1. Introduction
Over the course of late 2021, intelligence services noticed a concerning build-up of Russian resources and troops along the Ukrainian border.Footnote 1 As satellite images depicted increasingly unusual activity around the end of the year, concerns of an imminent attack began mounting.Footnote 2 Digital evidence of the changing landscape offered the international community foresight into what the coming months might bring.Footnote 3 This insight into future military actions, through satellite imagery and other forms of digital evidence, is a hallmark of the landscape of modern warfare – a terrain void of the surprise element associated with the outbreak of previous conflicts.Footnote 4
The utility of digital evidence did not, however, cease as the conflict intensified. Videos of developments in Ukraine quickly dominated Twitter, Facebook, and TikTok, among other social media platforms. Digital platforms showed footage of streets with cars replaced by tanks and armoured vehicles,Footnote 5 civilians huddling together to take refuge in subways stations,Footnote 6 and buildings aflame against smoke-covered skylines.Footnote 7 Not only did digital evidence offer warnings of attacks to come but also showed real-time indication of events on the ground.
Digital evidence is useful not only prospectively in conflict but also retrospectively. The promulgation of digital evidence in Ukraine currently is not exceptional but is rather indicative of what modern warfare will entail. There are more hours of video footage of the Syrian conflict than there have been hours of conflict,Footnote 8 and there is no reason to suspect that present, and future, conflicts will not be similarly documented. Digital evidence will serve as a historical record of conflicts for the affected communities, the world writ large, and, hopefully, the field of international criminal justice.
Despite the utility of digital evidence, it is not without its pitfalls. In the wake of a mass of new uploads, Twitter recently mistakenly suspended a number of accounts reporting from Ukraine.Footnote 9 Not only is this incident reflective of suboptimal moderation policies of social media platforms, but it is also an example of the potential weaponization of digital sources. The wrongfully-suspended accounts alleged that their accounts were removed due to an attack by Russian bots that had mass reported these accounts’ content.Footnote 10 While Twitter denied evidence of a co-ordinated attack, it admitted that the accounts had been suspended ‘in error’, and subsequently reinstated many of the accounts.Footnote 11 This incident is not an unprecedented one – digital evidence is particularly unique in its volatility, both in terms of the ease with which it can be altered and with which it can be publicly removed. Whether in error or intentionally, in the case of moderation of hate speech or incitement to violence,Footnote 12 digital evidence can be permanently deleted at the click of a button.Footnote 13
Evidentiary procedures in international criminal law were neither crafted with digital evidence nor the modern conflict in mind. Digital evidence is, in many respects, distinct from more traditional forms of evidence. Electronic, or digital, evidence is defined as ‘[i]nformation and data of investigative value that are stored in or transmitted by an electronic device’.Footnote 14 The rising use of digital evidence dovetailed with the emergence of open-source investigations (OSINT), or investigations that rely on publicly available digital information.Footnote 15 With OSINTs emerging as not only a prudent, but necessary, form of investigations in international criminal law, courts and investigative bodies are confronting unregulated and novel forms of evidence. Without significant internal guidance, a range of best practices regarding digital evidence has emerged from these investigative bodies.
The creation of a standing investigative mechanism has the potential to strengthen evidence collection and use across the international criminal justice system, particularly within the realm of open-source evidence. In the early years of the International Criminal Court (ICC or Court), concerns of ineffective investigations plagued its reputation.Footnote 16 In response, the Court began broadening its evidentiary sources, including increased reliance on information collected by third-parties. Footnote 17 Continuing this trend, notably with respect to open-source investigations involving user-generated evidence,Footnote 18 will further strengthen international criminal justice. Given the novelty of the use of user-generated open-source evidence before international criminal tribunals, despite the progress made by investigative bodies, there are a number of challenges with respect to the use of digital evidence. A standing investigative mechanism can facilitate greater standardization in the use of, and access to, evidence across the investigative community, allowing for an improvement in the quality of international criminal investigations and effective prosecutions.
2. Current evidentiary practices in international criminal law
2.1. Evidentiary standards set by courts
The renaissance of international criminal law took the turn of the twenty-first century by storm. Over the course of a decade, a flurry of internationalized courts – the ad hoc tribunals, the ICC, and hybrid courts – revitalized the field. Faced with the prospect of creating an internationalized court, the component parts of these courts reflect the compromises it took to create them. Notably, the rules of evidence of international courts, across the board, reveal a combination of civil and common law legal systems, with significant deference to Chambers to address the novel issues these courts would inevitably encounter. By design, the evidentiary rules of courts are limited but provide the standards through which digital evidence must be considered.
2.1.1. Rules of admissibility and exclusion
In adopting standards of evidence for the ad hoc tribunals, the drafters of their Rules of Evidence and Procedure prioritized flexibility. Given the limited precedent in the field of international criminal law prior to the establishment of the ad hoc tribunals, flexible rules of evidence allowed for judges to tackle issues of first impression without being bound by technical rules of evidence, similarly to the approach adopted by the Nuremberg tribunal.Footnote 19 Beginning with the ad hoc tribunals,Footnote 20 the Rules of Procedure and Evidence of international justice mechanisms provide for broad admissibility of relevant evidence.Footnote 21 The general standard that has emerged for the admissibility of evidence across courtsFootnote 22 is a tripartite test that considers the evidence’s (i) relevance,Footnote 23 and (ii) probative value,Footnote 24 weighed against (iii) any potential prejudice.Footnote 25
Despite the general admissibility of evidence, there are limited exclusionary rules prohibiting the introduction of evidence before international courts. The ad hoc and hybrid tribunals broadly prohibit the introduction of evidence ‘obtained by methods which cast substantial doubt on its reliability or if its admission is antithetical to, and would seriously damage, the integrity of the proceedings’.Footnote 26 Similarly, the Rome Statute offers two situations where judges may determine the admissibility of evidence:
Evidence obtained by means of a violation of this Statute or internationally recognized human rights shall not be admissible if: (a) The violation casts substantial doubt on the reliability of the evidence; or (b) The admission of the evidence would be antithetical to and would seriously damage the integrity of the proceedings.Footnote 27
This exclusionary standard is discretionary, however, and permits judges ‘to seek an appropriate balance between the statute’s fundamental values in each concrete case’.Footnote 28 The Special Court for Sierra Leone (SCSL) similarly provides for the exclusion of evidence ‘if its admission would bring the administration of justice into serious disrepute’.Footnote 29 The Extraordinary Chambers in the Courts of Cambodia (ECCC) specifically excludes statements obtained through ‘inducement, physical coercion or threats thereof’,Footnote 30 and evidence obtained through interceptions or recordings of conversations via telephone or electronic correspondence.Footnote 31 Accordingly, unless excluded on these bases, evidence is generally admitted to the record, with reliability dictating weight rather than admissibility.Footnote 32
Without stringent rules governing admissibility of evidence, the jurisprudence of international criminal mechanisms has expounded somewhat upon the limited rules of evidence. Within the context of open-source evidence, however, given the limited exposure, the jurisprudence is also limited.Footnote 33 Across the courts, while judges may determine the admissibility of evidence at the time of submission or with the final judgment, relevant evidence is generally admitted to the record, with its weight determined in the final judgment.Footnote 34 However, notably, the admissibility of digital evidence has exceptionally been ruled upon prior to that judgment,Footnote 35 given the unprecedented nature of the source material before international courts. As such, should this practice continue, the specific considerations for digital evidence may continue to emerge. In the meantime, however, the general tripartite standard for the admissibility of evidence will continue to govern.
When considering the admissibility of open-source evidence, probative value is likely the most precarious element of the three. Across tribunals, jurisprudence has established that reliability and authenticity are two crucial components in the assessment of probative value.Footnote 36 While related concepts, reliable evidence is, at its base, what it proports to be, while authentic evidence has not been manipulated or tampered with. Reliability can be established through a variety of factors, including the origin, content, corroboration, truthfulness, voluntariness, and trustworthiness of the evidence.Footnote 37 Authenticity, on the other hand, can be established based on a number of internal, relating to the evidence itself, and external, relating to the collection and management of the evidence, indicators.Footnote 38 For digital evidence, relevant internal indicators relate to the creation of the evidence, such as geolocation, source codes, and metadata.Footnote 39 To date, the ICC has primarily relied upon geolocationFootnote 40 and expert testimony reportsFootnote 41 to establish internal indicators. External indicators include the provenance and chain of custody of evidence.Footnote 42 The ad hoc tribunals generally admit evidence when corroborated by external indicators, such as expert testimony and corresponding transcripts.Footnote 43 Additionally, while ‘nothing in the Statute or the Rules expressly states that the absence of information about the chain of custody … affects the admissibility or probative value of Prosecution evidence’,Footnote 44 tribunals have broadly emphasized the importance of proof of chain of custody in determining authenticity,Footnote 45 particularly for digital evidence.Footnote 46
Given the nature of open-source evidence, while there are specific issues that are notably under addressed in the realm of digital evidence,Footnote 47 investigators must exercise particular diligence in ensuring, establishing, and conveying the reliability and authenticity of evidence in order to ensure its admissibility. Throughout the collection, storage, and admission processes, ensuring that markers of reliability and authenticity remain intact is of the utmost importance for the use of open-source evidence.
2.1.2. Determination of weight
Even if Chambers determine that evidence is admissible, this finding has ‘no bearing on the final weight to be afforded to it, which will only be determined by the Chamber at the end of the case when assessing the evidence as a whole’.Footnote 48 While the admissibility of all evidence is determined on the basis of standardized evidentiary tests,Footnote 49 the determination of weight is a more subjective and comprehensive analysis, and varies across categories of evidence.Footnote 50 Evidence falls into four general categories of evidence: testimonial, documentary, physical, and forensic.Footnote 51 Generally, digital open-source evidence posted on social media platforms constitutes documentary evidence.Footnote 52 In the context of documentary evidence, Chambers will consider the evidence’s ‘provenance, source or author, as well as their role in the relevant events, the chain of custody from the time of the item’s creation until its submission to the Chamber, and any other relevant information’.Footnote 53 Further, in addition to being components relevant to probative value, the authenticity and reliability of evidence are also relevant to its weight.Footnote 54
Across the range of international courts, the standards considered by Chambers in assessing the admissibility and weight of digital evidence remain largely opaque. While the full scope of the role of digital evidence has not yet been addressed, it is also likely that the opacity of decisions regarding digital evidence is due to the way that Chambers assess the evidence. The reality is that international criminal judges are not experts in digital evidence, nor the indicators needed to verify it,Footnote 55 and to that end are largely reliant on expert testimony or other corroborationFootnote 56 to determine the weight of digital evidence, precluding a need for significant discussion of the factors in case law. Further, Chambers have explicitly stated that ‘it will consider all the standard evidentiary criteria for each item of evidence submitted, though it may not necessarily discuss in the judgment every submitted item’.Footnote 57 As such, practitioners should proactively take all possible steps to ensure the clarity of the authenticity and reliability of evidence to rebut any potential concerns.
2.1.3. Storage of evidence
Due to the broad admission of evidence before international tribunals, the evidentiary record must be carefully retained so that judges are able to determine the associated weight of evidence. To that end, the retention of evidence throughout the judicial process is of the utmost importance. Prior to the commencement of proceedings, the official investigation rests within the purview of the Prosecutor, where they are ‘responsible for the [preservation and retention], storage and security of information and physical evidence obtained’.Footnote 58 Once proceedings commence, however, the Registrar obtains the responsibility of retaining and preserving the record.Footnote 59 The Registrar must ‘preserve a full and accurate record of all proceedings’, as well as ‘retain and preserve all physical evidence offered during the proceedings’.Footnote 60 Even after many iterations of revisions, the International Residual Mechanism for Criminal Tribunals’ (IRMCT) RPE refer only to physical evidence.Footnote 61 Distinct from the ad hoc tribunals, the ICC RPE refer, in establishing the Registrar’s duty of retention, to not only physical evidence, but ‘all the evidence and other materials offered during the hearing’,Footnote 62 broadly encompassing digital evidence in addition to more traditional forms of evidence.
Despite the novelty of digital evidence at the time of the creation of the ad hoc tribunals, these courts introduced an electronic document management system to organize and retain evidentiary materials.Footnote 63 Consequently, when the IRMCT established its own rules of evidence, it created a rule requiring the Prosecutor to ‘make available to the Defence, in electronic form, collections of relevant material held by the Prosecutor, together with appropriate computer software with which the Defence can search such collections electronically’.Footnote 64 This effort, while clearly a recognition of the need for electronic storage and sharing of documents, only scratched the surface of the role of technology before international courts. Similarly to the IRMCT, the ICC also adopted a regulation providing for the electronic management of the Court. Regulation 26 requires that the Court ‘establish a reliable, secure, efficient electronic system’, to be implemented by the Registry, in order to ‘ensure authenticity, accuracy, confidentiality and preservation of judicial records and material’.Footnote 65 As such, ‘[i]n proceedings before the Court, evidence other than live testimony shall be presented in electronic form whenever possible’.Footnote 66 The ICC also developed an ‘e-Court Protocol’, which establishes specific standards for digital evidence in order to ‘ensure authenticity, accuracy, confidentiality and preservation of the record of proceedings’.Footnote 67 The standards, however, largely offer guidance on the storage and format of evidence,Footnote 68 rather than admissibility standards. Recently, the Office of the Prosecutor announced the creation of a new access link, OTPLink, to facilitate submission of evidence.Footnote 69 In response to common issues associated with digital evidence, OTPLink allows any witness with a web-enabled device to securely submit evidence, uses a combination of machine learning and artificial intelligence to review and sort submissions, and creates a digital chain of custody in line with the Court’s standards.Footnote 70 With the passage of time since the ad hoc tribunals’ establishment and the associated technological advancements, the ICC certainly offers additional insight into international tribunals’ handling of digital evidence, but the still limited case law regarding digital evidence leaves open a number of remaining issues.
2.2. Evidentiary practices employed by investigative bodies
Following the emergence of international tribunals, the international criminal justice community, deterred by the hurdles associated with the establishment of those tribunals, turned towards other avenues for accountability. In both the public and private spheres, a number of investigative bodies emerged to document atrocity crimes in an effort to pave the way for future judicial efforts. Given their emphasis on investigative work, and their subsequent co-operation with international tribunals, these investigative bodies offer insight into the collection and management of digital evidence.
2.2.1. Public investigative efforts
Following the resurgence of international criminal tribunals at the turn of the twenty-first century, the United Nations (UN) General Assembly (UNGA) began playing a more active role in international criminal accountability.Footnote 71 Until that point, the UN Security Council (UNSC) bore primary responsibility for the creation of international criminal tribunals under its Chapter VII enforcement powers.Footnote 72 Given the stalemate often associated with the UNSC,Footnote 73 the UNGA opted to establish the United Nations’ International, Impartial, and Independent Mechanism for Syria (IIIM) rather than waiting for the establishment of an ad hoc criminal tribunal.Footnote 74 As such, distinct from international courts, the IIIM was established as a fact-finding body intended to support future criminal trials but without the mandate to prosecute themselves.Footnote 75 While authorization by the UNGA offered the IIIM the advantage of a less contentious, and timelier, establishment process, investigative mechanisms are not without their own challenges. Notably within the context of evidence collection, without UN Charter Chapter VII authorization or authorization by the Syrian regime,Footnote 76 the IIIM cannot access Syrian territory and is therefore entirely reliant on digital evidence, accessible from outside of Syria, and co-operation from unassociated actors located within, or outside of, Syria.Footnote 77
The establishment of the IIIM was subsequently followed by a number of similar fact-finding missions. Among others, the UNSC established, at the request of the Iraqi Government, the United Nations Investigative Team to Promote Accountability for Crimes Committed by Da’esh/Islamic State in Iraq and the Levant (UNITAD) in 2017.Footnote 78 The Human Rights Council (HRC) established the Independent Investigative Mechanism for Myanmar (IIMM) in 2018.Footnote 79 Finally, most recently, the HRC established an independent, international Commission of Inquiry on Ukraine in 2022.Footnote 80 Each of these fact-finding missions, like the IIIM, is distinct from a criminal tribunal in that they have no judicial, but only an investigative, mandate.Footnote 81
The investigative mechanisms are each responsible for the collection, storage, and preservation of their respective materials. Generally, these mechanisms adopt a similar general standard for evidence collection: compliance with international standards.Footnote 82 The IIIM publicly describes its procedures as being, ‘in accordance with international criminal law standards … [and] tak[ing] appropriate measures to respect and ensure respect for the confidentiality, privacy, interests and personal circumstances of victims, and taking into account the nature of the crime’.Footnote 83 Similarly, the IIMM adopts procedures ‘consistent with the UN Charter, UN rules, regulations, policies and good practices, relevant international law and jurisprudence, notably the security and well-being of victims and witnesses and the right to a fair trial and other due process provisions’.Footnote 84 Finally, UNITAD provides for similar considerations, also providing for the relevance of jurisprudence:
The Investigative Team has adopted procedures for collecting, preserving and storing evidence and materials that are in line with the highest possible standards, consistent with the UN Charter, UN policies and best practice, relevant international law, including international human rights law, notably the right to a fair trial and other due process provisions, as well as the relevant jurisprudence …Footnote 85
The mechanisms also provide for a baseline of consideration of storage and preservation of materials, from acquisition until transfer,Footnote 86 using electronic databases and other information management tools.Footnote 87 While these baseline standards regarding evidence collection and storage are consistent across investigative mechanisms, there remains significant discretion left to the bodies themselves to develop actionable standards and practices for evidence collection.Footnote 88
2.2.2. Private investigative efforts
In addition to the emergence of investigative bodies within the structure of the UN, a number of private organizations, including NGOs, governmental organizations, and educational institutions, have emerged as contributors to the realm of international criminal investigations. NGOs focused on OSINT, such as Bellingcat,Footnote 89 the Commission for International Justice and Accountability (CIJA),Footnote 90 the Syrian Archive,Footnote 91 and WITNESS,Footnote 92 among more traditional human rights NGOs such as Amnesty International,Footnote 93 TRIAL International,Footnote 94 and Public International Law & Policy Group (PILPG),Footnote 95 have begun bringing digital evidence investigations into the mainstream. These efforts are augmented by the aid of other similarly motivated institutions, like UC Berkeley School of Law Human Rights Center,Footnote 96 the Public Interest Advocacy Centre,Footnote 97 the Nuremberg Principles Academy,Footnote 98 and the Digital Verification Unit at the University of Essex’s Human Rights Centre.Footnote 99
The efforts of these private investigative bodies have made significant contributions to the standardization of investigative standards. Noting the lack of guidelines for the collection and use of digital evidence, the Berkeley Protocol on Digital Open-source Investigations (Berkeley Protocol) created a ‘set of minimum standards for the collection, analysis, and preservation of digital open-source information’.Footnote 100 Initiated at a point in time when there were no systematized guidelines in place to govern the use of digital evidence, the focus on minimum standards created a common baseline to which investigative bodies could adhere, rather than a set of best practices.Footnote 101 Subsequently, Leiden University developed the Leiden Guidelines on the Use of Digitally Derived Evidence (Leiden Guidelines), which seek ‘to assist practitioners by comprehensively outlining the essential elements which should be considered before submitting [digitally derived evidence] to an international criminal court or tribunal’.Footnote 102 However, these guidelines notably omit discussion of open-source evidence, and particularly social media posts, given the lacuna in jurisprudence on the issue.Footnote 103 Given this reality, investigative bodies still have significant discretion to adopt their own practices, resulting in the emergence of varied, albeit broadly stronger,Footnote 104 investigative standards, particularly within the realm of open-source evidence.
Further, some investigative efforts provide a uniquely hands-on approach to aiding citizen investigators. EyeWitness to Atrocities, an initiative of the International Bar Association, created a mobile application through which users can record and upload photos, audio, and video.Footnote 105 Once uploaded to the application, a master version of the media is saved to a secure server, along with affiliated metadata.Footnote 106 EyeWitness’s secure server also strives to protect the chain of custody of its evidence.Footnote 107 Finally, eyeWitness allows users to upload media anonymously.Footnote 108 Once housed in eyeWitness’s server, employees can access the material to review and categorize for use in future criminal investigations. CameraV, an application developed by The Guardian Project in collaboration with WITNESS, took a similar approach to documenting citizen investigator’s work.Footnote 109 However, while applications like eyeWitness and CameraV can serve a meaningful purpose for civilian investigators, it is not a panacea for open-source investigations. The reality is that the average citizen will turn to more familiar applications over specialized investigative applications,Footnote 110 and investigative applications were not developed to replace, but rather support, the role of traditional social media outlets.Footnote 111 Effectively interfacing with those traditional social media platforms will continue to be an essential component of international criminal investigations, notwithstanding the progress of investigative bodies and other efforts.
3. Challenges in digital evidence collection in international criminal law
To date, there remains a number of unanswered questions in the realm of digital evidence in international criminal investigations. Efforts, particularly by private investigative bodies, have contributed significantly to the emergence of standards for the collection of digital evidence. These sources, however, are most instructive to user-generated evidence in the most formal sense: where citizens seek out to collect evidence with the purpose of aiding investigations ex ante. As such, there remain particular issues with respect to user-generated evidence that have not yet been sufficiently addressed, either by international courts or investigative bodies.Footnote 112
3.1. Evidentiary standards of admissibility
In addition to the political compromise associated with the formation of international courts, the complex nature of international criminal cases is served well by limited evidentiary constraints. To that end, some practitioners take the view that user-generated evidence is not dissimilar in any meaningful way from more traditional forms of documentary evidence and therefore fits into the pre-existing evidentiary framework established by international courts.Footnote 113 However, the reality is that there are particular elements of user-generated evidence that are unique to this type of evidence, and there are a few unanswered questions with respect to the admissibility of user-generated evidence in international courts, namely with respect to anonymous digital evidence and consistency in the preservation of the chain of custody. These questions may well be answered by international courts themselves in due course through case law, but relying on the courts themselves is not the only way to obtain standardization. Consistency in the presentation of evidence to international tribunals could present courts with a reasonable framework for the admissibility of user-generated evidence going forward, allowing investigative bodies to similarly influence admissibility standards without the addition of a formal rule. Irrespective of the final approach taken, a more complete understanding of the role of authorship and chain of custody in the context of user-generated evidence is a crucial step in its admissibility before international courts.
3.1.1. Authorship
The role of authorship of content within the context of admissibility of user-generated evidence raises a number of unanswered questions. The nature of digital evidence, particularly when gathered from an open-source platform rather than directly from an individual, may render the determination of authorship challenging. While content itself may be publicly available, the underlying information, namely the original creator, may not be.Footnote 114 Even when the original creator posts content themselves, users may opt to post that evidence anonymously. There are legitimate reasons, both with respect to practicality and privacy,Footnote 115 for users to submit evidence anonymously.
Despite international court’s preference to date for authored evidence,Footnote 116 there are genuine reasons to maintain the anonymity of user-generated evidence. Firstly, in the context of user-generated evidence gathered through open-source investigations, the initial author of digital evidence may be difficult, if not impossible, to discern.Footnote 117 Further, authors of digital evidence are subject to security concerns, in a similar manner as more traditional witnesses.Footnote 118 While more traditional witnesses consent, at least to a degree, to involvement the judicial process, the same is not necessarily true for the creators of digital content, particularly of social media posts. While authors of digital evidence may not be obligated to travel, either in-person or virtually, to the seat of a court for the use of their evidence,Footnote 119 providing evidence is not without its dangers. Particularly when an author’s name is tied to evidence, there are still considerable risks for users posting content that then becomes evidence, from the filming of the incident through to the aftermath of a potential trial.Footnote 120 Even when evidence is provided anonymously, determined individuals can use the date, time, and other data to identify the author of the content.Footnote 121 Despite the respite that anonymity can provide to authors of user-generated evidence, courts’ preference for authored evidence is also mirrored in private investigative efforts’ preferences.Footnote 122 Given this reality, authorship of content is relevant not only to the admissibility of content but also to the consent of the author to the admission of that evidence.
The question of consent within the realm of open-source evidence remains underdeveloped. While courts have admitted, and referenced, anonymous evidence, particularly in the context of NGO reports with anonymous testimonial evidence,Footnote 123 the admissibility of anonymous digital evidence is likely not legally impeded, so long as indicia of reliabilityFootnote 124 can be effectively established without knowledge of the creator. That does not, however, render creator consent irrelevant. The Berkeley Protocol raises additional considerations with respect to creator consent. Implicit in the definition of open-source content is its publicity – the Berkeley Protocol itself defines open-source information as ‘publicly available information that any member of the public can observe, purchase or request without requiring special legal status or unauthorized access’.Footnote 125 While information may be publicly available on the internet, the data may have been uploaded by a third-party without proper permissions, leading to possible legal and ethical restrictions on its use.Footnote 126 For that reason, the Berkeley Protocol recommends that investigators obtain the consent of the persons involved in the creation of the content.Footnote 127 As such, creator consent remains a best practice, if not a requirement,Footnote 128 for investigative efforts prior to the use of data.
3.1.2. Chain of custody
A chain of custody is defined as the ‘chronological documentation of the sequence of custodians of a piece of information or evidence, and documentation of the control, date and time, transfer, analysis and disposition of any such evidence’.Footnote 129 The Berkeley Protocol provides that in order for information to be admissible as evidence, prosecutors and counsel must typically establish the chain of custody of the content.Footnote 130 While many forms of evidence require the establishment of a chain of custody as a marker of authenticity, establishment of the chain of custody for digital evidence is particularly technical in comparison.
The chain of custody of digital evidence can be established through two main procedures. The first approach, which replicates a traditional manner of verifying an unbroken chain of custody, relies upon the testimony of the individuals who controlled the possession of the evidence from acquisition through trial.Footnote 131 By testifying to the collection, storage, and preservation of the evidence, the chain of custody, and thus the reliability, of the evidence can be established.Footnote 132 Alternatively, technology itself can similarly establish the consistency of evidence throughout its lifecycle. When content is removed from a platform, a unique identifier, known as a hash, can be generated.Footnote 133 By cross referencing the hash at the time of the acquisition of the content with the hash at the time of presentation to the court, consistency in the two identifiers can demonstrate consistency in the content across time.Footnote 134 While both methods can demonstrate an unbroken chain of custody, ensuring that continuity in the first place is a more challenging. The task of ensuring that continuity is based more in policy and practice than in technology, and those practices become more difficult to regulate as the storage of digital evidence becomes more complex.Footnote 135 When an original piece is saved locally and subsequently untouched, with access and modification occurring only to a copy,Footnote 136 the chain of custody can effectively be maintained without issue. However, given the amount of digital content to which investigative bodies have access, local storage spaces may prove to be insufficient going forward. As investigative bodies turn towards cloud storage for content, new concerns regarding the maintenance of a chain of custody may emerge. Where there is a lack of encryption or a third-party storage platform is used, potential accessors to the content become outside of the control of the investigative body.Footnote 137 Given the lack of case law on the subject, it is possible that even opening the access of the content in this manner to external actors may complicate the maintenance of a chain of custody for international courts. For this reason, the question of ensuring effective storage of potential evidence is of the utmost importance.
3.2. Evidence storage
Effective storage of digital information is paramount to its eventual use as evidence. As recognized across international courts, retention and storage of evidence is a foundational requirement of the judicial process.Footnote 138 For international courts, effective storage of evidence permits judges to make informed decisions regarding weight at the conclusion of a trial.Footnote 139 For investigative bodies, effective storage of information will permit its subsequent use in a criminal trial by avoiding manipulation and ensuring continuity in the chain of custody. Given the volume of potential evidence that is being generated in the context of modern conflict, ensuring effective storage and access of those materials is paramount to the eventual increased use of user-generated evidence before international courts.
3.2.1. Storage of evidence
A prominent issue with the use of open-source evidence is the sheer volume of content. Storage of content comes at significant financial cost, requiring investigative bodies to make difficult decisions regarding storage. For some, with particularly stretched budgets, in-house preservation is impossible, and evidence is maintained only to the extent that it remains accessible online.Footnote 140 For others with more resources to dedicate to the preservation of evidence, tools of preservation include both internal and third-party resources.Footnote 141 Internally, investigators save certain files locally on their own computers, or re-upload them to personal YouTube or Vimeo accounts for, at least temporary, safeguarding.Footnote 142 Externally, platforms such as Google Drive or the Internet Archive’s Wayback Machine offer cost-effective mechanisms for storing data.Footnote 143 Finally, bodies with the most resources can create customized, or original, platforms for storage. By creating a private, encrypted storage platform, investigative bodies can most effectively store and protect information.Footnote 144 The Syrian Archive, for example, is working proactively to compile an archive of open-source information. By scraping platforms for relevant content, the Syrian Archive is able to store potential evidence in advance of the opening of a formal investigation.Footnote 145
Given the budgetary and operational differences between investigative bodies, the evidence storage and management platforms similarly vary significantly. Even more concerningly, evidence storage practices can vary within those individual organizations. Practitioners suggested that a lack of standard operating procedures (SOPs), even internally, creates ad hoc storage policies.Footnote 146 A lack of standardized storage procedures can render subsequent analyses of data more difficult to conduct, result in duplication of materials, and may even compromise the evidence itself. Given these realities, ensuring more standardized storage policies should be a priority for investigative bodies.
3.2.2. Access of evidence
Once evidence is maintained in a repository, there are a number of unanswered questions with respect to the access of that information. In the simplest of storage options, where information is held in-house on a local hard drive, access of evidence is similarly simple and can be limited to employees of an investigative body. With any added complications, however, that access can become more contentious.
The danger of ubiquitous access to evidence is twofold. Firstly, the access of evidence can raise important ethical concerns. The ‘Do No Harm’ principle acknowledges that any international involvement into conflict becomes part of that conflict and therefore produces both negative and positive impacts.Footnote 147 Under the principle, any intervener should minimize any potential, even if inadvertent, harm they may cause.Footnote 148 Within the context of open-source investigations, and more specifically the access of that information, the primary potential harm is the violation of the right to privacy. The right to privacy is established in a variety of domestic and international sources and is laid out in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), stating that ‘[n]o one shall be subjected to arbitrary interference with their privacy, family, home or correspondence, nor to attacks upon their honour and reputation. Everyone has the right to the protection of the law against such interference or attacks’.Footnote 149 Investigators’ use, even of publicly posted information, of digital content, particularly in a subsequent criminal trial, may constitute a violation of the right to privacy.Footnote 150 In order to respect that right, investigators must strive to obtain the informed consentFootnote 151 of the content creator when possible, acknowledging that evidence may be promulgated anonymously, rendering the acquisition of informed consent difficult, if not impossible, in certain contexts.
A violation of the right to privacy is not only problematic with respect to individual rights but also to the admissibility of any associated evidence. As laid out in Article 69(7) of the Rome Statute, evidence obtained in violation of a human right may preclude its admissibility.Footnote 152 The right to privacy, as an internationally recognized human right,Footnote 153 would fall within the purview of this article. However, the Court has provided additional insight into which violations would be sufficiently severe to justify exclusion. A violation of a right only affects the reliability of evidence where full respect to that right would have resulted in a difference in the content of the evidence.Footnote 154 In the case of a violation of the right to privacy in the context of open-source evidence, digital content would be consistent, regardless of whether it was obtained in respect or in violation of that right.Footnote 155 To that end, the right to privacy in the context of open-source investigations would likely not preclude the admissibility of digital evidence under Article 69(7), though a definitive answer to the question is unclear until international courts are in a position to address the question.
Further to protections of the right to privacy, ubiquitous access to digital information raises concerns with respect to the safekeeping of any potential evidence. Access to information necessitates a balance between the benefits that increased access to materials provide and the security of any potential evidence. Without the ability to share information, investigative bodies are likely to be overlapping, if not repeating, the work of their counterparts. Given the budgetary restraints associated with each of these organizations, avoiding this duplication would serve those organizations, as well as the broader international criminal justice community, more effectively. Overbroad access, on the other hand, would counter efforts to reduce duplicative work. If hostile actors have access to potentially valuable evidence, the content could be subject to alteration or removal, precluding its future use as evidence.Footnote 156 As with evidence storage more broadly, investigative bodies weigh these competing interests differently, resulting in a range of strategies regarding the sharing of information. Some organizations emphasize the security of their content, by opting to collect and store data locally, disconnected from the internet.Footnote 157 Despite the importance of ensuring the security of content, there is an increasing recognition among investigative bodies that there is a need for further co-ordination and co-operation – a feat which is only possible with increased access to potential evidence.
3.3. Corporate reliance
Within the realm of evidence obtained from social media platforms, investigative bodies are largely reliant on the platforms themselves to obtain crucial information.Footnote 158 That reliance presents itself in two main contexts: firstly, social media platforms have significant control over the scope and enforcement of their content moderation policies, resulting in the potential loss of valuable evidence; and secondly, access to that removed content, and underlying metadata of both removed and public content, is similarly controlled by the platforms themselves. In order to make use of the wealth of potential evidence privy to social media platforms, investigative bodies should aim to establish co-operative policies with these corporations.
3.3.1. Content moderation policies
Content moderation is defined as ‘the process by which Internet companies determine whether user-generated content meets the standards articulated in their terms of service and other rules’.Footnote 159 In response to increasing levels of extremist content, voluntary agreementsFootnote 160 and punitive measuresFootnote 161 entice social media platforms to strengthen their moderation policies.Footnote 162 The legal obligations binding content moderation policies are quite limited,Footnote 163 so as evidenced by the definition itself, each platform can, and does, establish its own standards for content moderation.Footnote 164 Content moderation can be conducted in two broad contexts: ex post or ex ante posting.Footnote 165 Users of a platform can flag content for removal once posted, known as ex post moderation, and the platforms’ content moderators will review a user’s flagging against the platform’s policies to verify content’s violation of or alignment with the policies. Flagging, and review, for removal is not only performed by individuals but is increasingly automated.Footnote 166
In the context of ex post moderation, investigators can, at least potentially, access and preserve content prior to its flagging and subsequent removal. In order to ensure the preservation of evidence, investigators are their own best resource at present: ‘you can’t trust others to ensure its existence’.Footnote 167 Ensuring preservation by an individual investigator, however, is easier said than done. Generally, social media platforms do not permit direct downloads from their website;Footnote 168 investigators, rather, have to rely upon external websites or software to download content.Footnote 169 The introduction of a third-party software potentially raises complications regarding the maintenance of the chain of custody, but without case law on the precise issue, it remains an open question as to how courts will treat evidence downloaded through such a platform. In addition to downloading content, investigators can also create stable links to the content, or simply capture a screengrab, though both of these options introduce the possibility of losing the metadata associated with the content.Footnote 170
Ex ante moderation of content, on the other hand, presents particular difficulties for international criminal investigations. While investigators notably aim to save information as soon as possible, where content is moderated prior to posting, an investigator loses the opportunity to access evidence. At present, social media platforms are neither required to disclose their moderation policies nor moderated content.Footnote 171 The relevance of the loss of moderated content prior to posting relies largely on the platform’s moderation policies and those influencing them. While content moderation is likely a necessary safeguard in a world of misinformation and content inciting crimes, they can also be assumed for nefarious purposes. In addition to civilian users or platform employees flagging content for removal, state actors have also taken advantage of moderation policies.Footnote 172 Through a variety of mechanisms, including formal requests, governmental referral units, and more inventive tactics, state actors have the capacity to directly influence the moderation of content.Footnote 173 Outside of this direct involvement in content moderation, given the flexibility of moderation policies, state actors often exercise political force to shape these policies.Footnote 174 The involvement of state actors in the regulation of social media platforms is neither surprising nor unwarranted, but there are indications that the moderation of content by state actors does not always result in expected outcomes. In examples raised by practitioners, there have been cases where content showing military vehicles or weapons, but was otherwise nonviolent, was removed, whereas violent content without those state connections was left untouched, raising suspicions of state involvement in content moderation.Footnote 175 Particularly within the realm of atrocity crimes, where state actors are often directly or indirectly involved in the perpetration of crimes, state actor’s involvement in the moderation of potential evidence in these cases raises significant concern.
3.3.2. Investigative access to content
In light of the necessity of content moderation, and the reality that social media platforms will continue to moderate their content, investigative bodies must work co-operatively within that framework. Social media platforms are privy to a large repository of valuable information – even in the case of a lack of publicly available metadata, it may still be accessible, at least for a period of time.Footnote 176 Social media companies maintain a repository of metadata of uploaded media, but the preservation of that content is neither uniform nor particularly clear.Footnote 177 Under Article 54(3)(f) of the Rome Statute, the Prosecutor is authorized to take measures, or request that measures be taken, to preserve evidence.Footnote 178 As such, the Prosecutor has the ability to request that social media platforms preserve evidence, but this avenue remains discretionary, as well as limited.
In order to reduce costs associated with data storage and increase the accessibility of data, social media platforms make use of cloud computing.Footnote 179 Rather than storing data on a local hard drive in a singular location, data is stored in centres in multiple countries.Footnote 180 Traditionally, prosecutors rely on Mutual Legal Assistance Treaties (MLATs), which are bilateral frameworks for co-operation in law enforcement,Footnote 181 to access and collect extra-territorial evidence. MLATs are, however, designed for use by states and, given their bilateral nature, can vary between jurisdictions. Further, unlike more traditional forms of evidence, within the realm of cloud computing, prosecutors likely need to make use of multiple MLATs to access all needed data.Footnote 182 Given the lack of standards for MLATs, co-ordinating data collection across jurisdictions for a state prosecutor is a challenging undertaking.
For international courts and investigators working outside the framework of states, the process for accessing data is even less regulated. Under Rule 104(2) of the ICC RPE, the Prosecutor may seek additional information from third parties, including ‘States, organs of the United Nations, intergovernmental and non-governmental organizations, or other reliable sources’.Footnote 183 As such, international tribunals can directly request information from social media platforms.Footnote 184 The willingness of platforms to comply with those requests is, however, a manner of internal policy, which is ‘largely a matter of company discretion’.Footnote 185 For civil society organizations, the avenues for co-operation with social media platforms are more limited still.Footnote 186 The existing legal avenues for content sharing between investigative bodies and social media platforms leaves investigative bodies largely reliant on the platforms for co-operation.
4. Standardizing open-source investigations
Despite the ongoing work of public and private investigative bodies alike, the most significant issue to the admissibility of open-source evidence is the ad hoc nature of investigations. International courts’ treatment of authorship and chain of custody in the admissibility and weight of potential evidence will likely be assessed on a case-by-case basis in the immediate future. Across investigative bodies and courts, the practices for the storage of evidence and the subsequent access of that information vary significantly. Similarly, social media platform’s content moderation policies and co-operative policies with law enforcement and civil society differ. Creating standardization across these gaps will strengthen the admissibility and the quality of potential evidence for international criminal investigations.
Scholars, in the wake of the establishment of a handful of ad hoc investigative mechanisms, have begun considering the establishment of a Standing Independent Investigative Mechanism.Footnote 187 Similarly to the considerations that preceded the establishment of the ICC, co-ordinating international investigations in a singular mechanism may serve the international community more effectively than the continued establishment of ad hoc investigative mechanisms. Currently, human rights activists, journalists, and lawyers are all contributing to open-source investigations. Creating a centralized investigative mechanism would ensure that all information gathered would be geared towards a trial standard, rather than the standards associated with advocacy or journalist. Further, by co-ordinating investigations, a standing mechanism could avoid repetition of work, both in and across investigations. At present, when a new investigative mechanism is established, there are significant financial costs and time restraints associated with its start-up – funding, staff, and systems must be acquired prior to the initiation of any investigative work.Footnote 188 With a standing mechanism, the administrative and organizational framework would already be in place when a situation arises meriting further investigation, allowing for more cost-effective and timelier investigations.
An underexamined benefit of a standing investigative mechanism is the role it could play in standardizing the collection and use of open-source evidence. A number of scholars have called for a collective repository of digital evidence, also referred to as a digital locker.Footnote 189 The idea of a digital locker is not only compatible with, but would be a crucial component of, a standing investigative mechanism. On a smaller scale, some organizations have begun operationalizing the idea of an evidence repository. Within the context of the European Union, Europol is working to develop a database for international crimes, through which members can request and share evidence between national law enforcement agencies.Footnote 190 Similarly, the Syrian Archive has created a repository of content related to human rights abuses committed in Syria.Footnote 191 By co-ordinating the storage of content, the Syrian Archive has been able to efficiently filter and cross-reference data, allowing for a more effective conceptualization of the scale and scope of incidents.Footnote 192 Using these initiations as a model for the broader international criminal justice community, a standing international investigative mechanism can offer a framework through which a digital locker could be established.
Co-ordinating investigations into a singular mechanism could also alleviate some of the pressures associated with investigative work. Access to funding is a significant concern for investigative bodies broadlyFootnote 193 – secure storage solutions are expensive to implement, and scarce resources can preclude the existence of an effective data management system.Footnote 194 Allowing investigative work to share resources, including hardware, storage space,Footnote 195 and staff, would allow even a limited budget to go further than it would on an ad hoc basis. Further, by co-ordinating work internally within one framework, a standing mechanism could also more effectively create a shared SOP for documentation, storage, and analysis of digital evidence.
By having a centralized investigative body, co-operation with social media platforms would also be streamlined. Given the lack of official avenues for co-operation with non-state actors,Footnote 196 investigative bodies are forced to work on an ad hoc basis, largely subject to the acquiescence of social media platforms. While a standing investigative body would not be privy to more official co-operative measures, it would allow for a singular set of agreements between the investigative mechanism and social media platforms. Under a memorandum of understanding, such as those entered into by select states or corporations and the ICC,Footnote 197 a more official agreement could bind social media platforms to share content and affiliated information with the investigative body, subject to certain conditions. The terms under which information would be shared, such as who could request it, what categories of content could be shared, and how intellectual property, privacy, and national security laws would be implicated, are likely to be contentious, though the prospect of undergoing those negotiations for one investigative mechanism is more palatable than the alternative.
Additionally, a standing investigative mechanism could facilitate the equality of arms. The principle of equality of arms is a crucial component of any fair trial.Footnote 198 Given the inherent power imbalance associated with the Prosecution’s initiation of a case, in addition to the practical imbalance in resources, the ICC enshrined protections in the Rome Statute to attempted to alleviate this tension, particularly with respect to the collection of evidence: namely, the Office of the Prosecutor has a duty to investigate both incriminating and exonerating circumstances equally,Footnote 199 and to disclose any evidence material to the preparation of the defence.Footnote 200 While these protections are crucial, they are minimum standards and do not fully remedy the power imbalance. By creating a standing mechanism, defence counsel could access a full repository of evidence, and associated metadata, allowing for a more streamlined sharing of evidentiary materials at lower cost to all parties.
A centralized investigative body could also aid in the rise of domestic prosecutions of atrocity crimes and strengthen the complementarity of the Court. One practitioner expressed a need not only for standardized investigations but also a replicable investigative framework.Footnote 201 Given the linguistic, cultural, and budgetary considerations associated with investigations, even a standing mechanism would involve co-operation with other bodies and could not be exhaustive of all potential investigations. To that end, being able to export the processes created by a standing mechanism would serve domestic prosecutions by allowing for a timelier initiation of, and more effective, investigations.
Despite the role it could play in standardization, a standing investigative mechanism is certainly not a panacea to investigative standardization. The establishment of a standing mechanism would be a feat of significant political will, not without questions of its own. As with any investigative body, policies would need to be developed regarding a number of standards – some questions include which conflicts would merit investigation and storage of potential evidence, and how they would be referred to the mechanism; how, and what, evidence would be transmitted to judicial bodies; what platform would be best suited to handling the storage of data; and what work processes would govern the handling, verification, and canvassing of potential evidence. Most crucially, a standing mechanism would require a significant amount of funding, and it would likely be reliant, like the ICC, upon voluntary contributions.
Further, the creation of an investigative mechanism and an associated evidence repository would not preclude the existence of other investigative bodies. Those investigative bodies would likely be served by the work of the standing mechanism, given its role in the increased standardization of best policies and practices, but many of the existing constraints faced by investigative bodies would endure. Notably, private investigative bodies would still face significant barriers to content sharing with social media platforms. While working with the standing mechanism may encourage social media platforms to increase content sharing with civil society more broadly, the reality is that the collaboration would still be on the platform’s terms. Investigative bodies would still face budgetary and storage concerns internally, but the existence of a standing mechanism could serve as a partial solution to those challenges, given the fact that bodies could outsource their storage needs to the mechanism, facilitating both a budgetary ease and increased co-operation amongst bodies. While a standing investigative mechanism would not alleviate all challenges faced by investigative bodies at present with respect to the lack of standardization, the contribution it could make to the efficiency and effectiveness of the international criminal justice community, particularly within the realm of open-source evidence, is significant.
5. Conclusion
As user-generated evidence continues to emerge from the landscape of the modern conflict, it is only a matter of time before international courts have to face difficult questions regarding the use of digital evidence. Given the relative novelty of digital evidence before international courts, case law and statutory rules provide limited guidance. Investigative bodies, therefore, have driven the determination of the future role, and standards for admissibility, of digital evidence. Despite the progress made by these investigative bodies, the work has been largely unco-ordinated, resulting in a range of best practices and guidelines in the realm of open-source evidence.
While the RPEs and statutes of international courts provide broad guidance for the admissibility of evidence, the particulars of digital evidence leave uncertain its future role in international criminal cases. Particularly with respect to the role of authorship and the establishment of the chain of custody in the digital realm, without specific guidance from evidentiary rules, the standards of admissibility for digital evidence remain both discretionary and uncertain until international courts face these questions directly.
Even in the absence of direct guidance on the standards for admissibility of digital evidence, there are steps the investigative community can take to pave the way for its eventual use in court. Ensuring adequate storage of digital evidence will protect the chain of custody of evidence while avoiding potential manipulation to the content. Reaching consensus on the access of that stored information – notably, who and under what circumstances – will require balancing the need for increased co-operation between investigative bodies and the need to protect the creators of content and evidence itself from harm.
Finally, enabling the admissibility of digital evidence requires access to the evidence in the first instance. Currently, social media platforms have access to, and are in control of, a vast amount of data. The use of content moderation policies endangers the loss of potentially crucial evidence. Challenges to obtaining access to that content and affiliated information is a significant roadblock to the potential role of digital evidence. Establishing a co-operative regime with social media platforms must be a priority for investigative bodies going forward.
Broadly, the international criminal investigative community would benefit from increased standardization. With a range of unanswered questions, unco-ordinated efforts have led to ad hoc approaches by investigative bodies. The prospect of creating a standing international, investigative mechanism will enable this standardization, by allowing a singular investigative body to guide the creation of best practices for the collection, storage, access, and use of digital evidence. Using this model of a standing investigative mechanism, the field of international criminal justice could facilitate increasingly effective and efficient investigations in the face of the novel challenge, and opportunity, of digital user-generated evidence.
Open access
