2023 QCCQ 9156, 2023 QCCQ 9156

R. c. Choi 2023 QCCQ 9156 COURT OF QUÉBEC CANADA PROVINCE OF QUÉBEC DISTRICT OF MONTRÉAL Criminal and Penal Division No: 500-01-216310-216 DATE: March 22 nd , 2023 ______________________________________________________________________ BY THE HONOURABLE ANTOINE PICHÉ, J.C.Q. ______________________________________________________________________ HIS MAJESTY THE KING Prosecution v. CHUL CHOI Accused JUDGMENT ON ADMISSIBILITY OF VD-1 AND VD-4 ______________________________________________________________________ INTRODUCTION [ 1 ] Between December 2018 and July 2019, L.

F. was subjected to criminal harassment. [ 2 ] This harassment took different forms and included occurrences at her workplace at Deloitte. [ 3 ] Deloitte began an internal investigation to determine the source of the harassment against its employee. [ 4 ] Mr.

Scott Hunter, partner owner of Deloitte, has been involved in the internal investigation from late May beginning of June 2019, to his conclusion at the end of July 2019. [ 5 ] During that investigation, the IP address 99.224.35.97, found in an email of July 17, 2019, was identified as being likely to lead to the author of the harassment. [ 6 ] Knowing that it is possible to track an IP address in Deloitte server, Mr. Hunter sent an email to Mr. Malik, who was the head of IT information security at that time, asking him if the IP address in question had been seen in any system of Deloitte. [ 7 ] Mr.

Hunter did not mention to Mr. Malik the reason why he was looking for that information. [ 8 ] Mr. Malik did not have a direct access to the server. In fact, no one in Canada had access to it. There was a way to obtain the information through the system owner, by addressing the question to the Global Incident Team. That team has access to the data from Microsoft Office 365 and is located in the United States of America (USA). [ 9 ] Mr. Malik sent an email to Mr. Diener, from the Global Incident Team. He asked him the same question Mr. Hunter asked him in the first place. [ 10 ] Mr.

Malik explains that he received a positive response from Microsoft. Mr. Diener sent him an email with an Excel table attached. Mr. Malik did not analyse the Excel table nor modify it and forwarded it directly to Mr. Hunter. [ 11 ] The Excel table sent by Mr.

Diener has been produced as Exhibit VD-4. [ 12 ] This table suggests that on twenty-one occasions, between June 22 nd and July 19 th , 2019, the accused connected himself on Deloitte’s server with the IP address 99.224.35.97. [ 13 ] For the same period, the table also contains approximately 490 additional connections from the accused for which he used another IP address. [ 14 ] Mr. Malik mentioned that Mr. Diener worked for him on multiple incidents. Although each incident is different, he always receives comparable information in an Excel table. As it is the case with VD-4, Mr.

Diener did not attach the raw data in his email, only

the Excel table. [ 15 ] Mr. Malik explains that the information contained in VD-4 came from raw data. The Excel table contains exactly the same information, has the same appearance, but columns do not appear in the raw data. In an Excel table, it makes information searchable. [ 16 ] Once Mr. Hunter received the Excel table from Mr. Malik, he verified the username, whether the connections with the relevant IP address were successful and if it was done from a device managed by the firm. [ 17 ] At the moment he received the Excel table from Mr. Malik, Mr.

Hunter had no knowledge of the accused. [ 18 ] The Excel table used by Mr. Hunter has been produced under VD-1. When compared to VD-4, they contain the same information and have the same structure, except that, the column A from Mr. Malik’s version (VD-4) has been split into two columns in Mr. Hunter’s version (VD-1). [ 19 ] Obviously, someone has modified the version that Mr. Malik send to Mr. Hunter by splitting the date and time, that was in the same column in the version of Mr. Malik. [ 20 ] No evidence has been introduced to explain that modification.

POSITIONS OF THE PARTIES [ 21 ] The Prosecution considers that VD-1 and VD-4 are admissible because: • VD-1 and VD-4 are electronic documents as defined at

section 31.8 of the Canada Evidence Act ( CEA ). • That the testimonies of Mr. Malik and Mr. Hunter satisfy the threshold of authentication. • That the presumption of integrity provided at

section 31.3 of the CEA applies to VD-1 and VD-4. [ 22 ] The Defence opines that VD-1 and VD-4 are inadmissible for the following reasons: • Crown did not prove that information in VD-1 and VD-4 are identical to the raw data. • No evidence has been introduced to specifically indicate what steps have been done to output the raw data. • Considering that VD-1 as been modified, we can not assume that VD-4 was not. • The person who created the Excel table, Mr. Diener, did not testify. • VD-1 and VD-4 are records made in the course of an investigation which makes them inadmissible according to section 30(10)

a) of the CEA . PRINCIPLES [ 23 ] The applicable statutory provisions ss. 31.1 to 31.8 of the Canada Evidence Act ( CEA ) create a framework for the admission of all forms of «electronic document» which is broadly defined in

section 31.8 as follow: S. 31.8 «electronic document» means data that is recorded or stored on any medium in or by a computer system or other similar device and that can be read or perceived by a person or a computer system or other similar device. It includes a display, printout or other output of that data. [ 24 ] Thus, an «electronic document» is a broad definition that goes beyond mere business records and includes all form of computer data. [ 25 ] To be admissible, an electronic document must comply with the rules of authentication and best evidence as prescribed by ss 31.1 to 31.8 CEA .

The case law adopted a functional approach to the framework of the CEA . [ 26 ] The burden of proving authenticity of an electronic document rests on the person who seeks its admission. [ 27 ] The standard of proof required is the introduction of evidence capable of supporting a finding that the electronic document is as it claims to be. [ 28 ] In essence, the threshold is met, and admissibility achieved, by the introduction of some evidence, direct or circumstantial, of authenticity. [ 29 ] The reason why the threshold of admissibility is low is well explained by Professor David Paciocco (as he then was) in Digital Evidence: A Practioner’s Handbook : It is simply that t he law prefers to see disputes about authenticity resolved at the end of a case, not at the admissibility stage.

Disputes over authenticity tend to turn on credibility, and credibility is best judged at the end of the case in the context of all of the evidence. “Authentication” for the purposes of admissibility is therefore nothing more than a threshold test requiring that there be some basis for leaving the evidence to the fact-finder for ultimate evaluation . [1] [ 30 ] As Justice Dadour said [2] , there’s an important distinction to keep in mind between the threshold of authenticity and the ultimate weight to be given to the document by the fact-finder.

[ 31 ] In addition, authentication does not necessarily mean the document is genuine. [ 32 ] In the same vein, an electronic document can be authenticated and admitted in evidence even where there is an issue over the content of the document. [ 33 ] Disputes about authenticity are resolved at the end of a case, not at the admissibility stage. [ 34 ] Finally, establishing the authenticity of an electronic document is not necessarily synonymous with demonstrating its authorship [3] .

The authentication threshold doesn’t require the testimony of the author of the document, it only require evidence, direct or circumstantial that the document is what it purports to be. [ 35 ] The second requirement of the CEA is the best evidence rule. The application of this requirement is well explained by the Saskatchewan Court of Appeal in Durocher : [86] (…) At common law, the best evidence rule requires the proponent of a record to produce the original record or the next best available record ( Law of Evidence at 1324).

This concept was further elaborated on in Hirsch : “The purpose of the best evidence rule is to assist the trier of fact with the verification of the integrity of documents because alterations are more readily detectable on an original” (at para 23). [87] The concept of original is ill-suited to electronic documents because their inherent nature makes it often not possible to provide direct evidence of their integrity (“Proof and Progress” at 195). Accordingly, s. 31.2 to s. 31.8 of the CEA set out the means by which document integrity can be met with electronic documents.

Such a means is discussed as follows in “Proof and Progress” (at 200): Given the generous statutory conception of an original document, the primary role the “best evidence” provisions of the Canada Evidence Act play is as merely as an adjunct to authenticity.

The provisions exist, not so much to assure that the best evidence is presented, but to provide some further assurance that the document provided to the courts is the same as the one that was input into the computer . [ 36 ] Thus, the focus in the second requirement is more on the system’s integrity than the electronic document itself. [ 37 ] A party may satisfy the best evidence rule by proving the integrity of the electronic document system by or in which the document was recorded or stored. [ 38 ]

Section 31.3 establishes a list of statutory presumptions of integrity with regard to an electronic document system: 31.3 For the purposes of subsection 31.2(1), in the absence of evidence to the contrary , the integrity of an electronic documents system by or in which an electronic document is recorded or stored is proven. (

a) by evidence capable of supporting a finding that at all material times the computer system or other similar device used by the electronic documents system was operating properly or, if it was not, the fact of its not operating properly did not affect the integrity of the electronic document and there are no other reasonable grounds to doubt the integrity of the electronic document system; (

b) if it is established that the electronic document was recorded or stored by a party who is adverse in interest to the party seeking to introduce it; or (

c) if it is established that the electronic document was recorded or stored in the usual and ordinary course of business by a person who is not a party and who did not record or store it under the control of the party seeking to introduce it. [ 39 ] These presumptions are aimed at providing some assurance that no changes in the information found in the document have been caused by technical reasons or human intervention. [ 40 ] S. 31.1 (

a) requires only evidence capable of supporting a finding of proper or unimpaired operation of the relevant electronic document system. The proponent has only an evidential burden. [ 41 ] As for presumptions provided at ss. 31.1(

b) and (c), they require the basic fact, whether it be recording or storage by an adverse party or in the usual and ordinary course of business, be established on a balance of probabilities. [ 42 ] Those presumptions are rebuttable by evidence to the contrary. ANALYSIS [ 43 ] VD-1 and VD-4 are electronic documents as defined under s. 31.8 of the CEA . [ 44 ] They are an output of the data put on a support that makes consultation readable and searchable. [ 45 ] The testimonies of Mr. Malik and Mr.

Hunter are sufficient to satisfy the threshold of authentication. [ 46 ] Their testimony allows to understand that VD-1 and VD-4 represented connections to Deloitte’s server between June 22 nd and July 19 th , 2019. [ 47 ] The table also allows to know several other information such as: the username, if the connection was successful, the application used, the IP address associated to the connection, etc. [ 48 ] Clearly, there is some evidence that VD-1 and VD-4 are what it claims to be.

[ 49 ] In addition, Mr. Malik received VD-4 directly from the Global Incident Team, the team who has access to the data. Mr.

Malik was able to explain the difference between the raw data and the Excel table and why information in the form of an Excel table is preferred. [ 50 ] Even though VD-1 is a modified version of VD-4, the modification is minor and does not modify the information from the data. [ 51 ] As for the question of integrity of the documents, there is no air of reality to the suggestion that the information contained in VD-4 may have been modified or otherwise altered. [ 52 ] The data is automatically recorded and stored in a routine manner. [ 53 ] As mentioned above, no one in Canada had access to the data. Mr.

Malik had to request the information to a team in the USA, the Global Incident Team. [ 54 ] Mr. Malik received VD-4 directly from Mr. Diener, who’s a member of the Global Incident Team with whom he worked on multiple incidents in the past. [ 55 ] Moreover, Mr. Malik did not know why Mr. Hunter was looking after the IP address and had no idea about the internal investigation. [ 56 ] Mr. Hunter did not know the accused when he asked Mr. Malik to research the IP address and he had no idea who could be linked to it.

He had no interest to modify or alter the information or to render it misleading. [ 57 ] As VD-1 demonstrates, the only modification made to VD-4 is to split column A into column A and B so date and time can be searchable separately. [ 58 ] Consequently, there is no realistic concern that the information output from the data base could have been modified or altered. [ 59 ] As to the fact that Mr.

Diener was not heard on the voir-dire, although it could have been useful, the prosecution was not required to do so. [ 60 ] Considering the evidence adduced during the voir-dire and the absence of evidence to the contrary, the presumptions of integrity provided at ss. 31.1(

a) and 31.3 (

c) apply to VD-1 and VD-4. [ 61 ] As for s. 31.1(a), considering: (1) the extensive testimonies of Mr. Hunter and Mr.

Malik, particularly in cross-examination, concerning the multinational Deloitte, its fields of activity, the professional services it offers, its structure, its system operation, etc. (2) the absence of evidence to the contrary and (3) the low threshold of presumption provided at s.31.1(a) [4] , this presumption applies to VD-1 and VD-4. [ 62 ] As for s. 31.3(c), it is established that the information contained in VD-1 and VD-4 was recorded and stored in the usual and ordinary course of business of Deloitte. That is what it appears to be to Mr.

Malik and the Court concludes, on the balance of probabilities, that it is the case. [ 63 ] Deloitte is not a party in the instance and did not record or store the data under the control of the prosecution. [ 64 ] As for the argument of the Defence regarding the inadmissibility of VD-1 and VD-4 based on s. 30(10)

a) of CEA , it is unsound. [ 65 ] First, that paragraph applies at

section 30, not

section 31. A document may be inadmissible under a

section but admissible under another one. [ 66 ] Second, the data output in VD-1 and VD-4 are not record made in the course of investigation. [ 67 ] They are recorded and stored automatically in the usual and ordinary course of business of Deloitte. [ 68 ] The fact that they subsequently become relevant to an investigation does not change their nature. [ 69 ] Therefore, VD-1 and VD-4 are admissible under the statutory provisions of ss. 31.1 to 31.8 of the C EA . FOR THESE REASONS, the Court concludes that VD-1 and VD-4 are admissible under the statutory provisions of ss. 31.1 to 31.8 of the C EA .

Consequently, exhibits VD-1 to VD-4 will be filed as exhibits under P-10 and P-13 and will be consider as part of the trial upon the merits. __________________________________ ANTOINE PICHÉ, J.C.Q.

M e Christine Desjarlais Counsel for the Prosecution M e Diana Sitoianu M e Gabriel Babineau Counsels for the Accused Dates of hearing: February 21 st and 23 rd , 2023 March 21 st , 2023 [4] Richardson v. R. , 2020 NBCA 35 , par. 30 .