Electronic evidence in criminal proceedings: when and how it can be challenged

Vitalii Petryk

Attorney at law · Lexon (LF LEXON)

Electronic evidence increasingly takes centre stage in criminal cases, and the outcome often depends on its admissibility. Below attorney Vitalii Petryk explains when such evidence can be challenged and how the defence should act.

What electronic evidence is and how the CPC classifies it

Electronic evidence is information in digital form: messenger conversations, email, files and metadata, log files, data from phones and servers, web pages, transaction records including blockchain. Civil, commercial and administrative procedure have separate rules for it. The Criminal Procedure Code has no separate definition, so such information enters a case as documents under Article 99 CPC or as physical evidence under Article 98 CPC. This distinction sets the requirements as to form, original and method of recording, and therefore gives the defence points to challenge.

When electronic evidence is admissible

Evidence is admissible if obtained in the manner prescribed by the CPC (Article 86). For electronic data the key issues are the lawfulness of the source and the procedure: a search, temporary access to items and documents on the basis of an investigating judge ruling (Article 159 and following), inspection (Article 237), and covert investigative actions where access to information in electronic systems or networks requires them. A simple rule: if a ruling was required to access a device, account or network, and there was none or the investigators exceeded its scope, the evidence is at risk.

Grounds for declaring electronic evidence inadmissible

• Improper method of obtaining: access to a device or account without the required ruling or beyond what was permitted.
• Breach of the procedure for temporary access or covert investigative actions.
• Absence of the original: a printout or copy submitted without the source medium where this matters.
• Breach of integrity: no confirmation that the data was not altered (checksum or hash, preserved metadata).
• A break in the chain of custody: it is unclear who seized, stored and copied the data, when and how.
• Late disclosure of materials to the defence under Article 290 CPC.
• Obtaining as a result of a substantial violation of human rights (Article 87).

Original or copy: why this is critical

A printout of a conversation or a screenshot is derivative data. Without the source medium and metadata its reliability is easy to question. The defence should therefore demand original media, check metadata (dates, authorship, signs of editing) and, where necessary, seek an expert examination. This is often where the fate of the evidence is decided.

Integrity and chain of custody

Reliable electronic evidence comes with integrity records: a checksum (hash) at the moment of seizure, a clear report of the investigative action, involvement of a specialist. Where these are missing, the defence has grounds to argue that the data could have been altered and is therefore unreliable. Checking the chain of custody from seizure to examination in court is a mandatory element of a lawyer work.

What the Supreme Court says

Case law is developing rapidly, so current positions must be checked in every case. The general guidance is as follows: as to reports of inspections of web pages and Telegram channels, the court looks at the order and completeness of the recording, otherwise the evidence loses force; open source data (OSINT) is assessed under the general rules of admissibility; and there is settled practice on late-disclosed evidence being inadmissible if it was not disclosed to the defence before the case was sent to court.

Defence algorithm for electronic evidence

1. Establish the source and method of obtaining each item of electronic evidence.
2. Check the existence and content of the relevant investigating judge rulings.
3. Demand original media and metadata, not just printouts.
4. Assess integrity: hashes, dates, signs of editing.
5. Check the chain of custody and the reports of investigative actions.
6. Monitor timely disclosure of materials under Article 290 CPC.
7. Where grounds exist, raise inadmissibility (Article 89) and seek an expert examination.