Court of Appeal refuses to exclude evidence obtained by phishing

What do you do with the fruit of a poisoned tree?  Most responsible litigants probably don't consider making use of modern, data driven criminality in order to gain an advantage in litigation. However, if you were of such an inclination - or facing someone that was - a recent Court of Appeal decision, in Ras Al Khaimah Investment Authority v Azima,  has  provided guidance on the question of how the courts might seek to deal with illegally obtained evidence.

In Azima, the Court of Appeal refused the defendant's appeal to a claim for misrepresentation and conspiracy on the basis that the claimant had procured important evidence by hacking, using a 'spear phishing' attack.  Repeating the well-established principle of English law that evidence should not be excluded on the grounds that it was obtained unlawfully, the Court found that a genuine claim should not be struck out, nor evidence excluded, on the basis that evidence was procured by hacking.

Background

The claim before the High Court was brought by the investment authority of the Emirate of Ras Al Khaimah ("RAKIA") against Mr Azima, a US-based businessman.  RAKIA's claims were for fraudulent misrepresentation in relation to a settlement agreement with a company controlled by Azima, and for conspiracy in relation to the sale of a hotel in Tbilisi, Georgia.

The High Court found that Azima had committed "seriously fraudulent conduct" against RAKIA including bribery, making fraudulent misrepresentations, creating sham documents and participating in an unlawful conspiracy to misappropriate large sums of money from RAKIA.  The court also rejected Azima's allegation that RAKIA was responsible for hacking the documents on which the claim was based.

Exclusion of evidence

Azima had also contended that RAKIA's claims should be dismissed or struck out on the basis that they relied on confidential emails that had been obtained by its unlawful hacking of his email accounts.  Azima's case on hacking focussed on 'spear phishing' attacks on his emails in late 2015.

'Spear phishing' emails are a more targeted and sophisticated form of phishing email that is specifically targeted at a certain individual or organisation.  Such emails are typically composed to include material of particular interest to the recipient, meaning that they are more likely to open the deceptive email and any attachments or links it contains.

These arguments were unsuccessful and the High Court found for RAKIA. Azima appealed, arguing, amongst other things, that if RAKIA was responsible for the hacking, the evidence obtained through hacking ought to have been excluded, or that its claims should have been struck out.

The Court of Appeal held that the evidence obtained by hacking was relevant to the proceedings.  The Court was not concerned with how it had been obtained; even had the relevant evidence been proven to be stolen it would have been admissible.

In coming to that decision the Court of Appeal accepted that it had the discretion to exclude otherwise admissible evidence but found that it was required to balance the need to promote observance with the law (ie discouraging hacking) with the need to achieve justice in the particular case.  In this regard, the Court noted that the emails were disclosable and should have been available at trial even if they had not been obtained by hacking.  The fact that the emails revealed a serious fraud on the part of Azima was also a serious bar to excluding the emails.

On this basis, the Court found that the emails would not have been excluded if Azima had applied to do so in advance of the trial, and that the same approach should be adopted in any application to exclude them after the trial.  The Court also held that striking out the claim would have been disproportionate and contrary to the public interest, even if it had been shown that RAKIA was responsible for the hacking.

Conclusion

The decision in Azima underlines the English Courts' reluctance to ignore the substantive merits of a case on the basis of unlawful conduct by the parties, such as hacking.  Unlike in the US, there is no 'fruit of the poisoned tree' doctrine in the UK.  There is a discretion to exclude evidence but  the need to achieve justice in the particular case is almost always likely to trump the general need to promote observance with the law.

The Court's reticence to exclude evidence obtained by hacking may seem surprising.  Given the increased prevalence of hacking in all walks of life, it may send the wrong message to potential litigants.  However, it should be noted that the Court of Appeal remitted to the High Court Azima's counterclaim against RAKIA in relation to the hacking.  The threat of such action provides a clear disincentive to any litigant considering the use of hacking to obtain evidence, even if it does affect the proceedings in which that evidence is used.