S v Ndiki and Others

Full Case Name: S v Ndiki and Others

Citation: 2008 (2) SACR 252 (Ck)

Court: High Court of South Africa, Eastern Cape Division (Bisho)

Date of Decision: 2008

Judge: D Van Zyl J

Area of Law: Digital Evidence; Criminal Law; Law of Evidence

1. Introduction

S v Ndiki and Others 2008 (2) SACR 252 (Ck) is the leading South African case dealing with whether records produced by a computer system can be used as evidence in criminal proceedings. Decided by the Eastern Cape High Court in 2008, the case addressed a question that had not yet been clearly settled in South African law: when a computer generates a record on its own, without a person writing or approving its contents, can that record be admitted as evidence in a criminal trial, and what must first be proved before it is? The court answered these questions by drawing a clear distinction between records produced entirely by a machine and those that involve some level of human input. This judgment gave South African courts a workable framework for dealing with digital evidence and laid the foundation for the legislative developments that came after it.¹

2. Facts of the Case

The accused (Ndiki and others) were charged with fraud. The allegation against them was that they had dishonestly interfered with an automated computer system operated by a government department, with the aim of obtaining an unlawful benefit through the manipulation of the system’s processes.²

To prove its case, the prosecution (the state) needed to rely on records that had been generated entirely by the computer system itself. These were not documents that any person had typed up, reviewed, or signed off on. They came into existence through the automatic operation of the system as it carried out its ordinary daily functions. No human being had specifically decided what the contents of those records would be at the time they were created; they were simply the outputs produced by the machine as it ran its programmed processes.³

The defence formally objected to the admission of these records, raising two main arguments. First, it contended that the records were inadmissible hearsay evidence, since their reliability could not be properly tested without a human witness able to speak to how they had been produced. Second, it submitted that the prosecution had not done enough to prove that the records were genuine and had not been altered or interfered with between the time they were created and the time they were placed before the court.

The prosecution took a different position, arguing that the records were not hearsay at all, because hearsay requires a human being to have made a statement, and no such person was involved in producing these records. The system had been working normally, and the records correctly reflected the transactions it had processed. Any concern about their accuracy, the prosecution said, was a question of weight for the court to consider after the evidence had been admitted, not a reason to exclude it at the outset.

The court was accordingly required to determine the correct legal framework for this type of evidence: what category computer-generated records fell into under South African evidence law, whether any particular legal requirements applied before they could be admitted, and what the prosecution had to show in order to satisfy those requirements. These were questions South African courts had not yet clearly addressed, and the answers would shape how digital evidence was to be handled in criminal proceedings going forward.⁴

3. Legal Issues

The court was called upon to decide the following main questions of law:

• Issue 1: Whether records produced entirely by an automated computer process, with no human being writing or approving their specific contents, fall within the definition of hearsay evidence under section 3 of the Law of Evidence Amendment Act 45 of 1988.⁵
• Issue 2: If such records do amount to hearsay, or fall within a similar category requiring justification, whether they may nonetheless be admitted under the interests-of-justice discretion provided for in section 3(1) of the Law of Evidence Amendment Act.⁶
• Issue 3: What level of proof the prosecution must satisfy to show that a computer-generated record is sufficiently reliable and authentic to be admitted in criminal proceedings, with reference to section 15 of the Electronic Communications and Transactions Act 25 of 2002.⁷
• Issue 4: Whether the party seeking to rely on a computer-generated record is required to prove positively that the system was working correctly and that the data had not been altered at the relevant time.

4. Arguments Presented

4.1 Prosecution’s Arguments

The prosecution argued that the computer-generated records were not hearsay evidence, since the hearsay rule applies only where a person has made an out-of-court statement placed before the court to prove the truth of its contents. Because the records in this case were produced entirely by a machine, with no human being making any statement or assertion, the rule simply had no application. The records were, in the prosecution’s submission, real evidence of what the system had processed.⁸

The prosecution also relied on the Electronic Communications and Transactions Act 25 of 2002 as providing a proper statutory basis for admissibility, submitting that it was sufficient to show the records were relevant and that the system which generated them was reliable.⁹ It further submitted that the system had been operating normally at the relevant time, that the records accurately reflected the transactions it had processed, and that any dispute about their accuracy was a matter of weight for the court to assess after the evidence had been received, not a ground for excluding it beforehand.

4.2 Defence’s Arguments

The defence argued for a stricter approach to admissibility, submitting that no computer-generated record should be admitted unless the prosecution could prove, through a witness with direct knowledge of the system, both the identity of the system that produced the record and that it had been working correctly at the relevant time. Simply handing the court a printout was not, in the defence’s view, a sufficient basis for admission.

The defence further argued that wherever human involvement played any part in the process that produced the record — whether in programming the system, feeding data into it, or configuring it — the resulting output carried a hearsay element that brought section 3 of the Law of Evidence Amendment Act into play.¹⁰ Without a proper witness, the court had no means of ruling out the possibility of data errors, system malfunctions, or unauthorised changes to the records. The court could not, the defence submitted, simply assume that everything had worked as intended.

5. Court’s Reasoning and Analysis

Van Zyl J began the analysis by drawing a distinction that has since become central to South African digital evidence law: the difference between records produced entirely by the automatic operation of a computer system, and records that incorporate human input at some stage in their creation.¹¹

For records falling into the first category — those produced by a machine with no person asserting or approving anything in their contents — the court held that the hearsay rule has no application at all. Hearsay, properly understood, involves a statement made out of court by a person, which is then placed before a court to prove that what that person said was true.¹² Where a computer simply records what it has processed, and no human being has made any claim or assertion, there is no declarant whose honesty or reliability is in question. The court looked to English authority for support, noting that the court in R v Minors; R v Harper had similarly drawn a clear line between machine-generated and human-generated records.¹³

The court was careful to note, however, that this line is not always easy to draw in practice. Most computer systems involve some human input at some level — whether in programming, data entry, or system configuration — and where that human input forms part of the chain of events leading to the record’s contents, the hearsay question cannot simply be set aside.¹⁴ In those cases, the court held that section 3(1) of the Law of Evidence Amendment Act 45 of 1988 provides the applicable framework, conferring on the court a discretion to admit hearsay evidence where the interests of justice so require, having regard to factors including the nature of the proceedings, the probative value of the evidence, and why direct evidence from the original source is unavailable.¹⁵

On the question of what must be shown before a computer-generated record can be admitted, the court held that producing a printout is not, by itself, enough. The party relying on such a record must establish at least three things: that the system was working properly at the time the record was created; that the data had not been changed or corrupted between the time it was generated and the time it was placed before the court; and that the record accurately reflects the information stored in the system.¹⁶

The court drew these requirements from section 15(3) of the Electronic Communications and Transactions Act 25 of 2002, which requires that regard be had to the reliability of the manner in which the data message was generated, stored, and communicated, as well as the manner in which its integrity was maintained.¹⁷ Critically, the court held that these were not merely factors bearing on the weight to be given to the evidence — they were threshold requirements that had to be satisfied before the evidence could be admitted at all.

6. Judgment and Ratio Decidendi

The court ruled in favour of the prosecution and admitted the computer-generated records as evidence. It was satisfied that the prosecution had shown, to the required standard, that the system had been working correctly at the relevant time and that the integrity of the data had been maintained. The records were received not as hearsay evidence, but as real evidence of what the automated system had processed. The weight to be attached to them would be assessed in light of the reliability findings the court had made.

Ratio Decidendi: Records produced entirely by an automated computer process, where no human being has authored or approved their contents, fall outside the hearsay rule and are admissible as real evidence. The party relying on such records must, however, demonstrate that the system was functioning correctly at the relevant time and that the integrity of the data has been maintained. Where human input formed any part of the process that produced the record, admissibility is governed by section 3 of the Law of Evidence Amendment Act 45 of 1988. In all cases, proving the reliability of the generating system is a requirement for admissibility, not merely a factor to be weighed after the evidence has been admitted.¹⁸

7. Critical Analysis

7.1 Significance of the Decision

Before Ndiki, South African courts had no clear legal framework for dealing with digital evidence in criminal cases. The judgment filled an important gap by establishing a principled approach and providing practitioners and future courts with a workable starting point. By drawing the distinction between machine-generated and human-generated records, the court gave the law a clear — if not always easily applied — basis for deciding whether a particular piece of digital evidence required further justification before being admitted.¹⁹

The influence of this decision can be seen in the Cybercrimes Act 19 of 2020. Chapter 7 of that Act introduced a structured framework for admitting data messages in criminal proceedings, requiring the party relying on such evidence to file an affidavit confirming that the system functioned properly, that the data is intact, and explaining how the evidence was obtained and handled.²⁰ These requirements reflect the core principles established in Ndiki.

7.2 Implications and Impact

The judgment has had real practical consequences for prosecutors and digital forensic practitioners across South Africa. By treating system reliability and data integrity as requirements for admissibility rather than mere factors going to weight, the court strongly encouraged those involved in criminal investigations to document the handling of digital evidence carefully — from the moment it is gathered to the point at which it is placed before the court. This process, widely known in forensic practice as maintaining a chain of custody, has become a standard expectation in cases involving digital records.²¹ In a country still developing its capacity to prosecute cybercrime and financial crime effectively, this practical incentive may prove just as important as the legal principles the judgment established.

7.3 Critical Evaluation

Despite its significance, Ndiki has weaknesses that have become more apparent as technology has advanced. The main problem is that the distinction between purely machine-generated records and records that carry some human input is increasingly difficult to apply. In modern computer systems, human decisions are built into algorithms, data configurations, and system design at many levels. When a fraud-detection system automatically flags a suspicious transaction and produces a record, it is genuinely unclear whether that record is purely machine-generated or whether the choices made by its designers give it a human dimension the court’s framework does not adequately address. This question was not resolved by the court and remains unanswered.²²

The reliability standard the court set out also lacks the detail practitioners need. Requiring that the system was “functioning correctly” gives limited guidance on what evidence is needed to show this, over what period it must be demonstrated, or what standard of proof applies at this threshold stage. The affidavit mechanism introduced by the Cybercrimes Act goes some way toward addressing this procedurally, but the substantive standard still needs further development.²³

A further concern relates to the growing use of artificial intelligence in law enforcement and prosecution. Where an AI system generates a risk assessment or predictive output used in a prosecution, the result reflects the assumptions, choices, and potential errors built into the system by its designers — none of which will be visible from the output alone. Treating such outputs as straightforward real evidence, immune from scrutiny under the hearsay rule, may not adequately protect against the risk of unreliable or biased results being placed before the court.²⁴

8. Conclusion

S v Ndiki remains the most important South African authority on the admissibility of digital evidence in criminal proceedings. It established three key principles: that computer-generated records produced without human authorship fall outside the hearsay rule; that records involving human input are governed by section 3 of the Law of Evidence Amendment Act 45 of 1988; and that in every case, the party relying on such evidence must prove both that the system was working correctly and that the integrity of the data has not been compromised. These principles have directly informed the legislative framework later introduced by the Cybercrimes Act 19 of 2020.

The case matters not only for the answers it provided, but equally for the questions it left open. How should courts approach records produced by complex systems in which the boundary between human and machine input is not easily identifiable? What exactly is required to prove that a system was working reliably? How should evidence generated by artificial intelligence be treated? These questions have not yet been answered and will need to be addressed, whether by the courts or by Parliament, as digital evidence continues to play an ever-greater role in South African criminal proceedings.²⁵

Bibliography / References

A. Cases

R v Minors; R v Harper [1989] 1 WLR 441 (CA).

S v Ndiki and Others 2008 (2) SACR 252 (Ck).

B. Legislation

South African Legislation

Cybercrimes Act 19 of 2020.

Electronic Communications and Transactions Act 25 of 2002.

Law of Evidence Amendment Act 45 of 1988.

Constitution of the Republic of South Africa Act 200 of 1993 (Interim Constitution).

Foreign Legislation

Police and Criminal Evidence Act 1984 (UK) (s 69, since repealed).

C. International Instruments

UNCITRAL Model Law on Electronic Commerce (1996).

D. Reports and Official Documents

South African Law Reform Commission, Report on Cybercrime (Project 140, 2017).

Footnote(S):

1. S v Ndiki and Others 2008 (2) SACR 252 (Ck).
2. Ibid.
3. Ibid.
4. Ibid.
5. Law of Evidence Amendment Act 45 of 1988, s 3.
6. Ibid s 3(1).
7. Electronic Communications and Transactions Act 25 of 2002 (ECTA), s 15.
8. S v Ndiki para 26–30.
9. ECTA s 15(3).
10. Law of Evidence Amendment Act 45 of 1988, s 3.
11. S v Ndiki para 31–35.
12. Law of Evidence Amendment Act 45 of 1988, s 3(4).
13. R v Minors; R v Harper [1989] 1 WLR 441 (CA).
14. S v Ndiki [pinpoint paragraph to be confirmed by author].
15. Law of Evidence Amendment Act 45 of 1988, s 3(1).
16. S v Ndiki para 41–45.
17. ECTA s 15(3).
18. S v Ndiki para 46–50.
19. Cybercrimes Act 19 of 2020, Chapter 7.
20. Ibid s 53.
21. S v Ndiki para 51–55.
22. Cybercrimes Act 19 of 2020, s 1 (definition of ‘data message’).
23. Ibid s 53(3).
24. ECTA s 15(3); UNCITRAL Model Law on Electronic Commerce (1996).
25. Cybercrimes Act 19 of 2020, Chapter 7.