) ) HER MAJESTY THE QUEEN – v. –, 2013 ONSC 3133

CITATION : R. v. Eaton, 2013 ONSC 3133 COURT FILE NO.: 10-5025 DATE: 20130729 ONTARIO SUPERIOR COURT OF JUSTICE BETWEEN: ) ) HER MAJESTY THE QUEEN – and – David Eaton Accused ) ) ) ) ) ) ) ) )) ) ) )) James Cavanagh, for the Crown Bruce Engel, for the Accused ) ) HEARD: April 29, 2013 and May 13-14, 2013 ruling on qualifications of detective warren bulmer Toscano Roccamo J. (orally) [ 1 ] After a two day voir dire ending on May 13, 2013, the Crown sought to qualify Detective Warren Bulmer as an expert in the following areas: 1.

On the operation of the Facebook website from an end user’s perspective, as this relates to number 4 below; 2. In particular, on the operation and appearance of the “News Feed” feature on Facebook as this relates to number 4 below; 3. On the nature and function of “hyperlinks” in HTML format internet websites including Facebook, and in the Microsoft Word, word processing program, as this relates to number 4 below; 4.

To provide evidence regarding “copy” and “paste” functions from HTML format on an internet website, specifically Facebook, into different versions of the Microsoft Word programs, and the operation of the “auto-correct” feature of the different versions of the Microsoft Word programs, again from the perspective and experience of an end user; and 5.

Assuming that the “Joose Chabot” entry in Exhibit “A” was copied from a Facebook News Feed and pasted into a Microsoft Word document, would the expert expect the auto-correct feature of the Microsoft Word program to change the spelling of the name from “Josée Chabot” to “Joose Chabot.” [ 2 ] At the conclusion of argument in the voir dire , I qualified Detective Bulmer as an expert in the noted areas, with written reasons to follow, as set out below.

Background [ 3 ] The Crown retained Detective Bulmer to offer an opinion as to the Facebook features which bear on the validity of the News Feed post from “Joose Chabot” found in Exhibit “A” filed at trial. This document was put to the Complainant, Marie-Josée Chabot, in cross-examination, and purported to be a hard copy of posted comments made by her and others in April 2009, to the Accused’s Facebook News Feed. Ms.

Chabot was specifically referred to a post, dated April 15, 2009, from “Joose Chabot” to the Accused as evidence of communications between them in which they discussed vacationing together only ten days prior to an alleged sexual assault

on the night of April 25, 2009. Ms. Chabot admitted that a similar communication may have occurred at some point, but denied anyserious conversation on the subject, and denied any romantic interest in the Accused. Secondly, she denied having any Facebook profileunder the name of “Joose Chabot”, or ever having spelled her name that way. Finally, after the allegations were made which gave rise tothe criminal charge against the Accused, Ms. Chabot took steps to block the Accused from being among her Facebook friends. [4] Pursuant to an admission made under s. 655 of the Criminal Code, R.S.C. 1985, c.

C-46, and entered as Exhibit 20 at trial,the Accused explained the process by which he was able to generate a hard copy of Exhibit “A”. The Position of the Crown [5] The Crown took the position that Detective Bulmer is qualified to provide expert opinion in the areas proposed, based uponthe training and the practical experience he acquired in the course of police investigations. In addition, the Crown argued that DetectiveBulmer offers important testimony with respect to a series of experiments he carried out, specifically in regard to this case, in an attemptto re-create Exhibit “A”.

The results of these experiments were set out in his report filed on the voir dire as Exhibit “C”, in appendices Bthrough E inclusive. The Position of the Defence [6] The Defence conceded Detective Bulmer’s expertise in the areas described in numbers 1 and 4 above.

In other words, theDefence conceded that Detective Bulmer is qualified to provide expert testimony from the end user’s perspective and experience on the“copy” and “paste” functions from HTML format internet websites, including Facebook, into different versions of the Microsoft Wordprograms, as well as the operation of the “auto-correct” function of the different versions of the Microsoft Word programs, from theperspective and experience of the end user. [7] The Defence also agreed that Detective Bulmer could provide limited testimony in the areas described in numbers 2, 3, and5, above, insofar as he is familiar with the operation and appearance of News Feeds on Facebook, and hyperlinks in internet websites,including Facebook and in Microsoft Word, and word processing programs involving “copy” and “paste” functions from Facebook intoMicrosoft Word programs.

However, the Defence took the position that Detective Bulmer would be unable to offer any useful guidanceabout whether or not the auto-correct feature of Microsoft Word, used by the Accused to generate Exhibit “A” from his Facebook NewsFeed, would change the spelling of “Josée Chabot” to “Joose Chabot.” [8] The Defence relied on a number of admissions made by Detective Bulmer in cross-examination on the voir dire to challengethe admissibility of Detective Bulmer’s evidence with respect to matters bearing on the authenticity and validity of Exhibit “A”.

TheAccused took the position that Detective Bulmer’s experience with the Facebook features at the material times in 2009 wouldsubstantially limit the value of any opinion he might provide on the subject. Therefore, despite some familiarity with the relevanttechnology as it existed in 2009, the Defence argued his evidence would ultimately be distracting and unhelpful. The Onus [9] The onus is on the Crown to establish Detective Bulmer’s expertise on a balance of probabilities: see R. v. Baxter, 2009ONCJ 16 (Ont. Ct.

J.), at para. 52, citing McWilliams’ Canadian Criminal Evidence (4th ed.) 12.30.20.50, pp. 12-54, and R. v. Terceira(1998), (ON CA), 123 C.C.C. (3d) 1 at 21, aff’d (SCC), 142 C.C.C (3d) 95 (S.C.C).

The Evidence on Voir Dire [10] Detective Bulmer is a 23 year veteran of the Toronto Police Service, currently seconded to the Toronto Police Fugitive Squad.He is also a full-time instructor at the Toronto Police College where he teaches Computer and Technology Facilitated Investigations, acourse he designed in September 2009 and has taught since January 2010, to over 750 investigators from across Canada who conductcomputer and cyber crime-related investigations. [11] Detective Bulmer’s curriculum vitae (“CV”) was entered as Appendix V of Exhibit “C” on the voir dire, and is attached asAppendix 1 to this Ruling.

In addition to related national and international teaching assignments, Detective Bulmer’s CV reflects that themain focus of his career over the years has been on the collection and preservation of digital evidence in child exploitation andpornography investigations. Much of this draws upon his skills in computer-based forensic examination, including use of internet andsocial media websites such as Facebook, and preservation of evidence using Microsoft Word applications.

Detective Bulmer’s testimonyon the voir dire highlighted his secondment between October 2010 and February 2011 to the Social Media Working Group of theToronto Police Service where he was tasked with writing policy for police use of social media, including Facebook. [12] His CV further reflects continuous involvement or attendance at numerous internal Toronto Police Services courses andseminars, as well as national and international conferences and workshops on related topics. As examples, in 2004, he undertook trainingin ethical “hacking” and technical investigative techniques.

In 2005, he undertook the study of software used in computer forensicexamination and undercover operations on the internet through the Canadian Police College, as well as forensic software training in theUnited States involving detection of stenography and image alteration techniques. In 2006 and 2007, he undertook advanced studies onAdobe Photoshop and image enhancement and alteration. In 2008, he was the keynote speaker at a conference hosted by the UnitedStates Department of Justice on analyzing digital evidence, which included the location, preservation and storage of data by copying andpasting.

In the same year, he attended a Microsoft computer forensics laboratory on Windows-based computer forensics. His curriculumdesign and teaching since 2009 of Computer Facilitated Investigations at the Toronto Police College has already been noted. In 2011

and 2012, he took courses on intermediate and advanced Microsoft-related programs including PowerPoint, Word and Excel. In 2012,when the Toronto Police Service migrated to Microsoft Sharepoint, he developed software for police use, and trained others within theToronto Police Service to teach its application in child exploitation investigations. [13] Detective Bulmer has authored and co-authored a number of publications on digital evidence which are detailed in his CV. [14] Detective Bulmer is regularly consulted by various police services and Crown Prosecutors.

In fact, he was referred by EmilyVacher, the Law Enforcement Officer of Facebook for North America, to a British Columbia Crown Prosecutor in an unreported decisionin R. v. Warrington (4 March 2013), Port Coquitlam 85462-2C (B.C. Prov. Ct.). He previously collaborated with Ms. Vacher indeveloping law enforcement protocols in cases where police are required to request and preserve digital evidence. [15] Finally, he has been qualified as an expert in computer forensics after a voir dire on his qualifications on two separateoccasions by our Court in unreported decisions in R. v.

Findlay (15 October 2007), St-Thomas 3476/07 (Ont. Sup. Ct.), and in R. v.Hughes (24 June 2008), Toronto P254-08 (Ont. Sup. Ct.), and twice by our Provincial Courts. On one occasion, his evidence was notadmitted by our Court following a voir dire in the unreported decision in R. v. McDermott (28 May 2009), Guelph CR 09-0824 (Ont.Sup. Ct.), on the basis that the evidence offered in that case would not go beyond any conclusions the Court could draw without expertevidence.

The cases in which Detective Bulmer’s evidence was received as an expert involved copying and pasting data from anAccused’s computer to Microsoft Word. While such data did not involve Facebook News Feeds, it did involve material from other socialnetwork internet sites and included texts, screen shots, pictures and movies. In all cases where Detective Bulmer was qualified as anexpert, his reports were filed in evidence. [16] Detective Bulmer has had both personal and professional access to Facebook since 2007. He has written Production Orderswith Facebook in the course of his employment.

He has also used Microsoft Word and hyperlinks employed by various internet websitessince 1995, but has used Facebook and Microsoft Word to copy hyperlinks from document to document, including portions of web pageslike Facebook to Microsoft Word since 2009. In cross-examination, he candidly admitted that he has no special knowledge or interest inthe history of Facebook or how it was formed, nor is he privy to any trade secrets involving the workings of Facebook technology.

Healso agreed that he never conducted forensic testing of Facebook News Feeds in 2009, and cannot now access Facebook codes from2009 in order to identify a Facebook account as it existed in 2009. However, he described the changes to Facebook News Feeds today asprimarily “semantic” changes or changes that Facebook made to update their programs and which were not otherwise dramatic changes.

He also described the advantages he acquired through special training and experience as an advanced user of Facebook and MicrosoftWord over the average user, including his ability to apply investigative techniques and expertise in reading and deciphering informationon Facebook.

For example, in the past, he has been able to trace Facebook messages by exploiting vulnerabilities in Facebookapplications which required that he crack computer codes Facebook was using, without Facebook awareness or involvement. [17] Detective Bulmer admitted that over the course of a week in April 2013, while attempting to investigate the authenticity ofExhibit “A”, he was unable to re-create its contents, due to the fact that Exhibit “A” is a photocopy of a Word document and his analysiscould not accommodate every possible version of Word software used to create the document.

In addition, when he contacted Facebookto determine if Exhibit “A” was consistent with News Feed coding in 2009, Facebook declined to assist because it was not a documentfrom their website; rather it was a Word document copied by highlighting and selecting information which was subject to manipulationor alteration. However, Detective Bulmer maintained that he has acquired knowledge of how hyperlinks appear on Facebook accountssince 2008; therefore, if evidence was received that Ms.

Chabot blocked the Accused’s account and removed him as a Facebook friendafter April 2009, no testing would be required to conclude that Ms. Chabot would not have appeared at all on the Accused’s Facebookaccount in this News Feed. In addition, the experiments he conducted using a select number of operating systems and web browsers inuse in 2009 and 2010, over the timeframe the Accused admits to having generated Exhibit “A”, revealed that at no time was the text of ahyperlink copied and pasted onto a Microsoft Word document using the auto-correct feature of any Word processing program.

Moreover, at no time in his testing did any program employed alter a single hyperlink to add or remove underlining in the hyperlink,while uniformly removing or maintaining the underlining in the other posts to a News Feed. In all experiments undertaken, he notedconsistency in the appearance of hyperlinks which was not the case in Exhibit “A”. Analysis and Conclusions [18] The Supreme Court of Canada in R. v. Mohan, (SCC), [1994] 2 S.C.R. 9, at para. 17, set out four criteria thatmust be met in order to admit expert evidence. The admission of expert evidence will depend on establishing: 1. Its relevance; 2.

Its necessity in assisting the trier of fact; 3. The absence of any exclusionary rule; and 4. A properly qualified expert. Relevance [19] The relevance of Detective Bulmer’s evidence was well established. The Defence put the contents of Exhibit “A” to theComplainant in cross-examination, and she unequivocally denied spelling her name as it appeared in Exhibit “A”.

The Accused also filedin evidence as Exhibit 20, the process by which he generated Exhibit “A”. [20] I accept that logically relevant testimony may still be excluded under this criteria of Mohan if its probative value is exceededby its prejudicial effect; if its admission requires an undue investment in time; and/or if it is misleading in that its effect is

disproportionate to its reliability; however, I find that Detective Bulmer’s evidence on voir dire was probative in that he explained hisability to discuss those aspects of Facebook and Microsoft Word which would help clarify both Exhibit 20 and Exhibit “A”. He was alsocareful and measured in acknowledging the limits of his opinion, including the fact that there was no digital copy of Exhibit “A” to workfrom and that Facebook would provide no assistance to him in all of the circumstances in evaluating the contents of Exhibit “A”.

However, he emphasized that the process described by Exhibit 20 relied more upon an understanding of Word processing features ofMicrosoft Word than Facebook. Finally, Detective Bulmer’s evidence in relation to the “auto-correct” and “copy” and “paste” features,as they affect hyperlinks, was material in addressing the process by which the Accused said that he created Exhibit “A”. This evidencedid not require an inordinate amount of time disproportionate to the value of the evidence. Necessity [21] The matters about which Detective Bulmer proffered testimony are highly technical in nature.

I am unable to understandExhibit 20 and Exhibit “A” without his guidance, and I am satisfied that the subject matter is one about which the average person couldnot form a judgment. In any event, the necessity of the evidence per Mohan, is not to be judged on too strict a standard, and I am gratefulto Defence counsel for highlighting the fact that Detective Bulmer’s evidence is not to be received so as to determine an ultimate issuesuch as the credibility of the parties. This remains strictly within my domain.

The Absence of Any Exclusionary Rule [22] I was not referred to any other rule of evidence which requires the exclusion of Detective Bulmer’s evidence. A Properly Qualified Expert [23] Finally, insofar as Detective Bulmer’s qualifications are concerned, the suggestion was advanced during the cross-examination of Detective Bulmer that his expertise did not include the testing of Facebook at times material to these proceedings in 2009and 2010, at the time the Complainant and the Accused communicated on Facebook, and subsequently when the Accused createdExhibit “A”.

It was put to him that his understanding of Facebook and Microsoft Word programming features was really that of thepracticed user, and not a subject about which he is an expert. I cannot agree. Detective Bulmer squarely established his expertise boththrough his studies and practical experience. While he used Facebook personally in 2005 and 2006, he began to use it in the course ofemployment in 2007 and has been copying and pasting it onto Microsoft Word documents since 2009. He was familiar with hyperlinksand News Feeds in Facebook, and with the appearance of account names in Facebook in 2009.

He testified about the appearance ofNews Feeds in 2009 as compared to the present date, and in particular about the difference between the appearance of News Feed postsand other messaging options such as “chat” and “private messages” in Facebook, as well as the effect of “blocking” or “defriending” in2009 to the present day.

As previously noted, Detective Bulmer began developing a curriculum for the Toronto Police College in 2009and has taught computer and technology facilitated investigations since 2010. [24] In any event, Mohan, at para. 27, provides that expert evidence may be received from a witness who has acquired special orpeculiar knowledge through study or experience. I would not exercise my discretion to exclude his evidence on the basis that he hasacquired his expertise primarily through his experience as a police officer.

In this regard, I observe that other courts have allowed policeofficers to testify as experts from the experience they have acquired in their police work: see R. v. Lindsay, (ON SC),[2005] O.J. No. 2870 (Ont. Sup. Ct.) at paras. 188, 178 and 616; R. v. Baxter, 2009 ONCJ 16 (Ont. Ct. J.); R. v. Parisien, 2011 ONCJ354 (Ont. Ct. J.).

Case Specific, Cost Benefit Analysis [25] Although I have concluded that Detective Bulmer’s evidence meets the criteria in Mohan, I have considered whetherDetective Bulmer’s evidence should nonetheless be excluded in the exercise of the Court’s gatekeeping function as described in R. v.Abbey, 2009 ONCA 624, 97 O.R. (3d) 330 (Ont. C.A.), at paras. 76, 86-91, and 94, on the basis that Detective Bulmer’s evidence is notsufficiently beneficial to the trial process to warrant its admission.

In undertaking a case specific, cost benefit analysis, I have notedamong the Defence arguments the concern that Detective Bulmer has admitted that he cannot testify on the specific encoding features ofFacebook in 2009; did not receive Facebook assistance in this regard; and could not carry out comprehensive testing using every versionof every operating system and web browser, as noted in his report at Exhibit “C”. He has conceded that, by his limited experiments,described in Appendices B to E inclusive in Exhibit “C”, he cannot attest to the authenticity of Exhibit “A”.

While all of this isacknowledged, and the limits of the experiments carried out by Detective Bulmer were exposed by able cross-examination, in myopinion, this does not undermine the admissibility of his evidence on these experiments. I note somewhat parallel limitations in theevidence on cell phone test calls received in R. v. Cyr, 2012 ONCA 919 (Ont. C.A.) at paras. 108-111.

Nevertheless, I have foundDetective Bulmer’s evidence to be both relevant and material, and note that, generally, such evidence is received, subject to the Court’sgeneral exclusionary discretion: Cyr, at para. 119. [26] In addition, I have concluded that Detective Bulmer can offer some assistance to the Court in respect of the operation ofFacebook, and even more so, in respect of Microsoft Word’s processing features, such as the “auto-correct” and “copy” and “paste”features, as they affect hyperlinks. This is particularly so as he has worked with these features for 14 years.

The Defence quite properlyagreed that Detective Bulmer may offer some assistance in this area. [27] Although not binding upon me, I have also found the dicta of the Saskatchewan Court of Appeal in R. v. Fisher, 2003 SKCA90, 18 C.R. (6th) 377 (Sask. C.A.), at paras. 19-20, of some guidance, although only cited for other reasons by our courts: see R. v. Atlee,

2010 ONCJ 72 (Ont. Ct. J.); R. v. Paul, [2004] O.J. No. 1334 (Ont. Sup. Ct.); R. v. Nicholas (2004), 70 O.R. (3d) 393 (Ont. C.A.). Fisher, at paras. 19-20, provides as follows: Deficiencies in the knowledge of the witness such as lack of more training in statistics, lack of personal knowledge of the compilation ofthe data base and reliance upon the study of others, went to the weight to be given to the evidence, not to its admissibility. The Defencevery skilfully brought out all of these deficiencies in the cross-examination of Ms. Charland.

It was for the jury to decide the weight tobe given to the evidence in all of these deficiencies. Furthermore, the Defence was not left helpless in the circumstances. It could have led its own expert evidence to contradict that of theCrown if it believes the Crown experts’ evidence to be wrong or misleading. It did not do so. [28] The approach in Fisher is in line with what the Supreme Court of Canada said in R. v.

Marquard, (SCC),[1993] 4 S.C.R. 223, at para. 5, where it held: The only requirement for the admission of expert evidence is that the “expert witness possess special knowledge and experience goingbeyond that of the trier of fact”: R. v. Béland, (SCC), [1987] 2 SCR 398, at p. 415. Deficiencies in the expertise go toweight, not admissibility. As stated by Sopinka, Lederman and Bryant, The Law of Evidence in Canada (1992), at pp. 536-37: The admissibility of such [expert] evidence does not depend on the means by which that skill was acquired.

As long as the court issatisfied that the witness is sufficiently experienced in the subject-matter at issue, the court will not be concerned with whether his or herskill was derived from specific studies or by practical training, although that may affect the weight to be given to the evidence. [29] I have also considered the fact that the evidence of Detective Bulmer advances trial fairness, having regard to theComplainant’s testimony as to her limited understanding of cell phones and computers, and the evidence of both Sarah Saska-Crozier andAndrew Conroy, both roommates of the Accused at the material times, and who have given evidence for the Crown, as to the Accused’sproficiency with both cell phones and computers.

Without the assistance of Detective Bulmer, the Crown is unable to address theevidence tendered by the Defence in both Exhibits 20 and Exhibit “A”. Conclusion [30] Notwithstanding its limitations, I have concluded that the probative value of Detective Bulmer’s evidence exceeds itsprejudicial effect, and very little trial time was devoted to its review. More importantly, I am not concerned here that a jury may employthe evidence beyond its permitted use.

I remain mindful of the fact that receiving this evidence does not divest this Court of itsresponsibility to determine the credibility of the parties and the weight, if any, to be assigned to the evidence of Detective Bulmer as apart of the body of evidence I have received, and have yet to receive in this case. Madam Justice Toscano Roccamo Released: July 29, 2013 CITATION: R. v. Eaton, 2013 ONSC 3133 COURT FILE NO.: 10-5025 DATE: 20130729

ONTARIO SUPERIOR COURT OF JUSTICE B E T W E E N: HER MAJESTY THE QUEEN – and – David Eaton Accused ruling on qualifications of detective warren bulmer Toscano Roccamo J. Released: July 29, 2013