The new standard form imaging order came into force on 6 April 2022. In this article, Euan McMahon and Philippa Rees of Mishcon de Reya and Graeme Buller of Alvarez & Marsal take a closer look at the practical and forensic aspects of how the imaging process works and consider the implications of the new form order.
Imaging orders themselves are not new. They permit the forensic copying of a respondent's electronic devices and evolved out of the search order jurisdiction (which permits a physical search of premises for hard copy evidence) as the digital era began to take hold. Both are designed to preserve evidence in cases where incriminating evidence is likely to be destroyed or concealed by the defendants without the protection of the court. Both have proved to be exceptionally useful tools against fraudsters who have no compunction about lying under oath or destroying evidence of their wrongdoing.
The call for a standard form imaging order arose out of the case of TBD (Owen Holland) Ltd v Simons, in which the imaging order obtained was first found to be "unworkable" in practice and was then egregiously breached by the claimants by carrying out a unilateral review of the forensic images obtained without the defendants' consent. This prompted Lord Justice David Richards to call for a standard form to be prepared as a matter of urgency to ensure that appropriate safeguards were included for the protection of respondents. These circumstances were not dissimilar to those that led to the introduction of the standard form search order in 1994, which again sought to provide safeguards for respondents, including the requirement that an independent supervising solicitor be present, which had not been a feature of search orders up until that point.
As Lord Justice Arnold recognised in the TBD case, search orders originated in the analogue era. There was a clear need for modernisation as imaging orders had begun to take on greater prominence, with combined search orders and imaging orders becoming the default. However, the TBD case moved away from this combined approach, establishing the presumption that if an imaging order is to be made, then a search order is unnecessary. That makes sense: in many cases (though not all of course) all relevant evidence is stored electronically and so will be captured by the imaging process without the need for a physical search as well.
Set against that background, the standard form order is clearly to be welcomed. However, experience applying for and carrying out imaging orders suggests that there are certain practical and technical issues that need to be considered in advance and catered for within the order. The standard form order does not currently cater for some of these issues and it is to be hoped that the judiciary will be amenable to such variations.
These considerations start with the scope of the imaging exercise. A respondent is likely to have a large number of electronic devices (phone, tablet, laptop, desktop computers, cameras, USBs) as well as online email and cloud accounts, online messaging services, and bank accounts, which are also permitted to be imaged under the standard form order. As such, it is not uncommon to come away with terabytes of data from a single individual. The issue is of course magnified when carrying out an imaging order at an office or business premises.
Where large numbers of devices are involved (or very large amounts of data), some moderation may be required: too many devices and too much data can leave you with a process that has become so unwieldy that it is practically impossible to complete. It is not only the quantity of data that can cause issues. Businesses may also store their data in specialist or non-standard software or storage systems, which can add significant time (and cost) to the imaging process and may require specialist expertise and equipment to image. As such, a decision may need to be made (either at the time of seeking the order or else on the day the imaging is carried out) to circumscribe the imaging process and limit it to those systems / accounts / devices that are most likely to be relevant and/or most cost-effective to image. A balance needs to be struck between seeking to capture all of the relevant evidence, and ensuring the process remains manageable and costs are kept under control.
This leads into two related considerations – time limits for the imaging exercise and location of the imaging exercise – neither of which are currently catered for within the standard form order.
Time limits are beneficial to both parties. The longer respondents are kept from their devices, the more likely they are to suffer damage (which correspondingly increases the risk that the applicant may need to pay for that damage under the cross-undertaking in damages). Introducing time limits into the order can limit this risk, although consideration needs to be given to including appropriate caveats around the provision of all access credentials and provision for any particular systems or devices that will require additional or specialist processes to be completed in order to ensure their full preservation. A rolling time limit may be appropriate, with the return of key systems or devices being prioritised.
Consideration should also be given to providing within the order for devices to be removed from the premises and imaged offsite. This is likely to speed up the imaging process and may in fact prove necessary. For example, if the devices subject to imaging are old, or very large and the internal storage media will take a significant amount of time to image and verify, then performing the imaging offsite in a laboratory with dedicated and powerful hardware will expedite the imaging and verification process. If devices require disassembly and hands-on examination to access and image the internal storage media, performing the imaging offsite in a forensically sterile laboratory will limit or avoid potential inadvertent damage and debris. Devices that may require technical assistance from external third parties not at the premises (such as an outsourced IT manager or company) may need to be removed from the premises in order to gain access. From a practical perspective, imaging offsite can also limit the disruption to businesses or the sense of intrusion at residential premises.
As far as any potential review of the imaged devices is concerned, the default position under the standard form imaging order is that there will be no review. The images are simply to be kept in the first instance by the supervising solicitor and the data should not be accessed or inspected without the permission of the court. In many cases, collection of the forensic images may be all the applicant needs. As set out by Mr Justice Mann in A v B [2019] EWHC 2089 (Ch) (25 July 2019):
"Once the image is taken the documents on it are preserved and safe from the risk of destruction, and it is that wish which the order was primarily intended to meet. It is not necessary to carry out any searching or identification for that purpose; the image is safe."
However, in other cases, such as serious fraud cases where data, money or other property have been misappropriated, there may be an urgent need for the images to be searched to establish what has happened to that data or those assets, and/or to identify other wrongdoers. In those cases, an urgent review of the images may be justified and consideration of this aspect of the process should take place at the earliest stage.
There is a common misconception (among both the general public and sometimes the judiciary) that a forensic image works in much the same way as the original device and that images can therefore be searched in the same way as the original device would be. However, a forensic image is in fact a literal bit-for-bit copy of a device (or targeted part of a device) and will require specialist processing to convert to searchable files. This may need to be catered for in the order, including the provision of encryption keys or passcodes/security tokens in order to make encrypted data accessible. Consideration should also be given to the cost of this process and in turn to the number and priority of devices that are processed in this way.
Even once the processing has been completed, there are likely to remain hundreds of thousands, if not millions, of files captured in total. Further pruning of the data will therefore be required in order to reduce the number of documents that will need to be manually reviewed (the most expensive part of the process). Common methods include whitelisting (to strip out irrelevant files by separating user-created data from system files), triage reports (showing the total number and aggregate size of different file types so that irrelevant files can be discarded) and the automatic removal of personal/privileged data using analytics tools. All such methods should be catered for within the order, or through an agreed protocol with the respondent and approved by the court, which should also cater for the actual review of documents. Within any protocol, flexibility is key, to include things such as provisions for how confidential / password-protected documents are to be treated, provisions to agree and apply additional keywords, or to amend the protocol by consent, and a dispute resolution mechanism (e.g. by reference to the supervising solicitor). In some cases, it may be appropriate to include a requirement for the respondent to direct you to relevant documents, or to suggest relevant keywords, which can significantly reduce the time and cost of the review.
It may not be possible to anticipate every eventuality that may arise during the imaging and review process. However, if the issues we have identified can be pre-empted and catered for within the order, it will prevent costly skirmishes between the parties and the requirement to return to court to seek variations. The new standard form imaging order is presented in Practice Direction 25A as "an example of" an Imaging Order. It is to be hoped that this will reflect a willingness of the judiciary to accommodate variations to the order to cater for the issues identified, which are ultimately in the interests of both applicant and respondent alike.