The Missing Pallets: Theft or Embezzlement, and Digital Evidence Without a Warrant
Ravi was a warehouse supervisor at Northgate Freight. He was responsible for inbound pallets and had sole authority to adjust inventory records in the Warehouse Management System (WMS). Over seven months, 43 pallets of imported goods were released to a trucking company owned by his brother-in-law, and the WMS entries were overwritten to read 'damaged - written off'. The WMS is hosted by a cloud provider. A company policy signed by Ravi permits 'monitoring and audit of all company systems, including access logs'. After an internal audit, police asked for the logs; Northgate's IT administrator exported them from the company's cloud tenant and handed them over with no warrant and no court order. The prosecution also tenders a WhatsApp message from Ravi's subordinate, Tono, reading 'the 43 went out again last night, boss'. Tono has resigned and cannot be located, and he does not testify. Ravi admits the pallets left but says he was following his manager's instruction and gained nothing personally; bank records show 12,000 deposited into his account in six instalments.
1. Classify Ravi's conduct. Is this theft, embezzlement or breach of trust, or fraud? Explain why the classification changes what the prosecution must prove.
Read the worked answer
Identify the decisive question: who had possession? Systems that distinguish theft from embezzlement turn on whether the property was taken out of another's possession, or was already in the actor's possession by virtue of a relationship of trust.
Application. Ravi had custody of the pallets, not possession in the proprietary sense; Northgate retained possession through him. On that analysis the removal is theft, aggravated by the fact that he was an entrusted employee. If the jurisdiction treats control over the disposition records as sufficient possession, the same facts support embezzlement or breach of trust. The falsified WMS entries do not convert the offence into fraud: fraud requires a deception that causes the victim to part with property, and here the deception came after the goods had already gone, as concealment.
Why it matters. (1) Fraud requires proof of deception and inducement, which the facts do not supply; pleading only fraud risks acquittal on the elements. (2) Personal enrichment is an element of some offences and not others, so Ravi's claim that he gained nothing is only relevant if enrichment is pleaded. (3) Penalty ranges and limitation periods differ. (4) The manager's instruction may negate the intent element of theft but is no answer to knowingly falsifying records.
Best course: charge theft or breach of trust as the primary count, plead the falsification as aggravation, and add a separate records offence.
2. Assess the admissibility of the WMS logs obtained from the company's cloud tenant without a warrant.
Read the worked answer
Framework. The objection is that the logs are private data taken without judicial authorisation. Admissibility turns on the reasonable expectation of privacy, the scope of Ravi's consent, and the court's discretion to exclude.
Privacy and consent. Ravi signed a policy permitting monitoring and audit of company systems. Employees have a reduced expectation of privacy in an employer's operational systems used for work, and he had no proprietary interest in access logs. The logs record system events, not intimate communications.
Who may consent. The data belonged to Northgate, and its IT administrator could lawfully produce company records; consent to production need not be the employee's. But the scope of the policy is monitoring and audit, not criminal investigation, so there is a gap for Ravi to exploit.
No warrant. If the procedural code requires prior judicial authorisation for stored data, the absence of a warrant creates a defect. Most courts apply a proportionality test rather than automatic exclusion, weighing the seriousness of the offence, the good faith of the police, the absence of intrusion into private life, and whether the same evidence was available by a lawful route (company witnesses, audit trail, the trucking company's dispatch records).
Authentication is the real battleground: completeness, hash values, system clock and chain of custody must be proved by the administrator who exported them.
Conclusion: likely admissible, with weight for the authentication gaps.
3. Tono does not testify. How should the court treat the WhatsApp message?
Read the worked answer
Characterise it. The message is an out-of-court assertion by an absent declarant offered to prove its truth: hearsay. Its admission therefore depends on an exception or on the court's discretion to receive unavailable-witness evidence.
Authenticity first. Before any exception matters, the prosecution must prove that the device and the account belong to Tono and that he sent the message. A screenshot alone is weak; device metadata, the service provider's records, or the recovery of the handset are needed. Ravi's own admission that he received messages on that number helps but does not identify the sender conclusively.
Exceptions. No business-record exception applies, since Tono was not under a duty to record. A statement against interest is not available, because the message implicates Ravi, not Tono. A spontaneous or contemporaneous-res Gestae exception is arguable if the message was sent while the trucks were loading.
Weight. Even if admitted, it is a single uncorroborated extra-judicial assertion by a witness who cannot be cross-examined, and it is open to coaching or fabrication. It cannot alone sustain a conviction.
Conclusion. The conviction should rest on the WMS audit trail, the trucking company's records, and the twelve deposits of 1,000, which together are capable of excluding the manager-instruction defence. The message may be admitted but only as corroboration, with an express warning about its unreliability.