Access to Information Orders

Decision Information

Summary:



• Electronic and physical records relating to a lawyer’s clients

• Section 17 (Reasonable Search) - search upheld

Decision Content

ORDER MO-2345

 

Appeal MA07-32

 

Toronto Police Services Board


BACKGROUND:

 

EnCase software is a computer forensic investigative tool used by law enforcement, government and corporate investigators to conduct large-scale digital investigations.  The requester in this appeal is a lawyer whose clients received a CD disk in the mail from an unknown source.  The CD disk contained electronic files belonging to them.  The clients retained an expert who conducted an independent investigation and concluded that the CD disk was produced with a version of EnCase software that was in limited circulation to police and government agencies during a specified time period.  The lawyer subsequently filed an access to information request seeking information about how his clients’ intellectual property ended up in police custody.  This appeal deals with the lawyer’s request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) to the Toronto Police Services Board (the Police).

 

NATURE OF THE APPEAL:

 

In the present appeal, the requester seeks “… information, notes and/or records, in whatever form they may exist, including but not limited to print and electronic media” relating to four questions about the Police’s use of EnCase software.  The four questions stated in the request relate to whether the Police used EnCase software for evidence recovery purposes and whether it used EnCase software to recover evidence relating to the requester’s clients. 

 

Attached to the request was a computer generated list indentifying the files found on the CD disk.  The requester refers to the items identified on the list as the Schedule “A” files or documents.

 

 

 

During mediation, the appellant confirmed that he is only appealing the Police’s decision with respect to the fourth question set out in the request which, in his position, had not been addressed by the Police.  Part four of the request reads:

 

Whether the Toronto Police Service is or has been in possession of any computer data obtained with the use of EnCase software which relates to the persons named herein as our clients, in particular, those files as referenced in Schedule “A” to this letter.

 

The Police take the position that they did not utilize the EnCase software for the purpose of evidence recovery, to create any print or electronic documentation or in relation to the Schedule “A” files.  The appellant does not view this statement as an adequate response to part four of the request.  It appears that the appellant may accept that the Police did not themselves utilize the EnCase software, but still takes the position that the Police have or had in their custody, copies of the Schedule “A” files obtained perhaps by other sources. 

 

This office commenced its inquiry by sending a Notice of Inquiry setting out the issues in dispute and inviting the Police’s representations.  The Police submitted representations in response to the Notice of Inquiry.  The Police’s representations, in part, state:

 

At this stage, the Toronto Police is willing to concede that they do have in their possession, computer software (a copy of two CDs) obtained with the use of EnCase software, (not established as the property of the appellant’s clients), but cannot state unequivocally that it relates to the appellant’s clients or those files referenced in the Schedule “A”.

 

This appeal was transferred to me and I decided that I required clarification from the Police.  In particular, I asked the Police to explain why it had not issued an access decision to the appellant regarding the two CDs in its possession.  I also asked the Police to describe to me, in affidavit form, the steps they took in searching for records responsive to the request.  In response, the Police provided this office with an affidavit and wrote the appellant to advise that they had contacted the OPP to discuss the possible release of the CDs.  The Police’s letter to the appellant referred to section 18(4)(b) (another institution may have a greater interest in the records) of the Act and indicated that it would issue an access decision shortly.

 

The Police subsequently issued their access decision and released the two CDs to the appellant.  I wrote to the appellant seeking confirmation that no other issues remained in dispute.  The appellant wrote back advising that his clients wished to proceed with the appeal.

I then wrote to the appellant and invited representations in support of his position that additional records exist.  Copies of the non-confidential portions of the Police’s representations and affidavit were provided to the appellant.

 

The appellant provided representations in response.  The appellant’s representations, however, did not address the reasonable search issue.  Rather, the representations focused on questions relating to how the Schedule “A” documents ended up with the Police and became comingled with EnCase software.  In response, I wrote to the appellant and advised that this office does not have the jurisdiction to make a determination on these issues and invited the appellant to make representations on the reasonable search issue, which he did.  Attached to the appellant’s supplemental representations is a confidential report prepared by its independent expert. 

 

DISCUSSION:

 

Where a requester claims that additional records exist beyond those identified by the institution, the issue to be decided is whether the institution has conducted a reasonable search for records as required by section 17 [Orders P-85, P-221, PO-1954-I].  If I am satisfied that the search carried out was reasonable in the circumstances, I will uphold the institution’s decision.  If I am not satisfied, I may order further searches.

 

The Act does not require the institution to prove with absolute certainty that further records do not exist.  However, the institution must provide sufficient evidence to show that it has made a reasonable effort to identify and locate responsive records [Order P-624].

 

Although a requester will rarely be in a position to indicate precisely which records the institution has not identified, the requester still must provide a reasonable basis for concluding that such records exist.

 

The non-confidential portions of the Police’s affidavit describe the steps the Police took in response to the request.  The affidavit was prepared by a staff member in the Police’s Access and Privacy office.  The Police submit that upon receipt of the request, they sent emails to two named police officers and received responses from both.  One of the police officer responded that the original CDs were in the possession of the OPP and confirmed that the Police had copies of the CDs.  The other police officer, who prepared the letter that was provided to the appellant during the mediation stage of this appeal, confirmed that a thorough search of the applicable systems was conducted and that no evidence or information relating to the Schedule “A” files were found. 

 

The Police also submit that a complete physical and computer search by two other officers in the Intelligence Service Section was conducted and that those officers reported that “[a]fter reviewing the CD’s and binders in their possession, they were unsuccessful in locating any responsive records”.  The Police’s affidavit also indicates that none of the officers recall any references to EnCase software in any dealings with the appellants.

 

With respect to the Police’s search for responsive records, the appellant states:

 

The affidavit of [the Police] begins with a reference to soliciting input from all of the offices involved for the purpose of locating CD’s.  The search undertaken by the Toronto Police Service was likely framed that way because our original appeal letter made reference to the fact that our clients surreptitiously received a CD that contained the Schedule “A” files.  However, just because our clients received a secret CD does not for a moment suggest the files in question are maintained by the Toronto Police Service on a CD instead of a hard drive.  By simply looking for CD’s the search undertaken by the Toronto Police Service had a very dim prospect of success.  Furthermore, while [the Police’s] affidavit refers to the fact that none of the officers involved recall EnCase being used with the [appellants] the facts remains the Schedule “A” documents were analyzed using that very specialized software.  All of the references to the O.P.P had to do with data and CD’s created from a third party, and not the [appellants].

 

If a proper search is to be completed, someone at the Toronto Police Service familiar with EnCase and its operations will have to review the results of EnCase work completed back in 1999.

 

Decision and Analysis

 

The request sought access to all records, including the Schedule “A” documents, relating to computer data obtained with the use of EnCase software that relates to the appellant’s clients.  The Police located and provided the appellant with copies of two CDs, which they advise were originally prepared by the OPP.

 

The appellant, however, claims that additional records or copies of the Schedule “A” documents exist beyond the CDs identified by the Police.  Accordingly, the issue I must decide is whether the Police conducted a reasonable search for records as required by section 17 of the Act.  The Act does not require the Police to prove with absolute certainty that further records do not exist. 

 

I have carefully reviewed the confidential and non-confidential representations of the parties and am satisfied that the Police conducted a reasonable search for records responsive to part four of the request.  The appellant argues that the Police failed to extend their search to include their computer hard drives.  The Police affidavit, however, sets out in detail the nature of the physical and computer searches conducted by various police officers.  The appellant submits that the police officers conducting the searches are unfamiliar with EnCase software and, as a result, failed to conduct a thorough search.  However, there is no evidence before me suggesting that the police officers conducting the searches at issue, lack the requisite knowledge and skill to identify and locate the requested information. 

 

Having regard to the above, I am satisfied that the Police conducted a reasonable search for records and dismiss this appeal. 

 

ORDER:

 

The Police’s search is upheld and this appeal is dismissed.

 

 

 

 

 

 

Original signed by                                                                        September 9, 2008            

Jennifer James

 You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.