Riding the digital forensics wave; pooling experience to avoid drowning

In recent years, policymakers have become increasingly alert to the digital forensics wave which has engulfed modern policing. However, practitioners from across the criminal justice system, who deal with digital forensics on a daily basis, remain sceptical that their experience will influence the response to a rapid succession of transformative changes.

Policy makers and oversight bodies have been warned of the scale and range of the problems arising from the infiltration of digital forensics across criminal justice. For example, in 2022, His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) examined how effective police forces are at providing digital forensics, and the results were, unsurprisingly to those who work in the criminal justice system, fairly damning. Clearly some forces are overwhelmed by the volume and complexity of digital forensics, and many did not have a clear understanding of digital forensics. These factors have resulted in huge delays in examining devices, which has a significant, consequential impact on prosecutions and negatively affects victims’ experiences of the justice system. 

These findings were echoed in the research undertaken by the Northumbria project.  This research extended the breadth of voices consulted, capturing the experiences of CPS and lawyers, as well as those within police forces and digital forensic units.  This research, however, differed from much earlier reports on this subject as a team of academics from Northumbria University and the University of Derby ensured that  working level voices were heard directly at a senior policy making level. The team’s research, which ultimately demonstrated a methodology for capturing and analysing perceptions of challenges in digital forensics and informed suggestions for solutions, from the coalface of legal practice. 

This research report was undertaken by academic member of Exchange Chambers, Dr Cerian Griffiths, along with Northumbria University’s Emma Piasecki, an academic member at New Park Court Chambers, Philp Anderson and Professor Tim J Wilson, and University of Derby’s Dr Sophie Carr. Their report, ‘Digital Forensics within the Criminal Justice System: Use, Effectiveness, and Impact’ is available here.  This research was presented to senior officials at the Home Office-led Forensic Science Reform Programme Board in 2024 and is hopefully currently impacting  policy development. 

The research team’s future plans include seeking to draw on and share criminal justice experience and ideas from European countries similar to the UK. This was instigated at an international policing conference hosted at Northumbria University in January, where their ideas garnered great interest, especially from policing colleagues in The Netherlands and Norway. 

The project report represents the broadest research undertaken in digital forensics in England and Wales to date, and initial responses have been extremely positive. A key factor in the project’s success is the breadth and scope representing perspectives across the justice system and successfully promotes cross professional cooperation between lawyers, CPS, digital forensics practitioners, police offices and HM Prison and Probation Service personnel and a willingness to participate in constructive problem solving around the increasingly thorny issue of digital forensics. 

The team's methodology proved highly effective in encouraging open dialogue and facilitating the rapid delivery of targeted recommendations to government policymakers. This methodological approach, combined with the team's diverse expertise, provided a comprehensive understanding of the mechanics of change within this area of criminal justice. 

The Digital Forensics Project

With the assistance of the Home Office, the research team employed innovative research methods to capture the everyday experiences of digital forensics within the criminal justice system, from the initial point of criminal investigation to trial and appeal. 

Participants in the study included representatives from regional police forces, the National Crime Agency and those involved in counter-terrorism, police Digital Forensics Unit investigators, HM Prison and Probation Service, independent digital forensics practitioners, the Crown Prosecution Service, and solicitors and barristers with experience of both prosecuting and defending.

The design of the project was initially presented to solicitors and barristers at Exchange Chamber’s Serious Crime & Fraud Forum in Spring 2023. Later in 2023, and employing an innovative methodological approach, the research team undertook a series of interviews, focus groups, and surveys with participants. The project uniquely brought together stakeholders who would not ordinarily interact, or who would only interact within the court, to facilitate frank discussion of experiences of digital forensics. These candid and open inter-stakeholder conversations produced rich research findings, leading to the recommendations of the report. 

Findings of the Research: Challenges and Limitations within the Justice System

The central findings of the Report are categorised into three main themes, with a fourth speaking directly to the Home Office’s Impact of Forensic Science Project, the purpose of which was to critique a model to allow the impact of forensic science across the criminal justice system to be measured.

1.           Digital Forensics Literacy

All participants in the research reflected how, across the criminal justice system, there is a general, and fundamental lack of knowledge and understanding of the capabilities and outputs from digital forensic analysis by those not intimately involved in digital forensic practice. The Report suggests this lack of knowledge – which we are referring to as digital forensics literacy -ultimately contributes to:

• Backlogs of devices waiting for examination, 

• Misunderstandings of data and analysis during investigations and through to trial, 

• An inability to properly assess reliability and admissibility of digital evidence,

• Poor evidence communication, 

• Discontinued prosecutions and the very real risk of miscarriages of justice.

2.           Technical and Practical Challenges 

A range of technical and practical challenges were identified by participants which included:

• Insufficient resource to address the volume of digital forensic material.

• The lack of appropriate resource, combined with ever-increasing volume, has repercussions across essential processes such as the communication, transfer and presentation of digital forensic data and evidence, disclosure, and other regulatory requirements.

• Digital forensic activity is not undertaken in a timely or efficient manner - there is a risk that the full needs of the investigation may not be met and that the data or evidence is misunderstood by those expected and required to understand and make appropriate use of it. 

• Insufficient number and distribution of appropriately trained digital forensic practitioners within Police Digital Forensic Units and independent private providers - to undertake the necessary extraction, analysis and interpretations required for the effective and reliable use of digital forensic evidence. 

• Insufficient number and distribution of Digital Media Investigators, key to assisting police investigators in developing an appropriate, proportionate and successful digital forensics strategy. 

3.           Digital Evidence and Admissibility

Digital evidence and its admissibility posed a significant concern, according to the research, with many participants reporting there to be limited attention paid to whether digital forensic evidence would ultimately be admissible.  Particularly concerning, were the findings that little, if any, attention is paid to whether different forms of digital forensic evidence is factual or opinion and  the underpinning reliability of the evidence and its limitations. Critically, there is little consideration of who is providing that evidence to the court; police officers are frequently placed in a position where they are expected to make inferences from the recovered digital forensic data, without a full understanding of the strengths and weaknesses of the methodology used and what that means in the context of a particular case.  Unsurprisingly, the rules of disclosure and challenges/failings of the disclosure regime regarding digital forensics was also raised by participants, both lawyers and investigators. 

• Current practice involves limited attention paid to whether digital forensic evidence will ultimately be admissible.
• There is an absence of attention paid to the crucial question of whether different forms of digital forensic evidence is factual or opinion, its reliability and its limitations.
• To properly determine relevance, admissibility and weight of digital forensic evidence, and ensure fairness in criminal proceedings, digital forensic evidence must be better communicated to, and understood by, those involved in the prosecution, defence, and adjudication of cases.
• Only digital forensic practitioners (experts) should be expected to provide opinion evidence.
• The rules of disclosure must be properly applied.
• Professionals in every discipline across the criminal justice system shared these concerns alongside the inadequacy of time for proper disclosure processes to be respected, for lawyers to properly consider digital forensic evidence and the inequality of arms between prosecution and defence hindering the defence's ability to adequately examine, analyse and effectively challenge digital forensic evidence relied upon by the state

Recommendations

There are eleven central recommendations of the Report, and these are mapped to the central identified three categories of challenges.

Digital Forensics Literacy

1.           All data and outputs, provided by Digital Forensic Units and external digital forensics practitioners to police investigators, must be supported by sufficient explanation to allow its significance and limitations in the context of the investigation to be understood.

2.           The creation of regularly updated interactive digital literacy training packages designed for individuals anywhere within the criminal justice system delivering knowledge and understanding of both:

• the capabilities and limitations of digital forensics processes
• the data produced

These resources should be role specific and appropriate to individuals within the police, legal professions and judiciary. Further, consideration must be given to the relevance of the training, ensuring its capacity to stay ahead of evolving technological developments and changes.

3.           Digital literacy training packages developed for lawyers should be equally available and accessible to the Crown Prosecution Service and defence representatives.  To ensure accessibility, Crown Prosecutors must be provided with an appropriate allocation of time to attend and engage and the cost to defence representatives must be reasonable or funded by the state.

4.           Consultation with the judiciary, the Royal Society and the Royal Society of Edinburgh, to ensure that any future judicial primer for court encompassing digital forensics addresses the limitations in digital forensic literacy identified by the Northumbria University Digital Forensics Project.

Technical and Practical Challenges

5.           A significant increase in and strategic deployment of suitably trained Digital Forensic Unit Investigators to address the extensive backlogs, increase the current level of activity and prepare for the inevitable continued increase in demand.

6.           A significant increase in and strategic deployment of Digital Media Investigators, in police forces and other investigative agencies, to:

• enhance the quantity, quality and accessibility of the provision of immediate guidance to investigators and 

• ensure more efficient referrals to the Digital Forensic Units and independent digital forensic practitioners to ensure the pursuit of only reasonable lines of enquiry.

7.           Establishment of a process which encourages and enables effective communication – upstream and downstream – between Digital Forensic Unit practitioners, police and the Crown Prosecution Service.

8.           Development of an effective, modern, data platform for the storage and sharing of digital forensics at all stages of the criminal justice process. 

9.           A review of whether strategic investment in policing co-access to digital forensic resources (equipment and personnel) would address the challenges of:

• keeping pace with the advances in technology required by digital forensic practitioners and the discipline
• financial provision and future investment for delivery and training, now and in the future
• significant backlogs and workloads associated with digital forensic investigation, that compromise efficiency, capacity and capability
• inequity of assistance across different case types and across forces
• a national level of service, underpinned by sustainable achievement and maintenance of accreditation requirements
• reducing the risk and practice of late and incomplete disclosure to the defence

Digital Evidence and Admissibility

10.        Bespoke training for police officers and Digital Forensic Unit practitioners on the criminal rules of evidence and procedure applicable to digital forensic evidence, specifically centred on matters of reliability, fact and opinion evidence, disclosure and admissibility.

11.        An urgent review of current practice in the admission and presentation of digital forensic evidence in magistrates’ courts to address non-compliance with the rules of evidence and the Criminal Procedure Rules.

Next Steps

Each recommendation of the report deserves further research to support evidence-based change across multiple layers of the justice system. In particular, the team are looking to explore digital forensics within magistrates’ courts, and the ways in which evidence presentation and disclosure processes might be improved as the volume of digital evidence increases across all courts. 

The research team will be presenting at several conferences over the following months, and welcome feedback and opinion on the report. Please email any such feedback to Dr Cerian Griffiths at cerian.griffiths@northumbria.ac.uk