Digital Evidence in War Crimes Investigations: Preservation, Authentication and Admissibility

Scope and significance

Digital evidence has become central to investigating and adjudicating war crimes and crimes against humanity. From satellite imagery and social media posts to metadata from mobile devices, digital materials can be decisive. Yet their intrinsic fragility and the complex provenance issues they raise require lawyers and investigators to adopt disciplined collection, preservation and authentication practices. This article outlines the core technical and legal considerations and offers practical advice for cross-border investigations, with attention to procedural norms applicable in Türkiye and comparative jurisdictions.

Core principles for admissibility

Courts typically assess digital evidence against three interrelated criteria: relevance, authenticity and reliability. Practitioners must prepare to meet each criterion:

• Relevance: Evidence must have logical probative value to a material issue.
• Authenticity: There must be a satisfactory chain of custody and proof the evidence is what the proponent claims.
• Reliability: The methods used to collect and process data must be scientifically defensible.

Practical steps for investigators

• Document collection methodology: Record the who, what, when, where and how for every digital acquisition. Automated harvests must be accompanied by logs and hash values.
• Use forensic tools and independent validation: Employ recognized forensic tools and, where possible, independent third-party validation to reduce disputes about tampering or alteration.
• Preserve metadata: Metadata often contains critical temporal, locational and device information. Preserve it in original form and document any processing steps.

Open-source intelligence (OSINT) and social media

OSINT has proved invaluable for documenting incidents at scale. But its admissibility depends on demonstrating provenance and reliability. For social-media content, investigators should:

• Capture original items promptly with forensic-quality tools rather than screenshots.
• Obtain account information via MLA where feasible to corroborate authorship and location data.
• Corroborate assertions with independent sources (satellite imagery, signals intelligence, on-ground witness statements).

Cross-border collection and mutual legal assistance

Digital evidence frequently sits on servers under foreign jurisdiction. Mutual legal assistance treaties (MLATs), expedited preservation requests and cooperation with service providers are key. Investigators should:

• Issue preservation requests rapidly under applicable MLAT mechanisms to prevent deletion.
• Understand service providers’ disclosure policies and legal bases for production (e.g., court orders or data protection constraints).
• Plan for translation, format standardisation and verification of foreign-produced materials.

Practical implication

Delays in MLA and non-compliance by providers may reduce evidentiary value. Proactive preservation requests and diplomatic engagement can mitigate such risks.

Chain of custody and continuity

Maintaining a clear chain of custody is non-negotiable. A defensible chain should record custody transfers, storage conditions and access logs. Where digital evidence has been processed (e.g., filtered or enhanced), maintain a complete audit trail and preserve originals in read-only form.

Witness testimony and expert evidence

Expert witnesses play a dual role: explaining technical processes to judges and vouching for methodological reliability. For remote witnesses or witnesses located abroad, courts increasingly permit secure video testimony, but safeguards must protect cross-examination rights and confidentiality for sensitive material.

Turkish practitioner considerations

In Türkiye, prosecutors and defence counsel should ensure compliance with domestic procedural rules on evidence while engaging international partners when relevant. Şahin Hukuk’s practice emphasises early preservation requests to cloud providers, rigorous forensic documentation and the use of neutral experts to support admissibility in domestic and international fora.

Checklist for court-ready digital evidence

1. Immediate preservation orders and MLAT requests where data is foreign-hosted.
2. Forensic collection with hash values and audit logs preserved.
3. Independent validation of collection tools and methods.
4. Corroboration of OSINT with independent sources.
5. Clear chain-of-custody documentation and expert reports explaining processing steps.

Digital evidence can be compelling, but only when collected, preserved and explained with forensic discipline and transparent methodology.

Av. Burak Şahin, Şahin Hukuk