ONTARIO
SUPERIOR COURT OF JUSTICE
COURT FILE NO.: 339/13
DATE: 2014-03-19
B E T W E E N:
Her Majesty the Queen
Mark Poland, for the Crown
- and -
Marlon Nurse and Darryl Plummer
Enzo Battigaglia, Counsel for Mr. Nurse
Margaret Bojanowska and Kate Oja, Counsel for Mr. Plummer
HEARD: March 14, 17, 2014
ENDORSEMENT
PUBLICATION BAN:
Pursuant to subsection 648(1) of the Criminal Code,
no information regarding this portion of the trial shall be published in any document
or broadcast or transmitted in any way before the jury retires to consider its verdict.
Coroza, J
OVERVIEW
[1] Marlon Nurse and Darryl Plummer (the “applicants”) stand charged that they committed first degree murder. The deceased was Devinder Kumar. The Crown alleges that Mr. Kumar was Mr. Nurse’s landlord and that he planned and recruited Mr. Plummer to carry out the murder in return for a promise of financial reward.
[2] The Crown argues that the plan is revealed by a series of Blackberry Messenger (BBM) chats that passed between the Blackberry phones of Mr. Nurse and Mr. Plummer in the days leading up to the murder.
[3] Both men were arrested and the Blackberry phones were seized incident to arrest.
[4] The phones were kept in an OPP vault until November 16, 2011, when they were removed and provided to the OPP Ecrimes Unit pursuant to a warrant issued by Justice of the Peace Creelman that day.
[5] The OPP Ecrimes unit could not access the phones because they were password protected and the OPP did not have the technical expertise to physically extract the computer chips from the phones in order to defeat the passwords.
[6] On November 23, 2011 they provided the phones to the RCMP Technological Crime Unit. The RCMP had the expertise to retrieve the data of Blackberry devices locked by a password.
RCMP SEARCH
[7] A forensic copy of the memory of the phones was retrieved by a process of physical extraction. This was done by the RCMP on November 25 for Mr. Nurse’s phone and on December 8 for Mr. Plummer’s phone.
[8] The memory was then imaged and a BIN file created. The BIN file contained the raw data (described as a series of 0s and 1s). The BIN file that was created for each phone was eventually provided to the OPP and stored on an OPP server.
[9] This raw data was then analyzed by software. The analysis took place on December 9, 2011, for Mr. Nurse’s phone and on December 12, 2011, for Mr. Plummer’s phone.
[10] A year later, the program for analyzing the raw data had been updated and, at the request of the Crown, the police accessed the BIN file on the OPP server and conducted a second examination with the updated software. The second examination revealed deleted BBM text/chats between the two accused.
THE WARRANT AND INFORMATION TO OBTAIN (ITO)
[11] The warrant issued on November 16 was in Form 5. It is not disputed that the affiant used an outdated Form 5 which on the faceplate contained the following words “…that are being sought as evidence in respect to the commission, suspected commission, or intended commission of an offence against the Criminal Code”.
[12] The Information to Obtain (ITO) revealed to the issuing justice that the police were looking for communications between Mr. Nurse and Mr. Plummer that they believed would reveal planning and deliberation with respect to the murder of Mr. Kumar.
[13] The affiant made it clear that he believed the phones would contain communications and correspondence that would reveal this plan. He also made it clear that he believed that Mr. Nurse’s computers would show correspondence between Mr. Nurse and Mr. Kumar and would show that Mr. Nurse was being pressured by Mr. Kumar for rent money.
[14] While the affiant did not specifically outline that the police would be extracting data from the phones, at paragraph 31, he disclosed that the phones would be taken to the OPP Ecrimes Unit. He described the unit as a unit that investigates computer crime and specializes in the forensic analysis of electronic evidence, including the recovery and analysis of data stored on computer systems, cellular telephones and other electronic devices[1].
[15] At paragraph 48 of the ITO the affiant added that the OPP Ecrimes Section provided the investigative skills to access and present evidentiary information. He asserted that an examination of the computer or a Blackberry Handset could reveal data that was currently stored on the handset or data on the handset that has since been deleted[2].
[16] The issuing justice signed the Form 5 warrant to search on November 16, 2011. Affixed to the Form 5 is “Appendix A” that specifically states that the OPP will enter the OPP Vault in Caledon and that a search will be conducted on a number of electronic items listed[3]. The phones are part of that list.
[17] Under the heading “Things to be Searched For”, in “Appendix A” the affiant listed the following:
a) Computer system and its peripherals and related devices, including the video monitor, any input or output devices, and associated communication equipment;
b) Devices or media capable of storing data[4];
c) Devices, media and documents containing computer passwords;
d) Operating systems and computer programs; and
e) Computer system or software manuals and reference materials.
ISSUE
[18] The trial of this matter is scheduled to commence on March 31. Pre-trial motions commenced in January and a s. 8 Charter challenge has been brought by the applicants. As a preliminary matter, the parties require a ruling as to whether the search of the phones was conducted with a valid warrant.
[19] I decline to make any finding as to whether the searches executed by the police pursuant to this warrant were overbroad or unreasonable. The parties confined their submissions to the issue of whether the warrant was valid on its face.
[20] If I hold that the warrant was invalid, the onus shifts to the Crown to show that the search was reasonable. If I find that the search was of the phones was conducted with a valid warrant, the applicants bear the onus to establish a breach of their s. 8 rights.
[21] The parties have agreed that I can rely on the warrant issued by the justice on November 16, 2011, the ITO of the affiant sworn November 16, 2011; the officer’s return to the justice dated February 23, 2012; the testimony of Mr. Gino Vecchio, a civilian employee of the RCMP given at the preliminary hearing; and the RCMP Investigative Report dated December 12, 2012.
[22] Mr. Battigaglia (for Mr. Nurse) submits the search of the phones was warrantless for the following reasons:
On the face of the warrant the place to be searched is the “General Property Vault of the OPP” and does not name any of the phones as a place to be searched;
The face of the warrant authorizes a search based on the suspected commission of an offence which is less than the standard required by s. 487 of the Criminal Code; and
The authority to search under the warrant expired at 9:00 p.m. on November 16, 2011. It is not disputed that the RCMP conducted their search for data on November 25.
[23] Ms. Bojanowska (for Mr. Plummer) adopts Mr. Battigaglia’s submissions and makes the submission that there is a defect on the face of the warrant because it does not say that there will be a search of the data found in the cellphones. Counsel highlights that in Appendix A the affiant has listed things to be searched for and has not mentioned that text message communications, data communications or any data will be searched. She argues, on its face, the warrant has not authorized the search for data and that the search conducted by the RCMP was warrantless.
[24] Counsel argues that the warrant only authorized a physical transfer of the phones from the OPP Vault to the OPP ECrimes Unit for an initial visual inspection to determine what could be done with the phones. Once it was determined that the OPP would not able to conduct an analysis on the password protected phones, a justice would have to be informed that the phones were password protected because it engaged additional privacy interests and a second warrant was required for the RCMP to break through this password and extract the data from these phones.
ANALYSIS
[25] With respect to challenges as to the facial validity of the warrant, I must examine only the face of the warrant and the ITO and stay within the four corners of the documents that were before the issuing justice. I do not go behind the ITO to consider the credibility or reliability of the assertions made by the affiant[5].
MR. BATTIGAGLIA’S SUBMISSIONS
ISSUE 1: PLACE TO BE SEARCHED IS THE OPP VAULT
[26] Mr. Battigaglia argues that on the face of the warrant the place to be searched is described only as “General Property Vault of the OPP” and does not name any of the phones as a place to be searched. I reject this position. The submission ignores that Appendix A was used and forms part of the faceplate of the warrant. The Appendix explicitly describes that the OPP will be entering the vault and conducting a search on electronic items including the phones. The appendix forms part of the warrant.
ISSUE 2: THE “BRANTON ERROR”
[27] Mr. Battigaglia argues that the warrant authorizes a search based on the suspected commission of an offence which is less than the standard required by s. 487 of the Code[6].
[28] In Branton, a search warrant was issued during an investigation under the Radiocommunication Act. The warrant purported to authorize the search and seizure of “things….that are being sought as evidence in respect of the commission, suspected commission or intended commission of an offence…”
[29] The Court of Appeal held that 487(1)(b) of the Code limits a search to “evidence with respect to the commission of an offence”. In authorizing a search for evidence of the “suspected or intended commission” of an offence, the warrant exceeded the authority prescribed in s.487. The Court held that the warrant appeared invalid on its face.
[30] In this case, the Crown concedes that the affiant used a superceded copy of the Form 5 Warrant to search with the identical offending language.
[31] However, the Crown distinguishes this case from Branton by arguing that in Branton, the search was prospective: no charge had been laid at the time that the search was conducted and charges were only laid after the search. The Crown argues in Branton there may have been an issue that the officers who conducted the search might have exceeded the justice’s authorization by seizing not only evidence of the commission of an offence, but also evidence of a suspected offence which is a lesser standard than reasonable grounds to believe. This of course is not permitted by s. 487(1)(b).
[32] The commentary on this issue in Branton is brief and appears to be an afterthought by the Court of Appeal[7]. It is clearly not the ratio of the decision and contains no extensive reasoning or explanation. It also does not address the issue of excision. The Supreme Court of Canada held in R. v. Grabowski[8] that where an authorization contains invalid parts and valid parts, the court could excise the invalid parts, so long as they are not so interwoven that they cannot be separated[9].
[33] Indeed, there are cases where other judges have excised the offending language to cure a “Branton” error[10].
[34] Mr. Battigaglia, relies on Hill J.’s comments in R. v. N.N.M.[11], in that case Hill J. was faced with this same problem in the case of a warrant to seize firearms. The Crown urged the court to apply the doctrine of severability to uphold the warrant but Hill J. refused, citing the decision in Branton. At para. 335 he held:
I am not inclined to do so for the following reasons. The court in Branton did not raise the prospect of curing such a facial validity defect by severance. Authorized searchers read the Form 5 warrant not the ITO. Apparent conferral of searching and seizing authority exceeding what is properly supported by grounds in the ITO improperly risks overly broad conduct at the scene of the search thereby implicating N.N.M.’s s.8 Charter right to be free from search by invalid court orders.[12]
[35] It seems to me that the proper approach is to review the particular circumstances of a case where the Branton error is alleged and determine if there is a possibility for confusion or overly broad conduct not permitted by the section.
[36] I find Mr. Poland’s argument persuasive and I hold that Branton is distinguishable from this case. If there is no realistic possibility that anyone was confused or misled, then Mr. Battigaglia’s argument should not prevail.
[37] I must presume that the experienced justice issuing the warrant in this case was aware of the standard and that he was capable of the proper interpretation on the entirety of the material before him. On this record, there is no possibility that the issuing justice authorized a search for evidence on the “suspected or intended commission” of an offence. The ITO clearly sets out the grounds for the officer’s belief that Mr. Kumar had been killed intentionally and I do not believe that there would have been any confusion by anyone executing this warrant as to whether the evidence being sought was in respect to the commission of the offence or suspected commission of the offence. Indeed, when this warrant was sought, both applicants had been arrested for murder, and they were both in custody.
[38] In my view, Mr. Battigaglia has identified no risk of potential overly broad conduct at the scene of the search in the circumstances of this case. The phone was in the lawful possession of the police. They were obtaining a warrant to search the phone based on the commission of the offence of murder. In this case, there was the use of a form with language that was erroneous.
[39] I am of the view that no one would have been misled as to the fact that the police believed that they had reasonable grounds to believe that murder had been committed and they were looking for evidence in respect to the commission of that murder.
[40] I do not accept the argument that the Branton error invalidates the warrant.
ISSUE 3: THE AUTHORITY TO SEARCH UNDER THE WARRANT EXPIRED AT 9:00 P.M.
[41] Mr. Battigaglia forcefully argues that the police were working to a deadline once the warrant was authorized and the forensic analysis of the phone had to end at 9:00 p.m. on November 16, 2011. It is not disputed that the analysis was conducted on November 25.
[42] The Crown argues that on its face, the warrant authorized the police to enter the vault and remove the items within a set time. However, the issue of time was not directed at the search of the devices themselves.
[43] An examination of the language of the warrant supports the Crown’s interpretation.
[44] On the Form 5, the OPP were authorized “between the hours of 6:00 a.m. to 9:00 p.m. to enter into the premises” and to search for the items noted in Appendix A.
[45] In my view, the commencement of the search began with the initial entry into the vault between the hours set out in the warrant and that any subsequent forensic analysis of the thing seized did not end at 9:00 p.m.
[46] I adopt the analysis of Paciocco J. in R. v. Barwell[13], which I find persuasive. In Barwell, the police had seized hard drives as part of an investigation and were holding those items at a police lock-up. The police sought a warrant to search the hard drives and obtained a warrant authorizing the search and seizure of the computer hard drives from the lock-up.
[47] The search warrant authorized the police to "between the hours of 6:00 a.m. to 9:00 p.m., to enter and search for" the computer hard drives "and to bring them before me or some other Justice to be dealt with according to law." The items were seized during the time frame specified but were not analyzed until the day after the period provided for in the warrant.
[48] The accused argued that the examination had to be completed within the 15 hour window set out in the warrant, and breached his s. 8 rights.
[49] Paciocco J. rejected this argument and held that the search and seizure authorized by this warrant occurred properly when the police assumed control over the computer hard drives from the lock up within the period specified for that search and seizure. He held at para 17-18:
It was not required by the warrant that the forensic examination would take place during that same brief window. The time limits under the search warrant were not, therefore, dishonoured by Detective Thompson when he commenced the forensic search the next day. First, consider the implications of the argument that a forensic search of a seized chattel must be undertaken within the search period specified on the face of the warrant. Imagine, for the sake of the exercise, that the computer had been at Mr. Barwell's home, and that the warrant authorized the search and seizure to occur there. In order to minimize the intrusion Mr. Barwell's private dwelling, the warrant period would necessarily have been brief, to minimize the control the police could exercise over Mr. Barwell's home. The law would have required it, and so the search period on the face of the warrant would have been brief. Would the law, nonetheless require, in such circumstances, that any forensic examination of the computer would have to occur within that same brief search window on the face of the warrant? This would be unrealistic. Forensic examinations take time, and it would be counter-productive to the privacy interest to extend search and seizure periods for long periods of time in order to accommodate forensic examinations.
The flaw in this Charter challenge is that it fails to recognize that the law treats the initial search and seizure and subsequent forensic examinations separately. There are provisions authorizing the initial search and seizure of the item, such as Section 487 of the Criminal Code of Canada, relied upon to secure the warrant in this case. There are other separate and distinct provisions dealing with the detention of items, including detention "for the purposes of any investigation." Specifically, Sections 489(1) and 490 of the Criminal Code of Canada together require that when things have been seized pursuant to a warrant, the police officer shall, as soon as practicable, either bring the seized items before a Justice or file a report identifying the thing being detained and the reason for detention. And the Justice shall order that the thing be released or detained, including for the purposes of investigation. In other words, the search warrant provision deals with the time required for the initial search for an item and with its seizure. The detention provisions address how long the item can be kept for forensic analysis after the search is made for the item and it is seized.[14]
[50] Defence rely on the decision of Kelly J. in R. v. Steer.[15] The Crown conceded the s. 8 breach in that case. The warrant in that case was submitted by an affiant who specifically requested a search for an “indefinite period.” The warrant issued by the issuing justice modified the search and handwritting addition specified that the search to take place between the hours of December 7, 2011 and January 28, 2012. It was clear that the issuing justice gave the police an end time for their search. The police in that case ignored the unambiguous end time and conducted the search on May 28, 2012.
[51] Similarly, the defence also relies on the decision of Fuerst J. in R. v. Little.[16] In finding a s. 8 breach when the police conducted their forensic analysis of computers after the search warrant had expired, Fuerst J. pointed out that in that case the issuing justice in unambiguous terms specified that the search was to occur between 10:30 a.m. and 5:00 p.m. although the affiant had not sought any time parameters for the search. Again, the police in that case lost track of their end time and violated the applicant’s s. 8 rights by carrying out their search outside of the time frame.
[52] In this case, I am unable to say that the issuing justice explicitly gave the police an end time for their search. There is also some appellate authority that once the phones were seized under the authority of the warrant, the extraction of data from the phone could be done at a later date.[17]
[53] In the end, I do not find this argument persuasive.
MS. BOJANOWSKA’S SUBMISSIONS
[54] The Crown argues that the OPP sought a warrant to do a series of things:
i. get the phones out of the OPP vault; and
ii. examine the phones for a specific purpose (i.e. extraction of data contained within the devices).
[55] Ms. Bojanowska’s submissions stripped down to the essentials are this: the police drafted a warrant that articulated and authorized only the first of those two steps.
[56] After reflecting on counsel’s very forceful submissions, I have come to the conclusion that the warrant authorized the police to search for data. I say this for the following two reasons.
[57] First, the ITO made it clear that the phones were seized incident to arrest and Appendix A attached to the warrant makes it clear that the justice was authorizing a search to be conducted on the phones. Inherent in the use of the phrase “a search will be conducted on the phones”[18] is that the search will be conducted of the data found in the phones.
[58] Second, Appendix A attached to the warrant lists under “things to be searched for” devices or media capable of storing data. Again, it is inherent that when officers are going to be searching for “devices or media capable of storing data” that they will be conducting a search for data.
[59] I do not accept Ms. Bojanowska’s argument that as a matter of common sense the OPP were looking to seize the phones, take it to the Ecrimes unit for the purposes of a visual or cursory inspection and then decide what course of conduct they would follow. As the Crown points out, the police were lawfully in possession of the phones and did not need an authorization to enter the OPP vault or to move the devices and Ecrimes unit. They did, however, need authorization to search for data.
[60] In assessing counsel’s submission, I also think it is relevant to consider the ITO in determining if the justice was somehow misled into authorizing a search for data. In my view, the justice would not have been misled that the police wanted to do a search for data because the ITO makes it clear that the phones were going to be sent to the OPP Ecrimes unit described by the affiant as a “unit that specialized in the forensic analysis of electronic evidence, including the recovery and analysis of data stored on computer systems, cellular telephones and other electronic devices”.[19] I think it is inherent in the retrieval of the phones from the vault and taking them to this Ecrimes unit, that the police were going to conduct a search of the data in those phones.
[61] In my view, the warrant authorized the officers to search the phones for data and I do not accept Ms. Bojanowska’s argument that the data extraction and the analysis conducted by the RCMP in 2011 were warrantless.
[62] As I have held, the warrant authorized the police to search for data and this permitted them to extract data from the devices associated to the accused. The warrants authorized a peace officer to search for data. It does not matter that the RCMP were called in to assist the OPP in the extraction process. The calculation of the impact on the applicants’ privacy interests is not altered by the fact that a different police force with more expertise in extracting the data was able to extract the data from the phone.
[63] Ms. Bojanowska also argues that the chats retrieved as a result of the re-examination of the data in November 2012 were also obtained pursuant to a warrantless search. In making that argument, counsel points out that the Supreme Court of Canada and the Court of Appeal have held that computers are places and that the initial data extraction was the removal of a place that stored a vast amount of information. When the police had in their possession a program that could obtain additional information from that place and would allow them to conduct a more extensive search of the place, the police were required to seek a further search warrant to spell out the change in technology to the justice and to disclose that they were conducting a more extensive and deeper search.
[64] Ms. Bojanowska drew an analogy to a search warrant being executed in a home with the use of a UV light. If the police came into possession of a more powerful UV light after the search, would the police, counsel asks rhetorically, be allowed to go back in the home without judicial authorization?
[65] Ms. Bojanowska’s submissions are attractive. However, after reviewing the record before me, I do not regard the conduct of the OPP in November of 2012 as a further search of a place. The phone had been lawfully seized and the police were given access to the contents of the phone and made a copy of the contents by creating a binary file which was a download of raw data. As Cromwell J. in R. v. Vu[20] points out (at para.48) that once a warrant to search a computer is obtained, the police have the benefit of s. 487(2.1) and (2.2) of the Code, which allows the police to search, reproduce, and print data that they find.
[66] In this case, once the data was reproduced or imaged, they analyzed the data. I think it is more appropriate to characterize what the police did in 2012 as a second analysis of data that had been reproduced and not a more extensive and deeper search into the contents of the phone. I did not hear evidence on this point and I base my finding only on the agreed statement of facts and the material that is before me.
[67] The agreed statement of facts points out that the program that was used to examine the binary file Cellebrite was updated in 2012. As a result of the update the program was capable of interpreting more data.
[68] This is not the same conduct that occurred in R. v. Jones[21], where the police who had unlimited access to a computer’s files and folders pursuant to a warrant authorizing a search for email transmissions and counterfeit images in relation to a fraud investigation. In that case during their search of the computer the police discovered images of child pornography and after receiving legal advice, decided to expand their search for evidence of child pornography without judicial authorization.
[69] The Crown in Jones, attempted to uphold the searches for child pornography and argued that the computer was an indivisible object of a search and the computer in the home was an item that was seized and like any other physical object seized could be subjected to whatever testing the police determined was necessary even for subsequently discovered crimes. Blair J.A. rejected that argument and held that unlike a physical object, it is not information generated by the physical characteristics of or adhering to the object that is the target of the search, it is the informational contents of the computer themselves that are the target of the search.
[70] According, to Blair J.A. the better analogy to draw was the search and seizure of two different places, the home in which the computer is found and the computer itself. The court held that there was no reason why in principle the police would be more entitled to roam around through the contents of a person’s computer in an indiscriminate fashion than it would be to do so in a person’s home without further authorization.
[71] In this case, by 2012, the search and seizure had already taken place. The roaming around the contents of the phone had taken place. What remained was the data seized from that roaming exercise. That data had been interpreted and analyzed. The police were now in possession of a different analytical tool and were entitled to analyze the data they had lawfully seized.
[72] They were not conducting a search for a different crime or more criminal activity, they were looking at the data they had retrieved and assessing whether more evidence could be revealed implicating the applicants in the crimes that they had been charged with.
[73] In my view, they did not need another warrant to conduct a second analysis of the data.
CONCLUSION
[74] The searches were not warrantless.
Coroza, J
Released: March 19, 2014
COURT FILE NO.: 339/13
DATE: 2014-03-19
ONTARIO
SUPERIOR COURT OF JUSTICE
B E T W E E N:
Her Majesty the Queen
- and –
Marlon Nurse and Darryl Plummer
ENDORSEMENT
PUBLICATION BAN:
Pursuant to subsection 648(1) of the Criminal Code, no information regarding this portion of the trial shall be published in any document or broadcast or transmitted in any way before the jury retires to consider its verdict.
Coroza, J
Released: March 19, 2014
[^1]: Emphasis added
[^2]: Emphasis added
[^3]: Emphasis added
[^4]: Emphasis added
[^5]: See R. v. Araujo, 2000 SCC 65 at paras. 19, 36
[^6]: See R. v. Branton, 2001 8535 (ON CA), [2001] O.J. No. 1445 (C.A.). “Branton”
[^7]: As Weiler J.A. points out the original motions judge in Branton, did not comment on this submission
[^8]: (1985), 1985 13 (SCC), 22 C.C.C. (3d) 449 (S.C.C.)
[^9]: See R. v. Sandham [2009] O.J. No. 4559 (S.C.J.)
[^10]: See R. v. Jacobson, [2004] O.J. No. 933 (S.C.J.) and R v. Sonne, 2012 ONSC 584, [2012] O.J. No. 6243 (S.C.J.)
[^11]: 2007 31570 (ON SC), [2007] O.J. No. 3022 (S.C.J.)
[^12]: Emphasis added
[^13]: [2013] O.J. No. 3743 (C.J.)
[^14]: Emphasis added
[^15]: [2013] O.J. No. 708 (S.C.J.)
[^16]: 2009 41212 (ON SC), [2009] O.J. No. 3278 (S.C.J.)
[^17]: See R. v. Weir, 2001 ABCA 181, [2001] A.J. No. 869 (C.A.)
[^18]: Emphasis added
[^19]: Emphasis added
[^20]: 2013 SCC 60, [2013] S.C.J. No. 60
[^21]: 2011 ONCA 632, [2011] O.J. No. 4388 (C.A.)