Takenaka (UK) Ltd V Frankl

Takenaka (UK) Ltd v Frankl

(CA (Civ Div)) Court of Appeal (Civil Division)

7 March 2001

Where Reported
Summary
History of the Case
Case Comments

Where Reported

[2001] EWCA Civ 348

[2001] E.B.L.R. 40

2001 WL 483005

Summary

Subject: Defamation

Keywords: Electronic mail; Electronic monitoring; Expert evidence; Libel

Catchphrases: libel; electronic mail; expert evidence; anomalous evidence supporting defendant's claim; weight of evidence

Abstract: F appealed against a finding that certain defamatory statements had been sent by him, via email, to T. The trial judge had accepted the conclusions of an expert witness to the effect that the weight of evidence, particularly the timings of the alleged emails and other computer activity, pointed towards F being the author of the emails notwithstanding certain anomalous evidence supporting F's case. F appealed, submitting that the fact the hard disk of the relevant computer had been subjected to extensive corruption supported his contention that an unknown person had interfered with the computer in order to make it appear that he was the author of the emails. Moreover, he argued that additional evidence relating to the timing of the emails raised sufficient grounds to allow the appeal.

Summary: Held, dismissing the appeal, that despite the anomalous evidence, the trial judge had been entitled to conclude that, on the balance of probabilities, F had sent the emails to T. The judge had correctly weighed the evidence supporting F's case against the mass of evidence pointing towards the conclusion that F was the author of the emails.

Judge: Mance, L.J.; Ward, L.J.

Counsel: For T: Not specified. For F: Wilson Q.C. and Graham Shipley

Solicitor: For T: Not specified. For F: Baily Gibson (High Wycombe)

History of the Case

Direct History

Takenaka (UK) Ltd and another v Frankl

QUEEN'S BENCH DIVISION

(Transcript: John Larking)

HEARING-DATES: 11 OCTOBER 2000

11 OCTOBER 2000

COUNSEL:
J Rushbrooke for the Claimants; G Shipley for the Defendant
PANEL: ALLIOTT J
JUDGMENTBY-1: ALLIOTT J
JUDGMENT-1:
ALLIOTT J: This is a claim by both claimants against the defendant for damages, aggravated in the case of the second claimant for libel. The first claimant also has a claim for breach of contract, but that is effectively subsumed in the libel claim, and I say no more about it.
The claims arise from the admitted publication of admittedly defamatory e-mails sent to the first claimant on 29 April 1999, 31 May 1999, and 22 June 1999. The emails were sent over the pseudonymous signature "Christina Realtor", and the sole issue before me on liability is whether the claimants have proved that their real author and publisher was the defendant.
It took months and expensive litigation for the claimants to track down the defendant, but on 21 October 1999 they sent him a detailed Letter Before Action, bundle 5 pages 709 and 710. On 28 October 1999 the defendant's solicitors replied that the defendant "informs us that the allegations made against him are totally fabricated and are not at all true". That is a stance which the defendant has steadfastly maintained up until and including his evidence in the witness box. He did so notwithstanding the reports of the single joint expert directed to give evidence by order of Deputy Master Fontain, dated 19 May 2000. That order named another expert, but on 22 June 2000 by consent Mr Terence James Bates was substituted.
In accordance with CPR 35.7 Mr Bates was instructed by both the claimant and the defendant. Mr Bates prepared a preliminary report dated 16 July 2000. Its conclusions at bundle 4, pages 520 and 521, read as follows:
"Given the amount of time, expertise and effort needed to manufacture all of the evidence revealed, even after a preliminary examination and the need for this to be correlated with other reports of received material I consider it extremely unlikely that the material I have examined is anything other than it appears to be."
I interpose there to find as a fact that Mr Bates examined the correct material. I reject the contention that he was provided with the wrong computer.
Continuing with the conclusions:
"Since some of the traces of HotMail activity match closely with the dates and times of the malicious e-mails and some traces of the e-mail correspondence with Christina Realtor exist in this computer it appears most probably that this computer was the source of the Christina Realtor e-mails. Given that David Frankl had access to this machine between 11 November 1998 and 23 August 1999, and that most of the Compuserve messages were sent in his name to friends and relatives, it seems most probable that he was responsible for this activity. I have not checked the relevant addresses but all of the messages are in a single Compuserve filing cabinet file. The appropriate time difference between Compuserve message activity and HotMail message activity on the dates of the malicious e-mails 29 April 1999 HotMail access 11 minutes before Compuserve after probably time correction. 31 May 1999 HotMail/internet access 18 minutes before Compuserve. 22 June 1999 HotMail access 57 minutes after Compuserve.
Since there are no indications of other activity around these times it appears likely that the same person was responsible for both types of activity on these dates. On the balance of probabilities I consider it unlikely that two different people could have been responsible separately for the HotMail access and the Compuserve e-mails."
It might have been expected that those conclusions would have brought about an end to this litigation, but that was not to be. Accordingly Mr Bates prepared his definitive report dated 30 September 2000. The preliminary report had run to 44 pages, and the definitive report covered 104 pages. Both demonstrated Mr Bates' expertise and the meticulous care he brought to the task set him by the court's order.
Essentially his reports analyse the contents of the computer traced to Thames Water, which the defendant had used. But at App K he identified collateral information in support of his conclusions. That appears at bundle 4, pages 671 to 673. App K reads:
"Analysis of computer contents cannot conclusively identify whose fingers were on the keyboard at the relevant times. Collateral information, both from internal (ie on the computer) and external sources must be sought. In this case, internal collateral information is available in the form of externally attributable (or admitted) activity. It may therefore be possible to compare such periods of activity and gain some idea of the sequence of events at this level.
Such collateral information concerning dates and times as was recovered is presented in Appendices I and J. Each presents information, usually identifying the name being used, in a tabular form based upon the date and time available. Note that these tables present information essentially from different sources. Examination of these two tables reveals some interesting conjunctions. In the following paragraphs, times are from the computer clock/calendar unless otherwise stated.
From the table at 12.1.1 on 6 February 1999 (item 2) there is access by 'sweet_revenge' at 09.13.46. From the same table (item 3) there is access by 'davidfrankl' at 09.14.32. A difference of 48 seconds. This is confirmed by the table at 13.1 (items 5 7 6) and the same time difference is observed.
From the table at 12.1.1 on 9th February 1999 (item 6) there is access by 'sweet_revenge' at 18.21.38. From the same table (item 8) there is access by 'davidfrankl' at 18.22.06. A difference of 28 seconds. This is confirmed by the table at 13.1.1 (items 24 & 26), where a time difference of 42 seconds is noted. An unidentified intermediate entry indicates that the connection was retained between the other two entries.
From the table at 12.1.1. On 16th February 1999 (item 9) there is access by 'davidfrankl' at 17.43.58. From the same table (item 10) there is access by 'sweet_revenge' at 17.45.12. A difference of 74 seconds. This is confirmed by the table at 13.1.1 (items 28 & 30) showing a similar time difference. An unidentified intermediate entry indicates that the connection was retained between the other two entries.
On 3 March 1999, the table at 12.1.1. Indicates access by an unidentified operator at 18.09.52. Applying the two hour correction factor (the difference between EST and computer time) converts this to 20.09.52. This is sixteen minutes after the Compuserve Billing time and when the billed time was only two minutes. I would conclude from this that this access was probably via the other Compuserve account number (114153.1227).
On 17 April 1999, the table at 12.1.1 reveals only access by 'christinarealtor' at 18.17.54 (item 32). The table at 13.1.1 confirms this entry (item 39) and also indicates identifiable activity by 'David Frankl' at 18.52.00 (item 40), a difference of thirty five minutes and six seconds.
On 18 April 1999 the table at 12.1.1 reveals only access by 'christinarealtor' at 16.49.09 (items 35 & 36). The table at 13.1.1 confirms this and provides an additional entry which extends this time to 16.50.50 (item 44). This table also indicates identifiable activity by 'David Frankl' at 18.43.00 (item 45), a difference here of one hour fifty two minutes and ten seconds.
On 27 April 1999 the table at 12.1.1 indicates access by 'christinarealtor' at 18.10.20 (item 37). The table at 13.1.1 (item 57) confirms this and also indicates preceding activity under the name 'David Frankl' at 18.01.00 (item 56), a difference of nine minutes and twenty seconds. Also relevant to this is an e-mail to 'Astrid' dated 17 April at 20.07.00. The text notes 'as I have the computer in my apartment at present, I heard the phone ring and straightaway downloaded your message'.
"On 29 April 1999 the table at 12.1.1 indicates access by 'christinarealtor' at 18.39.10 (item 40). The table at 13.1.1 (item 70) confirms this to within 8 seconds. However, this table also indicates access by 'christinarealtor' as early as 18.30.09 (item 62) and also lists activity by 'David Frankl' at 18.23.00, some seven minutes and eight seconds earlier. The 'christinarealtor' access times not only match with the information gained from the Compuserve Billing and that from the HotMail Access details, but they also bracket the time from the header of the first e-mail. There is also activity noted by 'David Frankl' at 21.59.00. Some additional information concerning this day appears in an e-mail message addressed to 'Astrid' dated 29 April 1999 at 18.04.00. This message concludes with the sentence, 'I think that's all for now. I will check the Email before I go to bed as I have the computer here. Tony has taken his phone so you cannot phone me, I'm afraid'.
On 22 May 1999, the table at 12.1.1 indicates access by 'davidfrankl' at 18.11.23 (item 45) and 'christinarealtor' at 18.15.35 (item 46). The table at 13.1.1 confirms the 'christinarealtor' time within one second (item 104) and it extends the 'davidfrankl' time by five seconds to 18.11.28 - a difference of four minutes and six seconds. However, intermediate entries indicate that the connection remained unbroken during this period. The table entries for this date also present the only apparent anomaly in these listings - in that the 'davidfrankl' access at 18.11.16 (table at 13.1.1, item 89) appears to be one minute and forty six seconds before the Compuserve billing time. In other words this access was too early. However, this is resolved if note is taken of the discontinuity in cluster allocated numbers. This indicates a separate session was started and the implication is that a different account number was used.
On 23 May 1999 the table at 12.1.1 indicates access by 'christinarealtor' at 18.37.31 (item 48) and also access by 'c_realtor' at 18.44.58 (item 50). The table at 13.1.1 confirms both of these accesses and also indicates an unbroken connection between them. Additional information is available from the full file listing which indicates that the cluster number allocated to the original file entry referred to in item 108 of the table at 13.1.1. (C: WINDOWS Temporary Internet Files start.htm) was 19,827. This is completely consistent with the cluster number (19,829) where a trace of the reply e-mail from '' was found (see Appendix B of my original report). It therefore appears that 'christinarealtor' read the reply e-mail at this time on this date and immediately created a new e-mail account in the name of 'c_realtor'.
On 31 May 1999, the table at 12.1.1 indicates access by 'c_realtor' at 17.11.40 (item 53). The table at 13.1.1 confirms this and shows activity by 'David Frankl' some six hours or so before this time (items 124 & 125). It also shows that the 'c_realtor' access continued until at least 17.22.12 (item 139), thus bracketing the time from the header of the second e-mail (17.22.05) which was sent on this date. It also shows that this access was succeeded by activity by 'David Frankl' at 17.41.00 (item 140) - a gap of eighteen minutes and forty eight seconds.
On 17th June 1999 the table at 12.1.1 indicates access by 'c_realtor' at 18.57.16 (items 58 & 59). The table at 13.1.1 confirms this (item 165) and shows activity by 'David Frankl' some four hours or so before this time (item 164). It also shows access by 'frankl' (item 167) around forty two minutes afterwards and activity by 'David Frankl' some fifteen minutes or so later.
On 22 June 1999 the table at 12.1.1 indicates access by 'c_realtor' at 19.09.20 (item 64). The table at 13.1.1 broadly agrees with this although there is no specific reference to the exact time entry. Other entries however (items 174 to 180) indicate that 'c_realtor' was on-line from 19.07.34 to at least 19.09.10. This again brackets the time from the header of the third e-mail (19.09.12) which was sent on this date.
The matching of dates and times between the Compuserve Billing information, the HotMail access logs, the three e-mails themselves and the computer traces (from the file structure, the file content, unallocated space, cluster analysis and the cache indices) is sufficient to confirm my assertion that this machine is the original source of the e-mails. They are consistent and give rise to no unreasonable anomalies.
Collating the above information leads me to conclude that the 'sweet_revenge' and 'davidfrankl' accesses in February 1999 were almost certainly completed by the same operator. The 'christinarealtor' accesses and the 'David Frankl' activities on 27 and 29 April 1999 were most probably by the same operator. The 'christinarealtor' and 'davidfrankl' accesses on the 22 May 1999 were most probably by the same operator and the 'c_realtor' access and 'David Frankl' activity on 31 May 1999 seem likely to have been completed by the same operator."
In this context Mr Rushbrooke cross-examining the defendant was able to point to the phrase "help needed", which appeared in the header to the e-mail of 29 April 1999, appearing also in the header of an e-mail dated 11 March 1999, which admittedly emanated from the defendant.
Reverting to Mr Bates' second report at App O, bundle 4, pages 692 to 694, he made some general observations.
They read:
"I was appointed single joint expert in this case under the Civil Procedure Rules, section 35.7. In accordance with my duties to the court and the instructions from both parties I caused an exact copy to be made of the laptop computer in this case belonging to Thames Water. I subsequently examined and tested this copy in connection with a series of e-mails received by the claimants.
The elements of this case in essence are quite simple. Takenaka (UK) Limited received malicious e-mails from an unknown source early in 1999. Attempts to trace this unknown source were eventually successful and the owners of the relevant account, Thames Water, were contacted, 20 August 1999, and asked to assist.
Thames Water traced the specific use of this account to a laptop computer which at the relevant time was in use by Thames Water employees in Turkey.
In due course the laptop computer was collected and examined by someone thought by Thames Water to have sufficient expertise to determine the precise nature and extent of the alleged activities. But this initial examination was bungling, negligent, incompetent, and relied solely upon such active files as remained with the internet. Cache directories did not disguise the apparent fact that this was indeed the source of the e-mails."
I interpose to say that Mr Bates' attitude has somewhat hardened on this topic, and he now considers that it is probably deliberate sabotage:
"All of the available evidence up to this point, 8 September 1999, could have been manufactured on another machine and planted on the laptop computer. It is not clear whether Thames Water were aware of this, but they were apparently sufficiently satisfied to accept the information, identify Mr Frankl as the perpetrator and dismiss him as a result.
Having previously given an undertaking on 6 September 1999 to preserve all relevant information the laptop computer was accessed further on 29 September 1999, 3 November 1999, and 13 December 1999. This last access created at least 9,735 additional files on the computer. Quite why this was done is not clear, but as discussed in appendix L, page 81 above, I do not accept that this was simple negligence.
The effect of the Thames Water investigation has been to cloud the issues in this case. The supply of temporary internet files to both parties quite reasonably raised questions concerning the true origins of the e-mails. Thus questions concerning the transport of these e-mails through the various nodes of the internet and the relevant timing comparison were valid and relevant. The further activity producing massive contamination also raised important questions concerning the possibility of action by a third party with a grudge against either Takenaka (UK) Limited or Mr Frankl, or both.