Transcript of Trial Proceedings (2023-02-27)

This page is incomplete! Must add the synopsis and commentary.

Disable Commentary

Disable Highlights

PDF

Court of Appeal CA49120

244069-10-BC

Vancouver Registry

In the Provincial Court of British Columbia

(BEFORE THE HONOURABLE JUDGE OULTON)

Vancouver, B.C.

February 27, 2023

REX

v.

PATRICK HENRY FOX

PROCEEDINGS AT TRIAL

BAN ON PUBLICATION 486.5(1) CCC

232205.Feb 27 23.Trial.Restricted

J.C. WordAssist Ltd. (Port Coquitlam)

202-2608 Shaughnessy St., Port Coquitlam, B.C. V3C 3G6

Phone 778-285-3425

244069-10-BC

Vancouver Registry

In the Provincial Court of British Columbia

(BEFORE THE HONOURABLE JUDGE OULTON)

Vancouver, B.C.

February 27, 2023

REX

v.

PATRICK HENRY FOX

PROCEEDINGS AT TRIAL

BAN ON PUBLICATION 486.5(1) CCC

Crown Counsel: Ryan Elias
Tara Laker

Appearing on his own behalf: Patrick Fox

232205.Feb 27 23.Trial.Restricted

J.C. WordAssist Ltd. (Port Coquitlam)

202-2608 Shaughnessy St., Port Coquitlam, B.C. V3C 3G6

Phone 778-285-3425

Vancouver, B.C.

February 27, 2023

Elias:

Your Honour, if I could call the Fox matter. It's a matter before you today for continuation of trial. It's Ryan Elias, E-l-i-a- s, first initial R, is he and him pronouns please, for the Provincial Crown. And I am here with my colleague, Ms. Laker. We are in the fourth voir dire as I recall. Oh, and Mr. Fox is here in person, of course.

Judge:

Yes, good morning, Mr. Fox.

Elias:

We are currently in the fourth voir dire on this file with respect to the voluntariness of a statement Mr. Fox gave with Sergeant McElroy. And Sergeant McElroy is just outside. Before I call her in I thought it might be a good idea to just -- and Madam Clerk prompted this -- prompted this as well just to review the status of the various voir dires to make sure that we're all on the same page.

Judge:

Yes.

Elias:

So as I said, to my recollection and to my notes, this is the fourth voir dire. Voir dire number one was with Ms. Seath with some reported remarks that you found to be involuntary. And, in my submission, nothing turns on that and we are not seeking anything further with respect to that voir dire. Voir dire number two was the voluntariness of the statement with Constable Dent. You have ruled that it was voluntary, but your ruling as to its any further use that could be put to it is still pending I believe.

Judge:

I have a note that the Crown was going to complete argument on that.

Elias:

Yes, and I've done -- I've done a little bit of research, so I am prepared to speak to that further.

Judge:

And I thought the Crown's position was that Crown was only seeking to rely on it for cross- examination purposes.

Elias:

That is correct. So it may be moot in any event. But, of course, Mr. Fox needs to know whether we are permitted to do so before he decides whether he wants to testify or not.

Judge:

No, of course. If you had some further argument and I don't think I've heard from Mr. Fox on it at all either.

Elias:

No.

Judge:

So if the Crown has any further argument and then Mr. Fox and then I'll --

Elias:

Well, I can tell you -- tell you what I have -- what I have discovered in my little bit of research. From what I --

Judge:

Maybe we'll take -- take a step away from that --

Elias:

Yes.

Judge:

-- and tell me and then we'll go back to that.

Elias:

Okay. There was voir dire -- oh, and I should say, Your Honour, regardless of -- of what happens with the remaining argument for voir dire number two Crown will be seeking to have the admissible evidence admitted at trial. So primarily I think Constable Dent provided a file number that the Crown is seeking -- for his investigation that the Crown is seeking to have be entered as evidence in the trial proper.

Voir dire number three was with Catherine Meiklejohn with respect to the authenticity of her screen shots. You ruled that they were authentic. And again, I don't know if we canvassed that Crown would be seeking to have the evidence from that voir dire entered at the trial proper. So there was some evidence about when she looked at them. Sergeant McElroy testified about her certain involvement in that process. So all that, to avoid the need for repetition, we are seeking to have that entered at the trial proper as well.

Judge:

And so are you -- are you asking to do that now, or just providing the facts, something that you need to --

Elias:

If we could do that now, given that that voir is complete. I don't think there's anything more to say about that. So, I'll let Mr. Fox make any comments he'd like to make.

Fox:

Sorry, I'm a little unclear. Perhaps you could refresh my memory. What -- what that is exactly that we are referring to with respect to Ms. Meiklejohn?

Elias:

Yes. So it was Catherine Meiklejohn testified about -- oh she didn't testify on the voir dire, but Sergeant McElroy testified about assigning Catherine Meiklejohn to -- to look at the website and then that she was in the office and observed what appeared to be the website that Catherine Meiklejohn looked at and then received some screenshots. Submitted them, or attached them to the file and eventually sent them to the Crown. So that -- that evidence.

Fox:

I don't believe that I would have any objection, or opposition to the evidence that Ms. Meiklejohn forwarded -- reported that Ms. Meiklejohn accessed. The issue that I have is whether what she was accessing was actually on the internet. I don't dispute that, you know, web browser on her local machine. She brought up some pages that appeared to her to be the website, or related to the website.

Judge:

Okay. So based on that I can make a ruling with respect to the authenticity of what Ms. Meiklejohn said she accessed. That is what the Crown is seeking from Ms. Meiklejohn, or --

Elias:

Yes, and the remaining --

Judge:

-- Sergeant McElroy?

Elias:

And the balance of the evidence admitted to the trial proper for that voir dire. So Sergeant McElroy's brief testimony for that voir dire.

Judge:

Okay. So, both Sergeant McElroy's and Ms. Meiklejohn's evidence with respect to that will be evidence on the trial proper.

Elias:

Thank you, Your Honour. And then, of course, I'll have a similar application with respect to voir dire number four once we're done. But we'll cross that bridge when we come to it, I think.

Judge:

So, before resuming -- so that means you haven't finished your examination in chief of Sergeant McElroy?

Elias:

Correct.

Judge:

Okay, and then Mr. Fox will have an opportunity to cross-examine Sergeant McElroy if he wishes.

Elias:

Yes.

Judge:

And then there was the expert witness, Sergeant Shook to come in the Crown's case. Do you want to address voir dire number two now and complete that, or do you want to wait?

Laker:

My temptation as Sergeant McElroy is already here would be just to conclude her evidence and then make arguments with regards to voir dire number two. I think that -- just to be aware of --

Judge:

All right, that's fine. That means in between Sergeant McElroy and Sergeant Shook we'll complete that?

Laker:

Yes.

Judge:

Okay.

Laker:

Thank you. And I'll just step out and have Sergeant McElroy --

Judge:

Okay, thank you.

Elias:

And, Madam Clerk, if I could have the -- the disc that we were playing. It's -- I can't remember which exhibit on the voir dire it is, but.

Clerk:

C voir dire 4, I believe.

Elias:

That sounds right. So and A and B were the two transcripts.

Clerk:

A and B. A and B, two transcripts, Your Honour.

Judge:

Thank you.

Clerk:

And, Your Honour, would you like the witness to be re-affirmed?

Judge:

Yes, please.

AMBER MCELROY

a witness called for the
Crown, recalled,
reaffirmed.

Clerk:

Please state your full name and your rank and spell your surname for the record.

McElroy:

Sergeant Amber McElroy. Surname is M-c-E-l-r-o-y.

Clerk:

Thank you, and your badge number, please?

McElroy:

Two-three-four-three.

Clerk:

Thank you.

Judge:

Thank you, Sergeant McElroy. You can have a seat or remain standing as you prefer.

McElroy:

Thank you, Your Honour.

EXAMINATION IN CHIEF ON VOIR DIRE #4 BY CNSL R. ELIAS, CONTINUING:

Elias:

Sergeant McElroy, thank you from me as well for being here. I am -- as I am sure you recall we were in the middle of reviewing Mr. Fox's statement with you. So I'm just going to cue us back up to where we were.

McElroy:

Thank you.

Elias:

And if Sergeant McElroy could be given a copy of the -- the statement transcript.

Clerk:

Is that Exhibit A, or B, please?

Elias:

B, the thicker one.

Clerk:

Thank you, Exhibit B on voir dire four.

Judge:

Let me get that, thank you.

Elias:

And we are on page 41 of that transcript, I believe.

Judge:

Yes. I have a note at line 26 is where we follow.

Elias:

Yes, so I'm going to back a few back a few -- about 15 seconds.

(AUDIO/VIDEO BEING PLAYED)

(AUDIO/VIDEO STOPPED)

Elias:

So I'm just going to pause and make sure that we all have --

Laker:

We are just about to get to line 4 I believe just at the top of the page.

Judge:

Oh, thank you. I was looking for -- okay.

Elias:

Thank you. So I'll resume then from here.

Judge:

Okay.

(AUDIO/VIDEO BEING PLAYED)

(AUDIO/VIDEO STOPPED)

Elias:

So, Your Honour, there's about a nine minute pause here. I want to canvass with Mr. Fox as to whether there's any -- any -- anything he'd like to just see in the intervening video, or hear.

Judge:

Have you watched it and can say that nothing happens in that part?

Elias:

I have, Your Honour.

Judge:

Okay. All right, then let's fast forward through it, please.

Elias:

I'm going to restart.

(AUDIO/VIDEO BEING PLAYED)

(AUDIO/VIDEO STOPPED)

Elias:

So again, Your Honour, there's a six minute pause. From the Crown's perspective nothing happens through that pause.

Fox:

I agree.

Judge:

Okay.

Elias:

Thank you.

Judge:

So you can fast forward then until there's interaction between Sergeant McElroy and Mr. Fox.

Elias:

And restarting.

(AUDIO/VIDEO BEING PLAYED)

(AUDIO/VIDEO STOPPED)

Elias:

So, Sergeant McElroy, having listened to that statement, you were following along with the transcript. And was the transcript overall accurate?

McElroy:

It was.

Elias:

Were there any gaps, or errors that you noted that you -- like a substantial gap that you wanted to fill in?

McElroy:

No.

Elias:

And did I understand correctly, that interview was from about 12:50 to 2:31 we just heard?

McElroy:

Yes.

Elias:

Throughout your time with Fox did you make any promises to him that -- for some things for benefit?

McElroy:

No.

Elias:

Did you make any threats?

McElroy:

No.

Elias:

Did you ever touch him?

McElroy:

Perhaps leading him by the arm, if anything, but other than that, no.

Elias:

Overall from your perspective was Fox -- did Mr. Fox appear to be listening to you as you spoke to him?

McElroy:

Yes.

Elias:

Did he appear to understand what you were saying?

McElroy:

Yes.

Elias:

Did you find him to be confused?

McElroy:

No.

Elias:

And did you observe anything that you would call a sign of intoxication?

McElroy:

No.

Elias:

Did you perceive him to be fearful?

McElroy:

No.

Elias:

Did you observe any injuries on him?

McElroy:

I did not.

Elias:

Do you recall any complaints of any injuries?

McElroy:

No.

Elias:

So, at the end of the interview that we just saw here, what further interaction did you have with Mr. Fox?

McElroy:

Actually we were just -- I can't honestly recall whether I assisted in leading him across the street to the jail, or whether my partner did that. But he would have -- we would have finished up the interview and then one of us, if not both of us took him across to the jail. I don't believe I was part of that transport.

Elias:

So, actually, Your Honour, there is one more audio file on the CD recording the transport. Mr. Fox was transported from an inter -- interview room to jail. I have a transcript of that that I am going to provide to Mr. Fox. I'm in your hands as to whether we should play it, or whether the transcript of that interaction will be sufficient. Perhaps I'll ask Sergeant McElroy to review it and see if this accords with her memory and canvass with Mr. Fox whether he wants to hear the recording, or whether he is content.

Judge:

Well, the recording is the evidence and the transcript is usually just the aide to hear the evidence. So if you think it is relevant I think you would -- I'd expect you would want to play it.

Elias:

Yeah, Your Honour. My submission isn't that it's relevant. It's just on the disc so I want -- so I do want to provide the -- the transcript --

Judge:

Oh, I see.

Elias:

-- so that if you do want to review it you have that aide.

Judge:

I mean, without seeing it I don't know if I want to review it. I just -- I'd be relying on Crown to tell me they either think it's -- it's part of what they want to present to establish voluntariness, or not.

Elias:

Your -- in my submission, it's not relevant to voluntariness. There's nothing -- there's nothing there. There is some further discussion about this access to IT issue. Nothing the Crown would intend to rely on, but there's a -- I turn to Mr. Fox if there's anything in that.

Judge:

Well, how long is it? It doesn't look very lengthy.

Elias:

It's four pages of transcript. I think there's some long pauses, but we could probably get through it quite quickly. I don't know. I anticipate.

Judge:

All right. I don't know what is on it, but in the interest of completeness I think and perhaps it might assist Mr. Fox, or he might have some questions about it, let's just play it. Do you agree, Mr. Fox?

Fox:

Yes, I take no position either way on it.

Judge:

Okay.

Elias:

All right, so I'll hand up a copy of this transcript and I will pass one to Sergeant McElroy.

McElroy:

Thank you.

Judge:

Okay. So this transcript will be Exhibit D on voir dire number four.

Clerk:

On voir dire four.

EXHIBIT D (on voir dire #4): Police Interview of Accused.

Elias:

Thank you, Your Honour. It appears that it's one -- one audio file covering both the interview and the transport to jail. So I'm just going to need a moment to find the end of the interview.

Judge:

Yes, okay. Would you like me to stand down, or are you able to just look for it while --

Elias:

If you don't mind me fumbling around a lit bit, I think I can find it quite quickly.

Judge:

Okay.

Elias:

Thank you.

Judge:

It looks as though the time needs to be adjusted though.

(AUDIO BEING PLAYED)

(AUDIO STOPPED)

Elias:

I apologize, Your Honour, I didn't notice it was one file or I would have found the -- the timing point beforehand.

Judge:

No, that's fine, but I think you want to have a look at the time in the sense that we just finished an interview that I am viewing at 2:31 p.m. on the 16th.

Elias:

Yes.

Judge:

And, you know, devices can -- daylight savings time. So in terms of your searching if I'm not being clear, so the transcript begins at 1:38 p.m. So in other words, that is impossible if the other one ended at 2:31 p.m. The transport came after the interview?

Elias:

Oh, yes.

Judge:

So in terms of searching --

Elias:

Well, Your Honour, I think I've found where we are. We are at line 16 now. So nothing I think has been said between -- well, just some of those noises we heard. So if Mr. Fox is content to start with line 16 there.

Fox:

Sure, yes.

Elias:

Thank you.

(AUDIO BEING PLAYED)

(AUDIO STOPPED)

Elias:

So, Sergeant McElroy, was the transcript substantially accurate?

McElroy:

Yes, and I apologize to the court obviously. I was present and I do recall that now.

Elias:

No worries. I was going to say having -- having listened to that do you recall now the -- the last of your interactions with Mr. Fox?

McElroy:

Yes, I do.

Elias:

Can you maybe just summarize -- summarize what those were?

McElroy:

So we were on the third floor of the annex. We took the elevator downstairs. We went out the front door. We took a cross-walk across East Cordova to the jail. They are buzzed into the jail. Once there, there is a place for search where I wanded him for anything that we may have missed on our previous search. And then the male holding cell pre-hold was full so they suggested I put him in the female pre-hold. I put him in that area for processing at the jail and I shut the door.

Elias:

After that did you have any further in-person contact with Mr. Fox before trial?

McElroy:

No, I did not.

Elias:

Overall in your interview were you candid with Mr. Fox about your level of knowledge about the file?

McElroy:

I was.

Elias:

Were you honest about -- about your -- or, attempting to be honest when you summarized the state of the evidence at that point?

McElroy:

I was.

Elias:

And then there was this episode during the statement where you -- you told Mr. Fox that you went to check the website. Could you explain to Her Honour what you did when you were out of the -- out of the room?

McElroy:

Sure. So Mr. Fox was in our interview room and next door to that was a monitor room where Detective Jenew [phonetic] was sitting. We have a computer set up there with two monitors. One has access to our VPD like internal computer system and potential internet access through that. And the second is just a monitor that shows my interaction with Mr. Fox in that room, so that he is monitored for safety at all times. And I had previously signed on that commuter -- computer with my permissions and I had set it up. So I had the same permissions that I would have at this computer that I would at my main office at Graveley Street.

Elias:

And did you try to access the website?

McElroy:

I did. I went into our internet access point and I typed in the website address a couple of times and I received an error message which I should have taken a screenshot of, but I didn't, basically telling me that this website was blocked and I wasn't able to access it.

Elias:

Now, in the course of preparing for this interview had you planned to attempt to access the website?

McElroy:

No, prior to this in my office at Graveley we sit right beside the analyst and we have two different levels of permissions to the internet within the department. Someone like analyst Meiklejohn has full access the same that you would at your home.

Elias:

Sorry.

McElroy:

Oh, sorry.

Elias:

Just for the purpose of the voluntariness voir dire did you plan to try to access for the website during your interview with Mr. Fox?

McElroy:

No, I didn't. So I didn't bring a laptop or any screenshots. It wasn't something that I was planning to do. I tried to facilitate it in a moment, but it wasn't in my plan.

Elias:

And when you described the steps you took to Mr. Fox afterwards were you being honest at that point about what had happened outside the room?

McElroy:

Yes, I thought it was a fair request and I was happy to try attempt to honour it, but I wasn't able to do that.

Elias:

Okay, just one moment. Your Honour, those are all my questions for Sergeant McElroy for the purposes of the voluntariness voir dire. I'll have some more questions for her in trial proper though.

Judge:

Okay, thank you. Any questions on the voluntariness voir dire for Sergeant McElroy, Mr. Fox?

Fox:

I have no questions specifically related to the voluntariness, but I do one question related to a question that the Crown had just asked.

Judge:

Okay. You'll have an opportunity to -- to cross-examine Sergeant McElroy after, but since the question is present in your mind now, why don't you ask it and --

Fox:

Sure.

CROSS-EXAMINATION ON VOIR DIRE #4 BY THE ACCUSED:

Fox:

When you attempted to access the website from the computer in the other room, you said that an error message had come up?

McElroy:

Yeah, not -- I guess I misspoke. Not an error message. Just the message saying you can't access this site.

Fox:

Right, but my question for you would be what is that -- the page where the message that came up, and I'm assuming it was fully paged within the browser, correct? It was -- it appeared as a page within the web browser, I assume, right? Like it wasn't a separate dialogue box that popped up outside of the web browser?

McElroy:

It was separate to the internet. It was an internal message. It seemed like it was -- it wasn't on that website because I couldn't get to the website at all. It just wouldn't let me access it.

McElroy:

Well, but you said it was an internal message. Do you know it was an internal message, or are you guessing it was an internal message?

McElroy:

I am guess -- I am guessing it was my limitations in my website access.

Fox:

Okay, but you --

McElroy:

So I'm guessing that it would be an internal message through there.

Fox:

But you don't actually know if that error message, or that page, or whatever it was, if that was returned by the web server, or if it was returned by something internal to VPD's network?

McElroy:

I know that when I returned to the office I had the analyst run the website again from her computer and it didn't come up with that message. So if that's what your --

Fox:

Well, no I'm just -- I'm trying to clarify whether or not you know that the error message that you received came from the web server that the website was supposedly -- was it on -- coming off the internet, or if it came from something within VPD's network? Like was it the VPD's network that gave you that error message, or was it the actual web server?

McElroy:

My impression, and I apologize again for not noting down the exact information, my impression at the time was that it was my department limiting my access to the internet. It was an internal message was my impression at the time. And since requesting proxy logs that has been confirmed that that was my limited access to the website that stopped my access to that website.

Fox:

Okay. So you said multiple times there "my impression". So can I assume then that what you mean to say is that you don't actually know whether you were blocked by the web server itself, or by something internal to VPD's network by that message. You don't know where it actually came from?

McElroy:

So my belief at the time was that it came from my internal department and that belief has since been proven correct after speaking with IT.

Fox:

Okay. That was your belief, but do you know beyond all doubt where that message came from?

McElroy:

I do now after speaking with IT, yes.

Fox:

And so you know that that message definitely came from the internal network?

McElroy:

Yes.

Fox:

Okay. I'm going to ask more about this later when I cross-examine.

Judge:

Okay.

Fox:

Thank you.

Judge:

All right. Do you have any re-examination for Sergeant McElroy on the subject of the voir dire, Mr. Elias?

Elias:

No, Your Honour. No, nothing for re- examination.

Judge:

Okay. So then at this point, Sergeant McElroy, I think I'll ask you to step outside for the argument of the voluntariness.

McElroy:

Sure.

Judge:

And they want to call you in again, I understand.

Elias:

Yes, that's right.

(WITNESS STOOD DOWN)

Elias:

And at this point, Your Honour, I'll also take a moment to make sure that we have all the exhibits back with Madam Clerk.

Judge:

Yes.

Clerk:

Thank you.

Elias:

So I'm handing her the disc and I see that she took the transcripts from the witness stand there.

Clerk:

[indiscernible] the last exhibit.

Judge:

Yes. So how does Crown want to proceed now. Do you want to argue voir dire number four, complete your argument on voir dire number two?

Elias:

Your Honour, let's, subject to my colleague's comments, let's complete voir dire number four which I think is relatively straightforward and then we can finish with Sergeant McElroy's evidence and then deal with voir dire number two once she's --

Judge:

Okay.

Elias:

-- off the hook, as it were.

SUBMISSIONS ON VOIR DIRE #4 FOR CROWN BY CNSL R. ELIAS:

Elias:

With respect to voir dire number four and the voluntariness of the statement that Mr. Fox gave to Sergeant McElroy, the Crown's submission is that it's -- it's clearly voluntary. It's a statement in which Mr. Fox is an active, I would say clearly informed and competent participant. He engages in fairly extensive discussion with Sergeant McElroy. He disagrees with her frequently and gives his alternative theories about -- about the -- about what -- what she says has happened and the propositions she puts to him. There is nothing in his -- his demeanour, or in the content of his evidence that suggests that he was incompetent in any way, or even intoxicated. He is clearly of an operating mind and taking full active, often quite combative part in the -- in the interview. You heard from Sergeant McElroy and Sergeant Kim that there were no threats, no inducements, no promises of benefit and in my submission that reflected in the transcripts and audio that you have reviewed. Nothing of that sort took place, nor was this an atmosphere of oppression.

Leaving aside the issue of sugar in the coffee with which Mr. Fox didn't appreciate there's nothing -- nothing arising to -- arising to the level of oppression, or any sort of conduct that would -- would come close to overbearing his will. It's not as conversational and pleasant as the Dent interview, but it's a, in my submission, standard professional police interview in which Mr. Fox clearly chose to -- chose to answer some questions, chose not to answer other questions. And had every opportunity to participate, or not participate as he chose to from moment to moment throughout the interview. There was no police trickery. Sergeant McElroy has -- has testified that she was doing her best to be honest. Certainly there were no grave misrepresentations of the evidence that might fool Mr. Fox into thinking that he had to speak otherwise he would be in legal jeopardy, or anything of that matter. So I've gone quite quickly, Your Honour, but in my submission it is clearly voluntary and there's no reason for you to be concerned that Mr. Fox wasn't a voluntary participant in the statement. And I'll note for you that the Crown will be seeking leave to hold this statement for cross- examination. We are not seeking to lead it as part of our Crown case. So subject to any questions, that is the Crown's submissions on voluntariness.

Judge:

Remind me. Mr. Fox was given his right to counsel but did not choose to speak to counsel before speaking to police?

Elias:

That's right, Your Honour. Constable Kim testified to that and I believe reviewed an arrest script.

Judge:

Okay. Mr. Fox, with respect to the voluntariness of your interview with Sergeant McElroy, do you have any submissions.

Fox:

No, I have no submissions with respect to voluntariness and I have no concerns about the voluntariness. I agree that it was entirely voluntary.

Judge:

All right, thank you.

[RULING ON VOIR DIRE NUMBER FOUR]

Elias:

Thank you, Your Honour, and Crown would seek to have viva voce evidence of Sergeant McElroy entered into the trial proper. Just some of the narrative and -- and whatnot.

Judge:

So that is a little unusual in that if Crown were making it part of their case that would be a normal thing to do. But since you're holding it I think you as a procedural manner -- well, I'll hear from you if you think differently, but I think you are going to need to take her back to those parts of her testimony that you want to have as part of the trial proper.

Elias:

Fair enough, Your Honour, if that keeps it simpler rather than --

Judge:

I think it keeps it clearer.

Elias:

Yes.

Judge:

And it's -- unfortunately, it's a bit repetitive, but in the circumstances you are not seeking that evidence to be part of your case against Mr. Fox. So, the other alternative is for you to parse out every single piece of evidence that you want Sergeant McElroy to testify to and then ask Mr. Fox if he agrees. And he may do that, but that will take some time as well. And so --

Elias:

Agreed, Your Honour, and there's not all that much from the transcripts, or from the voir dire.

Judge:

Okay.

Elias:

So, I'll -- I'll need her back here for any key points that I want in the trial proper.

Judge:

Okay, and then before we call her back -- you want to call her back right away before addressing voir dire number two, just to complete her evidence?

Elias:

Yes, I think so.

Judge:

Okay.

Clerk:

Excuse me, Your Honour, the evidence from voir dire four is not being marked, or entered on --

Judge:

No, it's not because of the purpose for which Crown is seeking to -- to lead it. Thank you.

Clerk:

Thank you very much.

Judge:

But we are out of voir dire number four now and I have made the ruling and we are going back into the trial proper with Sergeant McElroy.

Clerk:

Thank you very much.

Judge:

Sergeant, you are still under affirmation and we are back in the trial proper now.

McElroy:

Thank you.

AMBER MCELROY

a witness called for the
Crown, recalled, reminded.

EXAMINATION IN CHIEF BY CNSL R. ELIAS:

Elias:

Sergeant McElroy, I'm going to have to ask you some questions that are a little bit repetitive to those you've already answered, so apologies for that.

McElroy:

Sure.

Elias:

Can I just confirm you're an officer of the Vancouver Police Department?

McElroy:

I am.

Elias:

And how long have you been so?

McElroy:

Just over 18 years.

Elias:

And what is your current assignment?

McElroy:

I'm a sergeant at the Vancouver Jail.

Elias:

And prior to that do I understand that you worked for the domestic violence and criminal harassment unit?

McElroy:

I did.

Elias:

For about how long?

McElroy:

Approximately two years.

Elias:

And on May 16th, 2022 then what was your duty? What were your duties on that day?

McElroy:

I was a detective constable and I guess investigator for Mr. Fox's file.

Elias:

So you became involved in an investigation with Mr. Fox?

McElroy:

Yes. It was in the domestic violence criminal and harassment unit.

Elias:

Thank you. Do you have the file number for that investigation, the police file number:

McElroy:

Yes, 2022-66177.

Elias:

And in the course of that investigation you took a statement from Mr. Fox?

McElroy:

I did.

Elias:

Did you seize anything from Mr. Fox at the time of his arrest?

McElroy:

Yes, I did seize a cellphone, tablet, two SD cards and two USBs.

Elias:

And can you explain to the court what you did with those objects?

McElroy:

Sure. Incidental to arrest I put Mr. Fox's cellular phone in a Faraday tin and placed it in the back of our unmarked police vehicle and Mr. Fox's tablet was too large for a Faraday tin and so that remained in his laptop soft case along with the two SD cards and the two USBs. Subsequent to the statement that we took from Mr. Fox I then reattended back to our police station at 3585 Graveley Street. The cellular phone in the Faraday tin, along with the two SD cards and the two USBs were tagged in locker 31 on the fifth floor at 3585 Graveley Street which are our serious investigative section property lockers. And the tablet which was too large to be contained within a Faraday tin I took directly to the digital forensic unit which is located in our Kootenay building. Forgive me, I don't know that address right now, but I can get that. And that was tagged in locker room one, to be included in the Faraday room.

Elias:

So you said the Kootenay address. Could you just give an approximate location of that?

McElroy:

It's right beside the Graveley Street address. It's -- our department is split between the two buildings at Graveley and Boundary.

Elias:

Graveley and Boundary, thank you, in which city?

McElroy:

In Vancouver.

Elias:

And province?

McElroy:

BC.

Elias:

Thank you. So just to cover off this was at the time of the arrest. You arrested Mr. Fox?

McElroy:

I -- Detective Kim provided the arrest and Charter. I was present during the arrest.

Elias:

Right, and then you took them to the -- the two lockers as you described. Did you -- when did you see Mr. Fox's devices next?

McElroy:

Not until July 15th.

Elias:

And what -- did you -- did you file a Form 5.2?

McElroy:

The 5.2 yes, on the day of arrest.

Judge:

Sorry you didn't see what until July 15th? I missed that word.

Elias:

Mr. Fox's devices.

Judge:

Okay.

Elias:

So I'm just going to hand -- hand you something, Sergeant McElroy, and you can let me know if you recognize it?

McElroy:

Thank you. I do recognize it. It's the initial 5.2 that I completed on the day of arrest for the devices that were seized off of Mr. Fox.

Elias:

And whose handwriting is that on the form?

McElroy:

That's mine.

Elias:

Thank you. If this could be entered as an exhibit please, Your Honour.

Judge:

The 5.2 Report to a Justice will be Exhibit -- Madam Clerk, can you just see where are we?

Clerk:

Nine, Your Honour.

Judge:

Exhibit 9 on the trial.

EXHIBIT 9: Form 5.2 Report to a Justice

Elias:

And this -- this exhibit describes all the devices that you seized from Mr. Fox?

McElroy:

It does.

Elias:

And it records where it says "disposition", what does that mean on the second page -- or on the second page?

McElroy:

So the SIS lockers for items 4, 5 and 6 and then on the second page, is that where you're?

Elias:

I see actually that it's the same -- the same on both. So yes, if you could explain what field, "State location where detained" indicates?

McElroy:

So it is where the devices were supposed to be stored at the time of seizure. It does say the digital forensics unit, but because I had it in a Faraday tin I had decided that I would keep it in the SIS locker. So even though a smart phone does say "Digital forensic unit" it actually stayed in the SIS lockers at Graveley Street, whereas the [indiscernible] tablet did go to digital forensics unit.

Elias:

Which you said is an adjoining, or adjacent building?

McElroy:

It's adjacent building. It's -- yeah.

Elias:

And then the next time you saw these devices you said was on July?

McElroy:

Fifteenth.

Elias:

Fifteenth.

McElroy:

Two thousand and twenty-two.

Elias:

What did you do on that day?

McElroy:

So that is the day that I submitted my search warrant to the judicial justice and it came back approved. And once I had received the approved court papers I removed the tablet, the two SD cards and the two USBs from locker number 31 and transported them across basically the parking lot to the Kootenay building and tagged them in locker number one at the digital forensics unit.

Elias:

And were the devices where you left them?

McElroy:

Those -- yes, they were retrieved from --

Elias:

On Monday, yes. To your knowledge had anyone else accessed them in the intervening time?

McElroy:

The only device that had been accessed was the tablet the next day after the arrest on May 17th the digital forensics unit would have removed the tablet from locker number one and put it in a Faraday room and where that's where it remained up until July 15th when I brought the rest of the devices over.

Elias:

And you say would have, is that the standard practice?

McElroy:

Yes.

Elias:

But you weren't there personally for that step?

McElroy:

I wasn't. I had requested that it remain in the Faraday room and there would be no reason for them to remove it from that room.

Elias:

Thank you. I'm going to hand another document to you. Just if you could let me know if you recognize this?

McElroy:

Yes, this is the -- the search warrant that I wrote to get access to the devices.

Elias:

So you composed the -- the digital form of this document?

McElroy:

I did.

Elias:

And the writing on the back, is that -- did you write that, or is that the -- it says "Judicial Justice"?

McElroy:

That is the judicial justice that wrote that.

Elias:

Right, so you said it was approved, that's the approval. And on page two there is a -- some -- some items numbered with Roman numerals. Can you just describe what those are?

McElroy:

Yes, this is what I was asking permission from the judicial justice to search Mr. Fox's devices for. Would you like me to --

Elias:

No, that's okay. If this warrant could also be entered as an exhibit please, Your Honour.

Clerk:

We are on ten in the trial proper.

Judge:

Okay. Any objection, Mr. Fox?

Fox:

No.

Judge:

Okay. So Exhibit 10.

EXHIBIT 10: Search Warrant

Elias:

So on July 15th then after you received this warrant you retrieved the devices and you said you gave them to digital forensics?

McElroy:

That is correct.

Elias:

Did you have any contact with them after that, or any problem with them after that?

McElroy:

We discussed the -- the large amounts of searching that I was requesting, i.e. the SD cards, the USB and a tablet and the phone. They indicated that their section was quite busy and we decided that we would just narrow down the search to the tablet and the phone.

Elias:

Thank you. Did you eventually receive any information from DFU about the phone first?

McElroy:

I did in October. If I can refer to my notes I could see the exact date, but it was in October I received information -- that the information -- that the search data would be available to me.

Elias:

All right. Did you look at the data?

McElroy:

I did.

Elias:

And then did you refer it for any further analysis?

McElroy:

Yes, so using the scope of the items requested from the judicial justice I went through Mr. Fox's phone on a system called REAP [phonetic] which allows us to view the contents. There were 27 items that I flagged for further review from our digital forensics unit. Among these items were --

Elias:

I'll ask --

McElroy:

No, okay, sorry.

Elias:

No, that's all right. I'll have the digital forensics witness testify to those. But you referred them. Did you receive any information back from your referral at that --

McElroy:

I didn't, no. I think Crown has, but since I moved sections and ceased to be the lead investigator. So I actually had never received the digital forensics report.

Elias:

Fair enough. And then with respect to the tablet, do you know if any further analysis was done on the tablet?

McElroy:

At the time of me leaving the digital -- I'm sorry, the domestic violence unit, the search had not been loaded on REAP at that point and I -- I'm not sure where it stands on that process as I am no longer the lead investigator.

Elias:

Thank you. In -- in leaving the phone or, rather, in your dealing with the phone did you happen to record a -- any -- any device numbers, or anything like that that would identify it?

McElroy:

I did not.

Elias:

Okay. When it was stored with the property office would there have been a file number attached to it, or was there?

McElroy:

Yes. All six of these exhibits have been assigned individual exhibit numbers which have remained with them throughout their transport within our department.

Elias:

And is there a file number? Is that the file number for the investigation itself?

McElroy:

Yes. So it's -- it's a basically a number that uses the file number as a basis and then attaches a one, two, three and for all intents and purposes these exhibit numbers are the file number dash one, dash two, dash three, up to six.

Elias:

Thank you. So my next -- for my next questions if Detective McElroy could be shown Exhibit 5, please. Those are the May 16th screen captures.

Clerk:

Yes, Your Honour, Exhibit 5 is A and B, the screen captures [indiscernible] documents.

Judge:

Yes.

Elias:

And, Detective McElroy, before I have you look at that, there's one more thing just about the -- the other, or the devices. I'm going to hand you another document?

McElroy:

Thank you.

Elias:

And I'll just let Her Honour take a look at that. So can you tell me what this -- this is?

McElroy:

It is the second 5.2 Report to Justice that I wrote in regards to this file to include the data that was captured from both his, Mr. Fox's, cellphone as well as the -- the tablet.

Elias:

And this is your handwriting on the -- on this form?

McElroy:

It is.

Elias:

Then it was filled out on November 1st, status. I can use that date. You received the data in October?

McElroy:

I was advised the data was available on October 24th. I didn't actually access it until November.

Elias:

If this could also be entered as an exhibit please, Your Honour.

Judge:

Yes. The -- the Report to a Justice 5.2 dated November 1st, 2022 will be, I think we're at 11?

Clerk:

Thank you, Your Honour.

EXHIBIT 11: Form 5.2 Report to a Justice

Elias:

So then turning, Sergeant McElroy, to Exhibit 5 which I think you have in front of you. Do you -- could you read through this and tell me if you -- if you you recognize it?

McElroy:

These are like screen shots that were captured by our analyst from www dot desicapuano dot com.

Elias:

And in the course of your investigation did you review the -- these posts, like the substance of them?

McElroy:

I was shown them and yes, I did read through them briefly, but I didn't make any further notes regarding them.

Elias:

Just one moment. If I could have you turn to page 22 of the -- the package there of Exhibit 5. Are you -- are you familiar with the post that is captured on this page and the next page 23?

McElroy:

Yes.

Elias:

Do you know the -- the incident that it's refer -- or, are you familiar with the incident that it's referring to?

McElroy:

Yes, I have a running knowledge in regards to this, but I do know that at the time when the previous investigators were dealing with Mr. Fox's case we also had another file in domestic violence and criminal harassment unit in regards to an accused by the name -- can I?

Elias:

I don't need to hear the name of the other accused.

McElroy:

Another -- another accused.

Elias:

Yes.

McElroy:

And it was learnt that by mistake some disclosure meant for the other accused's file was sent to Mr. Fox by accident.

Elias:

And do you know when that mistake came to light?

McElroy:

I would -- didn't hear of it until after I had left the section. It wasn't until probably just the end of last year.

Judge:

So the end of 2022.

McElroy:

Twenty-two.

Elias:

And that's when you heard of it, okay. Just one moment. That's all I have for Exhibit 5 actually. Thank you. In your previous testimony you -- you mentioned that you saw Const -- or Analyst Meiklejohn pull up the website. Can you tell the court where that was physically, where that -- where those offices are?

McElroy:

Yes domestic violence criminal harassment unit is located on the 5th floor of 3585 Graveley Street, Vancouver, BC. Specifically Analyst Meiklejohn's computer is just in the cubicle beside where I sit.

Elias:

At the Graveley Street --

McElroy:

Yes.

Elias:

-- building. Got it. And have you -- have you checked to see if the website is online more recently?

McElroy:

I did check just late last week and it was -- the website is down and the URL name desicapuano dot com is available for purchase.

Elias:

Thank you.

Fox:

I'm sorry, can I -- I just want to make however that correctly. Did you say the domain desicapuano dot com or the domain desireecapuano dot com is available for purchase?

McElroy:

Desicapuano dot com on Go Daddy.

Fox:

Okay.

Elias:

Your Honour, those are all the Crown's questions for Sergeant McElroy.

Judge:

Okay, thank you. I think we'll take the morning break now. Come back please at 11:20 and that will be cross-examination of Sergeant McElroy by Mr. Fox.

Elias:

Thank you.

Sheriff:

Order in court.

(WITNESS STOOD DOWN)

(PROCEEDINGS ADJOURNED FOR MORNING RECESS)

(PROCEEDINGS RECONVENED)

Elias:

Your Honour, I see we are back on the record. We have Sergeant McElroy just outside for cross-examination by Mr. Fox. I think my colleague is just trying to help him with an IT question, or any questions [indiscernible]?

Fox:

Yes, but actually, I don't think it's really going to be Mr. -- I don't think I'm going to need him, because of what I just mentioned about if whatever they were accessing would have had to have been on the internal network. And so the fact that there are other cache copies of it on the internet are [indiscernible] because that wouldn't -- there's no way that that could have been what they were accessing, otherwise it would be in the logs. But before the witness does come in I do want to mention that based on what the witness has stated so far today I think it's extremely likely that I am going to request, or pursue a subpoena for Mr. Lam about -- to testify about these proxy logs and his emails with, is it Sergeant McElroy now, or detective?

Laker:

Sergeant. This is my suggestion, Your Honour. Let's -- so let's finish off with Sergeant McElroy.

Judge:

Oh yes, I think --

Laker:

And then Mr. Fox can cross-examine her. And then we are going to have Sergeant Shook come at 2:00 p.m.

Judge:

Okay.

Laker:

So depending on timing for this morning we can deal -- potentially deal with any of these other sort of unresolved issues --

Judge:

Right.

Laker:

-- if we have time. Otherwise we can deal with any possible applications by Mr. Fox concluding the voir dire two this afternoon. I do know that Sergeant Shook, he is only available -- I mean he can be here for longer, but his shift at the jail starts at 3:45. So his hope was that he would not be here for too much longer past 3:45, but hopefully we can deal with all of that as it comes up.

Judge:

Right, but he is working when he is giving testimony too.

Laker:

Yes.

Judge:

So we try and accommodate where possible, but --

Laker:

Yes, exactly.

Judge:

Okay. So why don't, Mr. Fox, you cross- examine Sergeant McElroy and then we'll see where -- where we are. I think voir dire number two should be completed if we have time this morning and then if you still want to apply to subpoena Mr. Lam then perhaps we'll have time for that this morning so that we can -- okay.

Fox:

Okay, thank you.

Judge:

So, Sergeant McElroy, you are still under affirmation and now I'm going to let Mr. Fox ask you questions he has in cross-examination.

McElroy:

Thank you, Your Honour.

AMBER MCELROY,

recalled, reminded.

CROSS-EXAMINATION BY THE ACCUSED:

Fox:

I would like to go back to what I was asking you earlier about when you tried to access the website from within the other room next to where I was being interviewed. And I believe that you had said that there some kind of error message, or denial of access message, or something that had come up and that you were quite confident that that message was generated by something within the VPD's network, not from something out on the internet; is that correct?

McElroy:

Yes, that is correct.

Fox:

Okay, can you explain to me how it is that you are so confident of that?

McElroy:

So again, I can't remember the exact content of the message but when I read it at the time I believed it was an internal message denying me access to that website. I believed that it was department specific because I knew that our analyst was able to access it and I had different internet permissions from our analyst.

Fox:

Okay. I'd like to present you with a document that you had obtained from -- from Johnny Lam, an IT person within the VPD. It's a -- the proxy logs that I showed you briefly before. And I have a few questions about that, that have arisen now from what you're saying about when you tried to access the website. And I wonder if this might be a good time to give a copy to the court so that the judge could follow along with what I'm asking.

Elias:

Yes, I don't have a court copy of the -- we don't have a court copy of the proxy logs yet, do we?

Judge:

No.

Fox:

No, they haven't been given to the court yet.

Elias:

Okay, let me get them. I think I have other copies here, let me just find it. Do you want the email as well at this point, or just the -- the proxy logs.

Fox:

Well, I really need to probably ask a question or two about the email.

Elias:

I apologize, Your Honour, I'm just going to see if I can find the document.

Judge:

No, that's fine. Do you need time to get the copies of that, or do you have copies?

Elias:

Perhaps it might be best to stand down and I can just print fresh copies rather than dig through my -- my files here. I think it --

Judge:

Okay. I won't go far, so I'll just wait for you to do that and then we can continue with the cross-examination.

Elias:

I'll try to be very quick. Thank you.

Sheriff:

Order in court. All rise.

(WITNESS STOOD DOWN)

(PROCEEDINGS STOOD DOWN)

(PROCEEDINGS RECONVENED)

Elias:

... giving me the time to find those. I'll pass Sergeant McElroy a copy and hand one up for the court to look as well of the document Mr. Fox requested.

Judge:

Thank you. Okay, so --

Fox:

I assume they have -- it has the emails first and then the proxy logs.

Elias:

Yes.

Fox:

Okay.

Judge:

So -- so this is a cover email from Johnny Lam to Amber McElroy and attached to it are the proxy server logs from May 16th, 2022; is that right?

Elias:

That is correct.

Judge:

Okay, and the date of the email is October 24th.

AMBER MCELROY,

recalled.

CROSS-EXAMINATION BY THE ACCUSED, CONTINUING:

Fox:

Okay so, Sergeant McElroy, I assume that these are documents that you are familiar with; is that correct?

McElroy:

That is correct.

Fox:

Okay, and can you confirm this document that we are describing as the proxy logs, the one that says re search near the top, is this the document that was emailed to you from Johnny Lam on October 24th, 2022?

McElroy:

Yes, it is.

Fox:

Okay. Is it your understanding that this is the log file from, or accessed log information from the VPD's proxy servers?

McElroy:

Yes.

Fox:

Okay and it's -- it is my understanding that you are saying, you're claiming, that when you tried to access the website the proxy server denied you access; is that correct?

McElroy:

Yes.

Fox:

Are you not aware that if -- if the proxy server, or in this case the Cisco proxy server that VPD uses, if it had denied you access to a website there would be a corresponding log in entry in the logs stating that access was denied? The question is are you aware of that?

McElroy:

No, I'm not aware what the proxy log would say, or not say in regards to that.

Fox:

Is it your understanding that Mr. Lam is an IT specialist, or IT professional with the VPD?

McElroy:

Yes.

Fox:

Okay, great. So, when you looked at this proxy log a few moments ago, and I realize that there's a lot of clusters of -- tough to read through, but did you see anything in there stating that access was denied? Well, actually first let me take a step back from that. Did you find a single entry in this proxy log referring to the domain name desicapuano dot com?

McElroy:

Yes, I can see it just by scanning in the first two entries.

Fox:

Okay, but let me ask you there. Is that actually referring to the domain name desicapuano dot com, or is that referring to the domain name desicapuano dot com dot site indices dot com?

McElroy:

So it does say site indices, but when I refer back to Johnny Lam's email what I look at -- at that to be is potentially different pages within the website. He is speaking to that in his email.

Fox:

Okay. I'd like to show you if I could what was marked as Exhibit number 6.

McElroy:

Okay.

Clerk:

I'll just provide a landscape Exhibit number 6.

Judge:

Thank you.

Fox:

And if you would be kind enough, please, to turn to page five.

Judge:

Give me a moment, Mr. Fox. I know I have that. I just want to get it out.

Fox:

Sure. And just to refresh everybody's memory this was -- these are some pages that Ms. Meiklejohn had accessed using the Hunchly software on -- well, various days. The one we're going to look at here was accessed on May 3rd, 2022.

Judge:

Thank you, I have it. So you're looking at the first page then with that date?

Fox:

Oh, no. So well, page five of that exhibit.

Judge:

Page five, thank you.

Fox:

So, Sergeant McElroy, looking at page five, would you agree that what follows is going to be the web page that was accessed at desicapuano dot com dot site indices dot com on May 3rd of 2022?

McElroy:

On page five it does look like that's what the URL is at the top, yes.

Fox:

Right, and to be clear, my understanding from Ms. McElroy's testimony is that what we see on page five here is information that was generated by the Hunchly software when she accessed the following web page.

McElroy:

So -- and I can't speak -- I know -- and also Meiklejohn was here speaking to this, but my understanding is that Hunchly just helps her capture the images off the website. It's not actually a search software. She is still accessing the internet directly and she's using Hunchly to capture.

Fox:

Yes, that is correct.

McElroy:

Okay.

Fox:

So if you would turn to the next page, please. And you should see a printout from a website. And at the top it says, "Site indices"?

McElroy:

Mm-hmm.

Fox:

So do you agree that that page all the way through to -- sorry, let me find the end of it here, to page ten. So pages six through page ten, do you agree that that is what desicapuano dot com dot site indices dot com refers to?

McElroy:

On May 3rd, yes it looks like that's what it refers to.

Fox:

Okay. Is it your understanding that what we are looking at right now, that web page has anything at all to do with the website that this whole case is about, the desicapuano dot com website?

McElroy:

No, it doesn't look to be except under the toenail on page six it does say desicapuano dot com in the print. And then if you were to flip to page seven it does -- under title it has her name as well as some of the words that were used on desicapuano dot com to describe her. So it seems to be a bit of a mix of a website and I don't know what this other stuff is.

Fox:

Okay, are you familiar with what an analytics website is?

McElroy:

No.

Fox:

Okay, what we've already heard from Ms. Meiklejohn about citing "Indices dot com" actually being an analytics website. But I just want to make sure of your understanding of what we're looking at here. So is this, or is this not the website that I originally created etc. that was recently accessible through desicapuano dot com, or is this some other website?

McElroy:

So, on May 3rd I know that it was still password protected at that time.

Fox:

I'm --

McElroy:

So analyst Meiklejohn was able to -- on May 3rd, sorry was the date she's captured it.

Fox:

No, I'm sorry though, but are you saying that site indices dot com was password protected on May 3rd?

McElroy:

No, I'm saying that analyst Meiklejohn was tasked with getting screen captures from desicapuano dot com and at this time, on this date, the website was still password protected and this is the information she was able to pull using her system.

Fox:

Sure.

McElroy:

And I don't know exactly how she accesses everything, but this is the information she provided on that date. This isn't what the website looked like on the day of your arrest.

Fox:

Yes, that's all fine and swell, but what I'm leading to, what I'm trying to get at here is to determine whether desicapuano dot com dot site indices dot com is actually a completely separate independent website that has absolutely nothing to do with the website that was located at desicapuano dot com?

McElroy:

Mm-hmm.

Fox:

Is this a separate different website, or are you suggesting that maybe this is actually part of the same website?

McElroy:

I think perhaps we should look at the screen captures from the date that these proxy logs reference. Maybe we'll have a bit more information.

Fox:

Well, unfortunately, there are no captures from desicapuano dot com dot site indices dot com that were provided, or disclosed to me on the day of May 16th.

McElroy:

So if we look at the proxy logs, Mr. Fox --

Fox:

Yes.

McElroy:

-- we'll see that earlier that morning prior to us making the decision to arrest you that day there were searches done at 6:00 a.m. and again at 7:00 a.m. and those were done by Analyst Meiklejohn and she provided screen captures from those searches, which I believe we do have here.

Fox:

Okay. So to make sure I'm understanding this correctly you are saying that at 6:14 a.m. and approximately seven something a.m. Ms. Meiklejohn had accessed the website and provided some screen captures which I assume would be in Exhibit 5?

McElroy:

I apologize. I don't know the exhibit number. I was looking at it earlier.

Elias:

Yes, Exhibit five.

Judge:

Yes, it is Exhibit five.

Laker:

If I -- I just -- if I could just have a moment. I may object to this question, but I just want to confer --

Judge:

Yes, okay.

Laker:

-- with my colleague for the time being.

Judge:

Yes.

Laker:

Okay, I have no objection. Thank you.

Clerk:

Is it Exhibit five, Your Honour.

Fox:

Yes, please.

Judge:

Oh, yes.

McElroy:

Thank you.

Fox:

So in four of each of the pages that was printed out and included in Exhibit five there's another one of those Hunchly reports where it shows the URL and the date the page was accessed. Could you please tell me which one of those pages was accessed at 6:00 or 7:00 a.m.?

McElroy:

I couldn't -- I couldn't say. I know that they were captured later in the day. I don't know how the analyst saves the data, or where she puts it.

Fox:

Okay. Well, from a quick look at these it looks like they were all -- according to the Hunchly reports it looks like they were all accessed around 9:20 to 9:30 a.m. approximately?

McElroy:

Mm-hmm. Yeah, it looks like that on the front pages. Again, I don't know if that is when they were taken off the website, or that's just when they were printed from the Hunchly program. I can't speak to that. I can see that the proxy logs don't show access around that time --

Fox:

Right.

McElroy:

-- but I know that I was present in the office when Analyst Meiklejohn accessed the website and these are the pages that I saw over her shoulder -- shoulder looking at her computer.

Fox:

Okay and we'll explore that further in just a moment, but first I'd like to go back to the proxy log. So in the fourteen entries that were found that did contain the string desicapuano dot com in the 48 hours from May 16th and May 17th, are there any that you find in there that do not refer to desicapuano dot com dot site indices dot com?

McElroy:

Yes. On the second page at 2:22:51 p.m. it says desicapuano dot com dot ICO.

Fox:

Yes?

McElroy:

And in addition below that it also says desicapuano dot com dot ICO which kind of -- which would correspond around the time that I was searching for your website.

Fox:

Okay, and there is actually one more dot ICO on the next page as well?

McElroy:

Yes, I do see that.

Fox:

Are you familiar with what a dot ICO file is?

McElroy:

I'm not.

Fox:

Are you aware that a dot ICO file is used to indicate an icon file?

McElroy:

I don't know what it is, so I can't comment on whether or not I know that to be true.

Fox:

Okay. Do you agree that in these particular instances here the three with the dot ICO on the end, it's -- sorry, the URL that is referenced here is desicapuano dot com dot ICO, not desicapuano dot com. Do you agree with that, or?

McElroy:

Again, I don't a hundred percent understand the computer language here.

Fox:

Right.

McElroy:

All I can say is that I accessed a computer around the time that's indicated in this proxy log that I was provided by IT showing that an attempt was made.

Fox:

Okay.

McElroy:

And I did not type that ICO or site industry -- indices. I just typed desicapuano dot com.

Fox:

Okay, and if you would look in the entry that is at -- on the -- on H-2 there's three entries. The entry in the middle that refers to desicapuano dot com dot ICO, in there there's a -- sorry, I'm looking for it.

Judge:

Sorry, are you on page two of five, or three of five?

Fox:

Two of five.

Judge:

Two of five, thank you.

Fox:

I'm looking for a particular field within that cluster of information but for some reason I'm having difficulty seeing it. Oh, here it is. Okay. One, two, three -- so the fourth line from the top of that block at the end it says Len, L-e- n. And then --

McElroy:

I see it.

Fox:

And then continued onto the next line, g-t-h. So it's the word length. And then within square brackets 780 B meaning bites.

McElroy:

Yes, I see that.

Fox:

Would it be your understanding that that refers to the length, or the size of the particular file that was returned?

McElroy:

I have no understanding. I can't comment on that.

Fox:

Sure. Okay, but you do say that you had typed in desicapuano dot com in the address bar and you were able to pull up the website, correct -- or sorry, no. You received some response, an error message, or something from VPD's network?

McElroy:

Yes.

Fox:

Can you explain then why it is that there's no corresponding denial of access log entry in here?

McElroy:

I -- I can't explain it other than the fact that's the time that I ran the website. I specifically in my request to IT told them that I had been interviewing you at the time and that the request from Crown was to obtain evidence that I had searched the website. They provided proxy logs for the whole day and indicated that my -- my search would have been within these parameters. I have narrowed down to the timing and I believe these two timings, these are the two attempts that I made to access the website.

Fox:

I believe that it is entirely reasonable to say that at 2:25 p.m. those few entries there would correspond to what you did, attempts to access at that time. But I would suggest to you that what you attempted to access, or what you possibly even did access was the page that we just looked at which was desicapuano dot com dot site indices dot com, not actually the website?

McElroy:

Again, the URL I typed was desicapuano dot com. I do have internet access although it's more limited than what our analysts does have. But apparently this website is not on the list of things I am allowed to view.

Fox:

So is it your understanding that you can only access websites that you are explicitly authorized by the proxy server to access?

McElroy:

So there are two levels of internet access within the department and not everyone is provided internet access. It has to be applied for. And in the detective position I was allowed to get internet access after application and for most members it's a basic level of internet access which doesn't include access to social media, things like that. Our analyst has full access as you would access the internet from your home because she needs to do open source searches as part of our investigations. Up until that moment I didn't realize that desicapuano was one of the websites I was blocked from. I learned it in that moment and that's why I wasn't able to provide that information.

Fox:

Do you know if you are blocked from site indices dot com?

McElroy:

I have never tried to search site indices dot com.

Fox:

But going to the proxy logs you did. According to the proxy logs there were I guess nine accesses to site indices dot com on that day?

McElroy:

But my searches say dot ICO which you said means icon, which doesn't say site indices.

Fox:

Right. The reason -- well, I could explain these dot ICOs but it would be a technical explanation, so I'll save that discussion for when hopefully Mr. Lam testifies because it would be pointless and meaningless and because I'm not testifying at this point, so. Okay, I would like to move on. Earlier when the Crown was asking you some questions there was mention of my phone being searched and my tablet as well. Do you know, was my tablet searched?

McElroy:

Actually, I believe it was, but I don't know for sure. I wasn't part of the -- the domestic violence unit at the time.

Fox:

Okay, are you aware that the search warrant that you were looking at earlier that is listed as Exhibit 10 states in here that these --

Laker:

Sorry, if the witness could just be provided with it. That would be great.

Fox:

Oh, sure.

Judge:

That was Exhibit 10, I believe.

Clerk:

Exhibit 10, Your Honour.

Judge:

Yes.

McElroy:

Thank you.

Fox:

So on page three, right above where it says "Issued by"?

McElroy:

Yes.

Fox:

There's a two line paragraph there. And it starts with "And to search the cellular phone for things that" etc. So, doesn't that mean that only the cellular phone was authorized to be searched?

McElroy:

It does. Under the things to be searched there's a list of six exhibits. The cellular phone is part of that. But yes, in that line it is misleading because we were searching six exhibits not just the cellular phone.

Fox:

But in the six exhibits, the list of the six exhibits, that paragraph doesn't actually say -- state that it's giving authorization to search those. That paragraph just says that there's reasonable grounds for believing that those following items -- well, I guess it's not really critical if the tablet hasn't been searched. Anything if the tablet was searched nothing from the tablet is being used at the trial. So I guess it's not really too important. So we can move on from there.

McElroy:

Okay.

Fox:

In the course of your investigation have you been in contact with Desiree Capuano, or the person known to be Desiree Capuano, I should say?

McElroy:

Not as part of the investigation, but as a complainant victim safety measure, yes I have been in contact with her.

Fox:

Okay, and when you had been in contact with her did she express any concern about the website?

Laker:

Your Honour, I am going to object to this question. I just don't see what the relevance is.

Judge:

I don't see the relevance.

Fox:

Okay, maybe we'll come back to that after when -- when the relevance becomes more clear. Do you happen to have a copy of your notes with you?

McElroy:

Yes, I do.

Fox:

So I have a question which I believe is definitely relevant. It has to do with the allegation that I failed to report. And so in your notes, I don't know how I could turn you to the appropriate spot because it seems that your notes span multiple notebooks and they're not all together. The one that says 135 at the top from October 12th.

Laker:

Yes, it appears the notation from October 12th of 2022 --

McElroy:

Do I have permission to --

Judge:

Yes, yes. You can look at your notes, Sergeant McElroy.

Fox:

Oh, I think I'm looking at the wrong one.

McElroy:

I do have it.

Fox:

Sorry, I was looking at the wrong note. Yes, so a note from May 4th, 2022.

Laker:

Is -- is the reference on page three.

Judge:

Notes from May 4th, 2022; is that correct?

Fox:

Yes.

Laker:

Yes, and I may have a copy.

McElroy:

Apologies, Your Honour, I have a photocopy of those notes. I don't have that original notebook with me.

Judge:

All right. So maybe perhaps you can compare what Mr. Fox wants to ask you about, because I'm sure he has a photocopy as well from disclosure. And as long as you are both on the same page, so to speak, that's -- that will work.

Fox:

This entry, yeah.

Laker:

Yes.

McElroy:

Thank you.

Fox:

So that entry dated May 4th, '22, did you -- did you write that?

McElroy:

I did.

Fox:

Okay, and does that refer to some -- a statement made by Probation Officer Trimis?

McElroy:

Yes, there was a phone conversation.

Fox:

Does that mean that that phone conversation occurred on May 4th?

McElroy:

Yes.

Fox:

And can you tell me, did he say to you that I had said, "I didn't take any steps because it has been taken down"?

McElroy:

So the information that I had received is that you had shown up at the probation office and your regular probation officer PO Trimis wasn't present. So the person there had redirected you to reattend on April 21st and that's basically what that -- that is, that you didn't go on April twenty -- 21st.

Fox:

Well, but what is written here in your handwriting and it's in quotation marks says, "I didn't take any steps because it has been taken down". Since that's in quotation marks I took that to mean, or I understand that to mean that that is what Mr. Trimis had said to you that I had said I guess to the Probation Officer Seath when I reported to her on the 19th?

McElroy:

Yes. That was the -- that was the statement they provided.

Fox:

Okay. So on May 4th, 2022 he did tell you that I did state that to some probation officer, correct?

McElroy:

That is correct.

Fox:

And is it your understanding that the probation condition required me to inform -- or sorry, to report to a probation officer to inform them of the exact steps I had taken to ensure the website was no longer available?

Laker:

Your Honour, I am going to object to this question. So I'll just -- because what this officer's interpretation of his reporting condition isn't necessarily relevant at this time. That that particular breach allegation is one that is directed through Community Corrections, not the police, and was -- and in my view asking this officer about her interpretation simply doesn't assist the court in any way with regards to that particular count.

Judge:

Okay. So, it is the case that Sergeant McElroy couldn't give a legal opinion, or a conclusion about what that probation term means, but I'm just wanting to understand if you would, Mr. Fox, for you the relevance of the question. And it maybe we should ask Sergeant McElroy to step outside just for a minute just so I can make sure that, in fact, you won't be asked to answer this question, or not.

Fox:

But -- but actually, I can forego the question because as I consider it more, as I think about it more, I realize that there was a warrant for my arrest issued on that count. And so she really had no discretion in whether or not to make any recommendations of charges because it was already --

Judge:

Okay. If you -- if you are content to leave the question, that's fine. That also addresses -- solves the question whatsoever.

Fox:

So moving on then. I would now like to present the witness with the C-log entries from the probation department which were Exhibit 4. I have a question about an entry in here.

Clerk:

Exhibit 4, Your Honour.

Judge:

Okay, thank you.

Fox:

There was an entry, and I realize you didn't make these entries so your knowledge of this might be somewhat limited. But on the second page, page two of four, the first full entry, or the second entry, the one that says "2022-04-20" at the time "13:52:40"?

McElroy:

Yes.

Fox:

In there Mr. Trimis discusses, or describes a conversation he had had with Detective Dent regarding the -- the website and this issue of having a password. So according to what is in here I get the impression from what Mr. Trimis is saying that VPD's position on the website having a password was that as far as they are concerned I have met the condition and you're not going to pursue that matter any further. Was -- is that your understanding?

McElroy:

So I've never seen this before and I wasn't part of that investigation. What I can say is Detective Dent was the lead investigator on your previous incident and he has never been assigned as lead investigator on this file. So I can't speak to the conversation that he may have had with your probation officer. That was not -- once I took lead and conduct of the file which was right from the get-go I didn't know this conversation was happening and I wasn't privy to this decision because I was in separate conversations with Crown and my management.

Fox:

Okay, and do you have any conversations with the cyber crimes unit?

McElroy:

Subsequent to searching your phone I had a conversation with cyber crime unit, but it's not in regards to what this note is about.

Fox:

Okay, and my apologies. I probably should have asked Detective Dent about this when he was testifying. So we'll move on from there.

McElroy:

And just to be clear, so that's not the VPD position. That might have been a conversation that he had, but that's not what our position was on this investigation.

Fox:

Sorry, there are some questions that I think that I might want to ask. It's just that until we hear from somebody who knows about the proxy logs, for example Mr. Lam, I don't really know that -- that I can go any further with that. Let me ask you, Sergeant. The -- the website. So it's my understanding from what a number of people have testified that there was a period of time where the website required a password, or PR anyways. Require a password to access what was on there. Are you familiar -- familiar with that?

McElroy:

Yes.

Fox:

Okay, and can you tell me, what caused that to change? Like what -- what happened on the web server that caused it to start prompting for a password?

McElroy:

I don't have control of the website. I imagine whoever has control of the website would be able to make those changes.

Fox:

If whoever had control of the website had deleted the -- sorry, I was about to get into some technical stuff and then I realized that I'd probably be speaking of things that people wouldn't have knowledge of. That's why I stopped. If whoever had access to the website had deleted all of the content from the directory on the server that the Apache web server looks for to find the content they get to display. If they had deleted that entire directory would the web server then have prompted for a password?

McElroy:

I can't speak to that.

Fox:

Okay, so is it fair to say then that you don't actually know. Like the fact that it was asking for a password, you don't know whether or not the website was even still there. I mean, are you saying then that as far as you know somebody could have gone onto the website's -- the server, deleted all of the content thereby deleting the website and that could have caused the Apache server, Apache being the software product, to prompt anybody who goes, or who tries to access the website for a password?

McElroy:

I can't speak to that. All I can say is that when our analyst searched the website when it was password protected, there were still bread crumbs and information from the website that she was able to access through Google searches. And as you can see on the site indices pages which reference the website. We couldn't say and that's what discussed in our interview. We couldn't say whether there is anything behind the password, or not behind password because we did not have access to it until the weekend before your arrest.

Fox:

In -- in the interview when you interviewed me you did make a statement that the website still shows up in Google; is that correct? Do you remember saying that?

McElroy:

I do.

Fox:

Okay, so there is here -- in Exhibit 6 there is some Google search results.

Judge:

Just a minute. Exhibit 6.

Fox:

Yes.

Judge:

Let me just get that. And do you have that, Sergeant McElroy, in front of you still?

McElroy:

I do. Yes, thank you.

Judge:

Okay.

Fox:

So it appears that this was captured on May 3rd, 2022 and it shows that you were on there. So it was a Google search for the literal string desicapuano dot com. Do you agree with that?

McElroy:

Yes, I do. Okay.

Judge:

Sorry, I just want to make sure I'm following you. On page one?

McElroy:

Page two.

Fox:

Sorry the first page was the Hunchly report and then --

McElroy:

Oh, sorry, page two.

Judge:

Page two?

Fox:

Yes, page two is the actual Google search results that were printed out.

Judge:

Right, thank you.

Fox:

Can you tell me, or can you tell me where in those search results there is anything at all that refers to the website desicapuano dot com? And when I say refers to, I mean that would be a link to the website, or that would be content on the website desicapuano dot com?

McElroy:

I don't see a direct link from the Google search, no. But I do see the website and I see information that is from the website listed in the Google search.

Fox:

I'm sorry, you say that you see the website and the information from the website. Which entry are you referring to?

McElroy:

If you look at the first entry it has desicapuano dot com.

Fox:

Yes.

McElroy:

And then dates that site indices dot com.

Fox:

Yes.

McElroy:

So it has the website URL within there. And then it has some information that is also on the website, or had previously been on the website listed, "Her the drug addict child abuse of".

Fox:

Right, but isn't that the third party website that just gathers information about other websites and just compiles them and -- otherwise known as an analytics website? Like that -- that website site indices dot com is not part of desicapuano dot com. It has got nothing at all to do with desicapuano dot come?

McElroy:

Oh, I understand, but what I explained to you in the interview was that when we searched that desicapuano dot com, as you can see in the Google search box information from your website cropped up. And that's what this --

Fox:

Information from the website, okay. Okay, would you agree with me that's kind of like saying that if there is a picture, a photograph of Ms. Capuano that was on the website, but that photograph also appears as say in her Facebook timeline and does that mean that I'm responsible for that? Like it's a third party. It's got nothing to do with me.

McElroy:

Well, this isn't -- this isn't the issue, that you're not charging -- you are not being with having content on the website that's no longer accessible with this search specifically. The issue is we typed in desicapuano dot com and it came up password protected. In addition to that, we were able to also get this information. This is not a standalone evidence. This is in addition to a password protected website. We also were able to retrieve this information and then subsequently the website became live and then we could capture that information.

Fox:

Okay.

McElroy:

This is -- just compliments what the analyst was able to come up with once we started searching your website.

Fox:

And when you say searching the website do you mean searching for the website?

McElroy:

Searching desicapuano dot com.

Fox:

Okay. A number of times you have used the term password protected when referring to the website and that there was some period of time where it was prompting for a password. What do you mean by protected?

McElroy:

So if you refer to the same book on page 17 it will give you an example of what the screen did say when we searched desicapuano dot com. It would come up prompting for a user name and a password and this is what I mean when I say password protected.

Fox:

Okay. So you don't really mean protected. You don't mean that there was something there that there was a password and the purpose of the password was to protect some data?

McElroy:

No, I can't -- I couldn't speak to what was potentially behind this. Whether the website was up and live at this point if you had a password, or if there was nothing there. I have no idea because I did not have access.

Fox:

Right, okay. All right, so I'm just about done. I just want to clarify a couple of points which would be like two minutes to make sure that I'm understanding everything correctly here. So it's my understanding that what you're saying is that the times when the website appeared to be prompting for a password, you have no knowledge of whether or not the website was actually -- was actually there?

McElroy:

That is correct.

Fox:

Okay, and you are saying that on May 16th, 2022 Ms. Meiklejohn accessed what appeared to be the website using the URL WWW dot desicapuano dot com and you were present and you observed her doing that; is that correct?

McElroy:

That is correct.

Fox:

Okay. However, nothing comes up in the proxy logs in that 48 -- 48 hour period showing that anybody ever made any attempt to access that domain?

McElroy:

If what you're saying, and you're reading the proxy logs correct --

Fox:

Yes.

McElroy:

I mean, that's what you're saying. I can't speak to whether that is correct, or not correct.

Fox:

Okay. All right, I don't believe that I could have any further questions at this time for the witness.

Judge:

Okay, but before I ask if Crown wants to re-examine you know, you've mentioned that maybe you will have some further questions for Sergeant McElroy. Generally, I think you're aware that's not how it works.

Fox:

Right.

Judge:

There is a possibility to apply to recall a witness, but it's pretty exceptional and there has to be a compelling reason to do that. So I just want to make sure you are aware of that. If you think you might have any more questions for Sergeant McElroy now?

Fox:

Okay yes, let me -- let me just ask one or two more. When -- when you observed Ms. Meiklejohn access what appeared to be the website, what steps did you take to confirm, or you, or Ms. Meiklejohn, or anyone else for that matter, what steps were taken to confirm that the domain name desicapuano dot com that she was entering was actually resolving to an IP address of, for example, a Go Daddy server where the website was supposedly hosted and not some internal server, or internal computer on VPD's network?

McElroy:

I had no reason to believe that Analyst Meiklejohn's computer was acting faulty. That there was any issue, or problems with it. She, as a course of her job, accessed the internet throughout her day accessing social media networks, different websites, gathers information for us. There was no indication that there was anything wrong with any of her searches that she conducted that day, nor the day prior.

Fox:

Okay, does that mean then that you have taken no steps, or to the best of your knowledge, nobody in VPD had taken any steps to confirm what IP address that domain name was resulting to at that time?

McElroy:

No, I didn't look into the IP address. I had no reason to be believe that it wasn't accessing the internet that we all use.

Fox:

Right. Okay, I don't have any further questions at this time at all. Thank you.

Judge:

Okay. Okay, thank you, Mr. Fox. Any re- examination for Sergeant McElroy?

Elias:

No, Your Honour.

Judge:

Okay. So we are almost at 12:30. We'll break now. Sergeant McElroy is excused. Come back at 2:00 and perhaps either for Sergeant Shook, or perhaps to address the -- the two issues, the ruling on voir dire number two and whether or not Mr. Lam -- whether Mr. Fox is going to request that he come as a witness.

Judge:

All right. So returning at 2:00 p.m.

(WITNESS EXCUSED)

Sheriff:

Order in court. All rise.

(PROCEEDINGS ADJOURNED FOR NOON RECESS)

(PROCEEDINGS RECONVENED)

Judge:

. . . the email and the proxy server log, Mr. Fox, what would you --

Fox:

Oh, sorry.

Judge:

-- like to do with it?

Fox:

I believe that, especially the proxy server logs are going to be extremely critical to my defence. But I'm pretty sure they're probably going to require somebody like Mr. Lam to provide testimony about the exact contents of them.

Judge:

Sure. But Sergeant McElroy was able to identify them, to the extent that she received them, this is the email she received from Mr. Lam.

Fox:

I --

Judge:

The -- the meaning or the interpretation you may require something further, but I believe you could ask that these be marked as an exhibit now.

Fox:

I --

Judge:

Does Crown have any objection to that?

Fox:

I would very much like to ask that these be marked as an exhibit.

Elias:

No objection from us, Your Honour.

Judge:

Okay. I think the authentication hurdle, I think, has been what needs to be, as to they are what they purport to be. Right. So they'll be the next exhibit, Exhibit 12?

Clerk:

Yes, Your Honour.

Judge:

Exhibit 12. And then we'll break for lunch. Thank you.

EXHIBIT 12: Copies of proxy logs and emails - seven pages

Sheriff:

Order in court.

(PROCEEDINGS ADJOURNED)

(PROCEEDINGS RECONVENED)

Laker:

Yes, Your Honour. Laker, initial T., for the Crown, and I'm here with my colleague Mr. Elias, and Mr. Fox is present, and we can continue to deal with the Fox matter.

Sergeant Shook is here, and my suggestion is that we deal with his evidence and then deal with those last remaining issues following his evidence. Does that -- would that work for Your Honour?

Judge:

I was thinking about that over lunch, and I think it may, and -- and here's why? I was thinking, Mr. Fox, maybe, once you have an opportunity to cross-examine Sergeant Shook you may find, I'm not sure, but you may find that he can answer some of the questions that you had. So in that sense, from a practical perspective, it made some sense to me to wait, let him testify, let you cross-examine him and then see if you still wanted to apply to subpoena Mr. Lam.

Laker:

Mm-hmm.

Judge:

You're nodding yes. You think that makes sense?

Fox:

Yes, that makes sense, but I'm quite, quite confident that he's not going to have the expert knowledge of the proxy logs.

Judge:

Okay. That may be so, but just in case, let's -- let's go ahead with him and then deal with the issues that remain after -- after his testimony is done.

Laker:

Yes. And just for the court's benefit, I will be asking that Mr. -- Sergeant Shook is qualified as an expert. So I was just explaining to Mr. Fox that we would have to enter into a voir dire for the purposes of -- of that.

Judge:

Right.

Laker:

And -- and I don't believe Mr. Fox takes issue with Sergeant Shook's qualifications, but just for the purposes of making sure that do everything procedurally correct, I think we should still embark on that.

Judge:

Yes.

Laker:

Okay.

Judge:

That's fine. You know, this happens routinely, a voir dire is declared when an expert's qualifications are put before the court. The opposing side is asked if they have any questions in cross-examination on the qualifications; they may, or they may say, no, I don't have any, and then the Crown seeks to have the person qualified on the basis of what they've put before the court and then outline the areas of expertise so that everyone is aware of what -- what the sphere of expertise upon which the expert's going to testify.

Fox:

Okay. Thank you.

Judge:

Okay.

Elias:

I'll just get [indiscernible]

Laker:

And he'll affirm.

Clerk:

Thank you, Your Honour. [Indiscernible/away from microphone], Your Honour, would you like to declare the voir dire now?

Judge:

Yes. Declaring voir dire number 5, here, with respect to Sergeant Shook's qualifications.

And Sergeant Shook, do you prefer to affirm or swear?

Shook:

Affirm, please.

Judge:

Thank you.

ROBIN SHOOK

a witness called for the
Crown, affirmed.

Clerk:

Please state your full name and your rank, and spell your surname for the record.

Shook:

Robin Shook, Sergeant. Spelled S-h-o-o-k.

Clerk:

And your badge number, please?

Shook:

2536, the Vancouver Police Department

Judge:

Thank you, Sergeant Shook. Can have a seat, remain standing as you prefer.

Clerk:

Thank you, My Lady. Sorry.

Laker:

And yes, Your Honour, the Crown is going to be seeking to qualify Sergeant Shook as an expert in digital forensics, including the forensic analysis of digital devices, which includes the identification, preservation, extraction and interpretation of digital evidence.

Judge:

Would you happen to have typed that out for me?

Laker:

I -- I believe it's included in Sergeant Shook's curriculum vitae. What -- what I understand, I just confirmed with Mr. Fox that he has a copy of it, and I will provide Your Honour with a copy and a copy to be marked as an exhibit. And . . .

Judge:

Thank you. Okay. If it isn't written anywhere, I'm just going to ask you to slowly repeat it.

Laker:

Yes. If Your Honour looks at page 14 of Sergeant Shook's curriculum vitae, he discusses his expert qualifications that --

Judge:

Yes.

Laker:

-- previously in court. So what I've sought him to be qualified as an expert in is -- is identical to that in Regina, I'm thinking, not Rex yet, Regina v. Gill [phonetic] from 2022.

Judge:

Okay.

Laker:

Where he was qualified as an expert in digital forensics, including the forensic analysis of digital devices, including the identification, preservation, extraction, and interpretation of digital evidence.

Judge:

Right. Thank you. And then the CD, you're asking that it be marked as the first exhibit on voir dire #5?

Laker:

Yes, please. Thank you.

Judge:

Okay. Curriculum vitae Exhibit A on voir dire #5.

Clerk:

Thank you, Your Honour.

Laker:

And could we please hand that to Sergeant Shook when Madam Clerk's ready.

Shook:

Thank you.

EXHIBIT A (on voir dire #5): Curriculum Vitae of Sergeant Robin Shook - 16 pages

EXAMINATION IN CHIEF ON VOIR DIRE #5 BY CNSL T. LAKER:

Laker:

And Sergeant Shook, you've indicated that you're a member with Vancouver Police Department?

Shook:

Yes.

Laker:

And how long have you worked there for?

Shook:

Since 2005, which would make it 18 years.

Laker:

And you've been handed a document. Do you recognize that as your up-to-date curriculum vitae?

Shook:

Yes. This is the version of January 8, 2023. There's some stuff that has slightly changed but it is the version that was current when I provided it to you last.

Laker:

And what has changed?

Shook:

Two weeks ago I was qualified as an expert in another matter in the Supreme Court of B.C., and that's not in this CV.

Laker:

What was the name of that case?

Shook:

Regina versus Siangio or Shongio [phonetic]. It's -- there's another citation which is an Ottawa version of the same trial. This is just a Vancouver. If you look at page 14, it's the same last name as the bottom entry.

Laker:

Ah, yes.

Shook:

Except this is a Vancouver matter and that was an Ottawa matter.

Laker:

Okay. And other than your -- you being qualified as an expert in that case, your -- your CV is up to date?

Shook:

Yes, that's correct, ma'am.

Laker:

Thank you. And at page 1 you've set out your past and current employment, and you've indicated that you were -- you've been with the Vancouver Police Department since 2005. I note here, on the last paragraph of page 1, you've indicated your experience in the digital forensic unit. Can you just elaborate on that a little bit more?

Shook:

Yes. In the six years in which I was a member of the digital forensics unit, I conducted forensic examinations on digital devices and digital data, which would include in-depth analysis of data from things like cell phones, laptop computers, tablets, as well as data from internet sources, including websites and server logs.

Laker:

And you've set out the training that you received to -- to perform in that area of employment, from pages 2 to 11. And I noted that that has occurred over the past decade.

Shook:

Mm-hmm.

Laker:

From 2011 to 2022; is that correct?

Shook:

Yes, that's correct.

Laker:

And what I'll do is I'll allow Her Honour to just quickly review that. I don't intend on going through all of that --

Shook:

Mm-hmm.

Laker:

-- in detail with you, sergeant, today. But perhaps you could just highlight a couple of things from this relevant police training that relate to your qualifications as an expert in digital forensics.

Shook:

Okay. The -- as part of the digital forensics unit there are two main fundamental baseline courses in which an examiner would obtain that kind of set the baseline level of knowledge and expertise as far as police forensic examination in Canada. So the first one I'll draw Your Honour's attention to is on page 9, at the top of the page, the computer forensic examiner course at the Canadian Police College in Ottawa. That is a three-week course that is kind of the base level knowledge base and testing for any forensic examiner -- police forensic examiner in Canada, so that goes from the base level knowledge to doing a lot of processes manually, such as reviewing file systems and how data is stored on devices, and kind of provides that level of standardization of knowledge for police departments and forensic examiners in Canada. So that is kind of the first real stepping stone in which an examiner can examine computers and mobile -- mobile devices and storage medium, such as a USB drive or removable hard drive.

The next significant one would be another Canadian Police College course, which is highlighted on page 7, right in the middle of the page, the mobile device acquisition and analysis course. And this is also the Canadian Police College in Ottawa. It's a two-week course which further builds on the computer forensic course but is more tailored to mobile devices, primarily cell phones, as that is what the vast majority of examinations are now based upon. So those are the two baseline courses for forensic examiners in the police world in Canada to have. That's kind of the standardization. The -- the knowledge on how examinations are done, what relevant caselaw there is in Canada at that time, how examinations are done with best practices across the agreed-upon standards in forensic units in Canada, and then we go to all of the other courses that you see.

So the thing with technology, as I'm sure Your Honour is well aware, is it's constantly changing. So every time a company releases a new device of a device updates, there's a new iPhone or a new operating system, or different types of technologies. For example, drones are now fairly ubiquitous when they weren't when I started. There are courses to each us, as a forensic examiner, how to get the data from that device and then how to interpret and process that device to make it -- that data to make it something that is just entries in a database to actually having real world -- real world meaning within a courtroom.

So because there is -- I think there was 11 pages of courses, that is why there's so many, because it's constantly evolving and constantly changing from year on year. So the two baseline ones were the Canadian Police College courses, and then everything subsequent is just further knowledge and experience and -- and getting to know what new devices are coming out, kind of like an update, like a caselaw update, what's happening and how police departments are then able to get data from the newer generation of devices. There are a lot of them. I think -- I think it was something like a hundred and eighty days in courses I did in the six years I was there, something -- something like that. So was a lot of -- lot of updated training just to remain relevant and have the ability to -- to stay current with the new trends and new devices.

Laker:

And I see that you've received training to deal with Android devices, for instance, at page 6, in 2017. There is a -- a course entitled, Access Data Android Forensic Analysis.

Shook:

Yes.

Laker:

And so you're familiar with Android devices and examining -- examining material that's -- that's obtained from that device?

Shook:

Yes, that's correct.

Laker:

And with regards to your prior court experience, you've already alluded to the fact that you have recently been found to be an expert in -- in this particular area. I note that you referenced a number of other cases, on pages 14 and 15, where you have been found to be an expert as well?

Shook:

Yes.

Laker:

And that includes courts both here in British Columbia and, as you had noted, in 2022 you were also found to be an expert in the Ontario Court of Justice?

Shook:

Yes.

Laker:

Your Honour, that -- those are all the questions that I propose to have for Sergeant Shook on -- on this voir dire. I don't know if Mr. Fox has any questions for him with regards to his qualifications.

Fox:

I have no questions for him with regards to his qualifications as they've been stated in his resume or thus far. There -- there are going to be questions that are going to come up in cross-examination, though, that will relate to his expertise or competence in certain specific areas.

Judge:

Okay, but I -- the specific question before me now is whether my next step is to qualify Sergeant Shook as an expert in the areas that Crown is seeking to have him qualified in and . . .

Fox:

Yes. And I apologize. The reason -- the reason that my response was so vaguely stated, I guess, is I'm not a hundred per cent clear on the scope that the Crown is seeking to qualify him as an expert. Because, for example, she had brought up his knowledge of Android systems. But does that mean that -- that the witness is an expert in, for example, the system files that the Android devices maintain, or . . . I -- well, I -- I would say at this point I have no questions or concerns --

Judge:

So if you just --

Fox:

-- about qualifying him as a . . .

Judge:

Have you got the curriculum vitae in front of you?

Fox:

I do.

Judge:

Okay, so just -- just have a look at the -- page 14, underneath Regina versus Gill, because that's what Crown is seeking at this point, just that I qualify Sergeant Shook as an expert in that.

Fox:

Yes. To a lay person that might make significant sense, but to a very technical person with a software engineering and computer science background, that's an incredibly vague statement. And so that's why I'm kind of unclear. It's almost like we're speaking two different languages. But I'm sure it will become more clear as he testifies.

Judge:

Right. I mean questions you may have for him specifically about his expertise connected to what he testifies about --

Fox:

Mm-hmm.

Judge:

-- that's proper cross-examination, as opposed to is Sergeant Shook an expert in -- in this area with enough training and background to be able to testify about this subject matter.

Fox:

Sure. Thank you.

Judge:

Okay.

Laker:

So at this point, Your Honour, I'm just going to ask that you do find Sergeant Shook as an expert in the noted -- previously noted area.

Judge:

Thank you. So I've seen Sergeant Shook's curriculum vitae and I've heard him asked some questions about his background and the extensive coursework he's taken, in particular for the six years when he was a member of the digital forensic unit, and I am satisfied that it is appropriate to qualify him as an expert in the areas the Crown has outlined, that is, an expert in the forensic analysis of digital devices, including the identification, preservation, extraction, and interpretation of digital evidence. Mr. Fox had indicated that he may want to cross-examine about the evidence [indiscernible/background noise] and he may have more detail type questions, but didn't take objection to him being qualified as [indiscernible].

Laker:

Yes, thank you, Your Honour. So I'll ask that the evidence heard on the voir dire become part of the trial proper and that his curriculum vitae be marked as the next exhibit.

Clerk:

That will 12 -- or 13, Your Honour. I apologize.

Judge:

Thirteen. Yes. So, Mr. Fox, this is something, there's nothing objectionable, and rather than repeating the evidence that's clearly part of the trial now that Sergeant Shook is qualified as an expert, so I'm going to allow that, what we heard already as his evidence, going to evidence on the trial proper and that curriculum vitae will become the next marked exhibit on the trial, Exhibit 13.

EXHIBIT 13: Curriculum Vitae of Sergeant Robin Shook - 16 pages (was A on Voir Dire #5)

EXAMINATION IN CHIEF BY CNSL T. LAKER:

Laker:

And Sergeant Shook, on January the 12th of 2023, you commenced an analysis of a digital device that was related to police file number 22-66177; is that correct?

Shook:

Yes, that's right.

Laker:

And what did you know about this search?

Shook:

The -- the information I knew about it was that it was a Motorola cell phone, and it was in relation to a -- a file from our domestic violence and criminal harassment unit. The digital forensic unit is not a investigative unit. We're a support unit, which means that the work done is on a support basis, so it's devices from across the department from everything from our patrol to devac [phonetic], which I stated, to homicide, and the information that is provided to me is encompassed as part of my report. It's a single page form in which the details of the examination requested are outlaid on it. The device and other pertinent information such as the property tag number or exhibit number.

Laker:

And the device was a Motorola Moto X Play phone?

Shook:

Yes, that's correct

Laker:

And as a result of you analyzing or -- or examining, I should say, this device, you created a report; is that correct?

Shook:

Yes, that's correct.

Laker:

And I'm going to show you a copy.

Judge:

This was previously provided to me.

Laker:

Oh, it was? Okay.

Judge:

I -- I have kept it and not looked at it.

Laker:

Okay.

Judge:

But is this --

Laker:

Yes.

Judge:

Is it -- do you want to check it's the same?

Laker:

Ten pages?

Judge:

Ten pages long?

Laker:

Yes.

Judge:

No, it's not quite. I think I -- actually, hand me what you have because what I was given before was stapled, and I can see it has some other documents at the end.

Laker:

Yes, it does have some other documents. I think that those documents actual l y were contained on the -- in the report, but I -- what I'll do is I'll ask Sergeant Shook about them separately and we can deal with it that way, Your Honour.

Judge:

Okay. Do you have this, Mr. Fox?

Fox:

Yes, I do, thank you.

Laker:

And, so Sergeant Shook, I just want to -- going to hand you a document.

Shook:

Thank you.

Laker:

And I see that at the top of the document it appears to be dated January the 12th of 2023.

Shook:

Yes, that's correct.

Laker:

And there's a file number associated that says 22- 66177?

Shook:

Yes.

Laker:

And it's a digital forensics unit mobile device examination result sheet. Is --

Shook:

Yes.

Laker:

-- that correct?

Shook:

That's correct.

Laker:

And in total, the report appears to be six pages, and it ends with a page that says "Firefox Search Terms" --

Shook:

Yes.

Laker:

-- is that correct?

Shook:

That's correct.

Laker:

And is this the report that you created after examining the Motorola Mato X Play phone?

Shook:

Yes, it is.

Laker:

There were also two additional documents that were included, I believe, in your report. The first one is entitled "Exhibit Submission Form"?

Shook:

Yes.

Laker:

And what's that document, please?

Shook:

This is what I was referring to -- the information that I would have been provided regarding this device. This is a standard form that is submitted by any unit within the Vancouver Police to the digital forensics unit, that is outlining their examination details that are requested as well as providing the authorization for that search.

Laker:

Okay. And was that attached? Was that document attached to your report?

Shook:

Yes, it was.

Laker:

Yeah. Okay. And then the other material, which is entitled pages 8, 9, and 10, I'll just hand it up to you, would you identify what this is?

Shook:

Yes. This would have been the authorization to search, which was included with the digital forensic unit ex -- sorry, ex exhibit submission form. In this case it's a s. 487, I believe, search warrant.

Laker:

Okay. And so all three of those documents were contained in your report?

Shook:

Yes.

Laker:

Okay. And so that was one package; is that correct?

Shook:

Yes, that's correct.

Laker:

Okay. So if I could actually ask that all three of these documents be included as one, and that be marked as the next exhibit, please, Your Honour.

Judge:

That make sense, the --

Laker:

I just want to confirm that Mr. Fox does --

Judge:

Mm-hmm.

Laker:

-- have all of those --

Fox:

Oh, yeah.

Laker:

-- pages

Fox:

Yeah, there's pages and pages.

Laker:

Okay. Excellent. Thank you.

Judge:

So collectively, then, these three documents that all came together from Sergeant Shook will be marked together as Exhibit 14 on the trial.

Clerk:

Thank you, Your Honour.

EXHIBIT 14: Copy of document titled Vancouver Police Department Digital Forensics Unit Mobile Device Examination Results Sheet for 2022-66177, prepared by Sergeant Robin Shook - 10 pages

Laker:

Yes. And in -- and in terms of the information that is provided to you, Sergeant Shook, what -- you've referenced the search warrant in this -- in your report. I'm going to assume that that's because that lists the parameters of your search; is that correct?

Shook:

Yes, that's correct. And that -- and it's a checks and balances system because we receive a very high number volume of exhibits, and the inclusion of the authorization to search, whether it's a search warrant or a consent search, within the paperwork provides us the knowledge that we actually have the -- the police have the grounds to search the device in front of us and what we're searching for. So it's another -- another check along the system that we do have grounds to search.

Laker:

And when you're searching the device, are you just looking at the device generally and all of the data that comes from it? Or is it -- has it been limited by the investigators on the file at all?

Shook:

So in the -- I can speak to how the Vancouver Police do it. I'm sure different forensic units across Canada will vary how their -- their intake and triage process is, depending on their volume and their resources.

In Vancouver we had a triage process. So how that works is a high number of devices are submitted to us for examination, along with the details requested and the authorization to search. There are some members of the digital forensic unit whose specialty is getting the data from the device. So this varies from physical acquisition, such as physically removing a data chip from a device, to using software devices like that are merely plugging a system into a phone, and then software processes running in order to obtain the device from it. Even as to low tech as taking pictures of the screen, if that's the only level of access that we have. So that is what we -- that is what we call the triage process, in which that data is extracted from the device and then presented to the investigator in -- in whatever form is available but is -- is what we colloquially call a preliminary report. That preliminary report is provided to investigators in whatever easiest-to-navigable format as possible. Just based on the volume of information contained within modern devices, there needs to be a solution in which that data can be reviewed and looked at and catalogued in a way that makes it possible for investigators and subsequent follow- up people, such as in the court process today, as be able to look at that data and -- and interpret what it is.

So for example, a regular iPhone might have 30,000 emails on it. If we present that information just in a printout report it would box on box of paper. So in this case, a preliminary report may have been with the program Cellebrite, which is a computer program which allows you to search data, to search specific terms, and highlights data types. So rather than navigating a regular phone in which you might have it and then have to go to a photo gallery and then look through pictures, the presentation of the Cellebrite program is a computer-based program in which, if you want to look at the pictures, you click on an icon of pictures, and it will show you representations of every picture that was found on that device.

So once this triage process has happened and this preliminary report, although it's a working copy, it's not an actual printed report, whatever data is easiest to navigate is given to the investigators.

The investigators are the one who have file knowledge and to know what actually is evidentiary and what's not. So as the digital forensic unit is a support unit, we are not part of the investigative team. I don't know who the accuseds are, I don't know who victims are, I don't know the elements of the offence, what they're looking for. That is for the investigators to review the data for, searching within the terms of their authorization, in this case a search warrant, to ensure that they're within the bounds of their search authorization, and then to take note of that data in whichever way they deem fit for subsequent analysis and extraction for a report for me.

Laker:

Okay.

Shook:

So in this case, using Cellebrite, it's possible to tag data, which is simply a digital version of putting a sticky note on something, so a follow-up and -- a follow-up person such as myself goes, okay, there's some -- for example, there's some internet history that could be evidentiary, so they'll just stick a little tab on it. Doesn't change the data, it just says, this is what I'm looking for. And then once that investigator review is complete, then that review comes back to somebody who is in my position as an examiner.

So what the role of an examiner will be is looking at what data was marked as evidentiary; one, confirming it's still within the authorization; and two, is really the -- the then extraction of that data into a format which is readable and understandable in a court and regular-person format. So it can change from the stored value, which is numbers in terms in a database to a format such as a printed output on the report in front of you.

Laker:

Right. And so that this report --

Shook:

Yeah.

Laker:

-- is a representation --

Shook:

Yes.

Laker:

-- of -- of the -- what the police determine is the relevant extracted data with regards to this particular file?

Shook:

Yes, that's correct.

Laker:

And so you mentioned that -- that the data can get tagged by the lead investigator or one of the investigators.

Shook:

Yes.

Laker:

Did that take place in this situation?

Shook:

Yes, that's correct.

Laker:

So the subsequent data that you examined had been tagged by the lead investigators as possibly relevant?

Shook:

Yes.

Laker:

Okay. And you looked into that further?

Shook:

Yes.

Laker:

Okay. So I'm just going to draw your attention to a little bit more in your report. So first of all, I see here that you provided a description of the article examined, and we've already discussed that that was the Motorola Moto X Play phone?

Shook:

Yes.

Laker:

And the property office article number was 226177- 1?

Shook:

Yes.

Laker:

And you noted you took some photographs of a phone, and that's the phone that you examined?

Shook:

Yeah.

Laker:

And there is a SIM card; is that correct?

Shook:

That's correct.

Laker:

Okay. And what was -- where was that SIM card located?

Shook:

The -- the data I reviewed is -- is a digital equivalent of the SIM card. The SIM card would have been included as part of the package that was triaged by whoever did the triage. So when I examine the SIM card, I look at the -- the data package from it rather than actually the physical card.

Laker:

Okay.

Shook:

Insofar as, like, when I look at the phone, I look at the data of the phone rather than the actual device itself.

Laker:

Okay. And I note that there's a reference on this SIM card that it -- it says Luckymobile.ca.

Shook:

Yes.

Laker:

What's -- what's that?

Shook:

Lucky Mobile is a service provider that operates in Canada. So it's -- it's usually a pay-as-you- go or it's like a -- think you can buy them at gas stations and cell phone kiosks. It's a -- kind of like a Rogers or Telus or Bell service provider.

Laker:

And then underneath those photographs you have your summary of findings.

Shook:

Yes. Thank you.

Laker:

And essentially, if you could just take a moment to review that.

Shook:

Yeah.

Laker:

And that essentially concludes what you've already told the court, just about how the data had already been completed and provided to investigators, investigators reviewed the data and located what was evidentiary.

Shook:

Yes.

Using these selections, I located the data verified, and have exported it for exclusion in this report.

Shook:

Yes.

Laker:

Okay. And underneath that you've written the exhibit details, and that sets out, what? Could you just explain that for the court?

Shook:

Yeah. The exhibit details is the tombstone data of a device, such as the make, model, colour, a Mac address, which is the -- I kind of think of it as the address of a phone for primarily wireless networks. So where that becomes relevant is in case there's linkages being made within a router or wireless environment. An eye-in-the-eye is a number that is similar to a serial number that is unique to a device. Operating system is the operating system of the device. In this case it's Android 7.1.1. The time zone, which is the time zone that was set to the device at the time of acquisition, in this case it was UTC my state [phonetic] which is the local for Vancouver. And then the two identification entries there, which is a phone number, which is 1-778-951-8542, that would have been imported from the SIM card data from the network data when a phone is -- that was provided into the phone, and a device user which had the entry of, Patrick.

Laker:

Okay. And just to confirm, this phone can connect to the internet?

Shook:

Yes.

Laker:

And I see that you've listed the SIM card details which we've already discussed briefly.

Shook:

Mm-hmm.

Laker:

You've also mentioned the memory card details. And then you have another reference here which says, "Other Notes". Can you -- can you just review that quickly and advise the court what that means, what those notes mean?

Shook:

Yes. Those would be my -- the version of police notes for this examination. So because this is a digital device, it's all done on a computer rather than handwriting notes and scanning them and touching them, this is the section which my police notes are included in my report.

Laker:

And in these other notes it says, "searched items tagged."

Shook:

Yes.

Laker:

So those were the items that were tagged by the investigator?

Shook:

Yes.

Laker:

And then you've referenced "Firefox Web Browser records". So can you just explain what that is?

Shook:

Yes. So with my -- my police notes will note the data that was marked as evidentiary by the investigators when they were reviewing the, what we call the preliminary report, the overall data. So the way that, in this case, Cellebrite, which is the forensic program that I was using, categorizes data for easy view. There are several categories for a investigator to look for, which one of these is searched items and another one is browser records. So depending on the type of investigation that it is, sometimes if an investigator is only interested in browser history, the way that Cellebrite is built is for ease of use is so they allow an investigator to go directly to a data category and then look at the records for that, and that's what I've indicated there.

Laker:

Okay. And then you've said:

Source files are data/data/org.Mozilla.Firefox

Shook:

Yes.

Laker:

-- slash -- can you just explain that -- that line, please?

Shook:

So as these are my police notes, what I've done is referenced what I am looking at as part of my forensic process in my notes rather than including every data category in the report itself. So for example, if we go ahead and look at the results page --

Laker:

Yeah.

Shook:

-- it's a -- a succinct outlay of what data was in a database, so for example, if we look at searched items and Firefox web data, we'd be referring to page 6 of my report.

Laker:

Okay.

Shook:

So if we look on page 6, you see the number column, in which I added, just for easy reference, if we were speaking about a specific items, a date and time reference as it was pulled from the database in which was searched, and then what that search term was in the third column.

So a database -- how phones and other mobile devices store data is within databases. So think of -- think of multi-layered Excel spreadsheets, and there could be hundreds of entries in a database that tracks many, many different types of data points that aren't necessarily evidentiary or need to be included for an evidentiary purpose in such a report like this. If you think the -- the overall amount of information being kept on a phone tracks user's movements and what they're doing, when they're doing, why they're doing it, that may be in a database. But if what investigators have concluded is evidentiary is such a search term, there's no -- there's no succinct reason for putting a hundred columns in a report when three or four will show the data that's evidentiary. But what I've done in my notes is listed the source of where I am getting this data from in case the court needs to or defence wishes to go and look at the source of that data from which I'm pulling it from to see if I'm to, one, verify I'm correct, or to do, if there's anything else that's evidentiary, inculpatory or exculpatory that's contained in that database that I haven't included.

Laker:

Okay. So -- so with regards to page 6 --

Shook:

Mm-hmm.

Laker:

-- of your Firefox search term.

Shook:

Yes.

Laker:

In very simple terms, what -- what is -- what is that table of?

Shook:

So Mozilla Firefox is a web browser. So that is a program which allows a user using a device that is capable of and is connected to the internet to connect to the internet to search for data, to search for websites or people, whatever somebody might search in Google, or Altavista or Bing, or whatever other search engine they wish.

So web browsers are built in such a way now that you can either put in a web URL, a web address at the top of it, or just merely enter a search term and it will conduct a search for you. What it will also do in this category is, if you go to Google and search for a term, it will enter that into this data category.

So what is encapsulated in the page 6 of Firefox search terms is entries within the web browser database for the Mozilla Firefox program in which a user was conducting a search, meaning entering a value and asking whatever search engine -- in this case it appears to be mainly Google -- on, to get results for that search term.

Laker:

Okay. So under the column time --

Shook:

Yes.

Laker:

-- there is a number of -- well, there's really a number of times that are referenced on May 13th and May 14th.

Shook:

Yes.

Laker:

What -- what are those times representative of?

Shook:

Those are the local -- adjusted to local time values of when those entries were entered into that database. So that indicates when those search terms were entered into the Firefox browser and completed for a search.

Laker:

And in the column aside, that says, Entered Search Term, what you have is, say at -- say at line 1 you have that on May 13th of 2022, at 6:27:52 p.m. Google webmas --

Shook:

Yes.

Laker:

-- w-e-b-m-a-s, was searched?

Shook:

Yes.

Laker:

Okay. Can you just explain for the court what Google Webmaster Tools are, what that -- what those relate to?

Shook:

Google Webmaster Tools are dual -- I'm sure it's a term of reference now -- is a giant company, one of the most valuable companies in the world. And basically, what they sell is information. And what part of their online business model is they allow a user to host a website and have various tools for -- in allowing for the administration of websites.

So one of the ways that a user administrates their website is their ability to be searched for and found on search engines. So what Google Webmaster Tools is primarily a suite of software tools that Google has which allows users, particularly administrators, other people with access to websites, to monitor their -- their usage of their website through Google and how it's interacting with Google. So in my -- I haven't done particular -- like a course on Google Webmaster, I've only come across it on files. Primarily what's -- it seems to be is a software suite that allows a administrator to promote or reconfigure or track usage of their website by the general internet population at large.

Laker:

And if I could just draw your attention to line 6, where the time is referenced as May 14th, 2022 at 2:36:04 p.m. And the search appears to have been desicapuano.com.

Shook:

Yes.

Laker:

So what -- can you say anything about that particular search?

Shook:

Yeah. That would have been -- those -- that value of desicapuano.com would have been entered into the address field of Firefox, and entered to be searched. So this doesn't say what the results of that search were. It's -- it's telling you that that's what was entered by a user as a search term.

Laker:

And I'm just going to take you back one page of your report, to page 5. And -- well, actually, no. First of all, let's just cover off the fact that pages 3 and 4 appear to be a glossary, so that's providing definitions for the -- for the reader of the report; is that correct?

Shook:

Yes, that's correct.

Laker:

And then with regards to page 5, can you just explain what that is?

Shook:

Page 5 is a compilation of user accounts that were found within various databases on this device. So previously, when I had said that I had, for Firefox search terms, my police notes had the source of that information, in this case I provided the source within this output here.

So anybody with a mobile device, Android or Apple, knows that it would be frustrating to enter a user name and password for every service every time they went to go use it on their phone. So for example, if every time you had to check your email, if you had to enter that information every single time, it would take a lot of time and it would be -- it would be annoying for a user. So devices have built in the capability of storing account information and pre-entering that and having that accessible to a user whenever they click on a program or service. So as this information is stored on a device, it is able to be digitally forensically analyzed and removed and -- and presented in this format. So what this page is showing is various accounts that were on -- in different databases on this device. Yes.

Laker:

And so what I see at -- the way you've created this table is again you've numbered your various lines?

Shook:

Mm-hmm.

Laker:

And then you have a column for user name?

Shook:

Yeah.

Laker:

And then a column for account data?

Shook:

Yes.

Laker:

So let's look at number one first.

Shook:

Yeah.

Laker:

The user name is identified at patrickhfox@gmail.com?

Shook:

That's correct.

Laker:

And then you've referenced the service type and source file. Can you just explain that in a bit more detail?

Shook:

So the -- the service type is a reference to the program or the application in which this value was entered. So a -- a user name can be whatever a developer allows a user to have a user name, so it could be a name or email, phone number, or whatever handle that the developer of the program or the application wishes it to be. So in this case, the email address, Patrickhfox@gmail.com is a user account that Mozilla Firefox, the browser we had spoken about before, has saved as a user name. So that's where we look at service type, is a Firefox account. And then the source file in which this was -- this entry was saved was the accounts underscore DE database.

Laker:

So is that where the account is stored within the phone?

Shook:

Yes. It's a -- the accounts DE and CE databases are Android databases in which various accounts are stored.

Laker:

Okay. Looking at number 2, what I see is a P with a number of dots.

Shook:

Yes.

Laker:

And then, at Gmail.com Can you explain that in a little bit more detail?

Shook:

Yes. The -- the account databases only retain what information the applications allow them to. So if an application is hiding the entire email address from that database from seeing it, such as we see with the first letter and then the stars, that's what will be stored within the database. So the database only stores what the applications allow them to. In this case it stored the value P with a bunch of dots at Gmail.com.

Laker:

And is this because -- and I note that this is the case with numbers 3 and 4 as well, and is that due to the fact that the service type is a BlueMail?

Shook:

Yes. Most likely. So BlueMail dot mail is a -- it's an application, a software suite that's primarily calendar and email syncing. So it allows you to -- allows you to import multiple email accounts and calendars and sync them in one place so you're -- you're more conveniently having all of your email addresses, whether you have one or two or many, in one place. So what it appears is that this BlueMail service · stores their account information in the accounts underscore CE database with only the first initial and -- and the -- the host, the at Gmail.com address.

Laker:

Right. And I note that with regards to number 3, it's Panda series of dots, at desicapuano.com?

Shook:

Yes.

Laker:

So is that an email address then?

Shook:

It appear -- it appears to be an email address. What it would have been stored as in this database is a user name. So --

Laker:

Okay.

Shook:

-- previously, when -- it's basically under the entry for username but appears to be an email address that was used as a username, as a email address that was being used as a username.

Laker:

Okay.

Shook:

Sorry.

Laker:

And I see that number 4 is E with a series of dots at desicapuano.com?

Shook:

Yes.

Laker:

The service type was the BlueMail --

Shook:

Yes, that's correct.

Laker:

-- service type, and I see that there's a password referenced?

Shook:

Yes.

Laker:

And what would that password be related to?

Shook:

So that would be the password associated to that user name that is store in that database. So sometimes passwords are stored in a hash value, which we see or, like, a hash or a ceded term, which we see in entry number 2, because _you see the password is a very long sequence of letters and numbers, and sometimes it's stored in what's called plain text, in what we see in entry 3 and 4. So the password of liz2munez8 is what was stored in this database as the associated password to these two user names.

Laker:

And then with regards to numbers 5, 6, 7, 10, 11, and 12, those all appear to be related to the Patrickhfox@gmail.com?

Shook:

Yes.

Laker:

So that's the same user name but are they referenced under different lines because the account data is different?

Shook:

Yes. They're different references because different applications or different services are using the same email address as that user name.

Laker:

Okay.

Shook:

For example, if we look at -- if we look at entry 6, line 6, the source for that is Android maps. So that will be your Google Maps application. So the user name for Google Maps in this case is Patrickhfox@gmail.com. And then if we go up one line to line 5, the source file for that one is Android Calendar, so it would be a Google Calendars user name, would be the same email address as Patrickhfox@gmail.com.

Laker:

And under line 8 there's a phone number that's referenced. That's the phone number that's associated to this phone; is that correct?

Shook:

Yes. It was the same phone number that was on the SIM card with this device, and in this case it's the phone number that has the user name under the MMS/SMS database, which is the primary database in which regular text messages are stored.

Laker:

And line 9, the user name is blank there. Can you explain what that line 9 means?

Shook:

Yeah. Sometimes the database is only retaining what information is allowed to it or it still retains. In line 9, in this case if you look at the user account information, this was from Instagram, and this was a deleted but recovered entry. So the -- I can't say for certain what it -- the reason is. If -- if Instagram -- this version of Instagram didn't want a user name being stored in the database, but in this case it was probably due to that account being deleted. So the user name no longer showed up.

Laker:

And Sergeant Shook, I'm just going to give you a chance to just quickly review your report and see if there's anything else that you've missed in advising the court about this report. I'm just going to check in with my colleague here.

Was there anything else that you wanted to add, Sergeant Shook?

Shook:

No.

Laker:

No? So my colleague just wanted me to clarify that with regards to numbers 3 and 4, under user accounts on page 5, are you able to draw any conclusion as to how those user names ended up on this particular device?

Shook:

Yes. Those -- those user names would have had to be either entered or authorized by a user to up to -- to appear on this device. So primarily, the two main methods of an account being entered on a device would be, one, a user enters it manually by entering a user name and password on a device and storing it; or two would be migrating information from another source onto a device in which, for example, if they had other email accounts and they bring it over all in one package to put onto this device. So those are the two main methods of it, but both of them would be through user input in some method.

Laker:

Those are all my questions for Sergeant Shook. I am just going to get him some water. He's talking a lot.

Shook:

Oh, thank you.

Laker:

And I'll give Mr. Fox a chance to --

Fox:

No, thank you.

Laker:

-- consider his questions.

Fox:

Oh, question.

Laker:

Do you want any water?

Fox:

I'm good for water, thank you.

Laker:

All right.

Judge:

Would you like to take the break before you cross-examine Sergeant Shook?

Fox:

Yes, I would, thank you.

Judge:

Okay. We'll take the afternoon break, now. If everybody could return, please, at 3:20.

Laker:

Thank you, Your Honour.

Fox:

Thank you, Your Honour.

Sheriff:

Order in court. All rise.

(WITNESS STOOD DOWN)

(PROCEEDINGS ADJOURNED)

(PROCEEDINGS RECONVENED)

Laker:

Yes, Your Honour, and it's Laker, initial T., for the Crown and -- and Mr. Elias is present, as is Mr. Fox. And I'm just confirming that the Crown did conclude our direct examination of Sergeant Shook. I believe Mr. Fox does have some questions for him.

Fox:

Yes, I do.

Laker:

Okay.

Judge:

All right. Go ahead. Cross-examination.

ROBIN SHOOK,

recalled.

CROSS-EXAMINATION BY THE ACCUSED, PATRICK FOX:

Fox:

The first thing that I'd like to clarify, on page 5 of your report it has the user accounts table.

Shook:

Okay.

Unidentified Speaker:

Have a moment, please.

Fox:

Sure.

Fox:

I believe that you had stated earlier that the values that appear under user name aren't necessarily identical of verbatim the actual user account, for example, the email address, but rather a nickname, if you will, that the user puts in?

Shook:

The user names that are stored in that value are what is being stored as a user name for that application. So I think I see where your -- your question is going. It would depend on what the user entered as a user name and what that application was storing as a user name. Whether -- in these cases it's an email address but if it's a program that doesn't use an email address, then it would be a nickname or something similar.

Fox:

Okay. So let me ask you. An email program, for example, like BlueMail, if person creates an account within something like BlueMail, they can often give that account a name, a pretext name. Like, for example, if I was going to create one for Patrickhfox@gmail.com, I could call that my Gmail account, and that's how it would appear within the application to the end user, in the user interface.

Shook:

Okay

Fox:

Of course, the actual email account would still be Patrickhfox@gmail.com?

Shook:

Yeah.

Fox:

So should I understand this to mean the values listed under user name here would be those plain text or free text descriptions as opposed to the actual account name?

Shook:

That would be -- so what you're asking, is it -- is it the descriptor of the account that's being stored in the user name, or the actual user name itself; is that what you're asking?

Fox:

Sure. Okay, yeah, that would be a good way of putting it.

Shook:

I believe that would vary from application to what application is. Primarily, what, in my training experience and looking at Android databases, the purpose of the account CE database, is for prefills. So if you had a -- if you had an account in which it was patrickhfox@gmail, and then link that email address within BlueMail to another account that's, you could just say Patrick, with an associated name, if that credential of Patrick and a password allowed you to access that further account, like that step in the door of the other account, then that is what would be store. It would be the -- it would be the prefill for getting into that first step.

Another example would be if you -- if you had a master admin account and within that admin account, so you could just say admin@gmail.com, for example, and within that admin account that you used to log in, that admin would be the one that would be stored in this database. If -- once within that account, if there was 10 other email addresses or user names associated, those wouldn't necessarily be associated to this user accounts database, would be that initial prefill one, the admin one.

Fox:

Okay. But looking at items 3 and 4 of your table, the two that referred to a desicapuano.com domain.

Shook:

Mm-hmm.

Fox:

I see that there's Panda number of dots, and then there's E and a number of dots. I mean, clearly those are not valid email addresses. So what exactly is it that we're looking at here? Like what -- what do these two values represent?

Shook:

Those represent -- the user name is what the entry is stored at within the database for that single cell. So --

Fox:

Oh.

Shook:

-- it depends on what the permissions are and what the application is allowing it to save. For example, it could only be displayed as a user for privacy sake. It doesn't show you the full user name. But that is what this database is storing as a user name.

Fox:

Okay. Two things that I want to say. First, I'm very familiar with databases and relational databases and SQL. So feel free to use technical terminology if that's easier for you. Unfortunately, though, there are some good people in the room who might not be familiar with it, might have some issue if we do that.

Judge:

Yes. I'll just stop you right there, Mr. Fox, to say, that that's true. Your invitation only really goes as far as yourself. I want to understand what Sergeant Shook is talking about and I'm sure the Crown wants to be perfectly clear, too.

Fox:

Right. Right.

Judge:

So if there are terms that I don't understand, I'll stop you, and I'm sure the Crown will do the same, but go ahead.

Fox:

Okay. Now, for the purposes of your testimony here today, it seems to me that these two entries in this one table are really the most, if not the only, relevant part or important part of your testimony. So I really want to make sure that we're very clear on what exactly this information is. Like does this mean that the device had these two accounts actively enabled on it at that time, such that from that device the user was able to access two email addresses that started with an E and a P?

Shook:

To speak accurate, I'm not sure what the overall case is so I'm not going to speak to the importance of some information over --

Fox:

Sure.

Shook:

-- other information. I don't have investigatory knowledge, I don't know. I'm just presenting the evidence. I don't know what's important, what's not.

As far as if this provides access to an account, that is something that would have to be tested to see if it actually allows a user to log into an account and whether if that grants access. What this data shows is at the time that the police -- the digital forensics unit were able to acquire the data from the device, these were entries within the accounts database and the associated information from it. So what it shows is that through the means that I spoke to earlier, this information of a user name, as well as an associated service, so those two email addresses which are P and E dot-dot-dot at desicapuano.com are from the BlueMail mail application, and that they have associated plain text passwords stored, and that this information was stored within the account's database. So what it shows is that first step. It shows that the data is there and it would have existed on the phone through some input of a user prior to the police acquiring this data. And the next step in which you're asking is, did this data actually allow a user access to those accounts is something that -- that I didn't see an authorization to do, and something that -- a step that I did not take. So I can't tell you whether or not allowed access to this account, but what I can tell you is that these are the entries within an account's database that were on the device at the time that we acquired the data from it.

Fox:

Okay. When -- if a user adds some account information through a third party application -- by third party I mean an app that isn't part of the Android operating system but something like, for example, Instagram or BlueMail, those are both third party applications, so if a user adds some account information using a third party application like that, and then subsequently deletes that account information, again, from within that third party application, will the corresponding records in the underlying database tables or database files be immediately deleted or would they just be marked as being deleted?

Shook:

Interesting question, and it would depend. So this is underlying questions on the functionality that would be not only specific to a specific device, saying a Motorola X Play, but to a specific-specific device, being this exact Motorola X Play.

Data deletion and freeing up of storage space on a -- on a device is called, commonly called a garbage collection. Basically, for the court, how devices store data on silicon chips nowadays, say within your cell phone, is there are, just for an example, one million positions in which it can store a piece of data. And chips can't -- those positions can only be used a finite amount of times; say, for example, 10 times. So that is when, if people have been using their phones overtime, they get slower and slower, the more device -- the more you use a phone. It eventually gets slower to a point where you have to upgrade. It's because the -- the actual chips that are storing the data only have a finite amount of storage, on-and-off switches, within those presets. So having said that, these chips have e a -- a very base layer of technology that is called wear levelling or garbage collection in which, when you delete a file, this very base level of operation of a chip which nobody -- a user doesn't have access to it's the base chip function itself, is looking at positions on the chip that have had -- been used a lot. So say if you -- if you had an analogy of a filing cabinet, if the first two drawers in your filing cabinet were getting used so much the hinges stopped working, then the base of this wear levelling is going to take the information that was in those two drawers and move them to, perhaps, to drawer three and four that haven't been used as much. So your phone stays quicker because now, instead of using the old drawers that are getting worn out, it -- it's moved that information to new drawers, less used spaces within the chip.

So this becomes relevant that when a user deletes an entry in a file, such as a SQLite database and Write-Ahead Log, the underlying functionality of the chip will look at that available space and either mark it for reuse or move that information totally independent on base factors of the user. So it could stay there for weeks, months, or it could be gone instantaneously, totally dependent on how the application is set up to run, and the usage of the chip and these underlying factors.

So to get to the question that Mr. Fox presented, how long would data stay within the database being deleted without being totally irrevocable, being able to parse and retrieve, would be dependant on the device and that specific device.

One thing that is notable, though, that the -- when a file is marked as deleted and hasn't been deleted and is recovered, there is a data set that shows it as being deleted and recovered.

So for example, if you look at my report, page 5, the entry number 9, for that entry it has deleted, yes. So that means that that entry was deleted but was recovered because that underlying garbage collection working so the chip hadn't actually purged that information out and we were able to recover it.

Does that answer your . . .

Fox:

That was a very thorough --

Shook:

Mm-hmm.

Fox:

-- response, and if -- it was a very good answer. Unfortunately, though, I think that it didn't really address the particular question I was asking because I wasn't asking about the deletion of a file but, rather, the deletion of a single record within the SQLite -- well, within the database files. So within

Shook:

Mm-hmm.

Fox:

-- accounts underscore CE, that's the database file. That's made up of a bunch of tables or one or more tables, and the tables are made up of columns and rows. So if one of those records, one of those rows, is deleted, if the user account is deleted, what I want to know is, will the corresponding row in the database table be immediately deleted or will the -- the row, the record in the database remain, but a particular column, for example, that would be cog deleted or something like that would be set to true, thereby signifying that the row has been deleted but the data will still remain?

Shook:

Yes. True. It would be written to the Write- Ahead Log, and then, when the Write-Ahead Log goes to activate run through, then it would be deleted. And you're saying it would be marked for deletion, it wouldn't actually purse that information in most cases.

Fox:

Right. But again, though, the important part is we're talking about within the SQLite databases --

Shook:

`Yeah.

Fox:

-- not in the file system?

Shook:

Yeah.

Fox:

Okay.

Judge:

Okay. Sorry, got to stop you there.

Fox:

Sure.

Judge:

Written to the Write-Ahead Log?

Shook:

This is - this is how we're delving into. So --

Judge:

So that I did not follow.

Shook:

So how a SQLite database has -- think of a database as your Criminal Code, a great big thick book of information, and a user is making changes, which might be one or two pages. Rather than constantly making that change to the big -- the main database, take out page 100 and replacing page 100, that kind of thing, how databases work, SQLite, rights to a file called a Write-Ahead Log, a wall file, in which it makes those changes. So it would be -- it would -- you have your main database and then a little sub-file which right in the -- might, for an indeterminate period of time, have all the revisions in it. So when that Write- Ahead Log has a predetermined set of variables, say 20, then it goes ahead and makes that one change. So it's writing to a smaller revisionary file instead of the main database. So when a file is marked for deletion, it's written into the wall file. The Write-Ahead Log is being marked for deletion. This is really getting into the weeds.

Judge:

It is. It is.

Shook:

So it's -- yes, I see -- so it is marked for deletion within a SQLite database. The time in which it takes is a variety of factors in which I didn't -- for your -- this particular file, I didn't do any testing to see how long the entry remains in it. If that's what you're asking, how long an entry remains in the database before being purged after being marked for deletion.

Fox:

My next question would be, are you aware that some applications, for example, BlueMail, make -- sorry, I shouldn't have phrased it as, are you aware.

Is it possible that some applications, when you delete a user account or an account that was created within that application, so you delete the account, they will flag the record in the database in some way to indicate that it's been deleted but they deliberately will not actually remove the underlying data?

Shook:

No, I haven't -- I haven't tested BlueMail to that level to have that level of knowledge.

Fox:

But would you say that that is a possibility?

Sorry, that was a poorly phrased question because obviously it would be possible.

Shook:

Is it --

Fox:

I withdraw the question. There's no real -- there's no good way that I could ask it because to ask if it's possible is kind of ridiculous because, of course, it's possible. It should have been is it likely or is it probable, but I think that -- I'm guessing that you don't have that extent of knowledge with BlueMail to know whether or not.

Shook:

Yes, that's correct.

Fox:

Right. Okay. Do you know when it was that I had first obtained or purchased this -- this mobile device, this phone?

Shook:

No. The -- the level of review that I did on this device, one, I -- personally, I don't attribute it to a person, so I don't know if it's yours or whose it is. I -- I present the data on a device and allow the court to put whatever weight on the data within the report.

For the second part of that question, when it was acquired --

Fox:

When -- when I obtained or purchased it?

Shook:

There may be a date on the front. No. In this case, I didn't extract any data that's -- that would have outlined a purchase date.

Fox:

Okay. Do you know whether the BlueMail application uses the changing of characters like how the -- the characters appear in these two email addresses, and P and then a bunch of dots, and E and a bunch of dots, does BlueMail use that as a way of signifying that those accounts have been deleted so it knows not to have them appear within the application anymore?

Shook:

No, I'm not aware of that.

Fox:

Okay. Would you accept that that may be a possibility?

Shook:

I would have to do some testing to see that, but more likely, in my training and experience, what I've run into, if a file -- if an entry was marked for deletion, it would have the deleted flag as shown in line 9, with Instagram, that would --

Fox:

Mm-hmm.

Shook:

- it as being deleted rather than -- than replacing characters with stars.

Fox:

Right.

Shook:

There's --

Fox:

Unfortunately, though, in this instance, you didn't specify what value the deleted column was set to for those records, so we can't say.

Shook:

The only -- if it had a value of yes, if it had a value of no, then I didn't include it. It's only for that value of yes in this that I did include it.

Fox:

Okay. And that would -- it would be my understanding that would only be relevant if the application in question utilized that convention as opposed to using some own -- one of it's own internal conventions for -- for indicating that an account has been deleted?

Shook:

Yes. Maybe internally it did, but what this database was from an overall Android database rather than a BlueMail database, so what this information is being pulled from is a -- you're looking at hierarchy of files. This is Androids, this is the operating systems accounts database.

Fox:

Mm-hmm.

Shook:

So whatever BlueMail is doing in their section of software, it didn't translate to the overall Android database.

Fox:

So can you tell me, do you know whether these three accounts here that seem to be associated with the application BlueMail, that's items 2, 3, and 4, do you know if these are valid current accounts?

Shook:

No. What I was pulling out for this report is accounts that were on the device at the time, accounts that had these entries within this database at the time of acquisition. I didn't conduct follow-up investigation. That's not the role of forensics examination. It would be an investigator to do, see if they were valid -- remain to be valid accounts.

Fox:

And do I understand it correctly that you have no knowledge as to when these accounts would have actually been put into the phone; is that correct? I think I asked you that already, but I'm not certain.

Shook:

No. These entries didn't have the -- the dates on them, or I didn't produce them for this report.

Fox:

Okay. And also, it's my understanding that you have no knowledge as to why the characters of the email addresses have been replaced with dots?

Shook:

No. Without further testing, I would have to see why it's saved in that way.

Fox:

Just out of curiosity, have you actually -- how -- how did you access the accounts underscore CE dot DB database? Like, did you use an SQL tool, or did you use that Cellebrite program that you mentioned earlier?

Judge:

Sorry did you say the account dot CE DB? Is that what you're asking about?

Fox:

Accounts underscore CE. Yeah.

Shook:

Yes. In this instance there was two versions of Cellebrite that I was using. And within Cellebrite -- Cellebrite is a company, physical analyzer is the product. It's a -- I would say one of the largest digital forensic companies in the world. They offer a lot of tools for the extraction of data as well as the interpretation and the viewing of data from digital devices, and physical analyzer is the program that I used in this instant, which allows a user to ingest information. In this case it was the entire image or extraction from this device, and then parse that information out to make it viewable.

Mr. Fox's question refers to how did I look at a specific database within that image, and the application suite of Cellebrite physical analyzer has a specific tool that's a SQLite browser, which is a tool that, within Cellebrite physical analyzer itself, allows you to -- a user to look at a SQLite database and look at the data within various cells and columns within it.

Judge:

Can you spell SQLite?

Shook:

S-k -- S-q-l-i-t-e.

Judge:

Oh, so S-q-l-i-t-e.

Shook:

Yeah.

Judge:

Okay. Not what I was thinking. Thank you, okay.

While we're paused, can I just ask a question? Is it fair to infer, looking at the user accounts and looking at item 9 where it says, deleted, yes, that if any of the other accounts had been deleted that I would expect to see a similar notation underneath account data?

Shook:

Yes, Your Honour. If they had been deleted and recovered, they would have that same variable.

Judge:

Okay.

Fox:

I'm -- I'm sorry, you said if they had been deleted and recovered?

Shook:

Yes. So if they were recovered within Cellebrite, they would show you as deleted, yes, such as line number 9 has.

Fox:

If they were recovered from within Cellebrite?

Shook:

So the entries that were deleted within a database, or within a file system, if they can be parsed out from -- they still remain on the device and are able to be covered through a forensic program, even though a user has indicated to delete them --

Fox:

Mm-hmm.

Shook:

-- they would be indicated as this deleted, yes, entry.

Fox:

Okay. When -- when data is being extracted from a device, is it expected that the data on the phone will be changed in some way?

Shook:

The -- the standard operating practice, so forensic best practices, state to get a -- the most accurate version of information possible closest to the time of seizure. So I previously spoke about wear levelling and garbage collection, how chips will automatically change when they're powered on. So with modern chip-based technology, if you acquire the data on a Monday, then on a Friday reacquire the data, the data will be the same, but it might be in slightly different places within the overall file because it has moved -- that that chip moving has moved it from drawer one to drawer three. However, the data itself should be as close to possible as being the actual data at the time of seizure. So whether or not it's changed or not will vary with the device, with the operating systems, with things like encryption and the method of acquisition. But what our -- and at least I can speak to the Vancouver Police's best practices is, is the acquire the data as soon as possible and as accurately as possible to the device at time of seizure.

Fox:

Okay. So in the process of extracting the data from the -- from the device, is it expected that some of the database files should be written to?

Shook:

When extracting, no. They shouldn't be written to.

Fox:

Okay. Can you clarify, then, why it is --

Judge:

So can I just make sure I understand that question. You're basically asking the same question a different way? You're -- you're saying if the database file is written to, that means it's changed in some way, right?

Fox:

Well, the database file could be written to without changing the actual data contained within it.

Judge:

Okay. Okay.

Fox:

Like, for example, a particular cell within a table may have a certain value, the value 10, and then the application could rewrite the value 10, so the file then would have been written to, even though the -- the data within it is still the same as it was before.

Judge:

I see. Okay.

Fox:

The reason I'm asking about that is, I'd like to know about the file modification time stamps on the stuff that was extracted from the phone because I noticed that some of the databases had more recent time stamps, which led me to believe that the database files must have been notified in some way.

Shook:

So the methods of extraction vary from device to device, and like I said, they deal with things like what operating system, the method of acquisition, and primarily what dealing with now is encryption. So it is -- and dates and times are -- it's -- it's hard to say exactly what would modify a date and time modification date as well. But again, without knowing the exact specifics and I know what these forensic programs do as well is they strive for not modifying the data if at all possible. So the same -- so these companies are worldwide giant billion-dollar forensic companies, so they hold the standards that we also hold, is that you're trying to get an accurate -- an accurate representation as possible of that device when you acquire the data from it. Whether or not dates and times change within the metadata, I can't speak to it. I just know what the processes we have in place will be to extract the data without making any modifications as possible.

Something, like one example that I might think that might change is if there is a -- there is databases that track power usage, so being plugged in and plugged not -- and unplugged. If a data -- if a device is kept on power after seizure, so say if it's seized in an investigation and then kept on power, that will change the values of that database after the point of seizure because it's kept on and it has power going to it, and that's possible.

But again, what we strive to do is to keep that data as accurate to the time of seizure as possible, where practicable.

Fox:

Okay. So would it surprise you to learn, then, that accounts underscore CE dot DB in the archive or the image that was provided to me, has a date modify -- has a date modified time stamp of 2022- 08-18, which would be August 18th, which I assume is the day, probably, that the data was extracted or searched from the phone. I noticed that there were a number of files that had that.

Judge:

Do you -- is there a place where -- where that date appears? Do you --

Fox:

I don't think that appears in the report.

Judge:

No?

Laker:

No, this would be from the raw data, if we can characterize it that way, that was provided to Mr. Fox at his request, that which is all the data that was seized from the phone.

Judge:

Okay.

Laker:

So what he's looking at is something that's not in evidence.

Judge:

Okay.

Laker:

As of yet, Your Honour.

Judge:

Okay. So, thank you. So you want to basically suggest that the raw data you received has this date stamp on it?

Fox:

Yes. Yes, the -- some of the database files in what I've received have this interesting date modification time stamp, being that files had been modified on that date, at a given time. Because my hook -- wondering if I can say this -- when I saw that my first assumption was somebody had changed something because accounts underscore CE dot DB, not only could I not open it on the laptop, everything else I could open fine, but that file, which is, of course, the critical file, because that's the one that contains this information, wasn't accessible to me and it wasn't until today that I was able to open it on the other laptop from the external hard drive. But, so I was very troubled that that had this newer time stamp which was months after I had been arrested and in jail. So clearly, it's not something I could have had any involvement in, so I was wondering if the officer would have any explanation for why that file and a few other database files had a more recent time stamp on them.

Judge:

So I just want to make sure Sergeant Shook has that raw data. If he has -- you know, do you have any knowledge of that? Can you speak to that? Is that something you have with you or . . .

Shook:

No. It wouldn't be something -- it would be something that would be available to digital forensics unit, or on secure servers in the lab, but it's not something I have with me today, and it's not something I -- it's not something I was aware of or that I looked at previously, so not sure to the extent that I can speak about that.

Fox:

Okay. So I don't -- I don't think there's much more that I could ask about the email addresses, but let me just quickly glance over my notes here.

Judge:

Yes.

Fox:

Oh, Sergeant Shook, I wanted to ask, because we've been talking about SQL or -- SQL is S-Q-L or Structured Query Language, is the database query language, but I noticed that that's not mentioned at all in your curriculum vitae. Would you -- would you say that you would consider yourself an expert in SQL, in particular SQLite?

Shook:

Could I be a SQLite developer, no. Do I know how -- do I know basically how it functions and I can write simple queries of Python. So what I would say is if we would attribute SQLite to use an analogy of a car, I would be -- I would be a base level mechanic where I could look at things and see if it makes sense and things are where they're supposed to be, but I'm not at the level of an engineer that could rebuild an engine, for example.

Fox:

So based on that, then, I just want to clarify with respect to the testimony that you have provided so far regarding SQL and the database files, is that expert testimony that you've been providing or is that just your understanding or your opinion of those matters?

Shook:

Well, my -- my training/experience have given me a lot of exposure to SQLite. It's a -- it's a database format that's found on a lot of mobile devices. I've done hundreds and hundreds of examinations with SQLite databases and seeing how they work and how they query. Being able to look at it and see what data is in the -- within the database is something I can do. However, I will acknowledge I'm not a SQLite developer. That level of expertise was not something that I believe I was qualified for. So I can provide a general level of knowledge to inform the court and to provide an overview of the report that I -- I did do, but I'm not at the level of where I could be a SQLite developer.

Fox:

Right. And let me say it, I'm not -- I'm not questioning your competence or your skills in this matter, I just want to make sure that I'm clear on whether the testimony you're providing with respect to SQL would be considered expert testimony.

Shook:

Well --

Fox:

I mean, my understanding would be, like when I -- when I noticed there was mention of SQL in your resumé, I assumed that you would not be providing expert testimony about SQL or relational databases or relational data modelling from -- as it pertained to the Android device.

Shook:

Well, I would say my expertise allows me to speak about the functionality of devices and how they work and applications and how they work.

Fox:

Mm-hmm.

Shook:

But I believe what you're asking is if I'm at a -- such an in-depth knowledge about a specific programming language, that I would be qualified expertise and be like a software developer specifically working with that language is, no, I wouldn't --

Fox:

Okay.

Shook:

-- SQLite is not -- I'm not proficient enough with SQLite to have employment that would be solely based on that.

Fox:

Sure, sure. Fair enough. Thank you.

I would like to turn the page to page 6, your Firefox search terms. And I know this came up earlier, but I just want to repeat it or make sure I'm clear on it. So it's my understanding that what you're saying is the search terms that appear in the third column of this table that you have here are not URLs that I actually accessed or went to but, rather, these are just key words that I had searched, presumably in Google or some other search engine; is that correct?

Shook:

Yes. These were entries that were tagged as search terms. Whether or not they were the search query terms within Google or another -- or in the search field. So this doesn't indicate that these websites were visited. It -- this is the search term that was entered within that search field.

Fox:

Right. So specifically number 6, that means that I searched for desicapuano.com, I didn't actually go to desicapuano.com; is that correct?

Shook:

Yes. This is --

Fox:

Okay.

Shook:

-- the search term. So that would have been what was searched for.

Fox:

Correct. Thank you. Okay, that's all the questions that I had with respect to the data that was -- or with respect to my phone. It's my understanding, though, that you may have some knowledge about another matter that we have outstanding, the proxy logs. Has anyone mentioned anything to you about that?

Shook:

Yes. Crown had asked me about some proxy logs.

Fox:

And can I ask you, is that -- do you have any particular knowledge of Cisco -- Cisco proxy log or Cisco device logs?

Shook:

Well, what I can say is that, again, with my analogy of a mechanic, where I can look at it and tell you generally what it means. But I am not a sys admin. I'm not a network administrator. I can't tell you specifically what every single entry means. I can --

Fox:

Sure.

Shook:

-- give a general overview of what a log might mean.

Fox:

Right. The reason I'm asking you is because we have this document. And so we're hoping to have somebody provide more insight or more official insight into it, and so we thought there might be a possibility that you might be able to do that. But I would not personally recommend that we proceed with that because I'd rather have the Cisco sys admin coming in because he can give a definitive answer. And again, though, I'm not questioning your competence or anything. From what I've seen from your answers, you -- you're -- you are very competent and very knowledgeable about what you've been testifying about.

I don't have any further questions.

Judge:

Would you like to try your questions, though? Because --

Fox:

About the proxy logs?

Judge:

-- you know, Sergeant Shook has said he has like a basic mechanics knowledge of the proxy logs.

Fox:

Okay, sure.

Judge:

Just to see, because it's perhaps --

Fox:

Sure.

Judge:

-- if you get your questions answered, that addresses another issue.

Fox:

Would anyone happen to have a copy that you could show him?

Laker:

Well, I think -- I think it's been entered as an exhibit. So the exhibit --

Fox:

Oh, yes.

Laker:

-- the exhibit should be shown to Sergeant Shook. Thank you.

Judge:

While you're being shown that, I just want to ask a clarifying question. You were asked --

Shook:

Yes, Your Honour.

Judge:

-- Sergeant Shook, page 6, that it showed the search terms, number 6, Mr. Fox took you to number 6, and he asked you: that shows that I searched for that, he said, but that I did not go to the website. And you said, yes, that's right.

Are you able to answer both parts of that question?

Shook:

So this particular field shows search terms as is entered into the web browser, but what it doesn't show is if, at a date and time, if that was -- website was then returned or not.

Judge:

Okay. Thank you.

Clerk:

[Indiscernible] talking about?

Laker:

Yes, that's right. Thank you. It was the -- the email followed by the -- yeah.

Clerk:

[Indiscernible].

Shook:

Take the case book?

Laker:

And I think, just for Mr. Fox's benefit, he's going to want to ask Sergeant Shook, think if we flip over two pages. Yes.

Shook:

Okay.

Laker:

So to the third page of that document. Thank you.

Fox:

First, let me ask, is this a report that you've ever seen before or?

Shook:

Yes. Crown had provided me with this -- these logs.

Fox:

Oh, okay. So you've actually seen this very document?

Shook:

I believe so.

Fox:

So do you -- do you have any understanding about what this information is or what this document purports to -- to show or to report?

Shook:

What my understanding is, these are logs from the VPD network proxies that are in relation to a term -- the term desicapuano.com. And what these logs show is that that proxy's activity in relation to that URL being entered.

Fox:

Okay. So there are 14 entries that I found that it returned in this report. In each of those entries there's a field that says "Filing", and then within square brackets there's some -- some data, some string. Would you have any knowledge or understanding of what that means, the -- the text that appears in between those square brackets after the -- the label or the -- the field name, file name?

Shook:

So my understanding of this proxy is the VPD network is a monitored network that looks for potential threats to the VPD network, including malware, viruses, that kind of thing. So when a -- a user using the network goes out onto the internet to conduct a search or to go to websites, such in this case desicapuano, what this proxy, this background program will do, will pull elements from that website, piece of code or files, or the website itself, to ensure that they don't -- they don't contain malware, there's no hidden risks within that website and if it matches lists that allow access to that website by a user.

So for example, there could be underlying -- underlying part of code on a website that, if somebody clicked on it, it could gain access for a third party to a network. What this proxy is doing is -- is preserving, so it's going out and looking at websites or files that are requested for and making sure that they're basically safe for the network to serve to the user.

Fox:

Okay.

Shook:

As well -- okay.

Fox:

Go ahead.

Shook:

So what the -- the entry in the file names looks like it's going through -- it looks like it's pieces of code or what has been designated as files by the proxy to -- for a subsequent search and analysis.

Fox:

Okay. So in that first entry where it says file name, and then desicapuano.com.siteindices.com, what is your understanding of desicapuano.com.siteindices.com? What does that represent or what does that value mean?

Shook:

That looks like a URL -- a website address to me.

Fox:

Okay. Do you understand that to be the domain name, desicapuano.com? Or do you understand that to be -- the desicapuano.com part being a subdomain of siteindices.com?

Shook:

That -- being a subdomain is entirely a possibility. I don't -- I don't know how this was set up at the date and time. So it could be that siteindices.com was the main address and desicapuano.com was a sub-address is what he's -- like a sub-site within it. It would depend on how it was configured at the time of the search.

Fox:

I wonder if it would be acceptable to show the witness Exhibit 6, the one that's desicapuano.siteindices.com.

Clerk:

Is this the [indiscernible]?

Judge:

Thank you.

Fox:

If you would, please, can you turn to page 5?

Shook:

Okay.

Fox:

So this is a page that was generated by the Hunchly software that Ms. Mieklejohn, the crime data analyst, that she used when she accessed these pages. And you see the URL there says, https://desicapuano.com.siteindices.com. Do you agree?

Shook:

Yeah, that's what it says.

Fox:

Okay. And then if you turn the page, there's the printout of the page that actually comes up at that particular domain name or URL.

Shook:

Okay.

Fox:

So based on this, do you agree that desicapuano.com.siteindices.com refers to this page that we're looking at right now with that fungusy [phonetic] toe thing?

Shook:

I believe that would be -- the way you've asked that question is -- I think would be better served for the person who made this capture at that date and time. That is what it appears to be in this report, but I don't want to speak for somebody else's evidence about their capture and at what date and time --

Fox:

Sure.

Shook:

-- and what they viewed, as it wasn't me that was doing it.

Fox:

Certainly. And I would like to mention, for the benefit of the court and for the Crown, that when Ms. Meiklejohn testified she did agree that that's what this page was and that this is an analytic site that isn't related to the desicapuano.com site.

Laker:

I don't know if Mr. Fox is looking for a response, but I think that that's probably best left for argument rather than during his --

Judge:

Think he's summarizing testimony for Sergeant Shook but I'm not sure if there's a question coming at the end of it.

Fox:

Oh, no. I was just reminding both the court and the Crown that that was her testimony when -- because the witness had said that this would be a question more appropriately --

Judge:

No, no, that's true.

Fox:

-- posed to her. And so she was asked that question and that was her response.

Fox:

Okay. So getting back to the proxy log that we have here, would it be your understanding that all of the entries in here, if you glance at each one you'll see that the -- the file name for each one refers to desicapuano.com.siteindices.com aside from three of them on page -- the second and third one on page 2 and the first one on page 3 refer to something else. But do you agree that all the other entries relate to desicapuano.com.siteindices.com?

Shook:

Yes. There are the three that are dot ICO. The rest are desicapuano.siteindices.com, yes.

Fox:

Okay, great. With respect to those three that are dot ICOs, are you familiar with what a dot ICO file is?

Shook:

An ICO file is typically what's called an icon file, yes.

Fox:

Right. That's correct. And are you familiar -- is it your understanding that a website or a webpage can have an icon associated with it -- well, that would be my first question.

Shook:

Yes.

Fox:

Okay. And has it been your experience that when you access a website within a web browser, the tabs that appear across the top, there's a tab for each page you have open. The icon is usually what appears in there, next to the page title?

Shook:

Yes.

Fox:

All right. So then would it be your understanding that the dot ICO files that we're looking at here would be related to that, the page icon? Actually, it would be understandable that you can't really say about that, you can only speculate, so let's not worry about that.

So based on what we see in this proxy log here, is it your understanding that this proxy log is showing that on this day there were nine accesses to desicapuano.com.siteindices.com and then three accesses for some icon file?

Judge:

Eleven and three.

Fox:

I'm sorry?

Judge:

Eleven and three.

Fox:

Oh, sorry. Yes, right. Oh, yes, yes, you're right. My mistake, sorry.

Judge:

No, no.

Shook:

Yes. That's what it appears to be, is that this is a log that shows the VPD proxy program and looking at those elements, of which three are the ICO dot ICO files and the rest are web address of a desicapuano.siteindices.com, yes.

Fox:

Okay. And are there circumstances in which somebody on the VPD's network would access the internet without going through the proxy server?

Shook:

Not that I'm aware of. That would -- I believe the network is configured in such a way as to prevent -- to provide security to the network as a whole.

Fox:

Yeah.

Shook:

So being able to access the internet through the VPD network without going through this proxy in this instance shouldn't be. There -- there may be cases if -- I'm sure there are -- I'm sure there are other methods of acquisition the internet other than through the VPD network, but it would be up to that specific investigator to provide that evidence rather than me.

Fox:

Okay. So looking at this log, would you say it's reasonable to assume that what's showing in the log here would be all -- would -- sorry, let me rephrase that.

Is it reasonable to assume that what we see in the log here are all the attempts that were made in this 48-hour period to access any URLs containing the string desicapuano.com? Oh, from within the VPD network.

Shook:

I would think that would be a better question for the person who generated that log. I don't believe it would be my evidence to speak to if something was complete when I wasn't the one conducting the search.

Fox:

Okay. Your Honour, I would say that his responses have been very helpful and very informative. The only issue -- the only problem is this last one, of course, to get the definitive -- oh, sorry.

Laker:

Well, just -- just before Mr. Fox goes into this, I'm just curious if he's done his questions of Sergeant Shook at this point.

Fox:

I believe I am, because to go further with this I think is going to require Mr. Lam --

Judge:

Okay.

Fox:

-- he was the one that generated the report.

Judge:

Okay, fair enough. So that completes your cross-examination, then, right now, for Sergeant Shook?

Fox:

Yes, it does.

Judge:

Okay. Any re-examination?

Laker:

Might have one question for redirect --

Judge:

Okay.

Laker:

-- but let me just ask Mr. Elias.

RE-EXAMINATION BY CNSL T. LAKER:

Laker:

So, Sergeant Shook, when you were being taken through the proxy log it was -- what was drawn to your attention was the fact that there were two file names that were created. One was desicapuano.com.siteindices.com, and then the other one was desicapuano.com.ico?

Shook:

Mm-hmm.

Laker:

So my first question is that you referenced the fact that that dot ICO is an icon file. Can you just explain for the court what an icon file is?

Shook:

An icon file is a small picture that a website will serve to a user to make -- to just add to the user experience. For example, if you go to Google, your web browser will have a little Gin it. That little G is just a tiny little picture. That's an icon file so it -- looking at the tab you could just have that, the picture along with the name from it. It's basically just a very, very small picture, typically is what an icon is.

Laker:

Okay. And then with respect to siteindices.com.

Shook:

Mm-hmm.

Laker:

What's your understanding what that is?

Shook:

My understanding is siteindices.com is a website hosting company. So a provider where you can host a website.

Laker:

And is that like a company name or is that a . . .

Shook:

It could be a company name, it could be just a URL. A lot of -- there are a lot of hosting websites. Google -- you can host a website with Google or Amazon, or siteindices. It's basically if you don't have the servers and infrastructure yourself, you can, like, sublet space on another provider's services. So siteindices is one of those services where, say if I wanted to have my website vpd.ca but I didn't want to have all the infrastructure myself, I could pay siteindices or Google or Amazon to host that website for me. So it would all -- all the infrastructure, the computers, and all the internet access and everything would be there. But I didn't have to maintain that myself.

Laker:

What about GoDaddy?

Shook:

Yes. GoDaddy is another one, as well.

Laker:

Okay. And so can you say anything about if -- if somebody, on May 16th of 2022, searched up www.desicapuano.com, just that website, is it possible that these two results would come up?

Shook:

Yes. It would depend on how the website was configured in the back end to serve to a browser. So basically the infrastructure on the internet, there are providers that have a list of website names, and then the actual address or the IP address where that website can be found. So if a user types in -- user would rather type in google.com, then like 173.7.12.8, that kind of thing. So that's -- but that string of numbers is how computers actually talk to each other. And that's not a real IP address. I just made it up.

So it depends on how that website at the end on that hoster is configured to serve when that URL is typed in. So a user can type in desicapuano.com, and then the website on the end, it can be totally re -- set up to go to redirected to desicapuano.com, or it could redirect to desicapuano.siteindices.com, or it could redirect to another third party itself. It totally depends on how that site is structured to receive those requests when it receives it.

Laker:

Those are all my questions.

Judge:

Thank you. All right. Thank you, Sergeant Shook, you're excused.

Shook:

Thank you, Your Honour.

Madam Clerk, that -- two for you. [Indiscernible] be enough.

(WITNESS EXCUSED)

Judge:

Okay.

Laker:

We have another day set for March the 7th. I think probably what's best is that we address this issue that Mr. Fox has highlighted just at the conclusion of Sergeant Shook's evidence that he may be asking for another witness to be produced. I don't know if Your Honour wants to deal with that now.

Judge:

Yes, I think we could perhaps. What I'm hoping to do in the interests of time --

Laker:

Yeah.

Judge:

-- and everything's long, I think we could address that. And then I -- I think I could address voir dire #2 --

Laker:

Yes.

Judge:

-- as well.

Laker:

Yes.

Judge:

Okay. So I listened to that cross- examination, Mr. Fox. Would you still like Mr. Lam to come as a witness?

Fox:

Well, response I would like to give to that would be, if it is necessary to clarify those points, then yes, I would. However, if, at this point, the Crown and the court agree about the meaning of the information in the proxy log, and that it proves that nobody on the VPD's network actually went to the site on that day, then it's not necessary. But I suspect that the Crown is going to be resisting to that.

Judge:

Right. I think that's certainly what -- what you want to argue, but I wouldn't say that you have evidence yet that supports that. You've asked questions. You did what I asked you to do, to see if Sergeant Shook could answer your questions.

Fox:

Hmm.

Judge:

But I could see, at the end, that you had a question you wanted to ask Mr. Lam. So I guess my question to Crown would be, I know from the -- the brief appearance we had in between that there was some resistance to Crown subpoenaing Mr. Lam, but I can see a relevance to what Mr. Fox seems to want to ask him. I think -- I think you agree, Ms. Laker, is it --

Laker:

Yes. And -- and the situation we're in is that VPD have -- have advised us that they won't simply produce Mr. Lam as a witness because he's a civilian member.

Judge:

Right.

Laker:

And -- and the nature of his job makes it difficult for him to leave his work, I would submit. However, should a subpoena be ordered for Mr. Lam's attendance, then obviously we will advise Mr. Lam of that.

Judge:

I mean, that's usually -- I mean Crown usually issues subpoenas.

Laker:

We do.

Judge:

That's why I'm just trying to --

Laker:

We do.

Judge:

-- understand. Are you requiring --

Laker:

Or -- or if we -- Yes. I think what would almost be easiest in this situation is if we were able to articulate that -- that this witness is being deemed necessary by the court, and as a result that this is -- that, if necessary, we will ask for a -- a subpoena.

Judge:

Do you need a subpoena from a justice?

Laker:

I -- I --

Judge:

I mean, that's why I was asking you. I was saying, can you see, listening to the questions, that there's a area -- Mr. Fox hasn't testified. I don't know if he's going to choose to testify. I don't, at this point, fully appreciate his defence --

Laker:

Mm-hmm.

Judge:

-- but at the same time I don't want to foreclose an avenue of inquiry --

Laker:

Yes.

Judge:

-- or some possible defence. And so in . . .

Laker:

Why don't we do this, Your Honour: I -- let us go back to the VPD and indicate to them that questions were asked of Sergeant Shook that did not resolve the current issue that's at play, and that it does appear that Mr. Lam's evidence is necessary.

And then if there is a subsequent issue, what we can do is possibly come back before Your Honour very briefly, later this week --

Judge:

Yes.

Laker:

-- to address that.

Judge:

I mean, the test for a subpoena in 698, where a person is likely to give material evidence in a proceeding.

Laker:

Mm-hmm.

Judge:

I wouldn't use the word necessary, but I would say what I've already said.

Laker:

Yeah.

Judge:

That I can certainly see that it's a line of questioning Mr. Fox would like to ask a few questions at least of Mr. Lam. Would Crown be then asking that he come and present him as the last Crown witness, almost as a courtesy to let Mr. Fox cross-examine him because that's what Mr. Fox wants to do?

Laker:

To -- to be honest, I'm not inclined to do that, Your Honour. I think that the Crown's case is essentially closed at this point.

Judge:

Do you want to not formally close the Crown's case --

Laker:

Mm-hmm.

Judge:

-- to consider that --

Laker:

Yes.

Judge:

-- further, because --

Laker:

Sure.

Judge:

-- certainly it happens in cases, and Crown doesn't have to do it, but it does happen on cases where defence has the burden, that Crown still produces the witness.

Laker:

Yes.

Judge:

And ask --

Laker:

Absolutely.

Judge:

-- a few questions and then allow -- because it does seem to me that certainly the questions are more in the nature of cross- examination --

Laker:

Cross-examination.

Judge:

-- than --

Laker:

Yes.

Judge:

-- than examination in chief. Okay. I think Mr. Lam should come on the next day. And I -- I'm going to leave it with Crown for now as to the mechanics of how that happens. If it needs to come back in front of me, you can put it back in front of me in the next few days.

Laker:

Mm-hmm.

Judge:

And then the other question is whether Crown just presents him almost as a courtesy as the last witness in their case so Mr. Fox can then ask any questions he has.

Laker:

Mm-hmm.

Judge:

But that's, again, that's a Crown decision, which I'll let you consider more.

We're just past 4:30. I don't know if the sheriff needs to leave. I just wanted to quickly address voir dire #2, even though we're just past the end of the day.

Laker:

Yes, and I'll let my colleague, Mr. Elias, just step forward to deal with that. That was the bulk of his.

Elias:

And if it assists, Your Honour, my submissions are going to be exceedingly brief. I did some research and was unable to find any sort of exclusionary rule, so my position was going to be that this previous statement is just a previous statement. It wasn't compelled. It's -- having been found voluntary, in my submission it's just wording that Mr. Fox said in the past and can be given weight as to that.

Judge:

Well, Mr. Elias, it's interesting because my -- my reflection came to a similar conclusion. This is what I thought about the use of statements to which that statement could be put.

Once a statement is ruled voluntary, Mr. Fox is like any other witness who has given a previous statement about the same subject matter. While I wouldn't have permitted the statement to form part of the Crown's case against him, I will permit the Crown to use the identified extracted portions of Exhibit B on voir dire #2, that's the statement on September 17th, 2020, to be held in reserve by the Crown, to be used for the purpose of cross- examining Mr. Fox if he chooses to testify.

As a matter of housekeeping, the identified portions should be marked, I think --

Laker:

Yes.

Judge:

-- as an exhibit on -- on the trial, just for clarity of the -- or, alternatively, could be marked only if Mr. Fox testifies. But I'm just flagging that for counsel, just so you know, don't forget --

Laker:

Yes.

Judge:

-- about that.

Elias:

Thank you, Your Honour. And then the only other thing from voir dire #2 is that there were two pieces of general evidence that Constable Dent testified to. One is that identification in court of Mr. Fox, and the second is the file number that he was the lead investigator on that resulted in the probation office -- in the probation order, rather, that is before you. So I'd ask that those two discrete pieces of evidence be made -- be -- be imported into the trial proper rather than me calling Constable Dent to get him to testify to those two things.

Judge:

Right. Okay. So that's just because the Crown just wanted the ruling of voluntariness and then the purpose that not having to call Detective Dent again for the fact that it was you talking to him on September 17th, 2020, and the file number with which he was conducting investigation.

Mr. Fox, do you have any objection to that evidence going in as part of the trial proper?

Fox:

I have no objection to that.

Judge:

Okay, thank you. So that evidence will go in, that Detective Dent was speaking to Mr. Fox on September 17th, 2020, and the file number in connection with which he was having that interview.

Elias:

Thank you. To clarify, it was actually a subsequent file that the -- the statement was on two investigations prior and then he was -- the file number he provided was for the most recent investigation.

Judge:

Okay. Do you want to, to be -- for it to be clear, to say what file number you want to be part of the record?

Elias:

Yes. So it's police file number 21- 132224. That was Constable Dent's investigation.

Judge:

Did you say one three two --

Elias:

One -- yes, sorry. 132224.

Judge:

132224.

Elias:

And then the prefix 21, for 2021.

Judge:

Okay. So those two pieces of evidence will form part of the trial proper with the consent of Mr. Fox as well.

Elias:

Thank you very much.

Judge:

Okay. And you're going to not mark the identified portions now, you're going to hold and wait? Okay.

Elias:

Yes, please.

Judge:

That's fine. All right, so we will continue on March 7th. Mr. Fox to be brought in person that day. If there needs to be another brief appearance in front of me before then, you know, we've already discussed you can do that and . . .

Elias:

Yeah, thank you.

Judge:

All right. Thank you.

Laker:

Thank you, Your Honour.

Sheriff:

Order in court.

(PROCEEDINGS ADJOURNED TO MARCH 7, 2023, AT 9:30 A.M.)

Transcribers:

J. Harding - Start to Noon Recess
C. King - Noon Recess to End

Transcript of Trial Proceedings (2023-02-27)

INDEX

EXHIBITS

RULINGS