Digital Forensics within the Criminal Justice System

Rare is the case that does not feature some aspect of digital technology. The House of Lords Science and Technology Select Committee identified that “Digital evidence is now a key component in many criminal trials…[estimating that]…90% of crime has a digital element, in the broadest sense…” Digital forensic evidence is critical in the course of all manner of criminal cases – from online fraud, stalking via social media, in cases where an offence is captured on CCTV, or where the prosecution of a case is reliant on cell site analysis.

However, according to a recent report from Northumbria University, Digital Forensics within Criminal Justice System: Use, Effectiveness, and Impact, the breadth and speed of the development of digital forensics has “far outpaced” the national infrastructure necessary to properly utilise it for the detection and investigation of suspected crimes.

This report has identified three main issues that illustrate the state of digital forensic expertise in the criminal justice system at present and proposes solutions for better use of this evidence in the future.

Improving Digital Forensics Literacy

First, there is a clear absence of digital forensics literacy. Barristers and other professionals involved in the criminal justice system have an incomplete understanding of the range of digital evidence which can be obtained from various devices or systems, the complexity involved in the data extraction process and often fail to glean the relevance of any ensuing findings. 

This can lead to lawyers into making spurious or unintelligible forensic data requests arising out of a fear that they will potentially miss something if they do not simply request everything. There are also concerns that barristers cannot always communicate to their client the forensic evidence that they do receive in a manner which allows them to take instructions effectively.  Ultimately, the report identifies that a lack of digital forensic literacy has led to a backlog of devices waiting for examination, misunderstandings of the data and analysis, poor communication of evidence, discontinued prosecutions, and potential miscarriages of justice.

The report recommends that all data and outputs provided to investigators should be supported by sufficient explanation so that the associated significance and limitations can be understood. It is suggested that this be achieved by training all end users of the digital forensics data. The report proposes the creation and regular update of digital literacy training packages, aimed at evangelising the capabilities and describing the limitations of digital forensics processes. The training materials should be equally available for prosecution and defence representatives.

Modules for defence lawyers might include case scenarios on extracting social media data, emphasising what can and cannot be retrieved from platforms like Facebook, Instagram and their inevitable successors. Prosecutors, too, could benefit from a training module on how to request targeted forensic analyses - limiting device searches to specific dates or app usage rather than requesting an unnecessarily complex, full data dump.

It is crucial that the data provided is adequately explained and has a navigable layout. Forensic reports should include visual aids such as timelines, heatmaps of mobile activity, or simplified flowcharts showing data origins. Text message timelines accompanying cell site, for example, help focus the jury’s minds on the issues at play. Police, experts and instructing lawyers should have this process of distillation and translation at the forefront of their minds at all stages of case preparation.

Of course, the two bug bears common to all criminal practitioners – time and money – lurk, as ever. If dedicated modules were to work, practitioners would need sufficient time to gain regular, periodic access and the funding to do so. While the latter may be less problematic for Crown prosecutors, for parity the report suggests state-funded training in respect of the defence. There is presently no formalised support mechanism for those who do not understand the digital forensic data provided. In the spirit of blind optimism, and bearing in mind the backlog, perhaps this might feature in ongoing reforms to the criminal justice system.

Technical and Practical Challenges

Second, the report refers to the technical and practical challenges facing the criminal justice system. The system lacks the resources required to address the volume of digital forensic material, an issue which mirrors the wider criminal justice system. There is an insufficient number of trained digital forensic practitioners within Police Digital Forensic Units to fully complete the forensic needs of investigations in a timely manner.

Lawyers highlighted that the lead officer in a case cannot reasonably be expected to provide expert forensic analysis of digital data from the witness box. A lack of communication up and downstream within and across police forces permeated this issue in the report, with officers in the case regularly handed reams of technical data with little in the way of plain-language analysis.

The report suggests the increase and strategic deployment of suitably trained Digital Forensic Unit investigators. While digital evidence forms part of a vast number and array of cases, less serious or urgent cases do not benefit from a dedicated Digital Media Investigator (DMI), leaving a gap where analysis is needed. The DMI as a role should be more widely available and available at an earlier stage to assist in initial investigative strategy. The DMI would work more closely with the officer in the case to better evaluate the digital forensics evidence.

Alongside the deployment of DMIs, the report calls for the establishment of a process to encourage and enable communication among those practitioners, police and the Crown Prosecution Service. Finally, a modern and effective data platform should be developed for the storage and sharing of digital forensics at each stage of the criminal process. This would have the benefit of decreasing the transfer of data through inappropriate formats, such as USB devices, discs and paper.

Perhaps unsurprisingly, the report strongly advocates for collaboration between forensic scientists, legal practitioners, and policymakers to address systemic issues. Collaborative training sessions where lawyers and forensic practitioners work through real-world case studies will go a long way to making the trial day a smoother ride for all, not least the defendant. Further, judicial primers on digital evidence, developed with input from the legal profession and forensic experts, would help judges navigate technical issues.

Digital Evidence and Admissibility

Thirdly, the report highlights how limited attention is paid to the admissibility of different forms of digital forensic evidence. Practitioners neglect whether the form of evidence represents objective fact or opinion, the overall reliability of the evidence and its limitations. Once the evidence is deemed admissible, there is also a limited consideration about how it ought to be properly communicated and presented. Inadequacy of time for proper disclosure processes has particularly hindered the defence’s ability to adequately challenge the admissibility of digital forensic evidence relied upon the state.

The report recommends bespoke training for police officers and the Digital Forensic Unit on the rules of evidence and criminal procedure relevant to digital forensic evidence. The presentation of the digital forensics evidence and the individual who is best placed to present that evidence are two central issues which should be carefully considered.

A Further Issue: Addressing Inequality of Arms

Defence practitioners often struggle to access digital forensic expertise to challenge evidence adequately, and in this way (and countless others) get a smaller slice of the already small resource pie. Solutions here are, theoretically at least, more straightforward and include readily funded access to defence experts to enable fair scrutiny of evidence and national guidelines on digital evidence disclosure to address common delays. Though more capable of solution than other difficulties outlined above, the significance of this area cannot be understated.

Conclusion

It is perhaps unsurprising that given the rapid acceleration of both the technology used in digital forensics and the reliance upon it in trials that the necessary processes and tools have not yet been perfected. The findings from Northumbria University illuminate a path towards more effective use of digital forensics both in investigations and trials in the future.