Jon Cook, International Training Instructor, Exterro, discusses how and why digital forensics must become a part of modern policing
His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS) is a key public body responsible for independently assessing UK police forces.
In a study published in December 2022, the Inspectorate examined how effective national law enforcement agencies are at providing digital forensics, capturing and analysing evidence across various digital devices such as smartphones and computers.
Ultimately, the findings were concerning
Ultimately, the findings were concerning. Inspectors involved in the analysis concluded that some agencies were “overwhelmed and did not have a clear understanding of what digital forensics are”, contributing to huge delays in examining devices.
It is perhaps the statistics cited in the most alarming report. Indeed, it highlights that there is a backlog of more than 25,000 devices waiting to be examined, with some forces taking as long as 18 months even to begin capturing case evidence as they struggle to manage the growing mountain of devices involved in criminal investigations.
The recent spike in data volumes lies at the heart of this problem
The recent spike in data volumes lies at the heart of this problem. Unfortunately, many police forces have failed to respond proactively to this challenge. Those still reliant upon outdated forensics methods are now unable to keep pace with growing investigation loads, making it almost impossible for them to meet deadlines and achieve speedy, just resolutions.
It’s a scenario in which everybody suffers. Indeed, many victims are left in a state of limbo by extensive judiciary delays and choose to opt-out of the criminal justice process altogether. Not only does this leave them with no resolution, but potentially guilty criminals may walk free only to offend again.
On the flip side, the prospect of prosecution hanging over an accused can take an immense emotional and psychological toll – something that is incredibly unfair, particularly to those that are ultimately found to be not guilty.
And it is also important to recognise that those professionals involved in the digital forensics process lose out too. Growing backlogs can place immense workplace pressures on them, leading to heightened stress and burnout.
Turning the tide with automation
The report is undoubtedly a major wake-up call. It highlights that digital forensics departments have reached a tipping point, and change is desperately needed to address some significant problems in the justice process.
The only way to turn the current situation around and protect the judicial process is by actively leveraging automation in lab processes and equipping investigators with the technology they need to review digital evidence efficiently and effectively.
By combining the right software with the right environment, digital evidence can become available for immediate review among both investigators on the front line as well as those back at the digital forensics unit. Critically, this improved data availability eliminates delays in reviewing evidence baked into outdated methods.
It’s worth noting that automated workflows can also help achieve ISO 17025 compliance, which is now vital when processing digital evidence. Automating processes can ensure quality control remains consistent and evidence is defensible time after time.
But how can policing departments transition and actively embrace automation in their digital forensics processes? Thankfully, several departments have begun to lead the charge on this front, demonstrating what can be achieved by making the switch.
WMP: A blueprint for improvement
West Midlands Police (WMP) stands as a prime example and has deployed a cloud-based digital forensics service in 2022, which uses an advanced forensic toolkit housed over Microsoft Azure.
Back in 2019, some police forces started to confront the issue that they were experiencing issues in managing heightened digital forensics workloads. WMP was one of these. Faced with growing forensics backlogs, it sought to share data more effectively with frontline investigators in an integrated manner.
Spearheading efforts to find a resolution, WMP worked closely with Microsoft to address the potential legal implications of placing police evidence data in the cloud – a desperately needed transition to leverage scalable hardware and transform the accessibility and security of its sensitive case data.
Proving that this could be achieved successfully and compliantly, WMP has been able to transform its operations completely. Today, it has digital forensic workflows that are managed in a single, collaborative cloud-based platform, where all evidence is processed and analysed at speed.
All data is then stored in a single database that provides investigators with access to the same information simultaneously on a 24/7 basis. Not only does this ensure that they are always working from the most up-to-date case data, but it also enhances collaboration and cuts investigation times. It reduces the cost and complexity of case management.
A cultural shift is required
While forces across the country are all facing the same issues in dealing with a tidal wave of digital devices, WMP has now set the standard for improving digital forensics across policing in the UK.
That said, this transition will be a slow and often challenging burn. Many forces will need to wait until ongoing vendor agreements, which might have several years remaining, are concluded. And even when they reach this point, forces will need to secure greater budgets as digital forensic investigations move into every day rather than being viewed as a specialist service.
We desperately need force recognition that digital evidence is now core to policing. New technologies and capacity will be required, but without investment, the mountain will not move, and capacity cannot grow.
Today, digital forensics is tied into investigations at every level. This must be recognised.
This piece was written by Jon Cook, International Training Instructor, Exterro
