Digital evidence requires an understanding of ‘cyberlaw’

How is the criminal justice system learning to cope with the unique complexities of digital evidence, with the analysis of mobile phone data, satellite imagery and emails? And that's before you add in all the potentially sensitive material on social media sites such as Facebook, Twitter, YouTube, Flickr and Instagram.

Advances in forensic science, particularly in DNA analysis, continue to revolutionise the ability of investigators to build conclusive cases.

But, in a world where hacking is increasingly the criminals’ tool of choice, how well-equipped are we to drive cyber investigations in pursuit of crucial evidence?

There are two strands to the answer. The first is that courts have traditionally preferred direct witness evidence to digital data, which is sometimes disallowed as stand-alone evidence, often for fear that it can be tampered with or that such tampering may be difficult or impossible to identify.

Judge training

As a result, there is a mindset to be changed. It begins with judges, who need to be trained in the complexities of digital evidence: how to gather and analyse it, how to authenticate it, and how its veracity or accuracy can be challenged – exactly as courts around the world have always done.

In the US, according to Gary Kessler, associate professor at Embry-Riddle Aeronautical University in Florida, and an academic who has looked at the relationship between the judiciary and digital evidence, most judges acknowledge the need for additional training, particularly in areas such as computer forensics.

While they are “appropriately wary” of digital evidence, says Kessler, they are also professional enough to know they need to be equipped to understand arguments made by lawyers in highly technical cases, by expert witnesses and in previous judgments.

As Kessler points out, even scratching the surface tells us that digital forensics entails high-level familiarity with the concepts of computer architecture, operating systems, software engineering and computer networking together with the rules of evidence as they apply in “cyberlaw”.

Which brings us to the second strand of the answer: that having trained the judiciary, the next stage is constant vigilance when it comes to the handling and forensic examination of digital evidence.

Because it turns out that wary judges are absolutely correct to be wary: digital data is often easily altered, it can be difficult to distinguish between original data and copies, and so extracting, securing and documenting digital evidence needs special expertise and attention.

As the US bible on the subject, Forensic Examination of Digital Evidence: A Guide for Law Enforcement points out, the greatest single challenge facing investigators in the courtroom is demonstrating "that the particular electronic media contained the incriminating evidence".

In evidence terms, some of the most complex cases in the world are heard by the International Criminal Court (ICC) in The Hague, which tries charges of genocide, crimes against humanity, and war crimes. In many cases the victims number in their thousands or even tens of thousands.

Uhuru Kenyatta

In the recent high-profile case against the Kenyan president, Uhuru Kenyatta, which collapsed in December, issues of evidence and its quality were central.

Each side claimed that the other’s witnesses were unreliable and several had to be withdrawn, leaving the case looking increasingly flimsy, while access to mobile phone records and bank statements were still a key problem for the prosecutor when the charges were thrown out.

A report for the ICC by the Human Rights Centre at Berkeley Law School placed those issues in a wider context when it observed that in 2013 the number of mobile phone subscriptions worldwide was 6.8 billion, up from 6 billion in 2011 and 5.4 billion in 2010.

“On the African continent alone, market penetration of mobile phones hit 65 percent in 2012, with an estimated 20 percent annual growth rate. On a continent with few landlines or internet connections, cell phones are used for communication, social media, and even banking – meaning that a considerable amount of personal information . . . may be stored on an individual’s phone.”

Digital players

The Berkeley report,

Digital Fingerprints: Using Electronic Evidence to Advance Prosecutions at the International Criminal Court,

suggests that the global reach of the ICC means it must adopt a two-pronged approach to developing its digital expertise; firstly, by building up in-house expertise, and secondly, by developing partnerships with outside agencies.

The FBI and Interpol were both represented on the panel that drew up the recommendations, which also suggest that the ICC might attempt building bridges to leading digital players such as Yahoo, Facebook, Google, Microsoft and YouTube, "who hold much of the world's digital data".

As with any other court, increasing the ICC’s competence in handling digital evidence requires a commitment to maintaining best practice and expertise.

A hurdle to watch, as one anonymous ICC staffer observes in the report, is that, “Lawyers are not innovators – they are traditionalists by nature”.