Burwell v Director of Public Prosecutions

1. MR. JUSTICE BLAIR: This case arises on unusual facts. Dr David Burwell was a consultant anaesthetist employed at East Surrey Hospital by the Surrey and Sussex NHS Trust. Academically he had been part qualified in computer sciences. Whilst he was at work he hacked into NHS computer records by cracking passwords. It was done, so it is said on his behalf, for idle amusement. His activities compromised the security of the NHS system and they constitute offences under section 1 of the Computer Misuse Act 1990. On 24th June 2008 Dr Burwell was charged with five offences, which charges were subsequently amended.

2. However, section 11 of the Act, a provision that has since been repealed, contains a time limit for bringing prosecutions. The relevant provisions are straightforward and provide as follows:

"(2) Subject to subsection (3) below, proceedings for an offence under section 1 above may be brought within a period of six months from the date on which evidence sufficient in the opinion of the prosecutor to warrant the proceedings came to his knowledge.

(3) No such proceedings shall be brought by virtue of this section more than three years after the commission of the offence."

To avoid the difficulties described by Auld LJ in R v Haringey Magistrates Court , ex parte Amyrosiou [1996] EWHC (Admin) 14,23, in ascertaining such potentially uncertain matters on identical provisions in a different statute, subsection (4) provides that a certificate signed by the prosecutor stating the date on which evidence sufficient in his opinion to warrant the proceedings came to his knowledge shall be conclusive evidence of that fact.

3. In the present case, following an appeal by way of case stated, the certificate in question was held by this court to be defective in Burwell v Director of Public Prosecutions [2009] EWHC Admin 1069 and the case remitted to the magistrates for them to decide whether the proceedings were in fact brought within the period specified in section 11(2). On 15th September 2009, at Redhill Magistrates' Court, at a hearing before deputy District Judge Hine, he held that the charges were not time barred. Against that finding Dr Burwell again appeals by way of case stated.

4. On 14th December 2009, the Deputy District Judge posed the following questions:

(1) Was the magistrates' court correct in holding that the prosecutor in these proceedings, for the purposes of section 11 of the Computer Misuse Act 1990, was confined to the police and the Crown Prosecution Service?

(2) Where a police officer permits or instructs a private person or organisation to gather and preserve evidence, does the police officer have 'knowledge' of evidence gathered in that way within the meaning of section 11 of the Computer Misuse Act 1990?

5. The argument as put by the appellant turns on the investigations of an organization called the Parkhill Audit Agency which carries on forensic investigation work. The appellant says in effect that when they are added into the prosecution process, the six month time bar is breached. The judge, it is submitted, was wrong to treat the prosecutor for these purposes as excluding Parkhill. In particular, challenge is made to the finding of the judge at paragraph 14(3) of his decision, to the effect that the NHS and Parkhill were not part of the prosecution as they were not instrumental in making or prosecuting a charge. This was because there was no evidence that either the NHS or Parkhill were contemplating a charge or that either suggested that any should be brought. That, it has been submitted by Mr Ellison for the claimant in detailed written arguments, was incorrect and in particular does not comply with the legal test which I shall come back to in a moment.

6. The facts were clearly set out by the judge and are not in dispute. The offences were committed between 8th May 2006 and 30th April 2007. On 29th June 2007 they were discovered by Mr Nick Creasey, the NHS Network Services Manager of the Trust. On 5th July 2007, Mr Creasey's findings were reported to Parkhill. I shall come back to the function of that body but, in brief, the organisation provides expert forensic investigators trained and qualified to investigate computer crime and did so on this occasion on behalf of the NHS Trust. Andrei Tinine, who was in the high-tech forensic department, began examining the computer hardware in the case, and Parkhill in due course recommended that the case be reported to the police, which was done on 6th August 2007.

7. The claimant points to the fact that from 21st August 2007 Parkhill operated in accordance with what is described as a joint plan agreed with DC O'Connor who was the investigating officer. We have been shown in the agreed bundle DC O'Connor's case chronology. That shows that on 21st August 2007:

"…initial briefing given to DC O'Connor by Parkhill. Their initial analysis suggested that offences under the Computer Misuse Act had been committed by Burwell. Parkhill's analysis is ongoing. Key decisions made by OIC DC O'Connor (1) to obtain a warrant for Burwell's home address to secure potential evidence; (2) due to complexity of case to delay arrest of Burwell until high tech analysis is complete."

8. On 31st August 2007, a search warrant was executed at Dr Burwell's home address. Both police and staff from Parkhill were there on that occasion. The Parkhill analysis revealed encrypted files on the computer seized from Mr Burwell's home but it was unable to open them. This appears to have explained some of the delay that ensued. In November 2007 Parkhill contacted the police and suggested that Dr Burwell be asked for help in opening the files. The information available suggests that DC O'Connor was concerned at that stage that the files were child pornography.

9. On 14th February 2008, according to DC O'Connor's case chronology, he had been given a draft report from Parkhill setting out the chronology of events. This was the first time that the OIC (that is officer in charge of the investigation) had a tangible report that could be discussed with the CPS. However, he added that the report was not yet of an evidential standard. On 25th March 2008 Dr Burwell voluntarily attended Staines Police Station to attempt to open the encrypted files. Despite apparently having tried for some four hours to do so he was unable to do so. On 22nd April 2008, according to DC O'Connor's case chronology:

"…decision made by DC O'Connor, in consultation with Parkhill, to collate the evidence they have into a final report of an evidential standard so that a package can be put to the CPS for a charging decision. Acknowledgement that we are unable to break the encrypted files and should progress with what we have."

That evidential package was put together on 14th May 2008 and included a statement in some detail from Mr Tinine of that date. It also included an earlier statement which had been obtained from Mr Creasey dated 9th May 2008. According to DC O'Connor's chronology this was the first time that the material was available upon which an interview plan could be made by the OIC and a charging decision made by the CPS. Thereafter, on 15th May 2008 Mr Burwell was arrested and interviewed. A day later the file was submitted to the CPS.

10. On 24th June 2008, as I have mentioned, the charges were made formally against Dr Burwell. Given the argument that has been put, I should say something about the evidence as regards Parkhill itself. The appellant has relied on the fact that its website describes the organisation as

"…having a team of specialists which brings a wealth of collective knowledge from the police, military and public sectors. It claims 'consistently high success rates in: police take-up of referred cases, client agreement to pursue criminal prosecutions, internal disciplinary proceedings, progressing of referrals through criminal/civil proceedings.'"

So far as digital forensic services are concerned, the relevant services for present purposes, the website states:

"Our forensic consultants also have a background in law enforcement to enable you to plan and conduct an investigation with total confidence. As a public sector organisation Parkhill generally undertakes work for the prosecution."

It states that:

"Recent investigative work has contributed to the suspension of a GP who was accessing inappropriate images, and a successful conviction in major international pharmaceutical counterfeiting operations."

11. As regards the evidence of the offences, the appellant says that although Mr Tinine's statement was dated 4th May 2008, whoever could be said to have had knowledge of the exhibits to the statements produced, it is said, well before 13th September 2007, would have knowledge of more than sufficient evidence to prosecute Dr Burwell for computer misuse offences. The judge took a different view. He found that the evidence sufficient to warrant the proceedings were the statements themselves which came well within the six months time limit.

12. The appellant takes a number of points based on the authorities. Firstly, as a concession in favour of the prosecution, section 11 of the Computer Misuse Act 1990 should be strictly construed. Secondly, it is submitted, relying on the case of Morgans v DPP [1999] 1 WLR 968, that "the prosecutor" for the purposes of section 11 includes any person, body corporate or otherwise who is actively instrumental in making or prosecuting the charge. Thirdly, whether a person or body which fits that description has "knowledge of relevant evidence for the purposes of section 11" will, it is submitted, depend upon the facts of the case. If there is more than one prosecutor knowledge of the evidence should be regarded as indivisible between them if it has been acquired by people who have the appropriate skills to consider whether it is sufficient to warrant prosecution. Fourthly, a person who has the appropriate skills to recognize the sufficiency of the evidence would effectively be under a duty to act upon their knowledge of the evidence so as not to frustrate the purpose of section 11(2). On the facts of this case , it is argued, the activities of Parkhill and/or its staff are consistent with the definition of the prosecutor as decided in the Morgans case. Furthermore, it and/or its employees clearly have the appropriate skills to recognise evidence of offences under the Computer Misuse Act, assess it and advise upon it. The court below therefore, it is submitted, erred in law in concluding that the prosecutor was confined to the police and the Crown Prosecution Service.

13. As regards the second question, it is submitted in the alternative that where a prosecuting police force agrees that an organisation with expertise should gather evidence on its behalf, the police force involved should not be permitted to deny knowledge of evidence gathered in that way within the meaning of section 11 of the 1990 Act. That would defeat the purpose of the provision itself and go behind the law as stated in R~(Donnachie) v Cardiff Magistrates Court [2007] EWHC 1846 Admin, and the Morgans case itself. The court below therefore, it is submitted, erred in concluding that the police would not have knowledge within the meaning of section 11 of evidence gathered on their behalf or on their instructions.

14. For its part, the respondent does not take issue with the fundamental proposition derived from Morgans , namely that:

"…normally speaking, anyone who makes or is actively instrumental in making or prosecuting a charge is deemed to prosecute it and so is called the prosecutor."

This, I pause to note, is the test as stated by Kennedy LJ at page 982.

15. Insofar as the facts of the appellant's case are concerned, Parkhill's involvement was, it is submitted, not to make or prosecute the charge. Parkhill was a forensic examiner retained to report upon the inner workings of the computer data. That is not to say that Parkhill were not actively instrumental in the progress of the investigation but that did not render Parkhill, as opposed to the police or the Crown Prosecution Service, the prosecutor. In any criminal case, it is said, where an expert is required to interrogate, analyse or display data for the purposes of adducing admissible evidence to be subjected to the scrutiny of a court, there is a clear factual distinction to be drawn between a person or an organisation involved in the investigation and the prosecutor. Parkhill Audit Agency was, it was submitted, no more than a facilitator of the production of evidence sufficient to mount a prosecution. On that basis the respondent submits that the necessity to answer the second question does not arise on the facts.

16. I would state my conclusion as follows. The appellant no longer seeks to argue, as he did before the judge, that the NHS Trust can be regarded as the "prosecutor" within the meaning of section 11 of the 1990 Act. This point is said to be abandoned in the light of the decision in RSPCA v Johnson [2009] EWHC 2702 (Admin) which was given after the hearing before the judge. Plainly, the NHS Trust was not the prosecutor in this case. It is hard to see how that point could sensibly have been advanced. Despite his careful arguments to the contrary, neither, in my judgment, is Mr Ellison correct in submitting that Parkhill Audit Agency was the prosecutor. That body, and specifically the forensic investigator, Mr Tinine, were brought in by the NHS Trust to investigate the very considerable problem which Dr Burwell had caused. The police were not involved at that stage but were later called in. Neither that fact, nor the fact that thereafter Mr Tinine and DC O'Connor worked together in investigating the offences, resulted in Parkhill Audit Agency becoming the prosecutor for these or indeed any purposes. The facts are completely different from those in the Morgans case, in which it was held that the police officer who charged the defendant was the prosecutor until the CPS took over the prosecution. In this case, Mr Tinine was the expert to carry out what Keene LJ in Dr Burwell's first appeal in paragraph 19 described as the

"…often complicated investigations necessary when dealing with possible offences concerning unauthorised access to computer data"

Mr Tinnie later gave a statement as an expert witness and would have given evidence as such at trial but for the pleas of guilty. The position of such an expert is in my judgment quite distinct from that of a prosecutor.

17. I would therefore answer the first question, namely whether the magistrates' court was correct in holding that the prosecutor in these proceedings for the purposes of section 11 of the Computer Misuse Act 1990 was confined to the police and the Crown Prosecution Service, in the affirmative. In the light of that I do not think that the second question arises for decision. But in any case it appears to me that the answer is found in RSPCA v Johnson , in which Pill LJ, with whom Rafferty J agreed, said at paragraph 33 that:

"There is no principle of law that knowledge in a prosecutor begins immediately any employee of that prosecutor has the relevant knowledge and Donnachie does not establish one. It is right that prosecutors are not entitled to shuffle papers between officers or sit on information so as to extend a time limit. There is, however, a degree of judgment involved in bringing a prosecution and knowledge, in my judgment, involves an opportunity for those with appropriate skills to consider whether there is sufficient information to justify a prosecution."

Pill LJ went on to say in paragraph 34:

"It is in the public interest that prosecutions are brought only upon a consideration of the evidence by an expert mind. In support of that approach, I refer to Burwell , paragraph 20: 'entitled to a degree of judgment as to when there is sufficient evidence'; Amvrosiou at paragraph 23: 'there is a margin of judgment given to the prosecutor'; and 'degree of judgment as to when sufficient evidence had arisen' ( Azam )."

18. The latter is a reference to the decision of Cranston J, with whom Scott Baker LJ agreed in Azam v Epping Forest District Council [2009] EWHC 3137 (Admin), where he sets out the principles applicable in this kind of case at paragraph 25. Insofar as it is necessary to do so, therefore, I would answer the second question, namely, where a police officer permits or instructs a private person or organisation to gather and preserve evidence, does the police office have "knowledge" of evidence gathered in that way within the meaning of section 11 of the Computer Misuse Act 1990, in the negative on the facts of this case. This was very much a case, to quote Pill LJ, in which it was important that there was an opportunity for those with appropriate skills to consider whether there was evidence to justify a prosecution, and "knowledge" must be seend in that light. It follows that I would dismiss the appeal.

19. LORD JUSTICE PITCHFORD: I agree. Among the facts found by the District Judge were the following which I extract from paragraph 7 of his case stated:

"Dr. David Burwell had been employed by Surrey and Sussex Healthcare Trust as a consultant anaesthetist since 2004. Employees such as Dr. Burwell were granted standard level access to the Trust's IT system which operates a network of approximately 1,300 PC's. The level of access granted to Dr Burwell enabled him as a user to log in to computers across the Trust and access the files and directories applicable to his own profile. In late June 2007 a network services manager at East Surrey Hospital named Nick Creasey realised that the memory of the entire network drive had been used up. As a result Mr Creasey investigated why this had occurred, and found a large number of files in the directory under Dr Burwell's profile. A number of other matters came to Mr Creasey's attention that led him to instituting an investigation, and to notify the Trust of his findings. In early July 2007 the Trust instructed Parkhill, a high-tech audit agency employed by the NHS to begin investigation and suspended Dr Burwell with full pay on 9th July 2007 in line with Trust policy. Parkhill attended the hospital and seized the computers that Dr Burwell had access to. Parkhill then contacted Surrey police and together they executed a search warrant at Dr Burwell's home address in August 2007. A personal computer and a personal digital system were seized along with other items at this location. Parkhill examined the Trust computers, the personal computers and the personal digital system used by Dr Burwell at work and at home and uncovered potential evidence of multiple breaches of the Computer Misuse Act 1990."

20. It is clear that the putative loser in the investigation was the Surrey and Sussex Healthcare NHS Trust. The unauthorised downloading of files in circumstances such as these was a matter of very serious concern. Thus, as the District Judge explained, the NHS Trust resolved that its own resources were inadequate and in order properly to investigate these events it was necessary to employ an expert. The same expert acted as the forensic examiner collecting evidence with a view to prosecution. The involvement of the police began in August 2007. It seems to me to have been well open to the District Judge to reach the conclusion that at no stage did the forensic expert become a prosecutor within the definition given by Kennedy LJ in the case of Morgans. At all times the thrust of the investigation and the ultimate decisions were to be for the police and the Crown prosecutor. There cannot be a more obvious case in which the expertise of the Crown prosecutor will have been required in order to assess the essential question whether there was evidence sufficient to warrant the proceedings.

21. For those reasons, upon the facts it seems to me that the District Judge's conclusion was both warranted and eminently sensible.