WHEN HACKED EMAILS BECOME EVIDENCE
Digital Evidence Independence · Manchester City & Football Leaks
📌 Abstract
Digital communications increasingly occupy a central position in investigations involving corporate misconduct, regulatory violation, and cybercrime. Email evidence presents a particularly difficult forensic problem because the evidential value of an electronic message depends not only on its substantive content but on separate and logically independent questions of acquisition, authentication, integrity, provenance and attribution. These questions become especially difficult where the party against whom the evidence is deployed disputes the legality of the process by which the material was obtained, while declining to dispute the material’s content.
This paper examines that problem through the Manchester City Football Leaks controversy and proposes a Digital Evidence Independence Principle: that the authenticity and integrity of a digital artefact should be evaluated independently of the legality of the method through which it was acquired.
1. Introduction
Electronic mail has become one of the most consequential categories of evidence in contemporary corporate, regulatory and cybercrime investigations. It is contemporaneous, often unguarded in tone, and difficult for an organisation to disown once its authenticity is conceded. It is also, for the same reasons, an attractive target for unauthorised access, and an attractive object of leak-based journalism and whistleblowing.
This dual character generates a recurring institutional problem: when a body of leaked or hacked emails is placed in front of a regulator, that body typically confronts two questions that are analytically distinct but frequently collapsed: was this obtained lawfully? and is this what it purports to be? The Manchester City controversy is unusually suited to examine this problem because the underlying facts are largely undisputed at the level of content.
2. Background
The material at the centre originated with the Football Leaks disclosures, first reported in November 2018 by Der Spiegel. The source associated with those disclosures has been publicly identified as Rui Pinto, who has separately faced criminal charges in Portugal. Manchester City has maintained a consistent public position that its internal correspondence was “criminally obtained”, and declined to engage with the substance of individual disclosures on that basis.
In July 2020, shortly before the CAS hearing, Der Spiegel published additional correspondence, including an email from Simon Pearce to Peter Baumgartner setting out sponsorship figures: £99m owed, £8m Etihad contribution, £91m required transfer, and a £2.5m shortfall. Independent reporting noted that this corresponded with an earlier email attributed to CFO Jorge Chumillas a point of internal corroboration.
5. Five‑Dimensional Forensic Model
The central analytical proposal is that email evidence should be evaluated along five distinct dimensions, treated as logically independent rather than collapsed into a single question of whether the email is “real”:
Let an email artefact E be represented as a tuple of its constituent forensic properties:
Evidential reliability, R(E), is then a function of these internal properties. The critical move is to keep this analytically separate from legality of acquisition (L). The position defended here is that:
6. Applying the Dimensions: Three Scenarios
Three scenarios that are routinely conflated:
| Scenario | Description |
|---|---|
| A · Unauthorised acquisition, authentic | Individual gains unauthorised access, copies a genuine, unaltered email. Acquisition may be unlawful, but email remains authentic. ✅ authenticity holds, legality contested |
| B · Unauthorised acquisition with alteration | Access + modification before copying. Integrity problem: artefact not identical to original. ⚠️ integrity failure |
| C · Fabrication | Wholesale manufactured email; no corresponding message ever existed. Authenticity failure in the strict sense. ❌ authenticity failure |
These are distinct forensic propositions. Treating a dispute over acquisition legality (as Manchester City’s public position has consistently asserted) as though it settles the Scenario A/B/C question is a category error.
7. Corroborative Analysis & Case Application
A further forensic technique is corroboration across independently sourced artefacts. The Pearce Bumgartner email’s figures (£99m / £8m / £91m / £88.5m / £2.5m) were reported to correspond with an earlier email attributed to Jorge Chumillas. Internal consistency across artefacts obtained from different custodians provides a more robust signal than a single document’s plausibility.
Applying the model to the Manchester City record: On authentication and integrity, the club’s litigation conduct is telling at no stage before the CFCB or CAS did City succeed in establishing that the emails were forged or materially altered. Its relief rested on evidentiary insufficiency and time‑bar, not on a successful attack on the documents’ authenticity. The CAS outcome a finding of non‑cooperation but insufficient proof on disguised‑funding allegations, without a finding of forgery is more consistent with a tribunal implicitly separating these axes than with either party’s public characterisation.
9-10. Discussion & Conclusion
The framework has application well beyond sports governance. Corporate investigations, financial‑regulatory proceedings and cybercrime prosecutions increasingly turn on material obtained through disclosure events whose legality is contested. Institutions handling such material benefit from a disciplined separation of the five dimensions: it prevents an interested party from using a legality dispute to manufacture apparent doubt about authenticity or integrity where none has been demonstrated.
Comments
Post a Comment