Removing a person’s computer or phone is the most disruptive thing done in an electronic search. Section 33(e) of the Cybercrime Code Act 2016 is the only power that permits it, and it is the only one of the seven section 33 powers with express conditions.
Section 33(e)
A member of the Police Force may, in executing a warrant, move any electronic system or device, or thing, at the place subject of the search, to another place for examination in order to determine whether it contains data that could be seized if —
(i) it is significantly more practicable to do so having regard to the task it will take to copy the data and the availability of the technical expertise that will be required to do so; and
(ii) there are reasonable grounds to suspect that the electronic system or device, or thing contains data that could be seized.
The paragraph uses “and”. Removal is not available merely because the officer suspects the device holds evidence; it must also be significantly more practicable to examine it elsewhere.
Note the standard: not more convenient, not preferable — significantly more practicable, measured against two named considerations.
Copying is the default
Section 33 offers copying before it offers removal:
- (c) copy seizable data to a storage device and take the storage device away;
- (d) copy it in documentary form and seize the documents.
Only then does (e) permit removal — and only where copying on site would be impracticable, judged by the task it will take to copy the data and the availability of the technical expertise.
The implication is that a device should be imaged on site where that can reasonably be done. Removal is for the case where it cannot — a large storage array, full disk encryption requiring specialist handling, a live system that must be preserved in its running state, or an absence of trained personnel at the scene.
Questions worth asking at the scene
| Question | Why it matters |
|---|---|
| Which paragraph of section 33 is relied on? | Removal requires (e), with both conditions |
| Why can the data not be copied here? | Goes to condition (i) |
| What grounds are there for suspecting this device? | Goes to condition (ii) — a device unconnected with the suspected offence should not be taken |
| Can a copy of business-critical data be provided? | Nothing prevents it, and a reasonable officer will consider it |
| What is the inventory of what is being taken? | Section 32(4) requires seized material to be taken before a Magistrate |
Note the warrant number and issuing Magistrate, the officers present, the time, each item removed with its serial number, and the answers given to the questions above. If the removal is later challenged, that record is the evidence.
Getting the device back
Section 32(4) says seized data or things may be detained by a Magistrate, and when no longer required as evidence, may be destroyed under an order of a Magistrate. There is no express provision for return.
Two routes remain:
- Application to the Magistrate. Section 32(2) requires seized material to be taken before a Magistrate “to be dealt with according to law”, which imports the general law — including the power to order return where the material is no longer required.
- The general search law. Section 33 operates “in addition to the powers under the Search Act (Chapter 341)”, so that Act’s provisions on the treatment of seized property continue to apply.
In practice, an application for return, supported by an offer to allow a forensic image to be retained, is the usual course once examination is complete.
The Search Act (Chapter 341) is not currently available on PacLII, so no link is given here.
If it happens to a business
- Keep current backups off the affected systems. The single most effective protection against operational disruption from a seizure.
- Identify what is critical immediately. Servers running payroll, accounting or customer service should be flagged at the scene, with an offer of imaging as the alternative.
- Consider privilege. Legally privileged material on a seized device should be identified at once and the claim recorded.
- Get advice the same day. An application to the Magistrate is easier made early.
See also what to do if you are accused of a cybercrime and managing cybercrime risk.
Sources
- Cybercrime Code Act 2016 — ss 32, 33, 34
- Constitution — ss 44, 49, 57
- Search Act (Chapter 341)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.