R. v. Alkhalil

2022 BCSC 905 R. v. Alkhalil

IN THE SUPREME COURT OF BRITISH COLUMBIA Citation: R. v. Alkhalil, 2022 BCSC 905 Date: 20220531 Docket: 27393-155 Registry: Vancouver Regina v. Rabih Alkhalil (a.k.a. Robby Alkhalil) and Larry Ronald Amero Restriction on Publication: A publication ban has been mandatorily imposed under s. 648(1) of the Criminal Code of Canada, restricting the publication, broadcasting or transmission in any way of any portion of the trial at which the jury is not present. This publication ban applies until the jury retires to consider its verdict Before: The Honourable Justice Maisonville Ruling re Application No. 155 - Admissibility of Expert Evidence of S/Sgt. Bernier Counsel for the Crown: M. Sheardown S. Dworkin N. Gregoire A. Cochrane D. Darby A. La Bar Counsel for the Accused, Rabih Alkhalil (a.k.a. Robby Alkhalil): R.S. Fowler, Q.C. K. Blok A. Tolliday Counsel for the Accused, Larry Ronald Amero: M. Rock J. Oppal Place and Dates of Trial/Hearing: Vancouver, B.C. April 12-14, 19, 25 and May 3, 5, 6, 9, 10, 2022 Place and Date of Ruling: Vancouver, B.C. May 31, 2022 Table of Contents introduction.. 3 governing legal principles. 4 s/sgt. bernier's evidence. 6 a) Background and Training. 6 b) RDX. 8 c) Time Discrepancy. 15 Notice of application 57. 17 discussion.. 18 a) Time Discrepancy Opinion. 18 b) Reliability of RDX Reports Opinion. 21 c) Proposed Non-Opinion Evidence.

26 introduction [1] The Crown seeks to qualify S/Sgt. Nicolas Bernier to give expert opinion evidence in the following areas: a) Opinion evidence that the time discrepancies observed in the extraction report for TAT 2012-166-014 (sideswipe@offshorebb.com) were likely cause by the BlackBerry Enterprise Server (BES) issue referenced as BlackBerry Knowledge Base article KB11008 affecting the BES server for offshorebb.com. This issue is described as: "When an email message is forwarded or replied to on the BlackBerry Smartphone, the BlackBerry Enterprise Server takes the message and creates a new time-stamp for the original message by localizing it with the time zone in which the BlackBerry Enterprise Server is located." In this case, S/Sgt. Bernier's opinion is that the BES server for offshorebb.com was likely affected by this issue and that the BES server could have been configured with a localized time that is one (1) hour later than the Sideswipe device. b) Opinion evidence that the software developed by the RCMP named "RDX" (RCMP Data eXtractor) generates a report in a readable format of the data contained in the physical extraction (image) of the BlackBerry device analyzed. That the RDX software program is capable of interpreting the data contained in the physical extraction (image) including the built-in BlackBerry encryption (i.e. content protection) and PGP encrypted

messages. S/Sgt. Bernier's opinion is that in his experience using RDX for almost 5 years that the reports generated by RDX are reliable. [2] The Crown also seeks to qualify S/Sgt. Bernier to give non-opinion evidence in regards to the following: a) The analysis of BlackBerry smart phones including the extraction and examination of electronic data stored on encrypted BlackBerry smart phones. b) The description and explanation of the security features available to the user of BlackBerry smart phones including supplementary third-party encryption services like Pretty Good Privacy software or PGP. c) The interpretation of RCMP RDX BlackBerry analysis reports and reports produced of BlackBerry data extracted from Cellebrite UFED Physical Analyzer. d) The description and explanation of the most common types of data recovered from BlackBerry smart phones, including address books, log notes, SMS, PIN to PIN, e-mail, and BlackBerry Messenger. [3] The accused oppose the application. They argue that the Crown has failed to meet its burden of establishing that RDX possesses the requisite reliability to permit the admission at trial of the reports it generates. They further contend that S/Sgt. Bernier is not sufficiently qualified with respect to the operation, reliability, and functionality of RDX or the operation of BES servers to ground the opinions the Crown seeks to have admitted. [4]

Before reviewing the evidence led on the voir dire, it will be helpful to first set out the analytical framework that will govern this application. governing legal principles [5] Opinion evidence is generally inadmissible. This is because it is a fundamental principle that it is for the trier of fact to draw inferences from the evidence and to form their own opinions regarding the issues in the case. Expert opinion evidence is an exception to this general exclusionary rule and may be admissible when the subject matter is outside the experience and knowledge of the trier of fact. It is the expert's function to provide the trier of fact with a ready-made inference from the facts that the trier of fact, due to the nature of the facts, is likely unable to formulate themselves. [6] Accordingly, expert opinion evidence is presumptively inadmissible. The burden of proving admissibility rests with the proffering party, here, the Crown. The framework for analyzing the admissibility of expert opinion evidence was set out in R. v. Mohan, [1994] 2 S.C.R. 9 and clarified in White Burgess Langille Inman v. Abbott and Haliburton Co., 2015 SCC 23. It consists of a two-stage approach, the first of which focuses on the threshold requirements of admissibility and the second of which focuses on the trial judge's discretionary gatekeeper role. In R. v. Abbey, 2017 ONCA 640, the Court summarized the

admissibility framework as follows (at paras. 48-49) [48] The test may be summarized as follows: Expert evidence is admissible when: (1) It meets the threshold requirements of admissibility, which are: a. The evidence must be logically relevant; b. The evidence must be necessary to assist the trier of fact; c. The evidence must not be subject to any other exclusionary rule; d. The expert must be properly qualified, which includes the requirement that the expert be willing and able to fulfil the expert's duty to the court to provide evidence that is: i. Impartial, ii. Independent, and iii. Unbiased. e. For opinions based on novel or contested science or science used for a novel purpose, the underlying science must be reliable for that purpose, and (2) The trial judge, in a gatekeeper role, determines that the benefits of admitting the evidence outweigh its potential risks, considering such factors as: a. Legal relevance, b. Necessity, c. Reliability, and d. Absence of bias. [49] In short, if the proposed expert evidence does not meet the threshold requirements for admissibility it is excluded. If it does meet the threshold requirements, the trial judge then has a gatekeeper function. The trial judge must be satisfied that the benefits of admitting the evidence outweigh the costs of its admission. If the trial judge is so satisfied then the expert evidence may be admitted; if the

trial judge is not so satisfied the evidence will be excluded even though it has met the threshold requirements. [7] In R. v. Bingley, 2017 SCC 12 at para. 17, the Court noted that the foregoing admissibility analysis cannot be conducted in a vacuum, and held that before applying the two-stage framework, the trial judge must first determine the nature and scope of the proposed expert opinion. The boundaries of the proposed opinion must be carefully delineated to ensure that any harm to the trial process is minimized: R. v. Abbey, 2009 ONCA 624 at para. 62; R. v. Sekhon, 2014 SCC 15 at para. 46. [8] In the present case, the only issues in dispute are S/Sgt. Bernier's qualifications to give the opinions sought and the reliability of the RDX software. Within the issue of qualification, the requirement that the officer be impartial, independent, and unbiased is not challenged. s/sgt. bernier's evidence [9] S/Sgt. Bernier testified over six days in April and May 2022. a) Background and Training [10] S/Sgt. Bernier is currently the Non-Commissioned Officer In Charge (NCO I/C) of the RCMP's "K" Division Digital Forensic Services. [11] S/Sgt. Bernier joined the RCMP in 2004 and after serving for three years, joined the Integrated Technical Crime Unit ("ITCU") in Ottawa as a digital forensic investigator. In that capacity, he conducted forensic analysis of seized computers and other

digital devices, as well as provided support services to other units and on-site expertise in the execution of search warrants. [12] From January 2011 to December 2015, S/Sgt. Bernier was a digital forensic investigator with the Technical Analysis Team ("TAT"), which he described as an escalation point for ITCU, his previous unit. TAT provided national support for difficult and challenging devices that required research and development and specialized techniques. At the time, his main task was "pretty much all BlackBerry devices" being sent to the unit from across the country. S/Sgt. Bernier explained that TAT had developed expertise in circumventing locked BlackBerry devices and interpreting the data they contained, including that which was PGP encrypted. He testified that this was the majority of his work during that timeframe. [13] Following his years with TAT, S/Sgt. Bernier became a senior cybercrime instructor with the Canadian Police College, Technical Crime Learning Institute, RCMP Headquarters, from late 2015 to February 2020. His main duty was teaching a cellphone seizure and analysis course to mobile device examiners from law enforcement agencies. S/Sgt. Bernier was additionally the primary course coordinator and instructor for the "technical court expert and testimony course", which was developed to prepare examiners to more effectively present technical evidence in

court and to understand their role and function as expert witnesses. [14] S/Sgt. Bernier subsequently became the NCO I/C of the National Digital Forensics Program for the RCMP in Ottawa from February 2020 to February 2022, before transferring to his current position. [15] With respect to his education and training, S/Sgt. Bernier completed two years of engineering and computer science courses at the University of Regina, Saskatchewan and St. Lawrence College in Ontario before receiving an offer to join the RCMP cadet training course. After joining ITCU in 2007, he enrolled in the understudy program, which included courses and workshops in computer forensic examination, cellphone seizure and analysis, internet evidence analysis and network investigative techniques. Over the years, he has also completed a great many training courses put on by vendors of the various forensic examination tools and programs. He has numerous certifications in relation to such tools and programs, including XRY, BlackLight, and Cellebrite. [16] S/Sgt. Bernier has testified as an expert witness in numerous proceedings across Canada with respect to the forensic analysis of BlackBerry devices, including encrypted devices, the extraction of data, and the interpretation of extraction reports relating to PGP and RDX. His CV lists seven such cases, including, in this province, R. v. Ferguson, R. v. McBride,

and R. v. McKinnon. He has given evidence both for the Crown and for the defence. He has also testified with respect to extraction reports as a fact witness on another five or six occasions. b) RDX [17] In brief, RDX is a forensic software tool developed to automate the process of data extraction and interpretation from the memory image of mobile devices. The software essentially translates the extracted data into a readable format. [18] S/Sgt. Bernier was not a developer of RDX. Rather, as an end user of RDX, his role was to apply the software to data extractions. [19] S/Sgt. Bernier explained that RDX was developed by the RCMP around 2008/2009 for the specific purpose of interpreting data extractions from BlackBerry devices. Prior to this time, BlackBerry extractions were limited to unlocked devices. S/Sgt. Bernier explained how RDX functions: So when a BlackBerry device is locked there is no easy USB solution to circumvent a locked BlackBerry. That's still the case today, 10 years later. If a BlackBerry is locked, it has to -- to circumvent the lock on it you have to have direct memory access to the device. And so my colleagues on the lab side of the Technical Analysis Team, Gino Vecchio for example, they would take the device and obtain an extraction of the device. I spoke of the chip-off method and the in-circuit method. My role as an analyst was to take that extraction

and to do the interpretation of the data using RDX. So one of the things we would look at when we obtained -- we took a copy of the extraction that was obtained by our lab, for example from Mr. Vecchio. We would verify the digital fingerprint to make sure that it's the same extraction that he had obtained, and that's documented on his lab report that he produces. And from that point we determine if the device has encryption or has PGP on it. And then we start our process, which involves, in many cases, preparing the file for RDX, extracting the password, the scrambled string that represents the password for the device unlocking and the password for the PGP key access if it has PGP, and then we resolve those passwords to their plain text equivalency. And then at that point we can enter or plug in everything into RDX and then interpret the data and generate the reports. [20] In more simple terms, S/Sgt. Bernier explained that RDX is able to find the PGP decryption key stored in the memory of the device, which is then used to decrypt its contents. [21] In mid to late 2012, Cellebrite developed the technology to interpret a BlackBerry physical extraction from a chip-off or in circuit extraction and was therefore able to support an extraction where there was no PGP encryption. However, prior to that time, the only tool available to interpret the physical extraction was RDX. [22]

S/Sgt. Bernier described how, given the lack of commercial tools that could do backup extractions and analysis of locked BlackBerrys, the RDX software tool "was unique, a niche". For this reason, his training with the software only came once he had joined the unit; as the tool had been developed in-house, all of the training was necessarily also in-house. As he described the training: It's essentially going through the motions from A to Z to complete an examination from the point of view of an analyst when our lab had extracted the data, and we would take a copy of that data, and just walk through the process of getting the final report. [23] In addition to this hands-on experience processing devices, S/Sgt. Bernier sent out many reports over the years and fielded questions about how to read and interpret them. [24] S/Sgt. Bernier testified that he received RDX training as soon as he started with TAT, which was being "beefed up" to meet the high demand for processing. He said that when he joined, there were close to 500 devices submitted by other law enforcement agencies waiting in the queue for processing, as there was no other solution for locked BlackBerrys. He was one of the individuals brought into the unit to be trained and to help clear the backlog. During his time with TAT, they were doing five reports on a slow week, ten on a busy week. [25] S/Sgt. Bernier testified

that he was trained on RDX 3, which was the predecessor to the version that was used in this case. RDX 3 was more manual than the new version, and required that the correct template be applied to the exact software version present on the device. As the developers of the RDX software were in the same unit, if he ever had an issue with its application to a newer device, they could have a look at it and work with him to update the template to decode the data on the device. Although the accused suggested in their submissions that what S/Sgt. Bernier meant by "template" was never made clear, I note that it is a common word in computer language, defined in dictionaries as something having a basic format that can be used many times. More importantly, S/Sgt. Bernier testified that in this context, a template was specific to each version of the operating system on a device. He described the function of the templates as follows: And then the templates in our RDX scans through the files and then matches using the template. It will look at a record and say, "You meet the definition of an address book entry. I will apply this template to this record and -- and decode that as an address book entry." And so it's -- it's very similar to what the modern tools today do, they just do it more dynamically. But they used -- they used definition of what a record is. So does it look like a duck, does

it quack like a duck, and then it interprets it as a duck, for example; right? And it just iterates through the extraction that way and interprets the records. [26] RDX 4 was the next iteration of the software and was more automated and easier to use. It had streamlined a lot of the different processes. It was the version used in relation to the devices in the present case. TAT changed over to version 4 around January or February 2013. [27] S/Sgt. Bernier testified that he used the older version of RDX for approximately one year and generated approximately 100 reports. If all of the various iterations of RDX are taken into account, he has generated a couple hundred reports involving PGP. Moreover, since there was no Cellebrite support for BlackBerrys in 2011, RDX was also used for non-PGP BlackBerry decryption. Thus, in total, S/Gt. Bernier estimates he generated around 400 RDX reports. [28] S/Sgt. Bernier gave evidence about verification of the data interpreted by RDX. He testified that in the early days when most devices were subject to an in-circuit extraction, he would verify the content on the device in an isolated Faraday environment to ensure that the decoding was successful. Because the device was still functional, he was able to undertake a sample verification of the records, usually the top five or so messages, the bottom five messages and a sample from the middle. As

well, he would visually scan through the report to see whether he could pick up anything that had not decoded properly. Finally, the practice was also to have a peer review the report before it was sent out. [29] For the majority of S/Sgt. Bernier's time, however, the extraction method was largely chip-off, which meant that the device would no longer function afterwards. Thus, some of the verification we did was just we would scan through the report to make sure that the -- the data had decoded successfully. And then when dealing with encryption, especially in the case where the device has the BlackBerry's built-in encryption and PGP encryption, you're dealing with two layers of encryption, so if one were to fail you would get basically -- it's all or nothing, essentially, in terms of encryption and decryption. So if we get a successful decryption after tackling the BlackBerry encryption and then the PGP encryption, we know we were successful at decrypting the data. [30] S/Sgt. Bernier repeated several times in his testimony that if RDX is not successful, it simply does not decrypt. It is all or nothing. He explained that sometimes RDX and other forensic tools will mis-decode certain characters because there might be special characters or a mix of languages in the content, and he has had to sometimes fix those decoding issues manually. However, asked whether he had observed any

instances in which RDX had generated reports that were shown to be completely wrong, he said that he had not. [31] S/Sgt. Bernier was asked to compare messages from the Birdman device and the WrathofTitans device, representing two sides of the same conversation. The Birdman messages had been obtained using RDX, while the WrathofTitans messages had been obtained using the in-circuit technique to obtain the password hash and screenshots taken of the messages. He said that the messages matched, which spoke to the reliability of RDX. [32] S/Sgt. Bernier was asked whether, as a result of his education, work, and experience, he had formed an opinion about the integrity of the RDX extraction reports produced by TAT as to whether they reliably reflect the content of the examined devices. He responded yes, it is reliable. [33] RDX software was developed in-house by the RCMP and is not publicly available, though it has been shared with a federal agency of a Five Eyes security partner that S/Sgt. Bernier did not identify (but one of either the United Kingdom, the United States, Australia or New Zealand). In cross-examination, he was asked extensively about the National Institute of Standards and Technology (the "NIST"). He agreed that RDX has not been subject to independent testing and validation the way Cellebrite had by the NIST, which he agreed was a well-regarded and respected USA

agency; all testing of RDX has occurred in-house; he did not know the processes used by the developers of RDX to document validation reliability of the software, nor was he aware of the operating procedure or protocol for testing the product; any reports or documentation on bugs, patches and errors were proprietary and kept internally by the team that maintains RDX; there is always a possibility that software has bugs; at the time RDX was developed it was novel in that no other existing program, whether commercially available or not, was capable of doing what it did; and, he was not aware of the error rate of the RDX software and he had seen error rates in NIST reports. He said that if the other agency that used RDX had reported any problems to the developers, they would have addressed them. [34] In cross-examination, defence counsel put to S/Sgt. Bernier a number of issues with the RDX reports in this case, including messages that appear to be mis-dated, the addition of messages to conversations threads where they do not appear to belong, duplicate messages, messages that appear to be missing their content, the presence or absence of additional fields and apparent decoding and decryption errors. The officer was unable to explain these issues and deferred to the developers of RDX, saying that they would need to look at the records directly in relation to questions, which were

very specific to the internals of the record. In his re-examination, S/Sgt. Bernier was asked whether any of these issues or combination of issues affected his opinion about the reliability of RDX reports. He responded: No, because what's in the alternate body gets decrypted in human readable text that makes sense. All the other fields the developers would have to address what those fields are. They're -- they're included in RDX as fields that get extracted with a message, and they may have no meaningful meaning. But what's a full message with a "to" and a "from" and an alternate body that's human readable decrypted messages, I have confidence in the content of those. [35] The officer had earlier explained that "alternate body" was the decrypted PGP message. [36] S/Sgt. Bernier testified that in November 2020, two experts retained by the defence in this case attended with their own dataset for a demonstration of RDX. The plan had been for two TAT employees to apply RDX from PGP encryption to report generation in the presence of the defence experts and using their dataset. However, the dataset the experts had did not work and in the end the demo was conducted with a sample dataset from TAT. S/Sgt. Bernier testified that they did not hear back from the defence experts as to whether they wished to return with another dataset and try again. [37] In cross-examination, S/Sgt. Bernier

was directed to evidence he had given in proceedings in Montreal in July 2019. By way of context, he had been called as a fact witness by the Crown. Defence counsel then sought to question him to qualify him as an expert. He was asked whether he was an expert in BlackBerrys: Q [ ] and Mr. Gauthier asked whether he could be, that is you, qualified as an expert, and the court said [as read in]: He's not an expert on BlackBerrys, he's never said that. And then at line 13 on page 31, the question was: So you're not an expert on the function of BlackBerries? A In this trial I have not been qualified as an expert, no. But that's not what I'm asking, I mean do you have the knowledge, more than the average person, of how a BlackBerry functions? And then you responded: To be fair to the court, the -- you know, it's been four and a half years since I worked at the Technical Analysis Team, so I would say the expertise is, you know, coming behind me. Turn over the page. Q Mm hmm. A So that's one of the main reasons where I wouldn't say right now that I'm comfortable to be the same expert level that I was three years ago, four years ago. Which would be 2015/2016, correct? A Correct, yes. Q So what you're saying is that your knowledges are not up to date? A Well, the reason primarily for that is that BlackBerry devices - like I teach at the Canadian Police College mobile device analysis, and

I touch on it, and BlackBerry devices are statistically zero percent of the global market so we don't teach BlackBerry very much anymore, it's Android and Apple . . . -- and then there's an inaudible -- -- U.S. So since coming to the police college in 2015, I've dedicated very little time to BlackBerry devices. Can you run that by me again, the you're a teacher at the Canadian Police College, and you teach how to extract evidence from mobile phones? A Yes. But you don't teach anything about BlackBerry? A We provide material at this point, but we really don't dedicate very much time at all to it. Q Why? A Again, that's again because our police officers or clients don't see them as much anymore. BlackBerry has a market share I think that rounds down to zero percent. Q Zero. A So it's not worth dedicating too much time on them anymore. Q Mm hmm. Ten years ago they were the main Smartphone, but not so much anymore. [38] Asked whether those answers were true, S/Sgt. Bernier responded they were true "in the context of that case, yes". He later explained in re-examination that he had been a lay witness in that case, and that another person had given evidence regarding RDX and flash memory. While his responses were true, he said that with the benefit of hindsight the comment about those days being behind him sold himself short since the technology had not changed since the time he was

in TAT. c) Time Discrepancy [39] S/Sgt. Bernier testified how time is recorded in a BlackBerry. In essence, the device internally records the date and time in Universal Coordinated Time ("UTC"). They are stored as a 13-digit number (Java time), which is the number of milliseconds that have elapsed since January 1, 1970, decoded to the UTC. RDX takes the number, decodes it, and leaves it at UTC. [40] S/Sgt. Bernier reviewed all of the PGP charts and confirmed their accuracy with the source extraction reports. He extrapolated the UTC time into the apparent time zones of the users. In reviewing the Sideswipe messages, he noticed that the time conversions were a little off in that multiple devices on offshorebb.com sending messages to Sideswipe were stamped an hour ahead. He testified that he did not believe that the devices themselves were misconfigured because the time discrepancy applied to more than one device. The first step he took was to verify that the timestamp in RDX was properly decoded to rule out the possibility that the one hour discrepancy was a coding issue. He confirmed that both Cellebrite and RDX had decoded the timestamp the same. He then decided to manually decode the timestamp that was displayed in the RDX record by going directly to the memory extraction. Again, it matched what was in the report. He also noted that based on other communications, it did not

appear that there was an issue with the configuration of the Sideswipe device. He ultimately formed the opinion that the cause was likely that described in a article published by BlackBerry. He gave the following evidence in this regard: A So the data on the device has the timestamp that is one hour ahead, so it's so again that to me stood out as something strange, because like I mentioned earlier you would expect the sent datetime and the ribbon datetime, which are based on UTC, so kind of your baseline, to be closely in sync to each other, but in this case here they're now ahead. Q Okay. And then you have a summary on the last slide, page 24. A Yes, so based on the examples of Sideswipe communicating with other parties, it appears that the device for Sideswipe is configured in line with UTC, so it does not appear that it's an issue with the Sideswipe device itself. Messages received from fellow offshorebb users are showing up as an hour ahead of time. And the timestamps in RDX were decoded correctly, and it was verified manually. The messages sent by Sideswipe and others on the offshore BES via reply forward, they do appear to be affected by the BlackBerry BES issue that I referenced. It's a knowledge based article that BlackBerry published where it was an issue or a bug, I guess, between the handsets and the BlackBerry Enterprise Server where in some circumstances the server

so again if you imagine a user sending a message, and they type their message and it goes in an envelope, and they hit send on their device, and it timestamps the sent time sent on the network, and it goes off to the - the server to be handed off down the line to the recipient down the road. The the issue described mentions that it's essentially in that situation it appears that the server received the mail, and stamps its own server timestamp on it, based on its current time and time zone. And then forwards it off. So it gets corrected. There's recommendations on how to resolve the issue in the knowledge based article, but again we don't - we don't know the details of the BlackBerry Enterprise Server configuration for offshorebb, but to me that appears to be what has happened with those messages, they they leave the device, and something is changing the timestamp when before the other parties see it, and then other members on the offshorebb when they're sending messages to Sideswipe, their timestamp for their sent messages are jumping ahead an hour. So it could be that the server is in a time zone one hour ahead, so could be, you know, the users are in Toronto and the server is based in Atlantic Time, or it could be that the server was just misconfigured, and when standard time resumed in November it remained at Daylight Savings Time, which would cause it to be an hour

ahead. So it's again, there's not much to go off on that BlackBerry Enterprise issue, knowledge based article, it's not in, you know, extreme detail, but that behaviour seems to be what's happening with this device and its fellow users. Q So is your opinion based on what you've seen that the original message is localized in the time zone which the BlackBerry server Enterprise Server is located? A It seems to support that there's something happening with the offshorebb users, and the BES - it appears that if this is being - if this issue is accepted as what is happening, then the server would be an hour ahead, so it's stamping the - the letters as they're going across with its timestamp, which is an hour ahead. Q And is that your opinion of what's happening? A Yes. [41] S/Sgt. Bernier testified that these time discrepancies would not affect the content of the messages. [42] S/Sgt. Bernier gave evidence about BlackBerry Enterprise Server ("BES"), which is software that allows individuals and agencies to customize and administer the email capabilities of BlackBerrys. The software is managed by an administrator who has a password that enables them to access the server and make whatever functional changes they wish, such as limiting the number of messages that remain on a device as opposed to the server or setting up automatic message forwarding protocols. S/Sgt. Bernier did not

have access to the BES in this case and agreed that whoever owns the server effectively manages it. He said that he was "not an expert on the BlackBerry Enterprise Server admin side and infrastructure and all that". He also accepted that the proposition that he had an understanding of BES's general functionality but not its full extent or scope was a fair statement. Notice of application 57 [43] In evidence on the voir dire was Notice of Application 57, "Notice of Motion for the Disclosure of the RCMP Decryption Program Referred to as 'RDX'", filed on December 12, 2019 by counsel for Mr. Amero. The application sought disclosure of the software on the grounds that such was necessary for him to "test the accuracy and reliability of the technology" and therefore to make full answer and defence (at para. 32). The voir dire was anticipated to run a number of weeks. Counsel for the Attorney General of Canada, Joel Katz, became involved as the RCMP refused disclosure on the grounds of investigative technique privilege. [44] As noted earlier in this ruling, two defence experts visited TAT for a demonstration and live explanation of the RDX system. They did so on undertaking. By email dated January 28, 2021, Mr. Gauthier advised Mr. Katz that "[f]ollowing our experts' visit at the RCMP last November, [ ] it is not our intention to pursue this matter further at this point, with one

exception". That exception related to obtaining a copy of an original memory chip. [45] Nothing was ever raised further in court in relation to Notice of Application 57. discussion a) Time Discrepancy Opinion [46] The scope of the opinion evidence the Crown seeks to lead from S/Sgt. Bernier on this issue is the following: Opinion evidence that the time discrepancies observed in the extraction report for TAT 2012-166-014 (sideswipe@offshorebb.com) were likely caused by the BlackBerry Enterprise Server (BES) issue referenced as BlackBerry Knowledge Base article KB11008 affecting the BES server for offshorebb.com. This issue is described as: "When an email message is forwarded or replied to on the BlackBerry Smartphone, the BlackBerry Enterprise Server takes the message and creates a new time-stamp for the original message by localizing it with the time zone in which the BlackBerry Enterprise Server is located." In this case, S/Sgt. Bernier's opinion is that the BES server for offshorebb.com was likely affected by this issue and that the BES server could have been configured with a localized time that is one (1) hour later than the Sideswipe device. [47] The Crown submits that the PGP messages are core evidence of the offences charged and are therefore relevant. It further says that S/Sgt. Bernier's opinion is necessary because in certain messages on the Sideswipe device,

Sideswipe and another appear, based on the content of the message, to be in the same jurisdiction but, according to the extraction records, are in two different time zones one hour apart. The Crown says that S/Sgt. Bernier is able to provide an explanation for this otherwise confusing discrepancy, one that the jury would not be able to come to on their own. [48] For the reasons put forth by the Crown, I agree that S/Sgt. Bernier's opinion is both relevant and necessary. His opinion on this issue is also not subject to another exclusionary rule. [49] I turn then to the sole issue in dispute, which is whether S/Sgt. Bernier is qualified to give the proposed opinion. [50] In Mohan, at para. 27, Justice Sopinka defined the test for a properly qualified expert as follows: [ ], the evidence must be given by a witness who is shown to have acquired special or peculiar knowledge through study or experience in respect of the matters on which he or she undertakes to testify. [51] Similarly, McLachlin C.J. stated in Bingley that "the basic requirement of expertise for an expert witness is that the witness has expertise outside the experience and knowledge of the trier of fact" (at para. 19). [52] The accused submit that it is clear from his testimony that S/Sgt. Bernier's opinion regarding the time discrepancies relating to the BES server derive largely from the BlackBerry article and is

premised on the manner in which BES servers themselves function. However, the officer acknowledged in cross-examination that he was not an expert on BES administration and infrastructure. He also agreed with testimony he had given in 2019 that his expertise in BlackBerrys was behind him, that he did not have the same level of comfort in his expertise as he did earlier in 2015/2016, and that he had dedicated very little time to BlackBerry devices since 2015. The accused argue that it is accordingly unsustainable for the Crown to now suggest he is qualified to give expert opinion evidence in these proceedings. [53] The accused further submit that to the extent the BlackBerry article forms the basis of S/Sgt. Bernier's opinion, it is an unsourced, unattributed and anonymous article from BlackBerry's website, and is inadmissible. To permit S/Sgt. Bernier to ground his opinion on this unsourced internet posting strays far from the permitted use of secondary source material in this context as summarized in R. v. Awer, 2016 ABCA 128 at paras. 62-64. [54] I disagree with these submissions and conclude that S/Sgt. Bernier is qualified to give the opinion sought by the Crown. [55] The accused attach much significance to S/Sgt. Bernier's comment that he was "not an expert on the BlackBerry Enterprise Server admin side and infrastructure and all that". However, it is for the Court to

determine whether a proposed expert has the requisite expertise, not the witness. In my view, there is little doubt from S/Sgt. Bernier's evidence as a whole that he is very knowledgeable about BlackBerrys and how they function. This is evidenced in his detailed responses to questions from both Crown and defence, as well as in his detailed PowerPoint presentation about BlackBerrys. While it is not obvious to me that BES is an entirely separate issue from the functioning of BlackBerrys, I am satisfied that he is sufficiently knowledgeable about BES to give the narrow opinion sought. It is clear from his testimony regarding the time discrepancy that he had considered other potential explanations for it, including that the server was in an earlier time zone or that the server was misfigured and did not reflect the change from Daylight Savings Time. This demonstrates an understanding of BES beyond that of the trier of fact. [56] As for the proposition that S/Sgt. Bernier by his own admission has not maintained his expertise with respect to BlackBerry technology, the officer himself addressed this when he explained that BlackBerry has, in essence, become obsolete technology and thus not worth dedicating time to anymore. His expertise cannot be anymore current than it is. [57] The article to which S/Sgt. Bernier refers was published by BlackBerry on its website to explain a

particular anomaly, which is that "when a message is forwarded or replied to, the time-stamp for the original message appears incorrect" (the title of the article). It described the cause of the problem and suggested a resolution. While referred to as an article by the parties, it is perhaps more accurately described as something of a troubleshooting guide. I would also note that although S/Sgt. Bernier referred to it several times in his testimony as a "knowledge based" article, "Knowledge Base" is the name that BlackBerry attached to the information. [58] In my view, it is common sense that when BlackBerry flags an issue with its own technology, a user or someone wanting to understand the problem would consider what BlackBerry had to say about it. It is, accordingly, entirely appropriate that S/Sgt. Bernier inform himself with the article. [59] The Crown does not seek to enter the article as evidence at trial. [60] I am therefore satisfied that S/Sgt. Bernier's proposed evidence meets the threshold for admissibility as it relates to the opinion the Crown seeks to lead. I do not understand the accused to argue that the proposed evidence should be excluded under the second stage of the admissibility analysis. I would decline to, in any event, as I am also satisfied that the benefits of its admission outweigh any potential risks or costs. b) Reliability of RDX Reports

Opinion [61] The scope of the opinion that the Crown seeks to lead from S/Sgt. Bernier with respect to this issue is the following: Opinion evidence that the software developed by the RCMP named "RDX" (RCMP Data eXtractor) generates a report in a readable format of the data contained in the physical extraction (image) of the BlackBerry device analyzed. That the RDX software program is capable of interpreting the data contained in the physical extraction (image) including the built-in BlackBerry encryption (i.e. content protection) and PGP encrypted messages. S/Sgt. Bernier's opinion is that in his experience using RDX for almost 5 years that the reports generated by RDX are reliable. [62] The proposed opinion evidence of S/Sgt. Bernier goes to the reliability of the reports generated by RDX, which translates computer code into understandable text. The Crown contends that with his training and vast experience working with RDX, S/Sgt. Bernier is in a unique position to provide the jury with his opinion regarding the reliability of the software. [63] The Crown contends that the PGP messages comprise key evidence of the offences charged and are therefore relevant. It further submits that given the apparent intention of the defence to argue to the jury that the extraction reports are unreliable, S/Sgt. Bernier's opinion as to their reliability is necessary. [64] For the reasons put

forth by the Crown, I agree that S/Sgt. Bernier's opinion is both relevant and necessary. His opinion on this issue is also not subject to another exclusionary rule. [65] The accused challenge both S/Sgt. Bernier's qualifications and the reliability of the RDX program. [66] With respect to the former, the accused submit that S/Sgt. Bernier provided limited evidence with respect to the RDX program and the manner in which it functions. His training and experience are limited to the production of the RDX report itself. He testified numerous times that whenever there was an issue with the manner in which the program functioned, it was the developers of the software who would be responsible for remedying it. It is thus clear that S/Sgt. Bernier does not possess the necessary qualifications with respect to RDX itself. His experience and training is as an end user and he is therefore unable to be effectively cross-examined with respect to issues and anomalies produced by the software. [67] As for the reliability of RDX, the accused submit that since the program is novel, the Crown bears an additional evidentiary burden of establishing that the program is reliable. They point to S/Sgt. Bernier's evidence that RDX is "novel" and "niche", and that no comparable product exists in the field. The accused say that the tool has not been independently tested and the Crown has led no evidence

of its reliability other than the anecdotal testimony of S/Sgt. Bernier himself as to his own spot checking of the program as an end user. No records of internal testing have been disclosed and no knowledgeable witness has been called to give this evidence. They contend that forensic tools of this nature can and have been tested, and that testing is essential to demonstrate reliability. [68] To reiterate the standard set out Bingley, the basic requirement of expertise of an expert witness is that they have expertise outside the experience and knowledge of the trier of fact. I am satisfied that S/Sgt. Bernier amply does as it relates to the interpretation and reliability of RDX generated reports. [69] S/Sgt. Bernier has extensive training and experience in interpreting RDX reports, an area most certainly beyond the experience and knowledge of the trier of fact. He was brought into TAT in 2011 to assist in clearing the large backlog of BlackBerrys in the queue to be decrypted, and he immediately underwent "A to Z" training on how RDX worked. Over the five years he was with TAT, he not only processed devices and generated RDX reports but he also fielded questions from recipients of the reports as to how to read and interpret them. He estimates that he generated over 400 RDX reports during this time. This provides him with a solid basis upon which to form an opinion about the

reliability of the reports. [70] S/Sgt Bernier's opinion about reliability is based on that considerable experience, and is not invalidated because he was not the developer of the software nor has technical expertise in precisely how it operates. McLachlin C.J.'s comments in Bingley about whether a drug recognition expert ("DRE") had the necessary expertise in the application of the 12-step drug recognition evaluation and determination of impairment without understanding the underlying science are apposite (at para. 22): This conclusion is not negated by the fact that a DRE is not trained in the science underlying the development of the 12-step evaluation. The test for expertise is merely knowledge outside the experience and knowledge of the trier of fact. Knowledge of the underlying science is not a precondition to the admissibility of a DRE's opinion. The scope of a DRE's expertise is in the application of the prescribed 12-step evaluation, not in its scientific foundation. Expert witnesses are not barred from assisting the court with their special knowledge simply because they are not trained in the underlying science of the field. Such knowledge is required only where the science is novel. [71] As I will now discuss, I do not consider RDX to be novel science. [72] The fact that RDX is a niche forensic tool developed by the RCMP does not, in my opinion, make it novel science

for the purposes of the test for the admissibility of expert opinion evidence. RDX is a software program that essentially "translates" unreadable digital code into a readable format. Indeed, designing software to effect a result occurs regularly. It is neither novel science nor a new application of a recognized technique within the meaning of authorities such as R. v. J.-L.J, 2000 SCC 51 and R. v. Trochym, 2007 SCC 6. As such, it is not in every instance that it is necessary to have proof of error rates to the extent argued by the accused. [73] I agree with the Crown's submission that the DNA and novel science analogies made by the accused are flawed. Computer code is not like a blood sample that is being used to identify the blood of another person. Rather, it is more akin to a translation from a foreign language to the English language. S/Sgt Bernier is able to interpret the reports and give an opinion based on the reliability of the translation. The meaning of the translation will be up to the jury. [74] In R. v. Aitken, 2012 BCCA 134, leave to appeal to SCC refused, the Court of Appeal noted: [73] Of the identified preconditions, it is primarily the requirement for a properly qualified expert that is in issue on this appeal. In her treatment of this criterion, the trial judge identified the proper test, which is set out at p. 25 of Mohan: "the evidence must be given by a

witness who is shown to have acquired special or peculiar knowledge through study or experience in respect of the matters on which he or she undertakes to testify". In my opinion, Mr. Kelly's experience and credentials satisfy this test. As summarized by the trial judge, his qualifications are as follows: [8] Mr. Kelly has a Bachelor of Science Degree in podiatric medicine and has been practising since 1987 in the United Kingdom. He has seen approximately thirty eight thousand patients. In 2002 he became a podiatric surgeon. From 2006 to the present he has been a researcher in forensic gait analysis identification at Barts College, which is part of the University of London. He has been consulted in approximately one hundred and fifty cases and has rendered over fifty expert opinions. He has testified in the English criminal courts over twenty times. [74] In evaluating Mr. Kelly's qualifications as an expert witness, the trial judge rejected the argument that his evidence was novel science. She observed, "Podiatry has been in existence for a thousand years and the expertise of a podiatrist to analyze an individual's gait has long been accepted and practiced in a clinical setting" (para. 34). Implicit in this conclusion is a determination that forensic applications of podiatry and gait analysis do not render the practice "novel" for the purposes of the Mohan test. In my

respectful opinion, the trial judge did not err in so holding. [ ] [79] Where the proposed opinion is scientific in nature, the Daubert [v. Merrell Dow Pharmaceuticals Inc., 509 U.S. 579 (1993)] factors, outlined above, may be applicable. However, Abbey, which concerned the evidence of a sociologist who was an expert in urban street gang culture in Canada, makes it clear that the Daubert factors are not essential to the reliability inquiry where the proffered evidence is based on specialized knowledge acquired through training or experience in a particular discipline: Scientific validity is not a condition precedent to the admissibility of expert opinion evidence. Most expert evidence routinely heard and acted upon in the courts cannot be scientifically validated. For example, psychiatrists testify to the existence of various mental states, doctors testify as to the cause of an injury or death, accident reconstructionists testify to the location or cause of an accident, economists or rehabilitation specialists testify to future employment prospects and future care costs, fire marshals testify about the cause of a fire, professionals from a wide variety of fields testify as to the operative standard of care in their profession or the cause of a particular event. Like Dr. Totten, these experts do not support their opinions by reference to error rates, random samplings or the

replication of test results. Rather, they refer to specialized knowledge gained through experience and specialized training in the relevant field. To test the reliability of the opinion of these experts and Dr. Totten using reliability factors referable to scientific validity is to attempt to place the proverbial square peg into the round hole ([R. v. Abbey, 2009 ONCA 624] para. 109). [75] The jury will be able to assess for themselves the reliability of S/Sgt. Bernier's evidence. [76] Nothing in the cross-examination of S/Sgt. Bernier created doubt about the reliability of the messages themselves in the RDX reports, excepting certain fields as were put to him in cross-examination. There was no suggestion that the software converted the data into content that was devoid of meaning or that it substituted words so as to change the meaning of the messages. The defence challenge to RDX's reliability rests in large measure on the absence of independent external validation. Given that the program was developed and has been used exclusively in-house, with the exception of one other law enforcement agency, it is not surprising that it has not been submitted for external review. While reliability data from the internal RCMP testing S/Sgt. Bernier said had been conducted would have been useful, I certainly do not consider its absence here to be problematic given the other indicia of

reliability that exist. [77] When the in-circuit method of data extraction was used, S/Sgt. Bernier was able to conduct spot checks to compare the RDX generated reports to the original messages. When the chip-off method was used, S/Sgt. Bernier reviewed the RDX reports to confirm that the data had been decrypted. As he explained, if the software is not successful in a given case, it simply does not decrypt. Thus, if a report is generated, the software worked as intended. Given S/Sgt. Bernier's evidence that he had collectively generated over 400 reports, these verifications occurred over a large number of extractions and are an indication of reliability. As well, the comparison between the messages from the Birdman and WrathofTitans devices, representing two sides of the same conversation, was some further evidence of the reliability of the RDX. So, too, was the comparison of RDX reports and screen shots of the CervezaFreya device. [78] Some of the evidence led at trial further confirms the reliability of the RDX reports. This includes the shooting of Mr. Khun-Khun, which is reflected in messages on the Where-is-Waldo device, as well as discussion between Birdman and "KGB" about their son's birthday, which is consistent with the birth certificate of Mr. Amero's son. [79] Accordingly, I am satisfied that S/Sgt. Bernier's proposed evidence meets the threshold for admissibility as

it relates to the opinion the Crown seeks to lead. As above, I do not understand the accused to argue that the evidence should be excluded under the second stage of the admissibility analysis. Again, I would decline to in any event as I am also satisfied that the benefits of its admission outweigh any potential risks or costs. c) Proposed Non-Opinion Evidence [80] The Crown seeks to have S/Sgt. Bernier qualified to give non-opinion evidence regarding several areas set out at para. 2 of this ruling. The accused take issue only with the following proposed areas: a) The analysis of BlackBerry smart phones including the extraction and examination of electronic data stored on encrypted BlackBerry smart phones; and b) The interpretation of RCMP RDX BlackBerry analysis reports. [81] It follows from my comments above regarding the proposed opinion evidence of S/Sgt. Bernier that I am satisfied that he is qualified to give evidence with respect to these disputed areas. [82] Finally, I should note that the Crown also seeks to have the PowerPoint presentation prepared by S/Sgt. Bernier made an exhibit at trial. The accused are not opposed so long as S/Sgt. Bernier's opinions contained therein are ruled admissible. Given my conclusion that his opinions are admissible, the PowerPoint presentation will be marked as an exhibit at trial. "Maisonville J."