New South Wales Supreme Court CITATION : R v Selim [2007] NSWSC 322 JUDGMENT DATE : 10 April 2007 JUDGMENT OF : Fullerton J DECISION : Evidence admitted CATCHWORDS : EVIDENCE - Admissibility LEGISLATION CITED : Evidence Act 1995 PARTIES : James Selim (Acc) The Crown (Cth) FILE NUMBER(S) : SC 2006/2744 COUNSEL : P Byrne SC/G Bashir/S Buchen (Acc) L Robberds QC/R Bromwich (Crown Cth) SOLICITORS : Aitken McLachlan Thorpe (Acc) Commonwealth Director of Public Prosecutions (Crown) IN THE SUPREME COURT OF NEW SOUTH WALES COMMON LAW DIVISION CRIMINAL LIST FULLERTON J TUESDAY 10 APRIL 2007 2006/2744 R v SELIM JUDGMENT HER HONOUR: 1 Mr Byrne SC makes application that certain aspects of the further evidence of Mr Bussing be excluded. Reliance is placed upon either or both of sections 135 and 137 of the Evidence Act 1995 in support of the application. 2 On the afternoon of Monday 2 April 2007- the nineteenth day of the trial - Mr Bussing was called by the Crown to give evidence. He was to be the last witness called in the Crown case save only for the potential recall of Federal Agent Banach. Federal Agent Banach gave evidence immediately preceding Mr Bussing being called. The ordering of these witnesses by the Crown was at the express request of Mr Byrne for reasons which I have no doubt reflect the significance of this body of evidence to the facts in issue in the trial. 3 I will have something to say about the recall of Federal Agent Banach as the circumstances giving rise to this being necessary are inextricably linked to the circumstances giving rise to the present application. This complex of circumstances also provide some explanation for the application to effectively exclude the balance of Mr Bussing's evidence being made at this very late stage in the Crown case and whilst Mr Bussing is in the witness box. While it appears that the Crown had some notice of a challenge to the admissibility of Mr Bussing's evidence beyond a certain point, it was not a matter that had been brought to my attention until that stage had been reached in his examination in chief where he was to give evidence of the results of his interrogation of the HPLC computer- the computer that is nominated in the indictment as the computer containing the data that was alleged to have been destroyed at the accused's instigation. 4 That part of Mr Bussing's evidence to which there was no objection was given before the jury in accordance with s 79 of the Evidence Act. No objection is now taken to his capacity to give further evidence as being beyond the operation of s 79 of the Evidence Act. The compliant is that to permit the Crown to lead the further evidence it wishes to lead from him would be productive of unfairness to the accused because of the particular circumstances in which that evidence came to be served (inclusive of the fact that it was served while Mr Bussing was in the witness box), and what are said to be the material difference between that evidence and the contents of a statement by him that was served as part of the brief of evidence prior to the trial commencing. 5 Mr Bussing is a partner of a corporation called Microstep. The principal activity of the business is the recovery of lost or corrupted data from the hard drive of a computer and, where possible, the return of that data to a useable form. 6 Mr Bussing has prepared a number of statements which have been served as part of the brief of evidence prior to trial of which only one has a direct bearing on the current application. That is a statement dated 11 October 2006. It was in fact served in advance of the second trial in November 2006 but has not been the subject of any testing since that trial aborted before he was called to give evidence. I shall refer to it as the October 2006 statement for convenience. 7 I also note that Mr Bussing provided a further statement dated 7 March 2007 which was served on that day, the first day of the trial before the jury. The fact that the defence were on notice that there was a further or supplementary statement to be served from Mr Bussing was brought to my attention on 6 March 2007 in the preliminary phase of the trial. Mr Byrne was concerned, and not without justification, that the evidence his client had to meet was fully served in advance of the case starting before the jury and, so far as the expert evidence was concerned, that that evidence was "bedded down" at that time. I was informed by Mr Robberds QC that so far as he was aware, all of the computer evidence upon which the Crown would rely had been served. 8 It is not suggested that Mr Robberds was at that time otherwise than of the considered opinion that the expert evidence, as it was then considered necessary for the Crown to call to prove its case, had been served. 9 I note that both the Crown and the defence opened their respective cases to the jury in anticipation of the evidence from Mr Bussing being of crucial significance to the central issue the jury was ultimately going to have to resolve, namely whether the accused instructed Mr Brooks to destroy data relating to Travacalm on the HPLC computer and whether Mr Brooks did what was asked of him. The fact that the case as opened by the Crown will change if the evidence under challenge is admitted, is simply a reflection of the fact that there are occasions in trial process where evidence for one reason or another falls short of what was anticipated, or that it changes in some way. Such is the case here. Of itself, that does not ordinarily ground an application to exclude evidence although it may ground an application to discharge the jury. No application is made of that kind. 10 In resolving what is at issue on this application it is necessary to refer to the evidence of Mr Brooks in a number of respects. 11 Mr Brooks gave evidence over two days. The cross-examination extended over four days. The cross-examination was searching and effective. It raised for the jury various issues that may affect the reliability of aspects of the evidence Mr Brooks has given both in the present trial and in previous trials. There is no doubt that the cross examination was crafted, and various propositions put directly to Mr Brooks, on the basis of what the defence were led to believe would be the evidence from Mr Bussing as to whether his researches revealed that a low level format of the HPLC computer had in fact been undertaken at the relevant time, and the extent to which such an exercise had been successful. 12 Given that the argument bearing upon the question of the admissibility of Mr Bussing's evidence has been somewhat wide ranging, in the sense that it was submitted in argument that the Crown has served the expert evidence in a piecemeal or tardy fashion and not "bedded down" as they had been led to believe, I propose to deal at this time with that complaint in so far as it concerns another aspect of Mr Bussing evidence that was also served during the currency of the trial. 13 Mr Brooks gave evidence that on the late afternoon of 30 January 2003 he accessed the Seagate website and downloaded a tool the Disc Wizard to perform a low level format. Exhibit U is an internet traffic log showing the fact of access to that site on that date and revealing internet traffic between the Seagate site and Pan Pharmaceuticals consistent with a program being downloaded. This is a log of all internet traffic to and from Pan Pharmaceuticals but is limited to traffic on 30 January 2003. It is said by the Crown to be strongly supportive of the evidence Mr Brooks has given of his access to the website on that date in order to carry out the instruction given by then accused that the data on the HPLC computer be destroyed. He was cross examined about the likely frequency with which other employees of Pan Pharmaceuticals might access the Seagate website given that that corporation is a supplier of computer hardware to Pan Pharmaceuticals and that it provides a support service for users of the computer hardware. 14 Mr Bussing was asked by the Crown at some time after Mr Brooks gave this evidence to examine internet access logs for Pan Pharmaceuticals for a given period either side of 30 January 2003 in order to see the extent to which traffic between Pan Pharmaceuticals and Seagate might be a usual or unusual occurrence. This was a enquiry undertaken by the Crown in order, no doubt, to deal with a submission that the defence might ultimately make as to the weight the jury might give to exhibit U as supportive of Mr Brooks' evidence. 15 On 23 March 2007 a further statement from Mr Bussing was served limited to dealing with that issue. Of the 429 days of internet traffic Mr Bussing examined only 7 days (inclusive of 30 and 31 January 2003) showed access to the Seagate website. At the time that the statement was served compliant was made that the Crown was altering the position it took at the commencement of the trial to the effect that the computer evidence was said by Mr Robberds to be 'bedded down'. While no formal objection was taken to the Crown being permitted to rely on this evidence, it was said to reflect badly on the Crown and their conduct of the case. 16 In so far as Mr Bussing's statement dealing with the frequency of access to the Seagate website from Pan Pharmaceuticals is concerned, no sustained criticism can be made of the way the Crown is conducting its case by that further statement being served in the course of the trial. This is not only because it was served well in advance of Mr Bussing being called and that the defence were on notice of it. In my view, it is not unusual for evidence of one kind or another to be served during the course of a trial where a fresh issue arises, or a need to elaborate or clarify some aspect of the evidence emerges because of the way the defence case is conducted. So ever long as this does not result in the Crown changing its case, and that the defence are not prejudiced in some identifiable way by evidence being served in the course of the trial, for example by being locked out of being able to adequately deal with the evidence or even being compromised in the being able to effectively deal with it because of the way the case for the accused has been conducted up to that point, then there is no necessary prohibition on the evidence being called. Such was the case with that aspect of Mr Bussing's evidence that dealt with the internet traffic logs. 17 In my view, neither the Crown's decision to obtain this further evidence from Mr Bussing, nor its service in the course of the trial has any bearing on the current application. (I note that it was this aspect of Mr Bussing's evidence that was ultimately given without objection before the jury on 2 April 2007). 18 What this application does involve is consideration of a further statement from Mr Bussing, served on the accused on the late evening of 3 April 2007, after a preliminary report bearing upon the same subject matter of the final report was served before the Court that morning. I was advised of this development when Court resumed on the morning of 3 April 2007. Given that I was informed by Mr Robberds that there was likely to be a further development in Mr Bussing's evidence, and in light of what I considered was the obvious significance of this additional evidence to the issues as they were crystallising, and the fact that Mr Bussing was the last witness to be called by the Crown, I adjourned the proceedings to allow the Crown time for a settled report to be prepared and served. This approach was not opposed by Mr Byrne. 19 The need for the preparation and service of that further statement arose in these circumstances. 20 Mr Bussing's further evidence was adjourned late in the afternoon of 2 April of to allow me to resolve what I then understood to be an issue that was limited to what has been described as "a verification issue" – an issue that it was accepted would likely involve Federal Agent Banach being recalled as it was an issue left outstanding, it was said, at the conclusion of his evidence. The verification issue had a direct bearing on whether Mr Bussing could give evidence at all of his interrogation of the hard drive that was given to him by Federal Agent Banach. It was not only proper for the Crown to have Federal Agent Banach confirm, after his cross examination, that the verification process he undertook produced an exact image of the HPLC computer's hard drive, it was essential that he do so. Without confirmation of that fact, Mr Bussing's evidence as to what was revealed to him on examination of the image produced by Federal Agent Banach would have been susceptible to challenge as being irrelevant. 21 When objection was first taken on the afternoon of 2 April 2007 to Mr Bussing giving further evidence before the jury, it was anticipated by the Crown that Mr Bussing's evidence would resume the next morning after resolution of the verification issue was attended to overnight. When Mr Bussing's evidence was interrupted for this matter to be resolved it was not anticipated (at least so far as the Crown was aware) that a further and materially different statement from Mr Bussing would be served, and that materially different evidence would be led from him as a consequence. 22 It is the content of this statement to which objection is taken. I shall refer to it as the April 2007 statement. 23 The April 2007 statement, and the October 2006 statement I referred to earlier, are related in that they both deal with Mr Bussing's interrogation of images from the hard drive of the HPLC computer. Both images had been made available to Mr Bussing by Mr Irwin. Without detailing the chain of custody I am satisfied that both images had been restored to commercially acquired hard drives by Federal Agent Banach. The image the subject of the October 2006 statement was restored to a Westin Digital hard drive and the image the subject of the April 2007 statement a Maxtor hard drive. The encased image needs to be transferred to a hard drive to allow interrogation of the imaged contents since Encase is in a 'view only' format which effectively prohibits an interrogation of the kind that Mr Bussing was charged with the task of undertaking. Unbeknown to Federal Agent Banach however, the image given to Mr Bussing in September 2006, the image contained on the Westin Digital hard drive and that formed the basis of the October 2006 statement, was in fact contaminated. This fact was not discovered by the prosecuting authorities until the after Court adjourned on 2 April 2007. The discovery was a direct result of the objection the defence took to Mr Bussing giving evidence of the results of his examination of the HPLC hard drive as it was presented to him in September 2006 because of what they contended was an unverified image of the HPLC hard drive on the Westin Digital hard drive given to him at this time. Once it was obvious that Mr Bussing had examined a corrupted image of the HPLC hard drive it was quite proper for the Crown to have him review his evidence in light of the necessity for him to undertake a fresh interrogation of a verified and uncontaminated image. 24 Just how the contamination of the Westin Digital hard drive occurred, and by whom, is not known and is probably not able to be satisfactorily explained at this time. The circumstances giving rise to the contamination of the hard drive can, however, best be understood in this way. 25 Federal Agent Banach took effective and official custody of the hard drive of the HPLC computer on 13 February 2003 by utilising a forensic software program called Encase. This program allows data on the hard drive at that time to be encased or sealed. This avoids the necessity for investigative authorities to take physical custody of the hard drive of a computer upon which data of forensic significance may be stored. Federal Agent Banach gave evidence in chief and was cross-examined about the procedure he employed to verify that the image he was encasing was an exact copy, or mirror, of the hard drive of the HPLC computer. It is obvious that the verification procedure undertaken by Federal Agent Banach on 13 February 2003, a procedure which occurs automatically as part of his encasing of the hard drive's image, was critical to the utility and the reliability of any expert evidence that might be obtained later by the investigators when seeking either to verify or contradict the account Mr Brooks gave of having performed a low level format on the hard drive of the HPLC computer on the 30/31 January 2003 at the direction of the accused. 26 Before the Westin Digital hard drive was sent to Mr Bussing, and without him being aware of it (or it would seem without Federal Agent Banach thinking it important to note) in April 2004 the same hard drive had been sent to Waters Australia as the manufacturers of the software program that had been licensed by Pan Pharmaceuticals for use in the HPLC computer. They were asked by the Therapeutic Goods Administration (TGA) to see if there was any Travacalm data on the hard drive as the TGA was apparently having difficulties accessing the mirrored image. I have been provided with a statement from Chris Cowie, formerly of Waters Australia and dated 29 September 2004, which confirms his receipt of the Westin Digital hard drive on 11 April 2004 for that purpose. While the evidence is not categorical, for the purposes of this application I am prepared to assume that in order to best assist the TGA, Mr Cowie endeavoured to render the data on the Westin Digital hard drive readable and that in that process he, or someone working to him, created two new files that were incorporated onto the Westin Digital hard drive. By incorporating these files onto the hard drive it was 'corrupted' as they were not files that were part of the image that Federal Agent Banach took on 13 February 2003. These files were named 'Data Recovery' and 'found 000". For reasons that are not entirely clear to me Mr Bussing did not notice that these files carried creation dates after 13 February 2003 – the date he had been asked to assume was the last relevant date when data of any kind have been recorded on the hard drive before it was effectively seized by the prosecuting authorities. 27 Mr Prestridge, a witness called by the Crown as the senior analytical chemist from the TGA was also asked questions under cross examination about his involvement with, and attempts at accessing any Travacalm data that may have been on the hard drive of the HPLC computer, and his contact with Waters Australia in April 2004 to this end. 28 At the time that Mr Prestridge was asked these questions it was not obvious to me, and I accept that it was not obvious to the Crown, that the defence was, or might then have been aware that there had been, or might have been a break in the continuous handling of the Westin Digital hard drive that Mr Bussing interrogated. 29 It is also important to note that in April 2003 the TGA, as the relevant investigative authority, were seeking to discover whether there was any Travacalm data on the mirrored image from the HPLC computer for its purposes, namely to ascertain the full extent to which the Travacalm data had been manipulated, as distinct from obtaining evidence to support the fact of the accused's complicity in the destruction of that data. This is borne out by the fact that as at April 2004 there was no assertion by Mr Brooks that he had been directed by the accused to do what the Crown now charges against him. 30 Since it is clear now that Mr Bussing's October 2006 statement dealt with a contaminated image of the hard drive HPLC computer, and that his report is for that reason alone unreliable since it proceeded upon the false premise that what he was examining was an exact mirror of the HPLC hard drive as at a given date, namely 13 February 2003, the Crown neither wishes to, nor would be permitted by me to lead the results of that examination before the jury. The April 2007 statement, by contrast, deals with Mr Bussing's examination of what I am prepared to accept is a verified and uncontaminated image of that same hard drive from the HPLC computer and for that reason his opinion, at least prima facie, is based upon an established or provable premise. That is evidence the Crown does wish to lead. The remaining question is whether they ought be permitted to do so. 31 It is conceded that the evidence is important evidence in the Crown case in that it is probative of a critical issue between the parties, namely whether Mr Brooks performed a low level format as a means of carrying out the instructions given to him by the accused to destroy Travacalm data or to render it irretrievable. A low level format is a process that has the effect of cleaning all programs and data from a computer hard drive. The particular program Mr Brooks said he used, namely the Disc Wizard Program downloaded from the Seagate website, involved a zero fill or zero write process. This is a process which is designed to write zeros over the entire data area of the hard drive rendering the underlying data irretrievable. 32 On one view of the evidence, the October 2006 and the April 2007 statement share a common denominator, namely that a low level format of the HPLC hard drive was in fact undertaken at some time and that the data overwritten is irretrievable. To that extent, it cannot be seriously contended that the defence is in a position materially different now from the case they came to trial to meet, given that the October 2006 statement was served months prior to this trial commencing. 33 What the defence contend is that while this was the position forecast in Mr Bussing's October 2006 statement, on a close analysis of his reasoning to this conclusion, to the effect that because there were fragments of files or other data remaining on the hard drive the reformatting process had been attempted but not concluded, his conclusions that there was a low level format performed on the hard drive were invalid and would have been demonstrated to be so. 34 Mr Byrne cross-examined Mr Brooks at some length, and with some emphasis, to confirm that the low level format he claimed to have performed at his home on the 30/31 January 2003 was not at any time interrupted and, furthermore, that he was satisfied that the process was completed successfully when he returned the computer to Pan Pharmaceutical's premises on the morning of 31 January 2003. It is clear that this was an approach taken by Mr Byrne with a view to undermining the reliability of Mr Brooks' evidence that a low level format had been performed by him while at the same time undermining the Crown case that Mr Bussing's evidence corroborated or supported Mr Brooks' evidence. In light of the April 2007 statement that cross-examination would have no continued currency since an important difference between the October 2006 and April 2007 statement is that in the latter statement Mr Bussing no longer reports on there being any fragments or files present or viewable. While he does not conclude from that that the process by which the low level format was performed was successfully completed, he abandons the concept of there being an attempt to reformat which was interrupted for some reason. It would appear that the reason that he cannot say that it was completed or concluded in more categorical terms is because the process of a full interrogation of every sector of the hard drive was not done. He rests his opinion on the fact of their being large numbers of consecutive sectors containing only zeros. 35 At this stage however this aspect of his evidence has not been tested. Neither has he been cross-examined and invited to explain the differing conclusions reached in the October 2006 and April 2007 statements. The fact that there was cross-examination of Mr Brooks on the issue of whether the process was or was not completed for a page or so of transcript in the context of a cross examination ranging over many other matters and over many days is, in my view, not likely to resonate with the jury such as to result in any prejudice to the accused. 36 In the final analysis it seems that the real complaint is that the April 2007 statement carries greater probative weight than the October 2006 statement and that the Crown will secure the forensic benefit of this were they permitted to lead evidence of it. That is not a matter of itself that can weigh in favour of the exclusion of the evidence under either s 135 or s 137 of the Evidence Act 1995. 37 If, as I have found, there is a reasonable explanation for the late emergence of this evidence, and since I am satisfied there is no procedural unfairness to the defence in now having to deal with it given that Mr Bussing is yet to be asked questions in chief about his interrogation of the hard drive, and that he was last in the witness box a week ago with the adjournment of his evidence and the Easter break intervening, I am unable to conclude that there is unfairness of the kind with which sections 135 and 137 of the Evidence Act are concerned. 38 It is not suggested that the jury will misuse or misapply the proposed evidence, in fact they will not even know of the contaminated disk and the conclusions Mr Bussing reached in the October 2006 statement unless it is introduced in cross-examination. Even then I fail to see how this would or might reflect unfairly on the accused in the relevant sense. To the contrary, should Mr Bussing be cross-examined about his now abandoned findings it may ultimately serve to undermine the reliability of the conclusions he now expresses. 39 I am not satisfied that there is any danger that the evidence may confuse the jury or cause or result in any undue waste of time of a kind that outweighs the probative value of the evidence which I am satisfied is significant. I am fortified in this view by the adjournment that has resulted from objection being taken to Mr Bussing's evidence on 2 April 2007, and the fact that over the adjournment the defence have had the opportunity to take advice and instruction from their expert advisors. 40 While it is regrettable that Mr Bussing's refined or revised opinion emerged late in the proceedings, I am not satisfied that s 137 mandates the exclusion of the evidence and, in so far as the discretionary judgment called for in s 135 is concerned, I am not satisfied, taking into account all that has been put to me, that the balance falls in favour of exclusion. 41 Accordingly, Mr Bussing's further evidence is admitted. I will leave it to the Crown to determine how that evidence is to be led. I do not propose to limit the content of his evidence to the April 2007 statement as some matters of methodology, for example, are common to both reports and may be better expressed in one report as distinct from the other. It is of course entirely a matter for Mr Byrne as to what matters he wishes to raise in cross-examination. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.