Digital evidence requires an understanding of ‘cyberlaw’

From mobile phone records to Facebook postings – courts must consider a new world of evidence

Facebook: in a world where hacking is increasingly the criminals’ tool of choice, how well-equipped are we to drive cyber investigations in pursuit of crucial evidence?  Photograph: Reuters/Dado Ruvic

Facebook: in a world where hacking is increasingly the criminals’ tool of choice, how well-equipped are we to drive cyber investigations in pursuit of crucial evidence? Photograph: Reuters/Dado Ruvic

 

How is the criminal justice system learning to cope with the unique complexities of digital evidence, with the analysis of mobile phone data, satellite imagery and emails? And that’s before you add in all the potentially sensitive material on social media sites such as Facebook, Twitter, YouTube, Flickr and Instagram.

Advances in forensic science, particularly in DNA analysis, continue to revolutionise the ability of investigators to build conclusive cases.

But, in a world where hacking is increasingly the criminals’ tool of choice, how well-equipped are we to drive cyber investigations in pursuit of crucial evidence?

There are two strands to the answer. The first is that courts have traditionally preferred direct witness evidence to digital data, which is sometimes disallowed as stand-alone evidence, often for fear that it can be tampered with or that such tampering may be difficult or impossible to identify.

Judge training

As a result, there is a mindset to be changed. It begins with judges, who need to be trained in the complexities of digital evidence: how to gather and analyse it, how to authenticate it, and how its veracity or accuracy can be challenged – exactly as courts around the world have always done.

In the US, according to Gary Kessler, associate professor at Embry-Riddle Aeronautical University in Florida, and an academic who has looked at the relationship between the judiciary and digital evidence, most judges acknowledge the need for additional training, particularly in areas such as computer forensics.

While they are “appropriately wary” of digital evidence, says Kessler, they are also professional enough to know they need to be equipped to understand arguments made by lawyers in highly technical cases, by expert witnesses and in previous judgments.

As Kessler points out, even scratching the surface tells us that digital forensics entails high-level familiarity with the concepts of computer architecture, operating systems, software engineering and computer networking together with the rules of evidence as they apply in “cyberlaw”.

Which brings us to the second strand of the answer: that having trained the judiciary, the next stage is constant vigilance when it comes to the handling and forensic examination of digital evidence.

Because it turns out that wary judges are absolutely correct to be wary: digital data is often easily altered, it can be difficult to distinguish between original data and copies, and so extracting, securing and documenting digital evidence needs special expertise and attention.

As the US bible on the subject, Forensic Examination of Digital Evidence: A Guide for Law Enforcement points out, the greatest single challenge facing investigators in the courtroom is demonstrating “that the particular electronic media contained the incriminating evidence”.

In evidence terms, some of the most complex cases in the world are heard by the International Criminal Court (ICC) in The Hague, which tries charges of genocide, crimes against humanity, and war crimes. In many cases the victims number in their thousands or even tens of thousands.

Uhuru Kenyatta

In the recent high-profile case against the Kenyan president, Uhuru Kenyatta, which collapsed in December, issues of evidence and its quality were central.

Each side claimed that the other’s witnesses were unreliable and several had to be withdrawn, leaving the case looking increasingly flimsy, while access to mobile phone records and bank statements were still a key problem for the prosecutor when the charges were thrown out.

A report for the ICC by the Human Rights Centre at Berkeley Law School placed those issues in a wider context when it observed that in 2013 the number of mobile phone subscriptions worldwide was 6.8 billion, up from 6 billion in 2011 and 5.4 billion in 2010.

“On the African continent alone, market penetration of mobile phones hit 65 percent in 2012, with an estimated 20 percent annual growth rate. On a continent with few landlines or internet connections, cell phones are used for communication, social media, and even banking – meaning that a considerable amount of personal information . . . may be stored on an individual’s phone.”

Digital players

The Berkeley report, Digital Fingerprints: Using Electronic Evidence to Advance Prosecutions at the International Criminal Court, suggests that the global reach of the ICC means it must adopt a two-pronged approach to developing its digital expertise; firstly, by building up in-house expertise, and secondly, by developing partnerships with outside agencies.

The FBI and Interpol were both represented on the panel that drew up the recommendations, which also suggest that the ICC might attempt building bridges to leading digital players such as Yahoo, Facebook, Google, Microsoft and YouTube, “who hold much of the world’s digital data”.

As with any other court, increasing the ICC’s competence in handling digital evidence requires a commitment to maintaining best practice and expertise.

A hurdle to watch, as one anonymous ICC staffer observes in the report, is that, “Lawyers are not innovators – they are traditionalists by nature”.

The Irish Times Logo
Commenting on The Irish Times has changed. To comment you must now be an Irish Times subscriber.
SUBSCRIBE
GO BACK
Error Image
The account details entered are not currently associated with an Irish Times subscription. Please subscribe to sign in to comment.
Comment Sign In

Forgot password?
The Irish Times Logo
Thank you
You should receive instructions for resetting your password. When you have reset your password, you can Sign In.
The Irish Times Logo
Please choose a screen name. This name will appear beside any comments you post. Your screen name should follow the standards set out in our community standards.
Screen Name Selection

Hello

Please choose a screen name. This name will appear beside any comments you post. Your screen name should follow the standards set out in our community standards.

The Irish Times Logo
Commenting on The Irish Times has changed. To comment you must now be an Irish Times subscriber.
SUBSCRIBE
Forgot Password
Please enter your email address so we can send you a link to reset your password.

Sign In

Your Comments
We reserve the right to remove any content at any time from this Community, including without limitation if it violates the Community Standards. We ask that you report content that you in good faith believe violates the above rules by clicking the Flag link next to the offending comment or by filling out this form. New comments are only accepted for 3 days from the date of publication.