A Single Comment — Permalink
© ICCforum.com, 2010–2024. All rights reserved. Policies | Guidelines
Featured Comments
- AhmadSoliman: Admissibility of Illegally Obtained Cyber Evidence at the ICC I. Introduction The International Criminal Court (ICC) is already grappling with questions about what types of cyber evidence will be admissible to the Court. Even more difficult questions about the admissibility of illegally obtained cyber information are on the horizon. The law governing the admissibility of illegally obtained cyber evidence contains several ambiguities, and new types of... (more)
- Steve Helmeci: The “Coming Storm”: Possibilities for Preserving Evidence of War Crimes Published on Major Online Service Providers I. Introduction There should be no greater windfall for criminal prosecutors, national or international, than the growth of the Internet as a tool for communication and networking. Potential evidence against perpetrators abounds: photos and videos posted by offenders, victims, and witnesses alike; personal... (more)
- glazera2020: Protecting Against Deepfakes: How the ICC Can Ensure Trust in the Verification and Use of Open-Source Evidence I. Introduction Digital devices have allowed ordinary civilians to become on-the-ground investigative reporters in almost every region of the world. Contemporaneous uploads of footage featuring protestors being tear-gassed in Hong Kong or Syrians fleeing from chemical warfare have allowed viewers all over the... (more)
- brittnewell: What Policies Should the Office of the Prosecutor Adopt in Receiving Cyber Evidence From User-Generated Evidence Gathering Apps to Help Protect Those Providing It? I. Introduction The rapid increase in the use of camera-equipped and internet-connected devices has enabled individuals to record far more information about their lives and their surroundings than ever before. This fundamental shift in information gathering is transforming... (more)
- Abhishek: Digital Evidence and the Use of Artificial Intelligence I. Introduction With the advent of new advancements in the technological world, it should come as no surprise that the primary source of information gathering and documentation is within the grasp of every individual. Internet and smartphones have virtually created journalists and investigators on every corner. International human rights and criminal prosecution organizations have... (more)
- marianava: Digital Evidence Repositories and Vulnerable Populations: How the Accumulation of Digital Evidence May Interact with the Privacy of Sexual Assault Survivors I. Introduction With the rise of digital technology, it is likely that the future of evidence collection at the International Criminal Court (ICC) will increasingly rely on digital evidence. This may take the form of videos, images, etc. (media) taken by victims or civil society... (more)
- Jill Mierke: The Promise and Problems of Open Source Evidence in ICC Investigations and Trials I. Introduction On August 15, 2017, the Pre-Trial Chamber of the International Criminal Court (ICC) issued an arrest warrant for senior Libyan military commander, Mahmoud Al-Werfalli.1 Al-Werfalli is accused of personally committing or ordering thirty-three murders in Benghazi between June 2016 and July 2017. Importantly, this is the... (more)
Comment on the Cyber Evidence Question: “To what extent can cyber evidence repositories, and digital and open-source evidence, facilitate the work of the OTP, and the ICC more generally?”
What Policies Should the Office of the Prosecutor Adopt in Receiving Cyber Evidence From User-Generated Evidence Gathering Apps to Help Protect Those Providing It?
I. Introduction
The rapid increase in the use of camera-equipped and internet-connected devices has enabled individuals to record far more information about their lives and their surroundings than ever before. This fundamental shift in information gathering is transforming the way that evidence is collected, analyzed, and presented at trial. These changes are already being seen on an international level. In 2017, the International Criminal Court (ICC or Court) issued an arrest warrant for Mahmoud Mustafa Busayf Al-Werfalli that was primarily based on videos of executions found on social media websites.1
While this increased access to information provides the ICC with unique opportunities, such as the real-time recording of human rights violations and the gathering of evidence in areas inaccessible to investigators, it also brings with it notable and pressing challenges. As cellphone users begin documenting war crimes and crimes against humanity, private actors will play an increasingly influential role in international criminal investigations. This new role brings with it the many risks inherent in collecting evidence, including the security concerns of the evidence gatherer.
This risk is even greater for private actors who lack the support and evacuation plans that are available to court-appointed investigators.3 These security risks are also present if the evidence is used at trial. It is yet to be decided whether or not these private actors will fall under the ICC’s existing protection regime, whether as witnesses or as intermediaries.4
International non-governmental organizations (INGOs) have created two evidence-gathering apps that seek to mitigate these risks and preserve the user’s anonymity while also gathering enough information to verify and authenticate the evidence in the hopes that it will be admissible at trial. Because these risks can only be mitigated and not eliminated, both apps also rely heavily on the notion of informed consent to ensure that participants are fully informed about the potential risks of their involvement. However, there are fundamental concerns of just how informed that consent truly is. With the promise of anonymity and the belief that their evidence will be admissible at trial, individuals are more likely to take greater risks.
In this comment, I investigate ways in which the Office of the Prosecutor (OTP) can mitigate the risks that users face when submitting information through user-generated evidence apps. Section II of this comment provides a brief introduction to the spread of information communication technology, the advent of user-generated evidence, and the INGOs operating in this space. Section III discusses the security risks that private actors face when providing user-generated evidence and how INGOs have sought to mitigate these risks through app-design and outreach programs. Section IV introduces ways in which the OTP can mitigate these security risks moving forward by incentivizing meaningful informed consent and adopting guidelines that ensure accountability.
II. Harnessing User-Generated Content as Evidence in the ICC
A. The Spread of Information Communication Technology
Since the advent of social media and the introduction of the iPhone in 2007, information and communication technology has evolved and spread rapidly on a global scale. As of November 2019, there are an estimated 5.15 billion people with mobile devices worldwide, making up over sixty-six percent of the world’s population.5 Ninety-seven percent of the world’s population lives within reach of a mobile cellular signal, and ninety-three percent of the world’s population lives within reach of a mobile broadband internet service.6 This widespread use of cell phones and global internet connectivity has brought with it new opportunities to document crimes and has eliminated the traditional financial barriers of photography and video recording.7
With smartphones in the hands of more people than ever before, there is no longer a need for people to buy a camera, as they now have one in their pocket to use whenever they would like. With mobile phone video becoming such an accessible technology, it has become increasingly important to “harness the potential of citizens documenting crimes, which may be used as evidence in international criminal trials.”8 These advances have ushered in an era of digital evidence, and, more specifically, of user-generated evidence.9 “User-generated evidence is recorded on a device such as a smartphone by an ordinary citizen with the intent to achieve legal accountability for wrongdoing.”10
B. External Partnerships Necessary to Collect, Analyze, and Use Digital Evidence
User-generated evidence provides new opportunities for the ICC, which has faced obstacles in obtaining sufficient evidence in the past. “Considering the Court’s global mandate, coupled with its limitations in funding and staff, obstacles to obtaining evidence are unsurprising.”11 Noting its struggles with heightened evidentiary standards and limited witness protection resources, the OTP emphasized a need for more diversified evidence as an alternative to witness statements in its 2012–2015 Strategic Plan.12 The OTP also recognized the “explosive growth” of digital data as a promising and highly reliable alternative and committed to expanding its own internal capacity as well as its reliance on external partners to work with digital evidence.13
In 2013, at the Salzburg Workshop on Improving War Crimes Investigations, the OTP and the ICC met with specialists in cyber investigations, human rights investigators, foundation representatives, and University of California Berkeley faculty and students to discuss how to gather and analyze digital evidence relevant to serious international crimes.14 Noting that “a lack of resources is the greatest constraint on the OTP’s ability to produce quality digital evidence,” the workshop concluded that the OTP should focus on fostering external partnerships with INGOs and private tech companies already operating in this space.15
In its 2016–2018 Strategic Plan, the OTP noted that “strategic partnerships with the law enforcement community, INGOs, and academic institutions were crucial to keeping up with developments in the field” of cyber investigations.16 With this in mind, the OTP outlined a strategy to build its own internal capacity by recruiting experts and investing in equipment, staff training, and partnerships.17 The success of this approach was noted in the OTP’s most recent strategic plan, which found that the diversification of evidence allows for “better corroboration of the facts, a lesser reliance on witnesses, and a greater resilience in the face of security challenges or witness interference.”18 The OTP has again committed to enhancing this practice from 2019 to 2021 through more strategic coordination with partners:
The “specific bodies and mechanisms” that have been created to collect and preserve evidence are discussed in more detail below.
C. User-Generated Evidence Apps as a Possible Solution
Presently, two apps have been designed with the specific goal of collecting and preserving user-generated evidence for international criminal prosecutions. The eyeWitness to Atrocities app was launched by the International Bar Association (IBA) after consulting with lawyers at the ICC and other international and hybrid tribunals.20 The second app, CameraV, is a joint venture between the video advocacy organization WITNESS and a software technology group, Guardian Project.21 It was funded by the technology company Benetech, a start-up based in Palo Alto, California.22
As such, both apps have built-in features to help address authenticity concerns in the hopes that the user-generated evidence will be admissible in Court.
The ICC has developed specific standards for authenticating video, photography, and audio-based evidence.24
Both eyeWitness to Atrocities and CameraV record vast amounts of metadata to meet these admissibility standards:
The IBA and WITNESS have both embarked in outreach efforts to conflict-affected communities to encourage individuals to download eyeWitness to Atrocities and CameraV and to use the apps to secure user-generated evidence.27 “As of July 2017, the IBA had received 1,200 pieces of footage, translating into some seventy hours of potential evidence.”28 “Over 10,000 users have downloaded CameraV.”29 Beyond advocating for users to download and use the apps, the IBA and WITNESS have also sought to educate users on the types of evidence needed to build a criminal case, emphasizing the need for linkage evidence.30
WITNESS has developed a 200-page field guide, which it uses to train those who may witness crimes.31 The field guide, Video as Evidence, explains some of the basic legal concepts of evidence and provides tips for capturing evidence in a way that could be useful in a criminal case while also emphasizing safety concerns.32 The IBA has produced materials to explain how to use the eyeWitness to Atrocities app but has focused primarily on outreach through traditional media and social media and in-person outreach to local human rights groups in Syria, Kenya, and South Sudan.33
While user-generated evidence apps are a promising development in the field of international criminal cases, they also raise a new set of concerns. Most notably, this development marks a shift in the traditional investigatory process from professional, court-appointed investigators to private citizens. As Hamilton noted:
This shift brings with it new security and accountability concerns, which are discussed in detail below.
III. Security Concerns Unique to User-Generated Evidence
There is an inherent amount of risk involved in evidence collection. With the advent of user-generated evidence apps and the OTP’s increased reliance on digital evidence, some of those risks are being shifted “away from court-appointed investigators who have institutional support and an evacuation plan, to people without such protections.”35 These security considerations are a significant factor in both the creation and preservation of digital evidence as well as its use in a criminal trial. This section of the comment will discuss the risks that users face at all stages, and will also examine how effectively INGOs have addressed those risks through app design and education efforts.
A. Security Risks of Evidence Collection
As eyeWitness to Atrocities notes in its FAQs:
Indeed, many of these security risks were part of the reason the OTP sought to diversify its evidence collection strategies, given its limited resources to provide witness protection.37 “Many users are, in a literal sense, witnesses; they often witnessed the commission of the atrocities they seek to document.” One can get a sense of the security risks that users face by looking at the risks that previous ICC witnesses faced.
The ICRC discusses the risks that individuals face when providing information in their Protection Guidelines:
Both eyeWitness to Atrocities and CameraV have built-in safety features to mitigate these risks, allowing users to delete material quickly.40 EyeWitness to Atrocities also has a “panic button” that allows the user to erase all recorded information and the app itself to make it appear as though the app is not even on the phone at all.41 While these features are meant to mitigate the risk of retaliation, they are not infallible.42 Ensuring that users are adequately informed of these risks, and able to provide meaningful informed consent before collecting evidence, is of the utmost importance and will be discussed in Section IV.
B. Security Risks of Evidence Retention
The risk of retaliation does not end after the evidence has been collected. There is further risk that the user can be identified and retaliated against as the evidence is transmitted and stored. Both eyeWitness to Atrocities and CameraV offer built-in anonymity options as a means of risk reduction.
CameraV also creates a unique hash value identifier connected to the phone rather than the user to protect the user’s anonymity.44
Although both apps encrypt information and send it to a secure location, there is always a risk that these secure sites will be hacked. When discussing the issue of hacking, Mark Ellis, the Executive Director of the IBA, explained the decision to store eyeWitness to Atrocities’s footage in a secure evidence locker based in London:
The IBA now promises that their partnerships ensure that all footage is secure from hacking.46 “Yet with all the best protocols in place, recent experience suggests that highly motivated hackers are able to breach highly sophisticated security systems.”47
C. Security Risks at Trial
This risk of retaliation follows the user through trial as well. The rules of disclosure that apply before and during a trial “may require that both documenters and subjects be named and made available for questioning by the other party in the case.”48 While the user-generated evidence apps are designed to ensure a level of anonymity, preventing adherence to disclosure rules, “there is always the possibility that a motivated defense team will be able to uncover their identity.”49 The protection regime of the ICC has provisions to address this; however, their resources for providing protection may be limited.50 Additionally, there is no guarantee that the user will be categorized as a witness and fall under the ICC’s existing witness protection scheme. Indeed, the goal of these apps is to make the apps themselves witnesses. As Hamilton notes:
Because of these many uncertainties, “many resources that encourage the documentation of crimes rightly emphasise informed consent at each stage of creating and sharing such information to ensure that participants are fully informed about the potential risks of their involvement.”52 Whether or not the INGOs deploying user-generated apps succeed in receiving a user’s informed consent is a more complicated question that is addressed in the next section of this comment.
IV. Recommendations to the OTP to Mitigate Security Risks Inherent in the Collection, Retention, and Use of User-Generated Evidence
A. Mitigating Security Risks in the Collection of User-Generated Evidence
As discussed throughout this comment, security risks are inherent in the role of evidence collection. While the IBA and WITNESS have sought to minimize these risks through strategic app design and education efforts, these efforts are not infallible. Security risk may be impossible to eliminate, but it can be mitigated by securing meaningful informed consent and the management of an individual’s expectations. As Hamilton notes:
In order to give meaningful informed consent, the user needs to be informed of all risks and voluntarily accept those risks.54 In order for consent to be voluntary, one party cannot “promise, nor even raise the prospect of, a benefit that is not assured.”55 This is especially important in the context of user-generated evidence, where the benefits of gathering the evidence are still unknown. If users believe that the footage they capture will be used to secure a conviction against a perpetrator, they may be willing to take more risks.56 If they are aware that the evidence might not be admissible in Court, or that it may be utilized by the perpetrator himself, they might not take the same risks.57
The OTP could ensure that users are able to give meaningful informed consent moving forward by mandating risk management and expectation management in its contracts with INGOs, as suggested by Hamilton:
If the ICC were to contract with INGOs, it could ensure consistent messaging to users about the risks of evidence gathering and help to ensure that users are not taking those risks on the assumption that it will be used in Court.59
INGOs involved in collecting user-generated evidence are acting as intermediaries by connecting Court officials to evidence, and traditional intermediaries are contracted by the Court and bound by an associated code of conduct.60 Hamilton cites two major concerns that any contract would need to address: “user security and the realistic management of user expectations.”61 To address user security, the OTP should require that INGOs are trained on the Court’s Guidelines on Good Practices on Risk Prevention and that all interactions with users align with the principles of harm minimization.62
To ensure that consent is given voluntarily:
This would include any promise that the user may remain anonymous, given the uncertainties discussed previously, and would also require full disclosure that the evidence may never be used by the Court at all.64 If the OTP establishes that it will not accept user-generated evidence provided by any INGO found to violate these contract provisions, INGOs will be highly incentivized to comply.65
B. Mitigating Security Risks in the Retention of User-Generated Evidence
The International Committee of the Red Cross (ICRC) has established Protection Guidelines as a model of professional standards for human rights actors and humanitarian actors working in conflict situations.66 Hamilton reminds us that “INGOs are not legally required to follow these, or any other, guidelines. But Courts seeking to use user-generated evidence in their investigations and proceedings could establish a norm of getting INGOs to do so by stipulating that they will only accept user-generated evidence gathered through organizations that adhere to these guidelines.”67
In 2013, the Protection Guidelines were revised to address advances in information and communication technology, with special consideration given to the ways in which sensitive information should be managed.68 The subsequent and most recent revision, issued in June 2018, further emphasized that “the rapid proliferation of initiatives to use information and communication technology in new ways for protection purposes and the growing body of law on data protection” requires updated guidelines for information management.69
Chapter 6 of the Guidelines establishes standards for:
While explicitly addressed to human rights and humanitarian protection actors, the Guidelines emphasize the importance of these standards to other actors in the field of information gathering:
The Guidelines identify several security risks that individuals face during the collection, retention, and use of user-generated evidence that were discussed in the preceding section, ranging “from physical and mental harm or threats of harm, discrimination, social marginalization and stigmatization.”72 The Guidelines seek to mitigate these risks through a series of directives related to data minimization, data retention, data security, confidentiality, and information sharing.73 Specifically, as it relates to the risk of third-parties accessing the data while it is retained, the Guidelines state:
By stipulating that user-generated evidence will only be accepted if these Guidelines are adhered to, the Court could mitigate the security risks inherent in the retention of such evidence and ensure that any future apps adhere to the highest standards of security.
C. Mitigating Security Risks in the Use of User-Generated Evidence
As discussed previously, the risks that users face at trial will depend on the way that user-generated evidence is characterized, if it is accepted by the Court at all. Hamilton discusses the two ways in which the Court might characterize the user:
If the user is characterized as a witness, their security risks at trial can be mitigated through the Court’s existing witness protection scheme.76 While this characterization might ensure the safety of the user at trial, it also runs counter to the purpose of user-generated evidence apps that arose in response to the need for diverse evidence other than witness testimony.77 “The great hope of those involved in developing user-generated evidence apps, however, is that judges will accept the app itself as the witness.”78 Indeed, the apps were designed with self-authentication in mind.79 If the app itself is accepted as a witness by the Court, the user would not automatically fall under the Court’s witness protection scheme.80 Instead, the user is better analogized to an intermediary. Hamilton recommends two ways in which the Court could mitigate the risks that the user would face at trial if categorized as an intermediary: through an ICC-user contract and the application of the ICC Guidelines on the Use of Intermediaries.81
An ICC-user contract would act in the same way as an ICC-intermediary contract and would provide the user with the same amount of security.
However, the Court must take measures to manage those risks, up to and including the use of protective measures.83
However, “the Court does not generally contract with ‘self-appointed’ or ‘one-off’ intermediaries, which is likely to be an accurate characterization of most users.”84 Therefore:
The ICC Guidelines on the Use of Intermediaries stress the responsibility of the intermediary to take precautions for their own safety, but when these measures fail to protect the user, then “appropriate protective measures shall be implemented [by the Court].”86 While the Guidelines apply automatically to any intermediary formally contracted by the Court, their coverage is decided on a case-by-case basis for intermediaries operating outside of a formal contractual relationship.87
As discussed above, users are unlikely to have a formal contractual relationship with the Court, leaving them no guarantee of coverage under the Guidelines. To resolve this uncertainty, Hamilton suggests that:
V. Conclusion
While some level of risk will always be inherent in evidence gathering, user-based evidence brings with it a set of unique concerns, as these risks are shifted away from institutional actors to private citizens. INGOs have sought to mitigate this risk and maximize the potential admissibility of user-based evidence through strategic app design. The OTP can further mitigate these risks throughout the various stages of user-based digital evidence, from evidence-gathering to trial, in its contracts with INGOs and with users themselves. The OTP should look to the contracts, guidelines, and policies that it already uses for intermediaries to ensure that users are able to give meaningful informed consent and to ensure that INGOs are using best practices in the gathering and storing of sensitive information through their evidence-gathering apps.
Endnotes — (click the footnote reference number, or ↩ symbol, to return to location in text).
The Prosecutor v. Mahmoud Mustafa Busayf Al-Werfalli, ICC-01-11-01/17, Warrant of Arrest (PTC I, Aug. 15, 2017), available online. ↩
International Bar Association, Evidence Matters in ICC Trials 27 (Aug. 5, 2016) [hereinafter Evidence Matters], available online. ↩
Rebecca J. Hamilton, The Hidden Danger of User-Generated Evidence for International Criminal Justice, Just Security (Jan. 23, 2019), available online. ↩
Rebecca J. Hamilton, User-Generated Evidence, 57 Colum. J. Transnat’l L. 1, 55 (Nov. 7, 2018), available online. ↩
Ash Turner, How Many Smartphones Are in the World?, BankMyCell, available online (last visited May 25, 2020). ↩
International Telecommunication Union, Measuring Digital Development: Facts and Figures 2019, 8 (Nov. 18, 2019), available online. ↩
Hamilton, supra note 4, at 15. ↩
Evidence Matters, supra note 2. ↩
Hamilton, supra note 4, at 3.
(The term “user-generated evidence” was coined by Hamilton to refer to the trend of technologists and criminal justice advocates coming together to collect content recorded by ordinary citizens). ↩
Id. ↩
UC Berkeley Human Rights Center, Digital Fingerprints: Using Electronic Evidence to Advance Prosecutions at the International Criminal Court 3 (Feb. 2014) [hereinafter Digital Fingerprints], available online. ↩
Office of the Prosecutor, ICC, Strategic Plan June 2012–2015, 22 (Oct. 11, 2013), available online. ↩
Id. ↩
Digital Fingerprints, supra note 11. ↩
Id. at 9. ↩
Evidence Matters, supra note 2, at 21. ↩
Id. ↩
Office of the Prosecutor, ICC, Strategic Plan 2019–2021, 13 (Jul. 17, 2019), available online. ↩
Id. at 21–22. ↩
Hamilton, supra note 4, at 17–18. ↩
Id. at 18. ↩
Id. ↩
Id. at 28. ↩
Nikita Mehandru & Alexa Koenig, Open Source Evidence and the International Criminal Court, 32 Harv. Hum. Rts. J., n.21 (Apr. 15, 2019), available online. ↩
Id. ↩
Hamilton, supra note 4, at 18. ↩
Id. at 21. ↩
Id. ↩
Id. ↩
Id. at 24–25.
(Linkage evidence is evidence which connects the crime to the person or people responsible). ↩
Id. at 25. ↩
Id. ↩
Id. at 26. ↩
Hamilton, supra note 3. ↩
Id. ↩
FAQs: How does eyeWitness protect the security of the app users?, eyeWitness, available online (last visited May 25, 2020). ↩
Evidence Matters, supra note 2. ↩
Hamilton, supra note 4, at 37. ↩
International Committee of the Red Cross, Professional Standards for Protection Work 109 (3d ed. 2018) [hereinafter Professional Standards], available online. ↩
Hamilton, supra note 4, at 38. ↩
Owen Bowcott, eyeWitness to Atrocities: The App Aimed at Bringing War Criminals to Justice, The Guardian, Jun. 7, 2015, available online. ↩
Hamilton, supra note 4, at 38
(quoting IBA director Mark Ellis’s acknowledgment that governments can seize the device and discover it was used to record evidence). ↩
Id. ↩
Id. ↩
Mark S. Ellis, Shifting the Paradigm—Bringing to Justice Those Who Commit Human Rights Atrocities, 47 Case W. Res. J. Int’l L. 265, 269–70 (2015), available online. ↩
Hamilton, supra note 4, at 44. ↩
Id. at 45. ↩
Evidence Matters, supra note 2. ↩
Hamilton, supra note 4, at 51. ↩
Evidence Matters, supra note 2, at 27. ↩
Hamilton, supra note 4, at 38. ↩
Evidence Matters, supra note 2, at 27. ↩
Hamilton, supra note 4, at 52. ↩
Id. at 30. ↩
Id. ↩
Id. at 30–31. ↩
Id. at 31. ↩
Id. at 54. ↩
Id. ↩
Id. ↩
Id. ↩
Id. ↩
Id. at 55. ↩
Id. ↩
Id. ↩
Professional Standards, supra note 39. ↩
Hamilton, supra note 4, at 59. ↩
International Committee of the Red Cross, Professional Standards for Protection Work 15 (2d ed. 2013), available online. ↩
Professional Standards, supra note 39, at 16. ↩
Id. at 106. ↩
Id. at 110. ↩
Id. at 109. ↩
Id. at 110. ↩
Id. at 131. ↩
Hamilton, supra note 4, at 55. ↩
Id. at 56. ↩
Evidence Matters, supra note 2. ↩
Hamilton, supra note 4, at 56. ↩
Id. ↩
Id. ↩
Id. ↩
Id. ↩
Id. ↩
Id. at 57. ↩
Id. ↩
Id. at 58. ↩
Id. at 57. ↩