Closing cases with open-source: Facilitating the use of user-generated open-source evidence in international criminal investigations through the creation of a standing investigative mechanism

Abstract

Digital open-source evidence has become ubiquitous in the context of modern conflicts, leading to an evolution in investigative practices within the context of mass atrocity crimes and international criminal law. Despite its extensive promulgation, international criminal tribunals have had few opportunities to address the admissibility of user-generated open-source evidence. Through semi-structured interviews with experts and analyses of primary and secondary sources, this article examines the current standards and practices governing the use of user-generated open-source evidence. Current practices illuminate a number of gaps in the realm of digital open-source evidence in international criminal law. This article posits the establishment of a standing international, investigative mechanism as a solution to a need for increased standardization and co-ordination within the realm of user-generated open-source evidence. By standardizing the collection and use of such evidence, investigative bodies will be prepared to more effectively serve the international justice community.

1. Introduction

Over the course of late 2021, intelligence services noticed a concerning build-up of Russian resources and troops along the Ukrainian border. ¹ As satellite images depicted increasingly unusual activity around the end of the year, concerns of an imminent attack began mounting. ² Digital evidence of the changing landscape offered the international community foresight into what the coming months might bring. ³ This insight into future military actions, through satellite imagery and other forms of digital evidence, is a hallmark of the landscape of modern warfare – a terrain void of the surprise element associated with the outbreak of previous conflicts. ⁴

The utility of digital evidence did not, however, cease as the conflict intensified. Videos of developments in Ukraine quickly dominated Twitter, Facebook, and TikTok, among other social media platforms. Digital platforms showed footage of streets with cars replaced by tanks and armoured vehicles, ⁵ civilians huddling together to take refuge in subways stations, ⁶ and buildings aflame against smoke-covered skylines. ⁷ Not only did digital evidence offer warnings of attacks to come but also showed real-time indication of events on the ground.

Digital evidence is useful not only prospectively in conflict but also retrospectively. The promulgation of digital evidence in Ukraine currently is not exceptional but is rather indicative of what modern warfare will entail. There are more hours of video footage of the Syrian conflict than there have been hours of conflict, ⁸ and there is no reason to suspect that present, and future, conflicts will not be similarly documented. Digital evidence will serve as a historical record of conflicts for the affected communities, the world writ large, and, hopefully, the field of international criminal justice.

Despite the utility of digital evidence, it is not without its pitfalls. In the wake of a mass of new uploads, Twitter recently mistakenly suspended a number of accounts reporting from Ukraine. ⁹ Not only is this incident reflective of suboptimal moderation policies of social media platforms, but it is also an example of the potential weaponization of digital sources. The wrongfully-suspended accounts alleged that their accounts were removed due to an attack by Russian bots that had mass reported these accounts’ content. ¹⁰ While Twitter denied evidence of a co-ordinated attack, it admitted that the accounts had been suspended ‘in error’, and subsequently reinstated many of the accounts. ¹¹ This incident is not an unprecedented one – digital evidence is particularly unique in its volatility, both in terms of the ease with which it can be altered and with which it can be publicly removed. Whether in error or intentionally, in the case of moderation of hate speech or incitement to violence, ¹² digital evidence can be permanently deleted at the click of a button. ¹³

Evidentiary procedures in international criminal law were neither crafted with digital evidence nor the modern conflict in mind. Digital evidence is, in many respects, distinct from more traditional forms of evidence. Electronic, or digital, evidence is defined as ‘[i]nformation and data of investigative value that are stored in or transmitted by an electronic device’. ¹⁴ The rising use of digital evidence dovetailed with the emergence of open-source investigations (OSINT), or investigations that rely on publicly available digital information. ¹⁵ With OSINTs emerging as not only a prudent, but necessary, form of investigations in international criminal law, courts and investigative bodies are confronting unregulated and novel forms of evidence. Without significant internal guidance, a range of best practices regarding digital evidence has emerged from these investigative bodies.

The creation of a standing investigative mechanism has the potential to strengthen evidence collection and use across the international criminal justice system, particularly within the realm of open-source evidence. In the early years of the International Criminal Court (ICC or Court), concerns of ineffective investigations plagued its reputation. ¹⁶ In response, the Court began broadening its evidentiary sources, including increased reliance on information collected by third-parties. ¹⁷ Continuing this trend, notably with respect to open-source investigations involving user-generated evidence, ¹⁸ will further strengthen international criminal justice. Given the novelty of the use of user-generated open-source evidence before international criminal tribunals, despite the progress made by investigative bodies, there are a number of challenges with respect to the use of digital evidence. A standing investigative mechanism can facilitate greater standardization in the use of, and access to, evidence across the investigative community, allowing for an improvement in the quality of international criminal investigations and effective prosecutions.

2. Current evidentiary practices in international criminal law

2.1. Evidentiary standards set by courts

The renaissance of international criminal law took the turn of the twenty-first century by storm. Over the course of a decade, a flurry of internationalized courts – the ad hoc tribunals, the ICC, and hybrid courts – revitalized the field. Faced with the prospect of creating an internationalized court, the component parts of these courts reflect the compromises it took to create them. Notably, the rules of evidence of international courts, across the board, reveal a combination of civil and common law legal systems, with significant deference to Chambers to address the novel issues these courts would inevitably encounter. By design, the evidentiary rules of courts are limited but provide the standards through which digital evidence must be considered.

2.1.1. Rules of admissibility and exclusion

In adopting standards of evidence for the ad hoc tribunals, the drafters of their Rules of Evidence and Procedure prioritized flexibility. Given the limited precedent in the field of international criminal law prior to the establishment of the ad hoc tribunals, flexible rules of evidence allowed for judges to tackle issues of first impression without being bound by technical rules of evidence, similarly to the approach adopted by the Nuremberg tribunal. ¹⁹ Beginning with the ad hoc tribunals, ²⁰ the Rules of Procedure and Evidence of international justice mechanisms provide for broad admissibility of relevant evidence. ²¹ The general standard that has emerged for the admissibility of evidence across courts ²² is a tripartite test that considers the evidence’s (i) relevance, ²³ and (ii) probative value, ²⁴ weighed against (iii) any potential prejudice. ²⁵

Despite the general admissibility of evidence, there are limited exclusionary rules prohibiting the introduction of evidence before international courts. The ad hoc and hybrid tribunals broadly prohibit the introduction of evidence ‘obtained by methods which cast substantial doubt on its reliability or if its admission is antithetical to, and would seriously damage, the integrity of the proceedings’. ²⁶ Similarly, the Rome Statute offers two situations where judges may determine the admissibility of evidence:

Evidence obtained by means of a violation of this Statute or internationally recognized human rights shall not be admissible if: (a) The violation casts substantial doubt on the reliability of the evidence; or (b) The admission of the evidence would be antithetical to and would seriously damage the integrity of the proceedings. ²⁷

This exclusionary standard is discretionary, however, and permits judges ‘to seek an appropriate balance between the statute’s fundamental values in each concrete case’. ²⁸ The Special Court for Sierra Leone (SCSL) similarly provides for the exclusion of evidence ‘if its admission would bring the administration of justice into serious disrepute’. ²⁹ The Extraordinary Chambers in the Courts of Cambodia (ECCC) specifically excludes statements obtained through ‘inducement, physical coercion or threats thereof’, ³⁰ and evidence obtained through interceptions or recordings of conversations via telephone or electronic correspondence. ³¹ Accordingly, unless excluded on these bases, evidence is generally admitted to the record, with reliability dictating weight rather than admissibility. ³²

Without stringent rules governing admissibility of evidence, the jurisprudence of international criminal mechanisms has expounded somewhat upon the limited rules of evidence. Within the context of open-source evidence, however, given the limited exposure, the jurisprudence is also limited. ³³ Across the courts, while judges may determine the admissibility of evidence at the time of submission or with the final judgment, relevant evidence is generally admitted to the record, with its weight determined in the final judgment. ³⁴ However, notably, the admissibility of digital evidence has exceptionally been ruled upon prior to that judgment, ³⁵ given the unprecedented nature of the source material before international courts. As such, should this practice continue, the specific considerations for digital evidence may continue to emerge. In the meantime, however, the general tripartite standard for the admissibility of evidence will continue to govern.

When considering the admissibility of open-source evidence, probative value is likely the most precarious element of the three. Across tribunals, jurisprudence has established that reliability and authenticity are two crucial components in the assessment of probative value. ³⁶ While related concepts, reliable evidence is, at its base, what it proports to be, while authentic evidence has not been manipulated or tampered with. Reliability can be established through a variety of factors, including the origin, content, corroboration, truthfulness, voluntariness, and trustworthiness of the evidence. ³⁷ Authenticity, on the other hand, can be established based on a number of internal, relating to the evidence itself, and external, relating to the collection and management of the evidence, indicators. ³⁸ For digital evidence, relevant internal indicators relate to the creation of the evidence, such as geolocation, source codes, and metadata. ³⁹ To date, the ICC has primarily relied upon geolocation ⁴⁰ and expert testimony reports ⁴¹ to establish internal indicators. External indicators include the provenance and chain of custody of evidence. ⁴² The ad hoc tribunals generally admit evidence when corroborated by external indicators, such as expert testimony and corresponding transcripts. ⁴³ Additionally, while ‘nothing in the Statute or the Rules expressly states that the absence of information about the chain of custody … affects the admissibility or probative value of Prosecution evidence’, ⁴⁴ tribunals have broadly emphasized the importance of proof of chain of custody in determining authenticity, ⁴⁵ particularly for digital evidence. ⁴⁶

Given the nature of open-source evidence, while there are specific issues that are notably under addressed in the realm of digital evidence, ⁴⁷ investigators must exercise particular diligence in ensuring, establishing, and conveying the reliability and authenticity of evidence in order to ensure its admissibility. Throughout the collection, storage, and admission processes, ensuring that markers of reliability and authenticity remain intact is of the utmost importance for the use of open-source evidence.

2.1.2. Determination of weight

Even if Chambers determine that evidence is admissible, this finding has ‘no bearing on the final weight to be afforded to it, which will only be determined by the Chamber at the end of the case when assessing the evidence as a whole’. ⁴⁸ While the admissibility of all evidence is determined on the basis of standardized evidentiary tests, ⁴⁹ the determination of weight is a more subjective and comprehensive analysis, and varies across categories of evidence. ⁵⁰ Evidence falls into four general categories of evidence: testimonial, documentary, physical, and forensic. ⁵¹ Generally, digital open-source evidence posted on social media platforms constitutes documentary evidence. ⁵² In the context of documentary evidence, Chambers will consider the evidence’s ‘provenance, source or author, as well as their role in the relevant events, the chain of custody from the time of the item’s creation until its submission to the Chamber, and any other relevant information’. ⁵³ Further, in addition to being components relevant to probative value, the authenticity and reliability of evidence are also relevant to its weight. ⁵⁴

Across the range of international courts, the standards considered by Chambers in assessing the admissibility and weight of digital evidence remain largely opaque. While the full scope of the role of digital evidence has not yet been addressed, it is also likely that the opacity of decisions regarding digital evidence is due to the way that Chambers assess the evidence. The reality is that international criminal judges are not experts in digital evidence, nor the indicators needed to verify it, ⁵⁵ and to that end are largely reliant on expert testimony or other corroboration ⁵⁶ to determine the weight of digital evidence, precluding a need for significant discussion of the factors in case law. Further, Chambers have explicitly stated that ‘it will consider all the standard evidentiary criteria for each item of evidence submitted, though it may not necessarily discuss in the judgment every submitted item’. ⁵⁷ As such, practitioners should proactively take all possible steps to ensure the clarity of the authenticity and reliability of evidence to rebut any potential concerns.

2.1.3. Storage of evidence

Due to the broad admission of evidence before international tribunals, the evidentiary record must be carefully retained so that judges are able to determine the associated weight of evidence. To that end, the retention of evidence throughout the judicial process is of the utmost importance. Prior to the commencement of proceedings, the official investigation rests within the purview of the Prosecutor, where they are ‘responsible for the [preservation and retention], storage and security of information and physical evidence obtained’. ⁵⁸ Once proceedings commence, however, the Registrar obtains the responsibility of retaining and preserving the record. ⁵⁹ The Registrar must ‘preserve a full and accurate record of all proceedings’, as well as ‘retain and preserve all physical evidence offered during the proceedings’. ⁶⁰ Even after many iterations of revisions, the International Residual Mechanism for Criminal Tribunals’ (IRMCT) RPE refer only to physical evidence. ⁶¹ Distinct from the ad hoc tribunals, the ICC RPE refer, in establishing the Registrar’s duty of retention, to not only physical evidence, but ‘all the evidence and other materials offered during the hearing’, ⁶² broadly encompassing digital evidence in addition to more traditional forms of evidence.

Despite the novelty of digital evidence at the time of the creation of the ad hoc tribunals, these courts introduced an electronic document management system to organize and retain evidentiary materials. ⁶³ Consequently, when the IRMCT established its own rules of evidence, it created a rule requiring the Prosecutor to ‘make available to the Defence, in electronic form, collections of relevant material held by the Prosecutor, together with appropriate computer software with which the Defence can search such collections electronically’. ⁶⁴ This effort, while clearly a recognition of the need for electronic storage and sharing of documents, only scratched the surface of the role of technology before international courts. Similarly to the IRMCT, the ICC also adopted a regulation providing for the electronic management of the Court. Regulation 26 requires that the Court ‘establish a reliable, secure, efficient electronic system’, to be implemented by the Registry, in order to ‘ensure authenticity, accuracy, confidentiality and preservation of judicial records and material’. ⁶⁵ As such, ‘[i]n proceedings before the Court, evidence other than live testimony shall be presented in electronic form whenever possible’. ⁶⁶ The ICC also developed an ‘e-Court Protocol’, which establishes specific standards for digital evidence in order to ‘ensure authenticity, accuracy, confidentiality and preservation of the record of proceedings’. ⁶⁷ The standards, however, largely offer guidance on the storage and format of evidence, ⁶⁸ rather than admissibility standards. Recently, the Office of the Prosecutor announced the creation of a new access link, OTPLink, to facilitate submission of evidence. ⁶⁹ In response to common issues associated with digital evidence, OTPLink allows any witness with a web-enabled device to securely submit evidence, uses a combination of machine learning and artificial intelligence to review and sort submissions, and creates a digital chain of custody in line with the Court’s standards. ⁷⁰ With the passage of time since the ad hoc tribunals’ establishment and the associated technological advancements, the ICC certainly offers additional insight into international tribunals’ handling of digital evidence, but the still limited case law regarding digital evidence leaves open a number of remaining issues.

2.2. Evidentiary practices employed by investigative bodies

Following the emergence of international tribunals, the international criminal justice community, deterred by the hurdles associated with the establishment of those tribunals, turned towards other avenues for accountability. In both the public and private spheres, a number of investigative bodies emerged to document atrocity crimes in an effort to pave the way for future judicial efforts. Given their emphasis on investigative work, and their subsequent co-operation with international tribunals, these investigative bodies offer insight into the collection and management of digital evidence.

2.2.1. Public investigative efforts

Following the resurgence of international criminal tribunals at the turn of the twenty-first century, the United Nations (UN) General Assembly (UNGA) began playing a more active role in international criminal accountability. ⁷¹ Until that point, the UN Security Council (UNSC) bore primary responsibility for the creation of international criminal tribunals under its Chapter VII enforcement powers. ⁷² Given the stalemate often associated with the UNSC, ⁷³ the UNGA opted to establish the United Nations’ International, Impartial, and Independent Mechanism for Syria (IIIM) rather than waiting for the establishment of an ad hoc criminal tribunal. ⁷⁴ As such, distinct from international courts, the IIIM was established as a fact-finding body intended to support future criminal trials but without the mandate to prosecute themselves. ⁷⁵ While authorization by the UNGA offered the IIIM the advantage of a less contentious, and timelier, establishment process, investigative mechanisms are not without their own challenges. Notably within the context of evidence collection, without UN Charter Chapter VII authorization or authorization by the Syrian regime, ⁷⁶ the IIIM cannot access Syrian territory and is therefore entirely reliant on digital evidence, accessible from outside of Syria, and co-operation from unassociated actors located within, or outside of, Syria. ⁷⁷

The establishment of the IIIM was subsequently followed by a number of similar fact-finding missions. Among others, the UNSC established, at the request of the Iraqi Government, the United Nations Investigative Team to Promote Accountability for Crimes Committed by Da’esh/Islamic State in Iraq and the Levant (UNITAD) in 2017. ⁷⁸ The Human Rights Council (HRC) established the Independent Investigative Mechanism for Myanmar (IIMM) in 2018. ⁷⁹ Finally, most recently, the HRC established an independent, international Commission of Inquiry on Ukraine in 2022. ⁸⁰ Each of these fact-finding missions, like the IIIM, is distinct from a criminal tribunal in that they have no judicial, but only an investigative, mandate. ⁸¹

The investigative mechanisms are each responsible for the collection, storage, and preservation of their respective materials. Generally, these mechanisms adopt a similar general standard for evidence collection: compliance with international standards. ⁸² The IIIM publicly describes its procedures as being, ‘in accordance with international criminal law standards … [and] tak[ing] appropriate measures to respect and ensure respect for the confidentiality, privacy, interests and personal circumstances of victims, and taking into account the nature of the crime’. ⁸³ Similarly, the IIMM adopts procedures ‘consistent with the UN Charter, UN rules, regulations, policies and good practices, relevant international law and jurisprudence, notably the security and well-being of victims and witnesses and the right to a fair trial and other due process provisions’. ⁸⁴ Finally, UNITAD provides for similar considerations, also providing for the relevance of jurisprudence:

The Investigative Team has adopted procedures for collecting, preserving and storing evidence and materials that are in line with the highest possible standards, consistent with the UN Charter, UN policies and best practice, relevant international law, including international human rights law, notably the right to a fair trial and other due process provisions, as well as the relevant jurisprudence … ⁸⁵

The mechanisms also provide for a baseline of consideration of storage and preservation of materials, from acquisition until transfer, ⁸⁶ using electronic databases and other information management tools. ⁸⁷ While these baseline standards regarding evidence collection and storage are consistent across investigative mechanisms, there remains significant discretion left to the bodies themselves to develop actionable standards and practices for evidence collection. ⁸⁸

2.2.2. Private investigative efforts

In addition to the emergence of investigative bodies within the structure of the UN, a number of private organizations, including NGOs, governmental organizations, and educational institutions, have emerged as contributors to the realm of international criminal investigations. NGOs focused on OSINT, such as Bellingcat, ⁸⁹ the Commission for International Justice and Accountability (CIJA), ⁹⁰ the Syrian Archive, ⁹¹ and WITNESS, ⁹² among more traditional human rights NGOs such as Amnesty International, ⁹³ TRIAL International, ⁹⁴ and Public International Law & Policy Group (PILPG), ⁹⁵ have begun bringing digital evidence investigations into the mainstream. These efforts are augmented by the aid of other similarly motivated institutions, like UC Berkeley School of Law Human Rights Center, ⁹⁶ the Public Interest Advocacy Centre, ⁹⁷ the Nuremberg Principles Academy, ⁹⁸ and the Digital Verification Unit at the University of Essex’s Human Rights Centre. ⁹⁹

The efforts of these private investigative bodies have made significant contributions to the standardization of investigative standards. Noting the lack of guidelines for the collection and use of digital evidence, the Berkeley Protocol on Digital Open-source Investigations (Berkeley Protocol) created a ‘set of minimum standards for the collection, analysis, and preservation of digital open-source information’. ¹⁰⁰ Initiated at a point in time when there were no systematized guidelines in place to govern the use of digital evidence, the focus on minimum standards created a common baseline to which investigative bodies could adhere, rather than a set of best practices. ¹⁰¹ Subsequently, Leiden University developed the Leiden Guidelines on the Use of Digitally Derived Evidence (Leiden Guidelines), which seek ‘to assist practitioners by comprehensively outlining the essential elements which should be considered before submitting [digitally derived evidence] to an international criminal court or tribunal’. ¹⁰² However, these guidelines notably omit discussion of open-source evidence, and particularly social media posts, given the lacuna in jurisprudence on the issue. ¹⁰³ Given this reality, investigative bodies still have significant discretion to adopt their own practices, resulting in the emergence of varied, albeit broadly stronger, ¹⁰⁴ investigative standards, particularly within the realm of open-source evidence.

Further, some investigative efforts provide a uniquely hands-on approach to aiding citizen investigators. EyeWitness to Atrocities, an initiative of the International Bar Association, created a mobile application through which users can record and upload photos, audio, and video. ¹⁰⁵ Once uploaded to the application, a master version of the media is saved to a secure server, along with affiliated metadata. ¹⁰⁶ EyeWitness’s secure server also strives to protect the chain of custody of its evidence. ¹⁰⁷ Finally, eyeWitness allows users to upload media anonymously. ¹⁰⁸ Once housed in eyeWitness’s server, employees can access the material to review and categorize for use in future criminal investigations. CameraV, an application developed by The Guardian Project in collaboration with WITNESS, took a similar approach to documenting citizen investigator’s work. ¹⁰⁹ However, while applications like eyeWitness and CameraV can serve a meaningful purpose for civilian investigators, it is not a panacea for open-source investigations. The reality is that the average citizen will turn to more familiar applications over specialized investigative applications, ¹¹⁰ and investigative applications were not developed to replace, but rather support, the role of traditional social media outlets. ¹¹¹ Effectively interfacing with those traditional social media platforms will continue to be an essential component of international criminal investigations, notwithstanding the progress of investigative bodies and other efforts.

3. Challenges in digital evidence collection in international criminal law

To date, there remains a number of unanswered questions in the realm of digital evidence in international criminal investigations. Efforts, particularly by private investigative bodies, have contributed significantly to the emergence of standards for the collection of digital evidence. These sources, however, are most instructive to user-generated evidence in the most formal sense: where citizens seek out to collect evidence with the purpose of aiding investigations ex ante. As such, there remain particular issues with respect to user-generated evidence that have not yet been sufficiently addressed, either by international courts or investigative bodies. ¹¹²

3.1. Evidentiary standards of admissibility

In addition to the political compromise associated with the formation of international courts, the complex nature of international criminal cases is served well by limited evidentiary constraints. To that end, some practitioners take the view that user-generated evidence is not dissimilar in any meaningful way from more traditional forms of documentary evidence and therefore fits into the pre-existing evidentiary framework established by international courts. ¹¹³ However, the reality is that there are particular elements of user-generated evidence that are unique to this type of evidence, and there are a few unanswered questions with respect to the admissibility of user-generated evidence in international courts, namely with respect to anonymous digital evidence and consistency in the preservation of the chain of custody. These questions may well be answered by international courts themselves in due course through case law, but relying on the courts themselves is not the only way to obtain standardization. Consistency in the presentation of evidence to international tribunals could present courts with a reasonable framework for the admissibility of user-generated evidence going forward, allowing investigative bodies to similarly influence admissibility standards without the addition of a formal rule. Irrespective of the final approach taken, a more complete understanding of the role of authorship and chain of custody in the context of user-generated evidence is a crucial step in its admissibility before international courts.

3.1.1. Authorship

The role of authorship of content within the context of admissibility of user-generated evidence raises a number of unanswered questions. The nature of digital evidence, particularly when gathered from an open-source platform rather than directly from an individual, may render the determination of authorship challenging. While content itself may be publicly available, the underlying information, namely the original creator, may not be. ¹¹⁴ Even when the original creator posts content themselves, users may opt to post that evidence anonymously. There are legitimate reasons, both with respect to practicality and privacy, ¹¹⁵ for users to submit evidence anonymously.

Despite international court’s preference to date for authored evidence, ¹¹⁶ there are genuine reasons to maintain the anonymity of user-generated evidence. Firstly, in the context of user-generated evidence gathered through open-source investigations, the initial author of digital evidence may be difficult, if not impossible, to discern. ¹¹⁷ Further, authors of digital evidence are subject to security concerns, in a similar manner as more traditional witnesses. ¹¹⁸ While more traditional witnesses consent, at least to a degree, to involvement the judicial process, the same is not necessarily true for the creators of digital content, particularly of social media posts. While authors of digital evidence may not be obligated to travel, either in-person or virtually, to the seat of a court for the use of their evidence, ¹¹⁹ providing evidence is not without its dangers. Particularly when an author’s name is tied to evidence, there are still considerable risks for users posting content that then becomes evidence, from the filming of the incident through to the aftermath of a potential trial. ¹²⁰ Even when evidence is provided anonymously, determined individuals can use the date, time, and other data to identify the author of the content. ¹²¹ Despite the respite that anonymity can provide to authors of user-generated evidence, courts’ preference for authored evidence is also mirrored in private investigative efforts’ preferences. ¹²² Given this reality, authorship of content is relevant not only to the admissibility of content but also to the consent of the author to the admission of that evidence.

The question of consent within the realm of open-source evidence remains underdeveloped. While courts have admitted, and referenced, anonymous evidence, particularly in the context of NGO reports with anonymous testimonial evidence, ¹²³ the admissibility of anonymous digital evidence is likely not legally impeded, so long as indicia of reliability ¹²⁴ can be effectively established without knowledge of the creator. That does not, however, render creator consent irrelevant. The Berkeley Protocol raises additional considerations with respect to creator consent. Implicit in the definition of open-source content is its publicity – the Berkeley Protocol itself defines open-source information as ‘publicly available information that any member of the public can observe, purchase or request without requiring special legal status or unauthorized access’. ¹²⁵ While information may be publicly available on the internet, the data may have been uploaded by a third-party without proper permissions, leading to possible legal and ethical restrictions on its use. ¹²⁶ For that reason, the Berkeley Protocol recommends that investigators obtain the consent of the persons involved in the creation of the content. ¹²⁷ As such, creator consent remains a best practice, if not a requirement, ¹²⁸ for investigative efforts prior to the use of data.

3.1.2. Chain of custody

A chain of custody is defined as the ‘chronological documentation of the sequence of custodians of a piece of information or evidence, and documentation of the control, date and time, transfer, analysis and disposition of any such evidence’. ¹²⁹ The Berkeley Protocol provides that in order for information to be admissible as evidence, prosecutors and counsel must typically establish the chain of custody of the content. ¹³⁰ While many forms of evidence require the establishment of a chain of custody as a marker of authenticity, establishment of the chain of custody for digital evidence is particularly technical in comparison.

The chain of custody of digital evidence can be established through two main procedures. The first approach, which replicates a traditional manner of verifying an unbroken chain of custody, relies upon the testimony of the individuals who controlled the possession of the evidence from acquisition through trial. ¹³¹ By testifying to the collection, storage, and preservation of the evidence, the chain of custody, and thus the reliability, of the evidence can be established. ¹³² Alternatively, technology itself can similarly establish the consistency of evidence throughout its lifecycle. When content is removed from a platform, a unique identifier, known as a hash, can be generated. ¹³³ By cross referencing the hash at the time of the acquisition of the content with the hash at the time of presentation to the court, consistency in the two identifiers can demonstrate consistency in the content across time. ¹³⁴ While both methods can demonstrate an unbroken chain of custody, ensuring that continuity in the first place is a more challenging. The task of ensuring that continuity is based more in policy and practice than in technology, and those practices become more difficult to regulate as the storage of digital evidence becomes more complex. ¹³⁵ When an original piece is saved locally and subsequently untouched, with access and modification occurring only to a copy, ¹³⁶ the chain of custody can effectively be maintained without issue. However, given the amount of digital content to which investigative bodies have access, local storage spaces may prove to be insufficient going forward. As investigative bodies turn towards cloud storage for content, new concerns regarding the maintenance of a chain of custody may emerge. Where there is a lack of encryption or a third-party storage platform is used, potential accessors to the content become outside of the control of the investigative body. ¹³⁷ Given the lack of case law on the subject, it is possible that even opening the access of the content in this manner to external actors may complicate the maintenance of a chain of custody for international courts. For this reason, the question of ensuring effective storage of potential evidence is of the utmost importance.

3.2. Evidence storage

Effective storage of digital information is paramount to its eventual use as evidence. As recognized across international courts, retention and storage of evidence is a foundational requirement of the judicial process. ¹³⁸ For international courts, effective storage of evidence permits judges to make informed decisions regarding weight at the conclusion of a trial. ¹³⁹ For investigative bodies, effective storage of information will permit its subsequent use in a criminal trial by avoiding manipulation and ensuring continuity in the chain of custody. Given the volume of potential evidence that is being generated in the context of modern conflict, ensuring effective storage and access of those materials is paramount to the eventual increased use of user-generated evidence before international courts.

3.2.1. Storage of evidence

A prominent issue with the use of open-source evidence is the sheer volume of content. Storage of content comes at significant financial cost, requiring investigative bodies to make difficult decisions regarding storage. For some, with particularly stretched budgets, in-house preservation is impossible, and evidence is maintained only to the extent that it remains accessible online. ¹⁴⁰ For others with more resources to dedicate to the preservation of evidence, tools of preservation include both internal and third-party resources. ¹⁴¹ Internally, investigators save certain files locally on their own computers, or re-upload them to personal YouTube or Vimeo accounts for, at least temporary, safeguarding. ¹⁴² Externally, platforms such as Google Drive or the Internet Archive’s Wayback Machine offer cost-effective mechanisms for storing data. ¹⁴³ Finally, bodies with the most resources can create customized, or original, platforms for storage. By creating a private, encrypted storage platform, investigative bodies can most effectively store and protect information. ¹⁴⁴ The Syrian Archive, for example, is working proactively to compile an archive of open-source information. By scraping platforms for relevant content, the Syrian Archive is able to store potential evidence in advance of the opening of a formal investigation. ¹⁴⁵

Given the budgetary and operational differences between investigative bodies, the evidence storage and management platforms similarly vary significantly. Even more concerningly, evidence storage practices can vary within those individual organizations. Practitioners suggested that a lack of standard operating procedures (SOPs), even internally, creates ad hoc storage policies. ¹⁴⁶ A lack of standardized storage procedures can render subsequent analyses of data more difficult to conduct, result in duplication of materials, and may even compromise the evidence itself. Given these realities, ensuring more standardized storage policies should be a priority for investigative bodies.

3.2.2. Access of evidence

Once evidence is maintained in a repository, there are a number of unanswered questions with respect to the access of that information. In the simplest of storage options, where information is held in-house on a local hard drive, access of evidence is similarly simple and can be limited to employees of an investigative body. With any added complications, however, that access can become more contentious.

The danger of ubiquitous access to evidence is twofold. Firstly, the access of evidence can raise important ethical concerns. The ‘Do No Harm’ principle acknowledges that any international involvement into conflict becomes part of that conflict and therefore produces both negative and positive impacts. ¹⁴⁷ Under the principle, any intervener should minimize any potential, even if inadvertent, harm they may cause. ¹⁴⁸ Within the context of open-source investigations, and more specifically the access of that information, the primary potential harm is the violation of the right to privacy. The right to privacy is established in a variety of domestic and international sources and is laid out in Article 17 of the International Covenant on Civil and Political Rights (ICCPR), stating that ‘[n]o one shall be subjected to arbitrary interference with their privacy, family, home or correspondence, nor to attacks upon their honour and reputation. Everyone has the right to the protection of the law against such interference or attacks’. ¹⁴⁹ Investigators’ use, even of publicly posted information, of digital content, particularly in a subsequent criminal trial, may constitute a violation of the right to privacy. ¹⁵⁰ In order to respect that right, investigators must strive to obtain the informed consent ¹⁵¹ of the content creator when possible, acknowledging that evidence may be promulgated anonymously, rendering the acquisition of informed consent difficult, if not impossible, in certain contexts.

A violation of the right to privacy is not only problematic with respect to individual rights but also to the admissibility of any associated evidence. As laid out in Article 69(7) of the Rome Statute, evidence obtained in violation of a human right may preclude its admissibility. ¹⁵² The right to privacy, as an internationally recognized human right, ¹⁵³ would fall within the purview of this article. However, the Court has provided additional insight into which violations would be sufficiently severe to justify exclusion. A violation of a right only affects the reliability of evidence where full respect to that right would have resulted in a difference in the content of the evidence. ¹⁵⁴ In the case of a violation of the right to privacy in the context of open-source evidence, digital content would be consistent, regardless of whether it was obtained in respect or in violation of that right. ¹⁵⁵ To that end, the right to privacy in the context of open-source investigations would likely not preclude the admissibility of digital evidence under Article 69(7), though a definitive answer to the question is unclear until international courts are in a position to address the question.

Further to protections of the right to privacy, ubiquitous access to digital information raises concerns with respect to the safekeeping of any potential evidence. Access to information necessitates a balance between the benefits that increased access to materials provide and the security of any potential evidence. Without the ability to share information, investigative bodies are likely to be overlapping, if not repeating, the work of their counterparts. Given the budgetary restraints associated with each of these organizations, avoiding this duplication would serve those organizations, as well as the broader international criminal justice community, more effectively. Overbroad access, on the other hand, would counter efforts to reduce duplicative work. If hostile actors have access to potentially valuable evidence, the content could be subject to alteration or removal, precluding its future use as evidence. ¹⁵⁶ As with evidence storage more broadly, investigative bodies weigh these competing interests differently, resulting in a range of strategies regarding the sharing of information. Some organizations emphasize the security of their content, by opting to collect and store data locally, disconnected from the internet. ¹⁵⁷ Despite the importance of ensuring the security of content, there is an increasing recognition among investigative bodies that there is a need for further co-ordination and co-operation – a feat which is only possible with increased access to potential evidence.

3.3. Corporate reliance

Within the realm of evidence obtained from social media platforms, investigative bodies are largely reliant on the platforms themselves to obtain crucial information. ¹⁵⁸ That reliance presents itself in two main contexts: firstly, social media platforms have significant control over the scope and enforcement of their content moderation policies, resulting in the potential loss of valuable evidence; and secondly, access to that removed content, and underlying metadata of both removed and public content, is similarly controlled by the platforms themselves. In order to make use of the wealth of potential evidence privy to social media platforms, investigative bodies should aim to establish co-operative policies with these corporations.

3.3.1. Content moderation policies

Content moderation is defined as ‘the process by which Internet companies determine whether user-generated content meets the standards articulated in their terms of service and other rules’. ¹⁵⁹ In response to increasing levels of extremist content, voluntary agreements ¹⁶⁰ and punitive measures ¹⁶¹ entice social media platforms to strengthen their moderation policies. ¹⁶² The legal obligations binding content moderation policies are quite limited, ¹⁶³ so as evidenced by the definition itself, each platform can, and does, establish its own standards for content moderation. ¹⁶⁴ Content moderation can be conducted in two broad contexts: ex post or ex ante posting. ¹⁶⁵ Users of a platform can flag content for removal once posted, known as ex post moderation, and the platforms’ content moderators will review a user’s flagging against the platform’s policies to verify content’s violation of or alignment with the policies. Flagging, and review, for removal is not only performed by individuals but is increasingly automated. ¹⁶⁶

In the context of ex post moderation, investigators can, at least potentially, access and preserve content prior to its flagging and subsequent removal. In order to ensure the preservation of evidence, investigators are their own best resource at present: ‘you can’t trust others to ensure its existence’. ¹⁶⁷ Ensuring preservation by an individual investigator, however, is easier said than done. Generally, social media platforms do not permit direct downloads from their website; ¹⁶⁸ investigators, rather, have to rely upon external websites or software to download content. ¹⁶⁹ The introduction of a third-party software potentially raises complications regarding the maintenance of the chain of custody, but without case law on the precise issue, it remains an open question as to how courts will treat evidence downloaded through such a platform. In addition to downloading content, investigators can also create stable links to the content, or simply capture a screengrab, though both of these options introduce the possibility of losing the metadata associated with the content. ¹⁷⁰

Ex ante moderation of content, on the other hand, presents particular difficulties for international criminal investigations. While investigators notably aim to save information as soon as possible, where content is moderated prior to posting, an investigator loses the opportunity to access evidence. At present, social media platforms are neither required to disclose their moderation policies nor moderated content. ¹⁷¹ The relevance of the loss of moderated content prior to posting relies largely on the platform’s moderation policies and those influencing them. While content moderation is likely a necessary safeguard in a world of misinformation and content inciting crimes, they can also be assumed for nefarious purposes. In addition to civilian users or platform employees flagging content for removal, state actors have also taken advantage of moderation policies. ¹⁷² Through a variety of mechanisms, including formal requests, governmental referral units, and more inventive tactics, state actors have the capacity to directly influence the moderation of content. ¹⁷³ Outside of this direct involvement in content moderation, given the flexibility of moderation policies, state actors often exercise political force to shape these policies. ¹⁷⁴ The involvement of state actors in the regulation of social media platforms is neither surprising nor unwarranted, but there are indications that the moderation of content by state actors does not always result in expected outcomes. In examples raised by practitioners, there have been cases where content showing military vehicles or weapons, but was otherwise nonviolent, was removed, whereas violent content without those state connections was left untouched, raising suspicions of state involvement in content moderation. ¹⁷⁵ Particularly within the realm of atrocity crimes, where state actors are often directly or indirectly involved in the perpetration of crimes, state actor’s involvement in the moderation of potential evidence in these cases raises significant concern.

3.3.2. Investigative access to content

In light of the necessity of content moderation, and the reality that social media platforms will continue to moderate their content, investigative bodies must work co-operatively within that framework. Social media platforms are privy to a large repository of valuable information – even in the case of a lack of publicly available metadata, it may still be accessible, at least for a period of time. ¹⁷⁶ Social media companies maintain a repository of metadata of uploaded media, but the preservation of that content is neither uniform nor particularly clear. ¹⁷⁷ Under Article 54(3)(f) of the Rome Statute, the Prosecutor is authorized to take measures, or request that measures be taken, to preserve evidence. ¹⁷⁸ As such, the Prosecutor has the ability to request that social media platforms preserve evidence, but this avenue remains discretionary, as well as limited.

In order to reduce costs associated with data storage and increase the accessibility of data, social media platforms make use of cloud computing. ¹⁷⁹ Rather than storing data on a local hard drive in a singular location, data is stored in centres in multiple countries. ¹⁸⁰ Traditionally, prosecutors rely on Mutual Legal Assistance Treaties (MLATs), which are bilateral frameworks for co-operation in law enforcement, ¹⁸¹ to access and collect extra-territorial evidence. MLATs are, however, designed for use by states and, given their bilateral nature, can vary between jurisdictions. Further, unlike more traditional forms of evidence, within the realm of cloud computing, prosecutors likely need to make use of multiple MLATs to access all needed data. ¹⁸² Given the lack of standards for MLATs, co-ordinating data collection across jurisdictions for a state prosecutor is a challenging undertaking.

For international courts and investigators working outside the framework of states, the process for accessing data is even less regulated. Under Rule 104(2) of the ICC RPE, the Prosecutor may seek additional information from third parties, including ‘States, organs of the United Nations, intergovernmental and non-governmental organizations, or other reliable sources’. ¹⁸³ As such, international tribunals can directly request information from social media platforms. ¹⁸⁴ The willingness of platforms to comply with those requests is, however, a manner of internal policy, which is ‘largely a matter of company discretion’. ¹⁸⁵ For civil society organizations, the avenues for co-operation with social media platforms are more limited still. ¹⁸⁶ The existing legal avenues for content sharing between investigative bodies and social media platforms leaves investigative bodies largely reliant on the platforms for co-operation.

4. Standardizing open-source investigations

Despite the ongoing work of public and private investigative bodies alike, the most significant issue to the admissibility of open-source evidence is the ad hoc nature of investigations. International courts’ treatment of authorship and chain of custody in the admissibility and weight of potential evidence will likely be assessed on a case-by-case basis in the immediate future. Across investigative bodies and courts, the practices for the storage of evidence and the subsequent access of that information vary significantly. Similarly, social media platform’s content moderation policies and co-operative policies with law enforcement and civil society differ. Creating standardization across these gaps will strengthen the admissibility and the quality of potential evidence for international criminal investigations.

Scholars, in the wake of the establishment of a handful of ad hoc investigative mechanisms, have begun considering the establishment of a Standing Independent Investigative Mechanism. ¹⁸⁷ Similarly to the considerations that preceded the establishment of the ICC, co-ordinating international investigations in a singular mechanism may serve the international community more effectively than the continued establishment of ad hoc investigative mechanisms. Currently, human rights activists, journalists, and lawyers are all contributing to open-source investigations. Creating a centralized investigative mechanism would ensure that all information gathered would be geared towards a trial standard, rather than the standards associated with advocacy or journalist. Further, by co-ordinating investigations, a standing mechanism could avoid repetition of work, both in and across investigations. At present, when a new investigative mechanism is established, there are significant financial costs and time restraints associated with its start-up – funding, staff, and systems must be acquired prior to the initiation of any investigative work. ¹⁸⁸ With a standing mechanism, the administrative and organizational framework would already be in place when a situation arises meriting further investigation, allowing for more cost-effective and timelier investigations.

An underexamined benefit of a standing investigative mechanism is the role it could play in standardizing the collection and use of open-source evidence. A number of scholars have called for a collective repository of digital evidence, also referred to as a digital locker. ¹⁸⁹ The idea of a digital locker is not only compatible with, but would be a crucial component of, a standing investigative mechanism. On a smaller scale, some organizations have begun operationalizing the idea of an evidence repository. Within the context of the European Union, Europol is working to develop a database for international crimes, through which members can request and share evidence between national law enforcement agencies. ¹⁹⁰ Similarly, the Syrian Archive has created a repository of content related to human rights abuses committed in Syria. ¹⁹¹ By co-ordinating the storage of content, the Syrian Archive has been able to efficiently filter and cross-reference data, allowing for a more effective conceptualization of the scale and scope of incidents. ¹⁹² Using these initiations as a model for the broader international criminal justice community, a standing international investigative mechanism can offer a framework through which a digital locker could be established.

Co-ordinating investigations into a singular mechanism could also alleviate some of the pressures associated with investigative work. Access to funding is a significant concern for investigative bodies broadly ¹⁹³ – secure storage solutions are expensive to implement, and scarce resources can preclude the existence of an effective data management system. ¹⁹⁴ Allowing investigative work to share resources, including hardware, storage space, ¹⁹⁵ and staff, would allow even a limited budget to go further than it would on an ad hoc basis. Further, by co-ordinating work internally within one framework, a standing mechanism could also more effectively create a shared SOP for documentation, storage, and analysis of digital evidence.

By having a centralized investigative body, co-operation with social media platforms would also be streamlined. Given the lack of official avenues for co-operation with non-state actors, ¹⁹⁶ investigative bodies are forced to work on an ad hoc basis, largely subject to the acquiescence of social media platforms. While a standing investigative body would not be privy to more official co-operative measures, it would allow for a singular set of agreements between the investigative mechanism and social media platforms. Under a memorandum of understanding, such as those entered into by select states or corporations and the ICC, ¹⁹⁷ a more official agreement could bind social media platforms to share content and affiliated information with the investigative body, subject to certain conditions. The terms under which information would be shared, such as who could request it, what categories of content could be shared, and how intellectual property, privacy, and national security laws would be implicated, are likely to be contentious, though the prospect of undergoing those negotiations for one investigative mechanism is more palatable than the alternative.

Additionally, a standing investigative mechanism could facilitate the equality of arms. The principle of equality of arms is a crucial component of any fair trial. ¹⁹⁸ Given the inherent power imbalance associated with the Prosecution’s initiation of a case, in addition to the practical imbalance in resources, the ICC enshrined protections in the Rome Statute to attempted to alleviate this tension, particularly with respect to the collection of evidence: namely, the Office of the Prosecutor has a duty to investigate both incriminating and exonerating circumstances equally, ¹⁹⁹ and to disclose any evidence material to the preparation of the defence. ²⁰⁰ While these protections are crucial, they are minimum standards and do not fully remedy the power imbalance. By creating a standing mechanism, defence counsel could access a full repository of evidence, and associated metadata, allowing for a more streamlined sharing of evidentiary materials at lower cost to all parties.

A centralized investigative body could also aid in the rise of domestic prosecutions of atrocity crimes and strengthen the complementarity of the Court. One practitioner expressed a need not only for standardized investigations but also a replicable investigative framework. ²⁰¹ Given the linguistic, cultural, and budgetary considerations associated with investigations, even a standing mechanism would involve co-operation with other bodies and could not be exhaustive of all potential investigations. To that end, being able to export the processes created by a standing mechanism would serve domestic prosecutions by allowing for a timelier initiation of, and more effective, investigations.

Despite the role it could play in standardization, a standing investigative mechanism is certainly not a panacea to investigative standardization. The establishment of a standing mechanism would be a feat of significant political will, not without questions of its own. As with any investigative body, policies would need to be developed regarding a number of standards – some questions include which conflicts would merit investigation and storage of potential evidence, and how they would be referred to the mechanism; how, and what, evidence would be transmitted to judicial bodies; what platform would be best suited to handling the storage of data; and what work processes would govern the handling, verification, and canvassing of potential evidence. Most crucially, a standing mechanism would require a significant amount of funding, and it would likely be reliant, like the ICC, upon voluntary contributions.

Further, the creation of an investigative mechanism and an associated evidence repository would not preclude the existence of other investigative bodies. Those investigative bodies would likely be served by the work of the standing mechanism, given its role in the increased standardization of best policies and practices, but many of the existing constraints faced by investigative bodies would endure. Notably, private investigative bodies would still face significant barriers to content sharing with social media platforms. While working with the standing mechanism may encourage social media platforms to increase content sharing with civil society more broadly, the reality is that the collaboration would still be on the platform’s terms. Investigative bodies would still face budgetary and storage concerns internally, but the existence of a standing mechanism could serve as a partial solution to those challenges, given the fact that bodies could outsource their storage needs to the mechanism, facilitating both a budgetary ease and increased co-operation amongst bodies. While a standing investigative mechanism would not alleviate all challenges faced by investigative bodies at present with respect to the lack of standardization, the contribution it could make to the efficiency and effectiveness of the international criminal justice community, particularly within the realm of open-source evidence, is significant.

5. Conclusion

As user-generated evidence continues to emerge from the landscape of the modern conflict, it is only a matter of time before international courts have to face difficult questions regarding the use of digital evidence. Given the relative novelty of digital evidence before international courts, case law and statutory rules provide limited guidance. Investigative bodies, therefore, have driven the determination of the future role, and standards for admissibility, of digital evidence. Despite the progress made by these investigative bodies, the work has been largely unco-ordinated, resulting in a range of best practices and guidelines in the realm of open-source evidence.

While the RPEs and statutes of international courts provide broad guidance for the admissibility of evidence, the particulars of digital evidence leave uncertain its future role in international criminal cases. Particularly with respect to the role of authorship and the establishment of the chain of custody in the digital realm, without specific guidance from evidentiary rules, the standards of admissibility for digital evidence remain both discretionary and uncertain until international courts face these questions directly.

Even in the absence of direct guidance on the standards for admissibility of digital evidence, there are steps the investigative community can take to pave the way for its eventual use in court. Ensuring adequate storage of digital evidence will protect the chain of custody of evidence while avoiding potential manipulation to the content. Reaching consensus on the access of that stored information – notably, who and under what circumstances – will require balancing the need for increased co-operation between investigative bodies and the need to protect the creators of content and evidence itself from harm.

Finally, enabling the admissibility of digital evidence requires access to the evidence in the first instance. Currently, social media platforms have access to, and are in control of, a vast amount of data. The use of content moderation policies endangers the loss of potentially crucial evidence. Challenges to obtaining access to that content and affiliated information is a significant roadblock to the potential role of digital evidence. Establishing a co-operative regime with social media platforms must be a priority for investigative bodies going forward.

Broadly, the international criminal investigative community would benefit from increased standardization. With a range of unanswered questions, unco-ordinated efforts have led to ad hoc approaches by investigative bodies. The prospect of creating a standing international, investigative mechanism will enable this standardization, by allowing a singular investigative body to guide the creation of best practices for the collection, storage, access, and use of digital evidence. Using this model of a standing investigative mechanism, the field of international criminal justice could facilitate increasingly effective and efficient investigations in the face of the novel challenge, and opportunity, of digital user-generated evidence.