments were set out in his report filed on the voir dire as Exhibit “C”, in appendices B through E inclusive.

The Position of the Defence

[6] The Defence conceded Detective Bulmer’s expertise in the areas described in numbers 1 and 4 above. In other words, the Defence conceded that Detective Bulmer is qualified to provide expert testimony from the end user’s perspective and experience on the “copy” and “paste” functions from HTML format internet websites, including Facebook, into different versions of the Microsoft Word programs, as well as the operation of the “auto-correct” function of the different versions of the Microsoft Word programs, from the perspective and experience of the end user.

[7] The Defence also agreed that Detective Bulmer could provide limited testimony in the areas described in numbers 2, 3, and 5, above, insofar as he is familiar with the operation and appearance of News Feeds on Facebook, and hyperlinks in internet websites, including Facebook and in Microsoft Word, and word processing programs involving “copy” and “paste” functions from Facebook into Microsoft Word programs. However, the Defence took the position that Detective Bulmer would be unable to offer any useful guidance about whether or not the auto-correct feature of Microsoft Word, used by the Accused to generate Exhibit “A” from his Facebook News Feed, would change the spelling of “Josée Chabot” to “Joose Chabot.”

[8] The Defence relied on a number of admissions made by Detective Bulmer in cross-examination on the voir dire to challenge the admissibility of Detective Bulmer’s evidence with respect to matters bearing on the authenticity and validity of Exhibit “A”. The Accused took the position that Detective Bulmer’s experience with the Facebook features at the material times in 2009 would substantially limit the value of any opinion he might provide on the subject. Therefore, despite some familiarity with the relevant technology as it existed in 2009, the Defence argued his evidence would ultimately be distracting and unhelpful.

The Onus

[9] The onus is on the Crown to establish Detective Bulmer’s expertise on a balance of probabilities: see R. v. Baxter, 2009 ONCJ 16 (Ont. Ct. J.), at para. 52, citing McWilliams’ Canadian Criminal Evidence (4th ed.) 12.30.20.50, pp. 12-54, and R. v. Terceira (1998), 1998 2174 (ON CA), 123 C.C.C. (3d) 1 at 21, aff’d 1999 645 (SCC), 142 C.C.C (3d) 95 (S.C.C).

The Evidence on Voir Dire

[10] Detective Bulmer is a 23 year veteran of the Toronto Police Service, currently seconded to the Toronto Police Fugitive Squad. He is also a full-time instructor at the Toronto Police College where he teaches Computer and Technology Facilitated Investigations, a course he designed in September 2009 and has taught since January 2010, to over 750 investigators from across Canada who conduct computer and cyber crime-related investigations.

[11] Detective Bulmer’s curriculum vitae (“CV”) was entered as Appendix V of Exhibit “C” on the voir dire, and is attached as Appendix 1 to this Ruling. In addition to related national and international teaching assignments, Detective Bulmer’s CV reflects that the main focus of his career over the years has been on the collection and preservation of digital evidence in child exploitation and pornography investigations. Much of this draws upon his skills in computer-based forensic examination, including use of internet and social media websites such as Facebook, and preservation of evidence using Microsoft Word applications. Detective Bulmer’s testimony on the voir dire highlighted his secondment between October 2010 and February 2011 to the Social Media Working Group of the Toronto Police Service where he was tasked with writing policy for police use of social media, including Facebook.

[12] His CV further reflects continuous involvement or attendance at numerous internal Toronto Police Services courses and seminars, as well as national and international conferences and workshops on related topics. As examples, in 2004, he undertook training in ethical “hacking” and technical investigative techniques. In 2005, he undertook the study of software used in computer forensic examination and undercover operations on the internet through the Canadian Police College, as well as forensic software training in the United States involving detection of stenography and image alteration techniques. In 2006 and 2007, he undertook advanced studies on Adobe Photoshop and image enhancement and alteration. In 2008, he was the keynote speaker at a conference hosted by the United States Department of Justice on analyzing digital evidence, which included the location, preservation and storage of data by copying and pasting. In the same year, he attended a Microsoft computer forensics laboratory on Windows-based computer forensics. His curriculum design and teaching since 2009 of Computer Facilitated Investigations at the Toronto Police College has already been noted. In 2011 and 2012, he took courses on intermediate and advanced Microsoft-related programs including PowerPoint, Word and Excel. In 2012, when the Toronto Police Service migrated to Microsoft Sharepoint, he developed software for police use, and trained others within the Toronto Police Service to teach its application in child exploitation investigations.

[13] Detective Bulmer has authored and co-authored a number of publications on digital evidence which are detailed in his CV.

[14] Detective Bulmer is regularly consulted by various police services and Crown Prosecutors. In fact, he was referred by Emily Vacher, the Law Enforcement Officer of Facebook for North America, to a British Columbia Crown Prosecutor in an unreported decision in R. v. Warrington (4 March 2013), Port Coquitlam 85462-2C (B.C. Prov. Ct.). He previously collaborated with Ms. Vacher in developing law enforcement protocols in cases where police are required to request and preserve digital evidence.

[15] Finally, he has been qualified as an expert in computer forensics after a voir dire on his qualifications on two separate occasions by our Court in unreported decisions in R. v. Findlay (15 October 2007), St-Thomas 3476/07 (Ont. Sup. Ct.), and in R. v. Hughes (24 June 2008), Toronto P254-08 (Ont. Sup. Ct.), and twice by our Provincial Courts. On one occasion, his evidence was not admitted by our Court following a voir dire in the unreported decision in R. v. McDermott (28 May 2009), Guelph CR 09-0824 (Ont. Sup. Ct.), on the basis that the evidence offered in that case would not go beyond any conclusions the Court could draw without expert evidence. The cases in which Detective Bulmer’s evidence was received as an expert involved copying and pasting data from an Accused’s computer to Microsoft Word. While such data did not involve Facebook News Feeds, it did involve material from other social network internet sites and included texts, screen shots, pictures and movies. In all cases where Detective Bulmer was qualified as an expert, his reports were filed in evidence.

[16] Detective Bulmer has had both personal and professional access to Facebook since 2007. He has written Production Orders with Facebook in the course of his employment. He has also used Microsoft Word and hyperlinks employed by various internet websites since 1995, but has used Facebook and Microsoft Word to copy hyperlinks from document to document, including portions of web pages like Facebook to Microsoft Word since 2009. In cross-examination, he candidly admitted that he has no special knowledge or interest in the history of Facebook or how it was formed, nor is he privy to any trade secrets involving the workings of Facebook technology. He also agreed that he never conducted forensic testing of Facebook News Feeds in 2009, and cannot now access Facebook codes from 2009 in order to identify a Facebook account as it existed in 2009. However, he described the changes to Facebook News Feeds today as primarily “semantic” changes or changes that Facebook made to update their programs and which were not otherwise dramatic changes. He also described the advantages he acquired through special training and experience as an advanced user of Facebook and Microsoft Word over the average user, including his ability to apply investigative techniques and expertise in reading and deciphering information on Facebook. For example, in the past, he has been able to trace Facebook messages by exploiting vulnerabilities in Facebook applications which required that he crack computer codes Facebook was using, without Facebook awareness or involvement.

[17] Detective Bulmer admitted that over the course of a week in April 2013, while attempting to investigate the authenticity of Exhibit “A”, he was unable to re-create its contents, due to the fact that Exhibit “A” is a photocopy of a Word document and his analysis could not accommodate every possible version of Word software used to create the document. In addition, when he contacted Facebook to determine if Exhibit “A” was consistent with News Feed coding in 2009, Facebook declined to assist because it was not a document from their website; rather it was a Word document copied by highlighting and selecting information which was subject to manipulation or alteration. However, Detective Bulmer maintained that he has acquired knowledge of how hyperlinks appear on Facebook accounts since 2008; therefore, if evidence was received that Ms. Chabot blocked the Accused’s account and removed him as a Facebook friend after April 2009, no testing would be required to conclude that Ms. Chabot would not have appeared at all on the Accused’s Facebook account in this News Feed. In addition, the experiments he conducted using a select number of operating systems and web browsers in use in 2009 and 2010, over the timeframe the Accused admits to having generated Exhibit “A”, revealed that at no time was the text of a hyperlink copied and pasted onto a Microsoft Word document using the auto-correct feature of any Word processing program. Moreover, at no time in his testing did any program employed alter a single hyperlink to add or remove underlining in the hyperlink, while uniformly removing or maintaining the underlining in the other posts to a News Feed. In all experiments undertaken, he noted consistency in the appearance of hyperlinks which was not the case in Exhibit “A”.

Analysis and Conclusions

[18] The Supreme Court of Canada in R. v. Mohan, 1994 80 (SCC), [1994] 2 S.C.R. 9, at para. 17, set out four criteria that must be met in order to admit expert evidence. The admission of expert evidence will depend on establishing:

1. Its relevance;

2. Its necessity in assisting the trier of fact;

3. The absence of any exclusionary rule; and

4. A properly qualified expert.

Relevance

[19] The relevance of Detective Bulmer’s evidence was well established. The Defence put the contents of Exhibit “A” to the Complainant in cross-examination, and she unequivocally denied spelling her name as it appeared in Exhibit “A”. The Accused also filed in evidence as Exhibit 20, the process by which he generated Exhibit “A”.

[20] I accept that logically relevant testimony may still be excluded under this criteria of Mohan if its probative value is exceeded by its prejudicial effect; if its admission requires an undue investment in time; and/or if it is misleading in that its effect is disproportionate to its reliability; however, I find that Detective Bulmer’s evidence on voir dire was probative in that he explained his ability to discuss those aspects of Facebook and Microsoft Word which would help clarify both Exhibit 20 and Exhibit “A”. He was also careful and measured in acknowledging the limits of his opinion, including the fact that there was no digital copy of Exhibit “A” to work from and that Facebook would provide no assistance to him in all of the circumstances in evaluating the contents of Exhibit “A”. However, he emphasized that the process described by Exhibit 20 relied more upon an understanding of Word processing features of Microsoft Word than Facebook. Finally, Detective Bulmer’s evidence in relation to the “auto-correct” and “copy” and “paste” features, as they affect hyperlinks, was material in addressing the process by which the Accused said that he created Exhibit “A”. This evidence did not require an inordinate amount of time disproportionate to the value of the evidence.

Necessity

[21] The matters about which Detective Bulmer proffered testimony are highly technical in nature. I am unable to understand Exhibit 20 and Exhibit “A” without his guidance, and I am satisfied that the subject matter is one about which the average person could not form a judgment. In any event, the necessity of the evidence per Mohan, is not to be judged on too strict a standard, and I am grateful to Defence counsel for highlighting the fact that Detective Bulmer’s evidence is not to be received so as to determine an ultimate issue such as the credibility of the parties. This remains strictly within my domain.

The Absence of Any Exclusionary Rule

[22] I was not referred to any other rule of evidence which requires the exclusion of Detective Bulmer’s evidence.

A Properly Qualified Expert

[23] Finally, insofar as Detective Bulmer’s qualifications are concerned, the suggestion was advanced during the cross-examination of Detective Bulmer that his expertise did not include the testing of Facebook at times material to these proceedings in 2009 and 2010, at the time the Complainant and the Accused communicated on Facebook, and subsequently when the Accused created Exhibit “A”. It was put to him that his understanding of Facebook and Microsoft Word programming features was really that of the practiced user, and not a subject about which he is an expert. I cannot agree. Detective Bulmer squarely established his expertise both through his studies and practical experience. While he used Facebook personally in 2005 and 2006, he began to use it in the course of employment in 2007 and has been copying and pasting it onto Microsoft Word documents since 2009. He was familiar with hyperlinks and News Feeds in Facebook, and with the appearance of account names in Facebook in 2009. He testified about the appearance of News Feeds in 2009 as compared to the present date, and in particular about the difference between the appearance of News Feed posts and other messaging options such as “chat” and “private messages” in Facebook, as well as the effect of “blocking” or “defriending” in 2009 to the present day. As previously noted, Detective Bulmer began developing a curriculum for the Toronto Police College in 2009 and has taught computer and technology facilitated investigations since 2010.

[24] In any event, Mohan, at para. 27, provides that expert evidence may be received from a witness who has acquired special or peculiar knowledge through study or experience. I would not exercise my discretion to exclude his evidence on the basis that he has acquired his expertise primarily through his experience as a police officer. In this regard, I observe that other courts have allowed police officers to testify as experts from the experience they have acquired in their police work: see R. v. Lindsay, 2005 24240 (ON SC), [2005] O.J. No. 2870 (Ont. Sup. Ct.) at paras. 188, 178 and 616; R. v. Baxter, 2009 ONCJ 16 (Ont. Ct. J.); R. v. Parisien, 2011 ONCJ 354 (Ont. Ct. J.).

Case Specific, Cost Benefit Analysis

[25] Although I have concluded that Detective Bulmer’s evidence meets the criteria in Mohan, I have considered whether Detective Bulmer’s evidence should nonetheless be excluded in the exercise of the Court’s gatekeeping function as described in R. v. Abbey, 2009 ONCA 624, 97 O.R. (3d) 330 (Ont. C.A.), at paras. 76, 86-91, and 94, on the basis that Detective Bulmer’s evidence is not sufficiently beneficial to the trial process to warrant its admission. In undertaking a case specific, cost benefit analysis, I have noted among the Defence arguments the concern that Detective Bulmer has admitted that he cannot testify on the specific encoding features of Facebook in 2009; did not receive Facebook assistance in this regard; and could not carry out comprehensive testing using every version of every operating system and web browser, as noted in his report at Exhibit “C”. He has conceded that, by his limited experiments, described in Appendices B to E inclusive in Exhibit “C”, he cannot attest to the authenticity of Exhibit “A”. While all of this is acknowledged, and the limits of the experiments carried out by Detective Bulmer were exposed by able cross-examination, in my opinion, this does not undermine the admissibility of his evidence on these experiments. I note somewhat parallel limitations in the evidence on cell phone test calls received in R. v. Cyr, 2012 ONCA 919 (Ont. C.A.) at paras. 108-111. Nevertheless, I have found Detective Bulmer’s evidence to be both relevant and material, and note that, generally, such evidence is received, subject to the Court’s general exclusionary discretion: Cyr, at para. 119.

[26] In addition, I have concluded that Detective Bulmer can offer some assistance to the Court in respect of the operation of Facebook, and even more so, in respect of Microsoft Word’s processing features, such as the “auto-correct” and “copy” and “paste” features, as they affect hyperlinks. This is particularly so as he has worked with these features for 14 years. The Defence quite properly agreed that Detective Bulmer may offer some assistance in this area.

[27] Although not binding upon me, I have also found the dicta of the Saskatchewan Court of Appeal in R. v. Fisher, 2003 SKCA 90, 18 C.R. (6th) 377 (Sask. C.A.), at paras. 19-20, of some guidance, although only cited for other reasons by our courts: see R. v. Atlee, 2010 ONCJ 72 (Ont. Ct. J.); R. v. Paul, [2004] O.J. No. 1334 (Ont. Sup. Ct.); R. v. Nicholas (2004), 70 O.R. (3d) 393 (Ont. C.A.). Fisher, at paras. 19-20, provides as follows:

Deficiencies in the knowledge of the witness such as lack of more training in statistics, lack of personal knowledge of the compilation of the data base and reliance upon the study of others, went to the weight to be given to the evidence, not to its admissibility. The Defence very skilfully brought out all of these deficiencies in the cross-examination of Ms. Charland. It was for the jury to decide the weight to be given to the evidence in all of these deficiencies.

Furthermore, the Defence was not left helpless in the circumstances. It could have led its own expert evidence to contradict that of the Crown if it believes the Crown experts’ evidence to be wrong or misleading. It did not do so.

[28] The approach in Fisher is in line with what the Supreme Court of Canada said in R. v. Marquard, 1993 37 (SCC), [1993] 4 S.C.R. 223, at para. 5, where it held:

The only requirement for the admission of expert evidence is that the “expert witness possess special knowledge and experience going beyond that of the trier of fact”: R. v. Béland, 1987 27 (SCC), [1987] 2 SCR 398, at p. 415. Deficiencies in the expertise go to weight, not admissibility. As stated by Sopinka, Lederman and Bryant, The Law of Evidence in Canada (1992), at pp. 536-37:

The admissibility of such [expert] evidence does not depend on the means by which that skill was acquired. As long as the court is satisfied that the witness is sufficiently experienced in the subject-matter at issue, the court will not be concerned with whether his or her skill was derived from specific studies or by practical training, although that may affect the weight to be given to the evidence.

[29] I have also considered the fact that the evidence of Detective Bulmer advances trial fairness, having regard to the Complainant’s testimony as to her limited understanding of cell phones and computers, and the evidence of both Sarah Saska-Crozier and Andrew Conroy, both roommates of the Accused at the material times, and who have given evidence for the Crown, as to the Accused’s proficiency with both cell phones and computers. Without the assistance of Detective Bulmer, the Crown is unable to address the evidence tendered by the Defence in both Exhibits 20 and Exhibit “A”.

Conclusion

[30] Notwithstanding its limitations, I have concluded that the probative value of Detective Bulmer’s evidence exceeds its prejudicial effect, and very little trial time was devoted to its review. More importantly, I am not concerned here that a jury may employ the evidence beyond its permitted use. I remain mindful of the fact that receiving this evidence does not divest this Court of its responsibility to determine the credibility of the parties and the weight, if any, to be assigned to the evidence of Detective Bulmer as a part of the body of evidence I have received, and have yet to receive in this case.

Madam Justice Toscano Roccamo

Released: July 29, 2013

COURT FILE NO.: 10-5025

DATE: 20130729

ONTARIO

SUPERIOR COURT OF JUSTICE

B E T W E E N:

HER MAJESTY THE QUEEN

– and –

David Eaton

Accused

ruling on qualifications of detective warren bulmer

Toscano Roccamo J.

Released: July 29, 2013