Assessment of digital evidence

How should digital evidence be authenticated and assessed in international crimes trials?

In conflict-related cases, digital evidence—ranging from personal computer files, call data records, and satellite imagery to videos on YouTube—plays an increasingly important role. Courts must address its reliability and sufficiency and reflect their reasoning in judgments to safeguard the accused’s right to a fair trial.

The Benchbook on the Adjudication of International Crimes (Chapter II, Part 2) provides detailed guidance on Ukrainian, international, and European standards on digital evidence in such cases. The Basic Investigative Standards (Section 5) also outline best practices.

 

International and European legal framework

There are no international legal rules specifically governing the admission or assessment of digital evidence in criminal proceedings. International and internationalised courts have general rules of evidence that apply to all evidence, including digital evidence, and are substantially similar in practice.

As the ECtHR notes, “while Article 6 of the [ECHR] guarantees the right to a fair hearing, it does not lay down any rules of admissibility of evidence or the way it should be assessed, which are therefore primarily matters for regulation by national law and the national courts.” (Balazs v. Hungary).

However, the ECtHR has found fair trial violations where domestic courts failed to adequately assess digital evidence (Handbook on Ensuring the Fairness of Conflict-Related Trials, paras. 279-281)

  • Balazs v. Hungary: Prosecution failed to link a social media post to the incident or explain why motive could not be inferred; court ignored relevant contextual comments.
  • Ciorap v. Moldova (No. 5): Failure to obtain the original video of an alleged ill-treatment during a search; use of incomplete, potentially manipulated copy.
  • Üçdağ v. Turkey: No adequate explanation why sharing two photographs on social media implied support for a terrorist organisation.

 

International criminal tribunals have extensive experience assessing non-oral evidence, including digital evidence, but limited experience with online open-source material. Under Article 69(4) of the ICC Statute, “[t]he Court may rule on the relevance or admissibility of any evidence, taking into account, inter alia, the probative value of the evidence and any prejudice that such evidence may cause to a fair trial or to a fair evaluation of the testimony of a witness…”.

When assessing non-oral evidence (where “the individuals who originally supplied the information were not examined”), ICC Chambers consider:

  • the contents of each item;
  • provenance, source or author;
  • the author’s role in the relevant events;
  • reported chain of custody from creation to submission;
  • any other relevant information (Bemba Art. 70 case, paras. 1785–1790).

 

Sources of reliability and testimony

Indicia of authenticity may come from the content or source, or from digital forensic analysis. Where open-source evidence is used (social media, public videos, satellite imagery), extra care should be taken to document collection methodology, verification steps, and triangulation with other evidence (STL Ayyash et al., Al-Mahdi, Tolimir).

Authenticity assessment would entail:

  • Provenance – trace the origin of the evidence from creation to court submission (chain of custody).
  • Metadata review – creation date, modifications, geolocation tags.
  • Integrity checks – hash values, checksums, or forensic imaging.
  • Consistency – compare content with other independent evidence.
  • Identify alterations – editing, cropping, or other manipulations.

Reliability assessment may entail:

  • Source credibility – reputation, past reliability, bias or interest.
  • Collection method – was it systematic, documented, and in line with recognised investigative standards (e.g., Berkeley Protocol)?
  • Preservation – was the original format maintained? Any conversions or compressions?
  • Context – surrounding circumstances of creation and storage.

 

In order to assess the authenticity, reliability, and probative value of digital evidence, witness testimony is often necessary:

  • Where source is known: The source or its representative (e.g. telecommunications providers in STL Ayyash et al.) may testify on probative value. In some cases, this may be unnecessary if other indicia suffice (Bemba contempt; Tolimir aerial imagery).
  • Where source is unknown/unavailable: Investigators, researchers, or analysts may testify on methodologies used to collect and verify evidence (e.g. STL Ayyash et al.).
  • Corroborating witnesses: Persons who can confirm contents from personal experience (e.g. videos in Lubanga; Ntaganda).
  • Experts: May be required where technical matters arise.

 

Relevant case law:

  • ICC, Bemba 70 – digital intercepts of mobile communications (Benchbook paras. 1785–1790)
  • ICC, Ongwen – intercept evidence and related witness testimony (Benchbook para. 1785)
  • ICC, Al-Mahdi – open-source social media video (Benchbook paras. 1793–1794)
  • STL, Ayyash et al. – telecoms evidence from service providers
  • ICTY, Tolimir – aerial imagery without provider testimony
  • ICC, Lubanga and Ntaganda – corroborating witness evidence on videos