Mr Stubbs appealed against his conviction for conspiracy to defraud arising out of unauthorised transfers of £11.8m made whilst he worked as a password reset clerk on a bank's online banking system. Mr Stubbs claimed at trial that someone else must have used his identification to reset the passwords which led to the unauthorised transfers. Evidence concerning the operation of the system was given at trial by both an acknowledged computer expert and an employee of the bank.
The computer expert was unable to report fully due to the lack of information regarding the old system. No hardware existed which could run the superseded version of the system. Further, no information was available as to how the system operated previously, nor was the Mr Stubbs’ workstation imaged. The expert therefore did not have sufficient data on which he could safely base a conclusion.
Consequently, the conviction rested on the evidence of the bank employee. On appeal, Mr Stubbs sought to challenge that evidence as inadmissible, on the basis that the employee did not have the requisite expertise to comment on the system and was not independent given his relationship with the bank. In this case1, the Court of Appeal accepted the validity of the employee’s evidence. However, in different circumstances, failure to retain an old system or old data could be damaging. Businesses should ensure that their document retention system is adequate for this purpose.