Section 18(5) of the Cybercrime Code Act 2016 is unique in the Act: a positive duty attached to a defence.
Section 18(5)
For the purposes of this section, if child pornography is stored for a bona fide law enforcement purpose, all traces, copies, or storage of such pornographic material shall be removed, deleted or otherwise destroyed once it is no longer lawfully required.
“Shall” — the duty is mandatory, not discretionary.
“All traces, copies, or storage” — not merely the primary copy. Working copies, forensic images, extracts, thumbnails, backups and any residue.
“Once it is no longer lawfully required” — the trigger. The material may be held while it is required for the investigation, the prosecution, any appeal and any related proceeding. When that requirement ends, the obligation to destroy arises.
Why the duty exists
Section 18(3) allows investigators to hold and examine material that would otherwise put them within section 18(1) and section 18(2) — offences carrying 25 years.
Without section 18(5), that defence would allow indefinite retention. Every copy retained beyond need is a continuing risk of further distribution, and a continuing harm to the child depicted.
Section 18(5) closes the loop: the law enforcement purpose that justifies holding the material also defines when holding it must stop.
Note that there is no equivalent duty in section 17 for adult material. The obligation is specific to child sexual abuse material.
“No longer lawfully required”
- An ongoing investigation.
- A pending or current prosecution, including committal and trial.
- An appeal or review, or the period in which one may be brought.
- A court order. Note section 32(4): data or a thing seized under a warrant may be detained by a Magistrate, and when it is no longer required as evidence, it may be destroyed under an order of a Magistrate. That provision and section 18(5) point the same way.
- Related proceedings — for example civil or child protection matters where the material is in issue.
Once none of those applies, the material is no longer lawfully required and must be destroyed.
Modern systems copy data as a matter of course. Complying with section 18(5) requires attention to:
Forensic images taken under section 33(c) and (d) — copying data to a storage device, or in documentary form.
Devices moved for examination under section 33(e).
Working copies held by examiners and experts.
Backups of case management and evidence systems.
Material provided to other parties — the prosecution, the defence, the court — and to other jurisdictions under mutual assistance.
Data held by third parties — including ICT service providers who preserved data under a section 36 preservation notice or produced it under a section 35 production order.
A destruction process that addresses only the primary exhibit does not satisfy the words “all traces, copies, or storage”.
Records of destruction
The section imposes the duty without prescribing how compliance is proved. Two considerations make record-keeping necessary in practice.
Proving compliance. An officer or agency later questioned about retention needs evidence that destruction occurred and when.
Preserving the defence. Retention beyond need is retention without a subsisting bona fide law enforcement purpose. At that point section 18(3) may no longer answer a charge under section 18(1) or (2) — and the offences catch conduct in excess of a lawful excuse or justification.
Compare the recording duties the Act does impose elsewhere: section 41(5) requires that during a forensic tool investigation, the technical means used, the time and date, the identification of the device and its modifications, and any information obtained be recorded; section 41(6) requires information obtained to be protected against unauthorised modification, deletion or access; and section 41(8) requires installed software or hardware to be immediately removed when an order is discharged.
The pattern across Part IV is clear: powers are granted on terms that they be documented and wound up. Section 18(5) belongs to that pattern.
Who the duty binds
Section 18(5) is not addressed to police alone. It applies wherever child pornography is stored for a bona fide law enforcement purpose.
That reaches prosecutors, forensic examiners, expert witnesses, and any ICT service provider that preserved or produced material under a court order — noting that section 2 brings a provider’s employees, servants, agents and assignees within the definition.
For providers there is a further consideration: section 45 makes it a crime to disclose the existence of a court order, anything done under it, or any data collected under it, where confidentiality is required. Destruction must therefore be handled without revealing the investigation.
Section 18 is not listed in Schedule 2 and cannot be dealt with summarily.
Sources
- Cybercrime Code Act 2016 — ss 2, 17, 18, 32–36, 41, 45–47, 48; Schedule 2
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.