Text Messages and Phone Data Evidence in NSW Criminal Cases

How Police Obtain Phone Data

Police access to mobile phone data has expanded significantly. Data is obtained through:

• Consensual access: Where the phone owner provides access voluntarily
• Search warrants: Authorising seizure and examination of devices
• Crime scene powers: Seizing phones as evidence at crime scenes
• Carrier records: Metadata from telecommunications providers

Once seized, phones are typically subjected to forensic extraction using tools such as Cellebrite or similar software. This extraction can recover active data, deleted data, and metadata including location information.

How Prosecutors Rely on Phone Evidence

Text messages and phone data feature in prosecutions across offence categories:

Drug Offences

• Messages discussing supply arrangements
• Contact patterns with known associates
• Financial transactions via phone banking apps

Domestic Violence

• Threatening or intimidating messages
• Messages contradicting complainant versions
• Contemporaneous complaints to third parties

Fraud and Financial Offences

• Communications evidencing knowledge or intent
• Banking and financial app records
• Documents stored on devices

Sexual Offences

• Communications between parties before or after alleged offences
• Statements relevant to consent
• Subsequent complaint messages

Common Weaknesses in Phone Evidence

Context and Interpretation

Text messages are excerpts from ongoing conversations. Prosecutors often tender selected messages without surrounding context. Critical issues include:

• Messages may be sarcastic, hypothetical, or joking
• Abbreviations and slang may be misinterpreted
• Preceding and subsequent messages may change meaning
• Non-textual communication (voice calls, in-person) is not captured

Attribution Issues

Messages from a phone are not automatically attributable to the phone's owner:

• Others may have access to the device
• Phones may be shared within households
• Accounts may be compromised or spoofed
• Messages may be sent without the owner's knowledge

Deleted and Recovered Data

Forensic tools can recover deleted messages, but recovery raises additional issues:

• Metadata may be incomplete for recovered messages
• Fragments may be recovered without full context
• Deletion timing may be unclear
• Technical artefacts may be misinterpreted as meaningful data

Selective Presentation

Police brief summaries often present selected messages supporting the prosecution case. Defence practitioners must review complete extractions to identify:

• Exculpatory messages not included in the brief
• Context for selected messages
• Inconsistencies with prosecution versions

Authentication Requirements

Phone evidence must be authenticated under the Evidence Act 1995 (NSW). Authentication typically requires:

• Evidence linking the device to the defendant
• Evidence of extraction methodology
• Chain of custody documentation
• Confirmation data has not been altered

For extracted reports (Cellebrite reports), the extraction analyst may provide a statement or certificate. Defence practitioners should consider whether to require the analyst for cross-examination.

Relevant Evidence Act Provisions

Section 69: Business Records

Carrier records and automated system logs may be admissible as business records. This includes call logs, cell tower data, and billing records.

Section 71: Electronic Communications

Section 71 facilitates proof of electronic communications by allowing inference of matters such as authorship from addresses and other indicia.

Section 137: Exclusion for Prejudice

Where phone evidence has limited probative value but high prejudicial effect (e.g., unrelated inflammatory messages), exclusion may be warranted.

Defence Approaches to Phone Evidence

CORE Defence Lawyers applies a comprehensive approach to phone data:

1. Obtain Complete Extraction

Request the full Cellebrite or equivalent report, not just prosecution-selected pages. Review the complete extraction for context and exculpatory material.

2. Challenge Attribution

Where identity of sender is in issue, require prosecution proof that the defendant authored the relevant messages. Consider who else had device access.

3. Examine Context

Place selected messages in context by examining surrounding communications. Identify how conversation tone, history, or subsequent messages affect interpretation.

4. Consider Technical Evidence

In appropriate cases, engage digital forensics experts to review extraction methodology, identify limitations, or provide alternative interpretations.

5. Cross-Examine on Interpretation

Challenge police interpretations of message meaning. Officers may assign criminal meaning to innocent communications without proper basis.