By including theories from different disciplines such as law, forensic psychology, investigative methodology and digital forensics - and by obtaining information from informants, a number of sources of errors when investigating digital evidence during the Digital Forensic Process were identified in this study:
6.1 Insufficient investigative competence
To investigate digital evidence in a criminal case, investigative competence is required. The components of investigative competence can be summarized to:
- Knowledge about ICCPR and ECHR
- Knowledge about the Penal Code - and evidential requirements
- Knowledge about Criminal Procedure Code – principles, obligations and coercive measures
- Knowledge about relevant crime phenomena - Skills in use of The Investigative Cycle - Skills in hypothesis generation and testing
- Knowledge about relevant biases, and sufficient countermeasures
- Knowledge and skills in relation to the procedures of a criminal investigation, and the relevant investigative methods
- Documentation and presentation skills
6.2 The right competence is not present at the right time
The handling of digital evidence in a criminal investigation requires both technological and investigative competence. The DFD and the CD have complementary competence, but this study indicates that they rarely possess the combination of necessary competence alone.
An alternative to every DFD developing investigative competence is to ensure that the sufficient types of competence are present at the right time. This is particularly important when decisions and tasks within the Digital Forensics Process phases that require
103
investigative competence are carried out. This requires a form of cooperation that facilitates optimal utilization of the different competences, as well as prevention and countering of errors.
The limitation of both the Digital Forensics Process and The Investigative Cycle in this context is that they do not provide any guidance about how this cooperation should be the carried out to ensure quality and efficiency in the investigation of digital evidence. The present study gives basis for an outline of the necessary competence components related to the Digital Forensics Process in the context of a criminal investigation. By implication, the outline can be understood as a proposal of the technical and investigative competence requirements for the identification, analysis and presentation phase.
Importantly, a combination of investigative and technological competence is needed in all these phases. In the thesis, this has been discussed in relation to:
- The identification phase, when planning of searches or decisions about seizure is made.
- The analysis phase, when the mandate is decided upon, and where the hypotheses generation and testing is conducted within three analysis sub-phases.
- The presentation phase, when the result of the handling of the evidence in the former phases is documented in reports together with a presentation of the evidence itself.
A component within the investigative competence is knowledge about bias, heuristics and countermeasures. This study has uncovered lack of knowledge and efficient countermeasures against these cognitive limitations, which constitute major risks of errors in the investigation of digital evidence.
6.3 Organisational Challenges
There are no defined competency criteria for handling digital evidence within a criminal investigation. The Norwegian Police Directorate has stated that this only should be carried out by personnel with “adequate training“ and “appropriate competence”, but has not outlined the meaning of these terms.
104
There are no routines defining how the cooperation between a CD and a DFD should be done during criminal investigation. This has implications for communicating the tasks, prioritizing of cases and when the right competence is involved in the investigation team.
Large backlogs have been and are still a problem for the quality and efficiency of investigation of digital evidence.
6.4 Consequences
The identified errors may lead to:
- Insufficient or poor quality, due to the investigation being inadequately purpose oriented in relation to the information requirement of the case.
- Inefficient investigations and lengthy case processing, caused by an unnecessarily large scope of the analysis.
- Inadequate protection of the rule of law, caused by errors in the investigation. The errors might origin from partial investigation of digital evidence, insufficient hypotheses generation or testing, or poor investigation in relation to the evidential requirements.
6.5 Countermeasures
The sources of errors may be prevented or countered:
On the individual level, by the individual detective having sufficient technological and investigative competence, as well as knowledge about the limitations of own competence.
On cooperation level, by the parties knowing which technological and investigative competence components that are required in the steps of Digital Forensics Process, and ensuring that the sufficient competence is available when necessary. A routine description could be developed to facilitate a structured cooperation.
The cooperation between the CD and DFD would benefit from a common platform for task management where the hypotheses of the case are available, as well as a description of the information requirement for testing the hypotheses.
105
To prevent bias and heuristics, such as confirmation bias and group think, a structure where the decisions and conclusions are routinely challenged would be beneficial. The impact of such a measure depends on whether a culture where the detectives are open to and believe in the advantages of such a countermeasure is established.
On an organisational level, by creating a plan for competence development in relation to both technological and investigative competence. A thoughtful organizational and physical
location of the DFDs also seems to matter.
6.6 Real life examples
The examples provided by the participants show that the DFD being included into the investigation team, preferably at an early stage of the investigation, clear leadership and adequate allocation of resources are important factors for good cooperation between CD and DFD when investigating digital evidence.