Director of Public Prosecutions v Hicks (a pseudonym) (No 4)
[2024] ACTSC 39
•23 February 2024
SUPREME COURT OF THE AUSTRALIAN CAPITAL TERRITORY
Case Title: | DPP v Hicks (a pseudonym) (No 4) |
Citation: | [2024] ACTSC 39 |
Hearing Date: | 21 February 2024 |
Decision Date: | 23 February 2024 |
Before: | McCallum CJ |
Decision: | (1) The evidence of Mr Monteiro as to the words communicated by the user of the alias “cback339884” to the Sinaloa Cartel site on the dark web and the words communicated in reply by an unknown person or persons operating the site is admissible. (2) The form in which that evidence may be given is a matter for the trial judge. |
Catchwords: | CRIMINAL LAW – JURISDICTION, PRACTICE AND PROCEDURE – Application for advance ruling on the admissibility of evidence – where data scrapes from posts on the dark web were reproduced as html files – where posts are previous representations but are not caught by the hearsay rule – where the terms of the posts can be proved by direct evidence – where the posts are admissible and amendable to proof at trial |
Legislation Cited: | Crimes Act 1900 (ACT) s 114B Criminal Code 2002 (ACT) ss 47, 308 Evidence ACT 2011 (ACT) ss 48, 50, 59, 137, 161, 192A |
Cases Cited: | Schulz v The Queen [2019] VSCA 179 |
Parties: | Director of Public Prosecutions Laura Hicks (a pseudonym) ( Accused) |
Representation: | Counsel M Dyason ( DPP) J White SC ( Accused) |
| Solicitors ACT Director of Public Prosecutions Legal Aid ACT ( Accused) | |
File Number: | SCC 115 of 2022 |
McCALLUM CJ:
1․Laura Hicks (a pseudonym) faces trial for two counts of incitement to procure murder contrary to s 47 of the Criminal Code 2002 (ACT), two counts of theft contrary to s 308 of the Code and one count of money laundering contrary to s 114B of the Crimes Act 1900 (ACT).
2․The prosecution case is that the accused stole $35,000 from her parents by transferring funds from their bank accounts to hers; that she then accessed a site on the dark web called “Sinaloa Cartel” that offered “murder-for-hire” services; that, over a series of days, she posted messages on the Sinaloa Cartel site offering to pay $20,000 to have her parents killed in a way that would look like an accident and negotiating the method of payment of that sum; and that she used some of the funds stolen from her parents to pay about a third of the contract price to the Sinaloa Cartel website in bitcoin.
3․The incitement offences are based on the contention that, by her messages posted on the Sinaloa Cartel website, the accused urged an unknown person to procure the murder of her parents. The application before the Court is concerned with the admissibility of the evidence by which it is sought to prove that essential element of the prosecution case.
4․The messages were brought to the attention of police in the ACT by a media entity in the United Kingdom called Novel. Mr Christopher Monteiro, who had been retained by Novel, was investigating a story about scams on the dark web. Mr Monteiro’s research led him to conclude that persons based in Romania had created plausible websites that offered violent services (including contract killings) in exchange for payment in bitcoin. The scam was that payment was taken from the bitcoin wallet but the services were never provided. The prosecution seeks to prove the messages it alleges were posted by the accused on the Sinaloa Cartel website by calling evidence from Mr Monteiro and tendering documents he has provided to police.
5․The posts are not in the name of the accused but that is not an issue for the present application. If the contents of the posts can be proved, the issue whether it was the accused who posted them is a question for the jury.
6․The accused has foreshadowed an objection to the admissibility of the posts on the ground that the proposed evidence of their contents is hearsay. As the evidence is essential to the prosecution case, the prosecution seeks an advance ruling on that question, as allowed under s 192A of the Evidence Act 2011 (ACT). The accused joins in the submission that the Court should give that ruling in advance of the trial, which is scheduled to commence on 4 March 2024. I am satisfied that it is appropriate to give an advance ruling on the question raised.
The proposed evidence of Mr Monteiro
7․Section 192A authorises the court to give an advance ruling on the admissibility of “evidence proposed to be presented” in the trial of an accused person. The prosecution’s application was argued by reference to a written statement taken by police from Mr Monterio in question-and-answer form together with three documents he provided to police. The prosecution also relied on correspondence between police and Mr Monteiro in which he clarified aspects of his written statement and provided a further document. For the purpose of determining the application, I have proceeded on the assumption that the prosecution proposes to present oral evidence from Mr Monteiro in accordance with his written statement as clarified in the correspondence and also to tender one or more of the four documents. That evidence may be summarised as follows.
8․Mr Monteiro has a background in information technology. In about 2018, he developed an interest in dark web markets and the legitimacy of hitman-for-hire sites which he suspected were scams. He began researching and writing on that topic. He identified the Sinaloa Cartel site as “one branch of affiliated and interconnected scam sites”. Mr Monteiro found ways to breach the Sinaloa Cartel site. In 2020, he was retained by Novel and began providing the results of his investigations to that company.
9․Mr Monteiro’s research involved “scraping” data from hitman-for-hire sites including the Sinaloa Cartel site. During his research for Novel, he was scraping that site approximately every six hours. He explained that a “web scrape” involves making “a complete html and artifact copy” of the webpage in question. The html files could be opened and analysed offline on a local computer. While Mr Monteiro did not explicitly say so, the obvious inference is that the web scrape is an automated process. The important point for present purposes is that, according to Mr Monteiro’s evidence, a web scrape produces a complete html copy of a webpage as at a particular point in time that can then be analysed offline.
10․At some point, Mr Monteiro worked out that the Sinaloa Cartel site used a “sequential messaging system”. I understood his explanation of this discovery to mean that, for each new user who registered an inquiry on the site, a separate webpage came into existence with a URL (address) with a message identifier that followed in sequence from the last. Mr Monteiro gave the example of a fictitious URL with a message identifier of “10”:
that example, the next user who posted an inquiry on the site would have the message identifier of “11”, giving the following url:
example of this system can be seen in exhibit CM7 to the affidavit of Chloe McKenzie affirmed on 1 February 2024. That exhibit is a document provided to police by Mr Monteiro described as “a sample raw html scrape featuring the full convo in question”. In exhibit CM7, the posts relied upon by the prosecution have the identifier number 8167 and are sent to and from an alias, “cback339884”. Exhibit CM7 also includes messages from a different alias, “ironskull”, which have the identifier number 8169. Mr Monterio explained that, having the URLs for the Sinaloa Cartel site, and having worked out that the messaging system was sequential, he was able to see all exchanges by manually changing the value on the end of the URL. He stated that it was then easy to download all the messages on the site.
13․After downloading a web scrape, Mr Monteiro analysed its contents. He has since developed an automated process for that task. However, at the time he obtained the posts relied upon by the prosecution in these proceedings, he was manually sorting through the data scrapes. He then analysed the data by “reading through lots of the messages”.
14․The data scrapes contained “dozens and dozens of different messages and data relating to all different users of the site”. Mr Monteiro did not provide that raw data to Novel. Instead (relevantly for present purposes), he sorted and analysed the messages, extracted the ones involving the person using the alias “cback339884” and cut and pasted those messages into a single document “to create a coherent narrative”. Mr Monteiro explained that there are “over 200 scrapes that mention this username” and that he has “no way at this time of providing this in a useful format”.
15․My understanding of Mr Monteiro’s evidence, in summary, is as follows:
(a)Mr Monteiro scraped content from pages on the Sinaloa Cartel website. The result of that process was that he held “a complete html and artifact copy” of those pages on a local computer and was able to analyse that material manually, offline. I will refer to that material as the web scrapes.
(b)Mr Monteiro analysed the contents of the web scrapes by reading through the messages.
(c)The web scrapes contained many messages exchanged between the Sinaloa Cartel site and many users of the site. That included messages exchanged between the site and the user of the alias “cback339884”.
16․Mr Monteiro attached three documents to his written statement. They are exhibits CM2, CM3 and CM4 to Ms McKenzie’s affidavit. He later provided a further document. A version of that document is exhibit CM7. It will be necessary to return to the provenance of exhibit CM7.
Evidence of the posts
17․As submitted by the accused, the critical issue in determining the application is to understand the process by which the material alleged to be posts made by the accused has been produced and put forward as evidence.
18․Exhibit CM2 is a document in which Mr Monteiro collated all the messages exchanged between the Sinaloa Cartel site and the user of the alias “cback339884” by cutting and pasting them into a single document. As I understand the evidence, that document was prepared as part of Mr Monteiro’s investigative research for Novel. It includes additional information added by Mr Monteiro and is described by him as “a message report produced by [his] automation”. The reports replicate the original messages posted by cback339884 but also include other information and changes.
19․Exhibit CM3 presents the exchanges with the user of alias cback339884 as if on a website. Mr Monterio describes it as a “single screenshot taken towards the end of the site engagement with cback339884” which “captures everything” (exhibit CM3). However, it is not a live screenshot of the Sinaloa Cartel website. Mr Monteiro states he did not take live screenshots. Instead, he made the “complete html and artifact copy” to which I have already referred. Exhibit CM3 thus appears to have been generated for the purpose of replicating the appearance the message exchange would have had if seen live on the Sinaloa Cartel website. The presentation of the messages in that form for television is understandable but its admissibility in a jury trial may be doubted.
20․Exhibit CM4 is described as “a screenshot of the master transaction page”. The prosecution evidently proposes to rely on it as a record of payments allegedly made by the accused to the Sinaloa Cartel website. However, the copy in evidence is illegible, and Mr Monteiro’s explanation of its provenance is inscrutable. I am not presently persuaded that exhibit CM4 is admissible.
21․Exhibit CM7 requires some explanation. After receiving Mr Monterio’s written statement, the DPP prepared a list of questions which Senior Constable Pugsley discussed with Mr Monteiro in a video conference on 6 April 2023. She then received an email from Mr Monteiro attaching a file named “cback339884-full.zip” described as “a sample raw html scrape featuring the full convo in question”. Senior Constable Pugsley states:
Contained within the attachment was a link to a html address titled Sinaloa Cartel Marketplace Offers. I opened the link and printed the material. I then redacted it for any identifiable material not related to this matter.
22․After the conclusion of the hearing, at my request and without objection from the accused, a copy of the Zip file was provided to the Court. However, the copy provided does not contain a link to an html address, as described by Senior Constable Pugsley. It contains what appears to be “the full convo in question” in PDF format. Exhibit CM7 appears to be a copy of the PDF file. It contains the same redactions as the PDF file included in the Zip file. I infer that Senior Constable Pugsley saved the product of the steps she took as a PDF file. Importantly for present purposes, if I have understood the evidence correctly, exhibit CM7 is a cut and paste collection of the raw html scrape of messages posted to and from the person using the alias cback339884.
23․As already explained, the prosecution case rests on proof of those messages. The prosecution’s primary submission is that the posts are relevant and admissible as direct evidence of the physical element of the incitement charges and are accordingly not caught by the hearsay rule in s 59 of the Evidence Act 2011 (ACT).
24․The prosecution accepts that the posts amount to previous representations but submits that they are not caught by the hearsay rule because they are not relied upon to prove the existence of any fact asserted. For example, the first post includes the following statement:
Willing to pay $20,000 AUD to have this done as soon as possible. 2 individuals, death by accident if at all possible.
25․The prosecution case is that, by that post, the accused was urging any recipient of the post to procure a hitman to murder her parents. The prosecution does not rely on that post to prove, for example, that the accused was in fact willing to pay $20,000.
26․That analysis makes sense but, with respect, does not engage with the accused’s objection. The critical question is, what are the posts, in evidentiary terms? In other words, what is the nature of the communications that constitute the acts of urging relied upon by the Crown and how can those communications be proved directly, in a form that is not hearsay?
27․The accused submits that the material sought to be relied upon by the prosecution is “some sort of reconstruction of material which a computer program has obtained (by unknown processes) from data held on a website after the actual communication the Crown seeks to prove has taken place”. She submits that the material is accordingly documentary hearsay. There are two aspects of that submission. First is the complaint that the material relied upon by the prosecution is a reconstruction of material obtained from another source. As to exhibits CM2, CM3 and CM4, I agree, for the reasons already explained. However, exhibit CM7 is a copy of the raw html scrape. It is not a reconstruction or reproduction of that material.
28․The second aspect of the accused’s submission is that the scrape was “from data held on a website” which was scraped “after the actual communication the crown seeks to prove has taken place”. The point was developed in oral submissions by reference to the example of interception of an oral communication. Mr White SC acknowledged that, if police intercept and record a telephone conversation, the recording can be tendered to prove the words said. He submitted that the present case was different because the posts were not intercepted.
29․I do not think it follows that the terms of the posts cannot be proved by direct evidence. The various means of proof of communications allowed by the Evidence Act do not turn on any requirement for contemporaneous interception. The Act assumes that an electronic communication can be recorded in a document: s 161. Mr Monteiro’s evidence establishes that there was an electronic record of the words communicated by the user of the alias “cback339884” to the Sinaloa Cartel site and the words communicated in reply by an unknown person or persons operating the site. That electronic record is a “document” for the purposes of the Evidence Act. The Act facilitates proof of the contents of that document by permitting the prosecution to tender a document that is or purports to be a copy of the document: s 48(1)(b) of the Act. If that analysis is not right, the logical corollary of the accused’s submission is that there are no documents on the Internet, or that the contents of messages sent via the Internet can only be proved if someone happens to be watching when a message is sent and that person finds a way to intercept or record it as it is sent.
30․On my understanding of the proposed evidence of Mr Monteiro, the web scrapes (the raw html files) are or purport to be or include copies of the posts. However, Mr Monteiro has explained that the raw html files are voluminous and complex and that they contain a great deal of material that is both irrelevant and distressing. It is only the exchanges with cback339884 that are required for the purposes of the prosecution case. While the method of proof is properly a matter for the trial, it is enough for present purposes to be satisfied that there are ways in which those posts could be proved, whether by oral evidence from Mr Monteiro of the content of the messages he read or by consideration of an application under s 50 of the Evidence Act.
31․My conclusion that the posts are admissible and amenable to proof in the proceedings is supported by a decision of the Victorian Court of Appeal relied upon by the prosecution, Schulz v The Queen [2019] VSCA 179. In that case the accused was charged with a grooming offence based on Facebook posts. The accused submitted that, “without any evidence as to when and how the documents were created, the content of the documents was hearsay and s 48 of the Evidence Act 2008 (Vic) did not provide a means by which the pages could be admitted”: at [40]. The Court unanimously rejected that argument, noting at [53] that the documents were “evidence of the communications that formed the basis of the grooming charge”. The Court’s reasoning in support of that conclusion at [44]-[45] included reliance on the methods of proof permitted by s 48 of the Evidence Act.
32․The accused’s argument on the present application implicitly questioned the premise necessarily accepted in the reasoning in Schulz that a message posted on a website is a document. In oral submissions, Mr White SC contended that the “urging” (the physical element of the incitement offences) “has taken place by a result of a message being sent”. He submitted that “it is the action of sending that message that constitutes the incitement”. He submitted that the position was “exactly the same as if one were to say, ‘I want you to murder X’”, being “just another form of communication”. But the difference is that the uttering of the words “I want you to murder X” does not of itself create a document. The typing of those words on a computer and their transmission via the Internet does.
33․It does not matter whether the process by which the communication is conveyed can be readily understood. The position is the same with a Facebook post, an email or a facsimile transmission. It is not necessary to understand the process in order to accept that the message typed at one end constitutes an electronic document that is faithfully transmitted at the other end by that process. Given that it is not possible to tender the Internet, the Evidence Act permits the proof of a written message by one of the methods prescribed in s 48.
34․Mr White SC sought to distinguish the decision in Schultz on the basis that, in that case, the Facebook messages were identified by and tendered through the complainant, submitting that, in those circumstances, the documents were not hearsay. With respect, the submission conflates two separate issues addressed by the Court of Appeal in that case. The first was whether the Facebook pages had been properly proven: at [49]. It was in that context that the Court referred to the fact that they were proven through the complainant, which obviated the need to prove “who took the screenshot or when it was taken”: at [51]. Here, there is no evidence from the author of any of the messages but, unlike the position in Schultz, there is evidence from the person who has produced what purports to be a copy of the posts.
35․The second issue addressed by the Court in Schultz was whether the documents were inadmissible hearsay. The fact that the documents were proved through the complainant was irrelevant to the determination of that issue. The Court held that the Facebook posts were not inadmissible hearsay because, among other reasons, they were evidence of the communications that formed the basis of the grooming charge. That is the position here. The messages posted on the Internet form the basis of the incitement charges.
36․Mr White SC made a separate submission asking the Court to reject the evidence in exercise of the discretion in s 137 of the Evidence Act. In my assessment, that is properly a matter for the trial judge to be determined after hearing the evidence of Mr Monteiro, which may have to be taken in the first instance in a Basha inquiry or on a voir dire.
Orders
37․For those reasons I make the following ruling:
(1)the evidence of Mr Monteiro as to the words communicated by the user of the alias “cback339884” to the Sinaloa Cartel site on the dark web and the words communicated in reply by an unknown person or persons operating the site is admissible.
(2)The form in which that evidence may be given is a matter for the trial judge.
| I certify that the preceding thirty-seven [37] numbered paragraphs are a true copy of the Reasons for Judgment of her Honour Chief Justice McCallum Associate: Date: |
0