Digital and records evidence: production orders and warrants

The phone number on the cigarette listing was the thread that tied the Northgate case together. Erin Bose, the analyst who found the listing, could see the number but not who it belonged to. To find out, and to find out where that phone had been on the night of the robbery, Ferreira needed records held by a telecommunications company, and the law sets out exactly how police may obtain them. Desjardins tells the class that digital and records evidence now appears in almost every serious investigation, and that the rules for getting it are among the most technical in criminal procedure. 'You do not need to memorize every section number,' he says. 'You need to know what kind of information you are asking for, what level of grounds the law requires for it, and what document authorizes you to get it.'

Kinds of digital and records evidence

Records evidence is information held by someone other than the suspect: a phone company, an internet service provider, a bank, a social media platform, a retailer, a transit authority, a hotel. Digital evidence is information stored on devices, including phones, computers, cameras, vehicles and smart home devices, or in online accounts. Both can be divided by how private the information is, which largely determines what legal authority is needed. Subscriber information identifies who holds an account: name, address, phone number. Transmission data, sometimes called metadata, describes communications without revealing their content: which number called which, when, for how long, and which cell tower or internet address was used. Location data shows where a device was. Content is the communication itself: the words of a text message, an email, a photo. As a general rule, the more revealing the information, the higher the grounds and the stronger the authorization required.

Production orders and preservation

Part XV of the Criminal Code provides a set of production orders, which require a person or organization that is not under investigation to produce documents or data. A general production order under section 487.014 requires reasonable grounds to believe that an offence has been committed and that the documents or data will afford evidence of it. Specific orders for transmission data under section 487.016 and tracking data under section 487.017 require only reasonable grounds to suspect, because they reveal less, and an order for financial data under section 487.018 identifies accounts. In R. v. Spencer (2014), the Supreme Court held that a person has a reasonable expectation of privacy in subscriber information that links them to their online activity, so police need lawful authority, such as a production order, rather than an informal request. Because companies may delete records, police can issue a preservation demand under section 487.012, which requires the company to keep the data for 21 days, or seek a preservation order under section 487.013 for 90 days while they apply for a production order.

On February 12, Ferreira sent the carrier a preservation demand for the listing number's records, then applied to a justice for a production order for its subscriber information and for transmission and tracking data for the evening of February 7. Her information to obtain described the robbery, the listing posted two days after it offering six sealed cartons of the brand stolen, and the fact that the store had lost six cartons. The justice issued the orders on February 16. The subscriber was a prepaid account in the name 'C. Marsh' at an address on Elm Street. Desjardins notes that the subscriber name alone did not prove who used the phone, but combined with the DNA hit two days later, the vehicle registration and the address, it gave strong grounds for the arrest.

Location records and their limits

Historical cell site records show which cell tower and which sector of the tower a phone connected to when it made or received calls, texts or data sessions. They place the phone within the area served by that sector, which in a city may be a few hundred metres across and in rural areas several kilometres. They do not show the phone's exact position, and a phone may connect to a tower other than the nearest one when the network is busy. Experts called to explain cell site evidence in court should describe these limits. Other location sources, such as location history stored by phone operating systems or apps, can be more precise but raise additional privacy concerns and require their own legal authority.

# Records produced for the listing number, evening of February 7
# (time, tower-sector, type). Find records within 15 minutes of the robbery.
records = [
    ("21:12", "B-1", "data"),
    ("21:31", "B-1", "text"),
    ("21:40", "A-2", "data"),
    ("21:46", "A-2", "data"),
    ("21:53", "A-3", "text"),
    ("22:04", "B-1", "call"),
    ("22:15", "B-1", "data"),
]
robbery = 21 * 60 + 48
def mins(t):
    h, m = map(int, t.split(":")); return h * 60 + m
near = [r for r in records if abs(mins(r[0]) - robbery) <= 15]
for r in near:
    print(r)
print("records in window:", len(near), "of", len(records))
print("sectors in window:", sorted(set(r[1] for r in near)))

('21:40', 'A-2', 'data')
('21:46', 'A-2', 'data')
('21:53', 'A-3', 'text')
records in window: 3 of 7
sectors in window: ['A-2', 'A-3']

Three records fall within fifteen minutes of the robbery. Two, at 21:40 and 21:46, connect to sector 2 of tower A, the sector that serves Northgate Convenience; the third, at 21:53, connects to sector 3 of the same tower, which covers Pine Street to the west, the direction the hatchback drove. Records before and after connect to tower B, sector 1, which serves the area around Marsh's apartment. Desjardins asks what the records do not show. Linh Tran answers that they show where the phone was, not who was carrying it, and that they are consistent with the phone being at the store, not proof that it was inside. Ferreira's report described them in exactly those terms.

Seizing and searching devices

Phones and computers seized from a suspect hold enormous amounts of personal information, and courts in both countries treat searching them as highly intrusive. Under R. v. Fearon (2014), police may conduct a limited search of a phone incident to a lawful arrest only in narrow circumstances, with careful notes; a full search requires a warrant. In R. v. Marakah (2017), the Court held that a sender can have a reasonable expectation of privacy in text messages even after they reach the recipient's phone. The usual practice is to seize the device, protect it from remote wiping by placing it in a signal-blocking bag or airplane mode, record its condition, whether it was on or off, locked or unlocked, and any visible notifications, and then apply for a warrant that describes what may be searched for.

The search itself is carried out by trained digital forensic examiners using specialized tools that extract data without changing it, verified with hash values. Examiners should search only within the scope of the warrant, such as messages, photos and location data for a defined period, and record their methods. If they find evidence of a different crime outside the warrant's scope, they should stop and seek further authorization. When Marsh was arrested, his phone was seized, placed in a signal-blocking bag at 2:14 p.m. and logged into property at 3:30 p.m. A warrant issued on February 23 authorized a search for messages, photos, listings and location data from January 15 to February 20. The examiner found photographs of six sealed cigarette cartons on a bed, taken at 10:41 p.m. on February 7, and messages arranging their sale on February 10.

Financial and business records

Stolen property and money leave records. Bank records can show deposits after a robbery; payment app records can show the sale of stolen goods; store loyalty records can show who bought an item; pawn and second-hand dealer records, which many municipalities require dealers to keep and share with police, can show who sold property. Each requires the appropriate legal authority, and the request should be specific: the accounts, the time period and the kinds of records needed. Overbroad requests take longer, produce more irrelevant private information, and are more likely to be challenged. Ferreira obtained a production order for records of the payment app the buyer of the cigarettes had used, limited to transactions between the two accounts from February 9 to February 12. The records showed a payment of 180 dollars to Marsh's account on February 10.

Providers outside the country and other digital sources

Many online services store their data outside the country where the crime happened, and a court order issued locally may not reach them. Canadian police can ask a foreign provider to disclose information voluntarily, rely on the provider's own law enforcement guidelines, or, through the federal Department of Justice, use mutual legal assistance treaties, which are slow but produce evidence in a form Canadian courts accept. In R. v. Bykovets (2024), the Supreme Court held that internet protocol addresses attract a reasonable expectation of privacy, so police need lawful authority to obtain them from third parties. Investigators should consult a prosecutor or the service's technical crime unit early when data is held abroad, and should send preservation requests at once, because the legal process may take far longer than the provider keeps its records.

Digital evidence is no longer limited to phones and computers. Modern vehicles record location, speed, door openings and paired phones in their infotainment and telematics systems. Smart doorbells, home assistants, fitness trackers and connected cars store data in the cloud as well as on the device. Ride-share and delivery apps record trips and drop-offs. Each source can corroborate or contradict an account, and each raises the same questions: who holds the data, how long they keep it, what legal authority is needed to obtain it, and how it can be copied without changing it. In the Northgate case, Marsh's hatchback was too old to have a telematics system, but the review noted that in a newer vehicle the car itself might have recorded its trip along Pine Street.

Investigators should also think about what digital evidence might show in favour of a suspect. Location data that places a phone far from the scene, a time-stamped message sent from home, or a streaming record showing a game being played at the time of the crime can support an alibi. Marsh told Ferreira he had been playing video games at home all evening. The gaming platform's records, obtained later with the appropriate authority, showed no activity on his account between 9:15 p.m. and 10:30 p.m. on February 7. Had they shown him online, that would have been important evidence for the defence, and it would have been disclosed in the same way.