Encrypted phones and missing verification data are complicating digital evidence in the trial of suspended First Vice President Riek Machar, as defense lawyers push for independent scrutiny of the prosecution’s forensic analysis.
During Monday’s 58th court session in Juba, a government-hired digital forensic expert acknowledged that some devices seized from Machar and co-accused could not be accessed because they were password-protected, limiting the scope of the investigation.
Ratlhogo Peter Calvin Rafadi, a South African forensic analyst, told the court that investigators were unable to unlock certain devices, including one belonging to Machar, and said the court could order that passwords be provided for independent verification.
“Another digital forensic expert will arrive at the same answers,” Rafadi said, adding that access to passwords would allow the findings to be independently verified.
Defense lawyer Gerry Raimondo Legge questioned the reliability of Rafadi’s report, asking whether “hash values” – digital codes used to confirm the integrity of electronic evidence – had been submitted.
Rafadi said they had not been submitted to the court but could be shared with an independent expert while maintaining the chain of custody.
Defense counsel Deng John Deng requested that one of the accused’s phones be opened during cross-examination to verify the messages cited in the report. Prosecutor Ajo Onyo’Ohisa Issa opposed the request, warning that activating the devices in court could risk tampering with evidence and delay proceedings.
“If the defense doubts the report, let them bring their own expert to examine all the phones and laptops, not just one device,” Ohisa said. “Only an expert can challenge an expert.”
The presiding judge, James Alala Deng, adjourned proceedings until Wednesday, March 11, when the court is expected to rule on whether the defense can access the devices during cross-examination.
Rafadi was contracted by the government to analyze electronic devices seized from Machar and seven co-accused following a March 2025 attack on the Nasir military garrison. Prosecutors say messages, photos, and videos recovered from the devices show coordination among the accused, including financing, arms procurement, and operational planning linked to the assault.
Machar remains under house arrest, while the others are detained by the National Security Service in Juba. They face charges including murder, terrorism, treason, destruction of public property, and crimes against humanity. Prosecutors allege the attack killed 257 South Sudan People’s Defense Forces soldiers and involved the seizure or destruction of military equipment worth about $58 million.