R v Rich (Ruling No 27)

[2009] VSC 161

IN THE SUPREME COURT OF VICTORIA Not Restricted

AT MELBOURNE

No. 1535 of 2007

THE QUEEN

v

HUGO ALISTAIR RICH

---

JUDGE:	LASRY J
WHERE HELD:	Melbourne
DATE OF RULING:	26 May 2009
CASE MAY BE CITED AS:	R v Rich (Ruling No. 27)
MEDIUM NEUTRAL CITATION:	[2009] VSC 161

---

CRIMINAL LAW – Subpoena – computer hard drive – encrypted and deleted files – delay – files sought to justify an application to recall witness – witness security – legal professional privilege – sufficient compliance with subpoena.

---

APPEARANCES:	Counsel	Solicitors
For the Crown	Mr M. Tinney SC with Mr S. Milesi	Office of Public Prosecutions
For the Accused	Mr J. Desmond with Mr R. Edney	Doogue & O’Brien

HIS HONOUR:

1. Leonard Frank Ryan is the principal witness in the Crown case against Hugo Alistair Rich who is charged with armed robbery and murder as arising out of the events at North Blackburn Shopping Centre on 8 March 2005 during which a Chubb security guard, Mr Erwin Kastenberger, was fatally shot. 

1. Mr Ryan was called as the main witness in the trial of the accused.  He commenced his evidence on 17 February 2009 and completed his evidence on 5 March 2009.  He was extensively cross-examined by counsel on behalf of the accused over a period of some 9 days. 

1. On 17 September 2008 I published Ruling No. 4 in this matter.[1]  That ruling concerned a subpoena issued by the solicitors for the accused on 10 July 2008 addressed to Mr Ryan who was and remains a person in the custody of the Department of Justice.  The issues which arose in relation to that subpoena related to the hard drive from Mr Ryan’s computer which was the object of paragraph one of the subpoena which was in the following terms:

A Computer Tower case containing all components inclusive of the hard drives, mother board, RAM, cables, power unit, graphic board, floppy drive and DVD, all being property belonging to prisoner Lenord Frank Ryan and potentially in the possession and/or control of Corrections.

[1]R v Rich (Ruling No. 4) [2008] VSC 355R.

1. As I observed in that ruling, the remaining paragraphs in the subpoena sought documents which had already been dealt with in the Magistrates’ Court in March 2007 during the committal proceedings against the accused. 

1. The issue with which I was concerned in Ruling No. 4 was whether a legitimate forensic purpose been demonstrated in the accused’s request to examine the hard drive itself, as opposed to the hard copy documents, to establish whether there were documents secreted on the hard drive within the terms of the subpoena but because they were secreted, had not been revealed in the Magistrates’ Court process. 

1. In the course of my conclusion in Ruling No. 4 , I said:

In my opinion the documents to which Mr Desmond has referred and which may be secreted on the hard drive the subject of paragraph 1 of the schedule of the subpoena may provide information which will be relevant to the question of credibility of Ryan.  It follows that counsel for the accused have demonstrated that this material is sought for legitimate forensic purposes.

1. I then went on to note that it was not therefore simply a matter of handing over the documents but rather formalising arrangements by which an independent expert could examine the hard drive to establish whether there are files on the hard drive not previously disclosed and which are relevant.   The process was complicated by the fact that, in relation to documents contained on the hard drive of his computer,  Mr Ryan claimed:

(a) some documents were subject to legal professional privilege;

(b) some documents had already been provided to counsel for the accused;

(c) some documents related to the legal matters of another person;

(d) some documents were irrelevant; and/or

(e) some documents would tend to identify where Ryan was held and would tend to identify his family members, or his associates and friends unrelated to this case.

These claims meant that some analysis needed to be done which did not compromise Mr Ryan’s security. 

1. On 22 October 2008 the hard drive from Mr Ryan’s computer was provided to Mr Mark Garnett, Certified Computer Examiner of McGrath Nichol for examination.   Mr Garnett was instructed to address the following questions in his report:

(1)Undertake an analysis of a hard disk drive containing electronic data provided to me by the Supreme Court of Victoria and create file listings containing the following information:

-    Details of all files located on the hard disk drive including files that have been previously deleted; and

-    Details of all encrypted files located on the hard disk drive.

(2)Recover, where available, any metadata associated with compound documents such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint and Adobe Acrobat files.

(3)Provide specific details with respect to the following:

-    The type and version of operating system installed on the hard disk drive; and

-    The file system used on the hard disk drive.

1. On 12 November 2008 Mr Garnett provided a report setting out his analysis methodology.  Attached to the report was a DVD-ROM containing the file lists Mr Garnett had created in response to Questions (1) and (2) above.  The report was provided to the Crown and counsel for the accused but not to the accused personally.  The disc was not provided to either party at that stage.

1. Leonard Ryan’s evidence concluded on 5 March 2009 and on that day and after he had left the court, counsel for the accused made an enquiry of me as to whether he was permitted to disseminate the report from Mr Garnett to his client[2].  As a result of that enquiry, on 6 March 2009, this Court wrote to Mr Ryan’s solicitor, Mr Avi Furstenberg of Messrs Lewenberg and Lewenberg Solicitors of Melbourne asking him to obtain instructions from his client regarding Mr Garnett’s report.  The letter informed Mr Furstenberg that the Defence wished to determine whether any material which had not then been disclosed was within the forensic purpose identified by counsel for the accused. 

   [2]At p 1569

1. On 7 April 2009 the matter had progressed no further and Mr Furstenberg had not responded with his client’s instructions.  Counsel for the accused asked that the issue of the provision of Mr Ryan’s hard drive and Mr Garnett’s report be fixed for debate and resolution.  

1. At the mention of the matter on 15 April 2009 Mr Furstenberg appeared to represent Mr Ryan and gave a brief history of the treatment of the materials contained in the hard drive to date.  As he explained, the hard drive was originally seized by Corrections Victoria and all the material contained on the hard drive was printed off to create 23 volumes of material.  Those volumes of material were then taken to the Magistrates Court and were reviewed by Magistrate Goldberg during the committal proceedings for this trial.  After his review, the Magistrate went through the volumes in open court and released those documents he believed relevant.  Despite that release, the Defence remained concerned that the hard drive still contained relevant files which had been deleted or encrypted, hence the subpoena of 10 July 2008 issued to Mr Ryan. 

1. During the mention of 15 April 2009, Mr Furstenberg relayed Mr Ryan’s instructions: Mr Garnett’s report identified 737 encrypted files and 102 deleted files.  

Encrypted files

1. In his expert report, Mr Garnett had prepared a spreadsheet which indicated there were 749 files which were encrypted.  Of the encrypted files, Mr Ryan had instructed that 70 were Word files, eight were Excel files, five were temporary shadow Word files and the remaining items bear file extensions indicating that they are system files.   In relation to the 70 Word files and the eight Excel files, Mr Ryan had instructed that some documents were apparently already in the possession of the accused (as counsel for the accused had cross-examined him on that specific material), some were privileged, some were irrelevant, approximately ten or fifteen files related to another person and their legal matter and some he did not object to releasing to the Defence.  Mr Furstenberg had not yet sighted his client’s written instructions in relation to the files at that stage, and undertook to provide same to my Associate upon his receipt.

Deleted files

1. Of the 102 files identified as deleted in Mr Garnett’s report, Mr Ryan’s instructions were that one file was a Word file, there were some temporary files, however the remaining 81 files have a ".PST" extension.  Mr Ryan tentatively identified those PST files as Outlook files.  Mr Furstenberg submitted that if the PST files were to be recovered Mr Ryan would want an opportunity to peruse same to ensure no personal or privileged information was contained therein.  Mr Ryan did not object to the release of the one Word file.

1. Mr Desmond then made submissions that the Defence would not simply accept Mr Ryan’s instructions to Mr Furstenberg.  As a result, Mr Desmond submitted that lists contained in the DVD-ROM attached to Mr Garnett’s report should be subjected to directory report software.  That process would produce a list of deleted and encrypted files which the accused could review  I then informed the parties that I would defer the matter to the following day in order to refamiliarise myself with Mr Garnett’s report and to review written instructions from Mr Ryan that Mr Furstenberg had indicated would be shortly forthcoming.

1. Later that day of 15 April 2009, Mr Furstenberg provided two large spreadsheets to me identifying the deleted and the encrypted files according to Mr Ryan’s instructions.  

1. The following day, 16 April 2009, I asked Mr Furstenberg why I should not allow the Defence to show the accused Mr Garnett’s report, including the disc, and to peruse the material he had provided identifying encrypted and deleted files.  Mr Furstenberg responded that numerous files were irrelevant (did not meet the forensic purpose I had previously identified), and there were “security issues” with other file names and meta data which contained names and revealed correspondence with other parties unconnected with the present trial.

1. I then sought to find a swift solution to the issue as it appeared that the parties were at loggerheads.  Mr Furstenberg suggested that Mr Garnett be asked to verify his client’s instructions regarding the number and type of encrypted and deleted files, however I rejected this suggestion as Mr Garnett is located in Sydney.  I asked Mr Furstenberg whether his client objected to the list of deleted and encrypted files being shown to the Defence.  He indicated that there was an objection, due to there being some files or file names over which Mr Ryan claimed legal professional privilege.  I then pointed out that  whilst some documents did appear to have been created for the purpose of legal proceedings, the file names of those documents did not contain any information or instructions but simply identified the topic of the document.  I then indicated to Mr Furstenberg that I was not sure why I should not allow Mr Desmond to show the accused the file lists.  Mr Furstenberg then identified eight file names containing names of personal friends and relatives. It was proposed that Mr Furstenberg provide another list to the Court redacting the names, and that I would review the files themselves if necessary to determine their content.

1. What followed was further debate regarding how the issue ought to progress, and perhaps some confusion amongst counsel regarding Mr Garnett’s report, the contents of the DVD-ROM attached to Mr Garnett’s report, and Mr Ryan’s file lists provided to the court through Mr Furstenberg.  Mr Desmond submitted that the accused should have access to the entire file listing of the hard drive.  Mr Furstenberg suggested that the easiest way of resolving the issue would be for an expert to verify that Mr Ryan had correctly identified the number of deleted and encrypted files, and the number of those files which actually contained data.  I then directed Mr Furstenberg to have his client swear an affidavit deposing the position he had instructed Mr Furstenberg to take in relation to the files.  I also asked that Mr Furstenberg provide a list of deleted and encrypted files over which no objection was raised by Mr Ryan which could in turn be provided to the Defence.

1. The affidavit of Lenord Frank Ryan sworn and dated 20 April 2009 was provided to the court by Mr Ryan’s solicitors on that date.  In his affidavit, Mr Ryan notes at paragraph 2.1 that in the DVD-ROM attached to his report, Mr Garnett prepared a spreadsheet containing 749 files named ‘Encrypted File Listing.xls’.  Mr Ryan then used the CustomAuto Filter in Microsoft Excel to capture all the ‘.doc’ (Word) and ‘.xls’ (Excel) files from the original list. 

1. On 24 April 2009 Mr Ryan gave oral evidence at a voir dire in relation to his affidavit and was cross-examined on behalf of the accused.   He said he had been through the files on the hard drive and that he thought Mr Garnett’s review was fairly complete.   He said that files that were referred to as “encrypted” were files that were password protected.   These files were Microsoft Word files and spreadsheet files among others.  Some of those documents, he said, were created for the purpose of instructing his lawyers.  Some of those files were not the subject of a claim for privilege because, as I followed the evidence, it was obvious to Mr Ryan that the accused already had them as they were contained amongst documents he was shown while giving evidence.

1. On 28 April 2009, I was informed by Mr Furstenberg that as to the encrypted file list Mr Ryan annexed a flowchart that he produced to his affidavit and with the notation was "GN" in relation to those files which he has no objection to being produced.  Mr Furstenberg made it clear that such a willingness to hand over documents was not to be taken as a waiver of his entitlement to claim that the documents were privileged.   Although there was further delay, a folder of documents in hard copy form was handed by Mr Furstenberg to the Court and in turn to counsel for the accused on 1 May 2009.  Broadly those documents can be said to be documents for which production was not objected to either based on security concerns or considerations of legal professional privilege.

Conclusion

1. In the way the debate about these matters has developed and given the history of the matter,  the real issue for resolution is whether the means by which Mr Ryan proposes to comply with the subpoena is proper compliance.   On any view, at this stage of the proceedings it is not feasible for the accused to be examining the entire hard drive at large given that access has been had to many volumes of printed documents from that computer.  Of those documents, as I understand it, the only two have been the subject of any cross-examination of Mr Ryan, being the document which is described as the “relevant issues document” and the so-called “Dickson affidavit”.  The only ultimate issue I will deal with is whether, on the question of hidden and deleted files, what Mr Furstenberg proposes represents proper compliance with the subpoena.

1. I was placed in the position of having to determine the issues raised by this subpoena well after the witness in respect of whom the documents were sought had completed his evidence.  That meant that I was now considering the issue on the basis that documents sought to be obtained under this subpoena might justify an application that Mr Ryan be recalled and further cross-examined.   No such application was made on the basis of the documents that were handed over.  As I earlier stated, I published my reasons in Ruling No. 4 on 17 September 2008.  Mr Ryan’s evidence during the Basha hearing commenced on 6 October 2008, during which nothing arose in cross-examination upon which counsel for the accused sought to demonstrate that it is likely there are other documents on this hard drive which would be to be of assistance to the accused.  Before the jury, he was cross-examined by Mr Desmond in relation to his computer and two documents which had been worked on by him, Mark Dickson and the accused. Again, there is no aspect of his evidence in this trial that is relied upon to demonstrate the nature of any particular documents that might be of assistance.  Finally, I remain unable to understand why no effort was made to progress this matter between the receipt of Mr Garnett’s report in November 2008 and March of 2009 after Mr Ryan’s evidence had been completed.

1. During the course of the committal proceedings an extensive exercise was gone through by the Magistrate which considered all the material printed  from Mr Ryan’s computer.   What we are now concerned with is documents which were encrypted or deleted.   Mr Ryan has given evidence about those and identified files which he is prepared to permit the accused to have access to which do not compromise his security and which are not the subject of legal professional privilege.  In my view, in the unusual circumstances in which this issue has arisen, that is sufficient compliance with subpoena.

---