Use of digital forensics raises questions in Reuters case

21 July 2018
Use of digital forensics raises questions in Reuters case
Detained Reuters journalist Wa Lone (2-R) is escorted out of court by police after his trial in Yangon, Myanmar, 17 July 2018. Photo: Nyein Chan Naing/EPA

While the case that recently went to trial against jailed Reuters journalists Wa Lone and Kyaw Soe Oo has revolved around alleged physical documents in their possession, the seizure of the pair's phones has also raised serious questions about the handling of digital evidence.
Defence lawyers say that what has been submitted in court is only a fraction of what was extracted from the phones – obtained with the help of what is known as a Universal Forensic Extraction Device (UFED), a piece of cutting-edge technology manufactured by the Israeli company Cellebrite.
As seen in samples available online, forensic reports generated by Cellebrite's UFEDs commonly run more than 1,000 pages in length for a single smartphone and contain call logs, SMS messages, voicemails, GPS data, user files, and the ability to identify deleted items for retrieval.
So far, all that has been submitted as phone evidence in the Reuters case have been printed copies of 21 documents, containing “allegedly confidential government letters and plans for the development of an island off Myanmar’s west coast for tourism,” according to Reuters.
Defence requests for digital copies of the documents and communication records prior to the reporters' December 12 arrest have been rejected by Judge Ye Lwin. The reason given was that prosecution witness and IT expert, Police Major Aung Kyaw San, had already shown that the process had been “systematically” conducted.
While Cellebrite claims that the integrity of digital evidence can be maintained in part through the use of radio frequency-shielded bags upon seizure, this measure was apparently not taken in the case of the Reuters journalists. 
Defence lawyer Khin Maung Zaw told the court on May 29 that Wa Lone's phone had been used to send a single WhatsApp message – “OK” – after the reporters' arrest.
The defence also claims that the location of the phones while in transit from Yangon to Nay Pyi Taw after being seized by police could be easily tracked online, meaning there is no guarantee they were not tampered with remotely or in-person following the arrest.
Police Major Aung Kyaw San said he was not aware of the WhatsApp exchange, or of anybody having access to the phones who was not designated as part of the investigation, according to Reuters.
Without being able to make use of call logs that may be contained in the Cellebrite data, and with requests to have phone records submitted as evidence denied on July 16, defence lawyers said they plan to make a second attempt when a witness from Myanmar telecom Telenor is called to testify.
Myanmar ICT for Development Organisation (MIDO) executive director Htaike Htaike Aung, who attended several hearings as a court observer, noted that there is a lack of legal framework in Myanmar for the use of these powerful tools in criminal investigations.
“In other countries, in ideal scenarios there are processes and procedures that investigative bodies have to follow when they are conducting digital forensics. I doubt that is the case in Myanmar,” she said.
When it comes to the issue of warrants in the Reuters case, Police Major Aung Kyaw San told the court in a May 28 hearing that this did not apply to the data extraction due to charges being brought under the Official Secrets Act – bringing a colonial-era law into a high-tech context.
Cellebrite, founded in 1999 in Petah Tikva, Israel, began selling handheld UFEDs in 2007 and has seen remarkable growth in recent years, placing it well above its competitors as the leader in the global digital forensics market.
With customers in more than 100 countries and bold claims made earlier this year that it had gained the capability to unlock nearly every iPhone on the market, reactions to Cellebrite's offerings from law enforcement and privacy advocates have been at opposite ends of the spectrum.
While it is not public information how long UFEDs have been used in criminal investigations in Myanmar, Cellebrite-generated data have been presented as evidence in cases dating back to 2016, according to MIDO.
As a final verdict on whether Wa Lone and Kyaw Soe Oo will be found guilty of violating the Official Secrets Act and face a maximum sentence of 14 years in prison approaches, contradictory testimony concerning an alleged plot to entrap the reporters could make digital evidence a deciding factor.