Chats and screenshots as evidence in a criminal case

Why an image is not yet a completed argument

A screen image makes a text easy to read, but usually does not fully show its own creation. It can come from a participant, a forwarded file or an appearance in an official report. A name may be chosen by the user of an address book. A date may be out of view. The question is therefore not only whether the words are in the image, but what inference is made from that image and on what that inference is based.

Our editorial contention is that digital evidence is judged more strongly when three questions are asked separately. Is the material what it says it is? Is the relevant conversation fully visible enough? And does the content support the explanation given to it? A complete conversation can be authentic and yet interpreted differently. An incomplete screenshot may show an accurate passage, but not provide enough context for a firm conclusion about intent or timing. These differences should remain visible.

The location of messages in the criminal file

The rules of evidence are set out in Article 338 et seq. of the Code of Criminal Procedure. A judge assesses whether the charged offense can be convincingly established from legal evidence. Messages can end up in the file in various forms, for example through an investigation report or as an attachment. Legal form and factual reliability are related but not identical questions. An image acquires an indisputable meaning not only by being included in a file. (article 338 et seq)

Therefore, ask the lawyer which document is used, which passage therein would be incriminating and which evidentiary step is taken with it. Is it about identification, presence, knowledge, an appointment or a reaction afterwards? A discussion about one word may seem important, while the Public Prosecution Service uses the message for another part. Anyone who knows the evidence objective can respond in a more targeted manner. The general criminal file guide discusses how access to documents and preparation with the lawyer are organised. (criminal file)

Separate sender, account and person

A phone number or account can be an indication of a person's involvement. It does not follow without further assessment that every message was written by that person. Shared use, an old number, a changed contact label or a forwarded message may be relevant if there is a concrete factual reason for this. It is not enough to just say that anyone can misuse an account. An alternative scenario is given meaning by information that can be verified in the case in question.

Therefore, note how the link between account and person is made in the file. Is there a user statement, a technical finding or just a name on an image? Which date and which device are associated with this? Also mention if you do not know who used a device. A defense is not strengthened by presenting uncertainty as certainty. The goal is to test the precise identification step, not to point out a new user or accuse someone without basis.

The missing beginning may change the meaning

A casual response such as “is good” only gains meaning through the question to which it responds. If that question falls outside the image, the reader may unintentionally fill in the context themselves. A series of messages before or after an incident can also consist of several days. Therefore, check whether the displayed order, date boundaries and participants are recognizable. A collection of screenshots neatly organized for an argument may be slightly different from the original conversation order.

Ask which missing passage is actually necessary to assess the disputed conclusion. A request for all messages from all years is not always specific enough. Perhaps it concerns the hour before the discussed appointment or a specific response after a forwarded image. Explain why that material is relevant. The lawyer can discuss how it can be responsibly secured or requested. Do not approach the other participant to make a favorable selection together or to coordinate messages.

Irony, group speech and translation require context

Messages contain abbreviations, colloquialisms, irony, and references to previous conversations. An expression can be read literally by an outsider while participants assume a different meaning. This does not mean that every unfavorable message containing the word joke can be dismissed. The alternative explanation must fit the actual context and not be constructed after the fact to eliminate a problem. The distinction between possible meaning and demonstrated meaning is important here.

Another language requires attention to the translation and the terms used. Note which words may be ambiguous and why that is relevant to the accusation. Have an appropriate expert or interpreter assess what a passage means in context when necessary. A friend who translates a loose sentence more favorably does not automatically provide a verifiable solution. Keep the original language version next to the translation and indicate which version is cited in the procedural document.

A time on the screen requires a timeline

A visible time can be confused with the date of the incident, the receipt of a message, or the time a screenshot was taken. Those moments don't have to coincide. Forwarded content can also have its own date that is not the date of the forward. You should not assume technical errors without a concrete reason, but in the event of a relevant uncertainty it must be clear which time source is used.

Create a timeline showing the event, the alleged sending time, the received file and the inclusion in the file. Include the source for each moment. Your own memory that it was around midnight is different from a technically recorded time. If different sources conflict, let the attorney determine whether additional research is necessary. Do not change device settings yourself to demonstrate a difference on material that can be examined later. A demonstration and the original evidence must remain separately identifiable.

How the material was obtained is a separate question

Messages can be voluntarily provided by a participant or from a device study. The current framework for smartphone research is relevant to the latter. The origin of the material can therefore also raise a question of jurisdiction. Reliable content does not automatically make an investigative act lawful; conversely, a possible lack of jurisdiction does not prove that the words are technically forged. Discuss both topics separately. (current framework for smartphone research)

When examining equipment, ask what demarcation, authorization and reporting are available. For screenshots provided, it is especially important who took them, what that person saw and whether more original context exists. A general accusation of manipulation can be serious and requires a factual basis. Therefore, first describe the visible defect: missing date, interrupted conversation, unknown source or a difference between two versions. The lawyer can assess which question needs to be investigated legally and technically.

Fictional example: same words, two conclusions

Suppose that in a fictional case there is a screenshot with “take him with you”. In a separate image this can be interpreted as a command that concerns a person. A longer conversation may show that the participants were discussing a toolbox just before. Conversely, additional context can actually support an incriminating explanation. The example says nothing about an actual case. It makes visible that completeness can make the meaning both more favorable or unfavorable.

A careful comparison juxtaposes the individual passage, the preceding question, the participants and the timeline. It is also examined how certain it is that both versions belong to the same conversation. The conclusion is not that a complete export is always innocent, but that a concrete context question must be investigated before an ambiguous text is used as an unambiguous assignment. Note for the lawyer exactly which inference is disputed and what additional material can test that inference.

Store available material safely and unaltered

Anyone who has relevant messages must ensure that the method of delivery does not make the origin unclear. Discuss with the lawyer which form is useful and whether technical assistance is required. Keep the original available material next to a readable copy. Don't just cut the favorable words from a conversation and present them as the full message. Do not remove unfavorable context or ask others to edit or delete their messages.

Don't share the material publicly to show you're right. Messages may contain personal data, confidential information and data of other data subjects. Use the agreed channel for the file consultation. Note who made the copy and what edits were made for readability only, for example a separate translation. Don't make a technical statement about authenticity if you don't have the knowledge or data to do so. An honestly described limited source is easier to investigate than a file with unclear edits.

One worksheet per disputed proof step

For each important message, use one short note with source, context and the conclusion to be tested. This keeps a file open for discussion, even when there are hundreds of pages of communication. A long list that takes everything out of context helps less than three concrete passages for which missing context can be identified. The worksheet below is an editorial tool; the lawyer determines which questions justify a wish to investigate or a legal defense.

• Location: which procedural document, which appendix and which page does the passage contain?
• Origin: who provided the material and what is known about the device, account and copy?
• Identification: what is the link between account and person based on?
• Completeness: which preceding or following passage is missing and why does it matter?
• Meaning: what concrete conclusion is drawn from the words and what is the alternative?
• Time: which date and time source are used and what uncertainty remains?
• Research: What limited additional material can verify the difference without changing existing data?