Written by Andrew Livesley MBE
The very real advantage of triage in the Criminal Justice System
Recent press coverage and statements by senior officers have served to highlight the scarcity of forensic digital examination resources and, indeed, the impact of that scarcity on the Criminal Justice System.
“…….figures show Lancashire Constabulary seized 745 computers last year and employed three forensic examiners to extract images from them.”
Alarmingly, these figures, obtained as a result of a Freedom of Information request (FOI), the report continues:
“…….do not include other devices such as digital cameras, mobile phones, portable hard drives, CDs, gaming devices, tablets and videos. Yet such devices are routinely seized by police as part of these investigations.”
The main issues for the police and law enforcement when dealing with digital data may be seen as;* The volume of data to be seized and/or examined;* The resources available for expert examination of seized material;* The ever growing distance between the investigator and the seized data.
Such activity carries a high value to the investigating officers as stated by DAC Steven Kavanagh
"Mobile phones and other devices are increasingly being used in all levels of criminal activity," said Stephen Kavanagh, Deputy Assistant Commissioner of the Metropolitan Police Service.
HMIC stated “we have found worrying examples of cases not being prepared properly because officers, having gathered evidence, were unable to have it recovered forensically in a format that would be admissible as evidence, or there being unacceptable delays in the analysis of the evidence.”
This situation fails to serve the victim and the delays can have an adverse effect on outcomes:“There are cases and there will be cases where the delay is such it could make the difference between an immediate custodial sentence and non-custodial disposal.”Judge Clement Goldstone QC
HMIC went onto to say: “The capabilities to tackle cyber-crime should not be the preserve of the specialist officer; every police officer needs an understanding of it and the capabilities to deal with the cyber-crime they will encounter.”
In order to make the fastest assessment of, for example, a laptop, a system which uses triage is required. Such a system can limit the data recovered and analysed. The speed of examination and analysis can be accelerated by intelligence driven data selection. For example, if the suspect is suspected of holding images of child exploitation, by cutting the search of the data down to only images, the speed will increase substantially. In such a case, rapid analysis at the front line will achieve two objectives:
* Provide the investigators with the evidence they need for charging, and* Allow the images to be submitted to assist in the protection of the children from further abuse at the earliest possible juncture.