The right to a fair trial as a conceptual framework for digital evidence rules in criminal investigations

Digital evidence and digital forensics have a significant impact on criminal investigation. This requires an examination if the fair trial principle remains sound in the new domain.In this paper the right to a fair trial in Art. 6 ECHR and its interpretation in case law is analysed in order to clarify its connection to evidence law and its specific application to the investigation stage of criminal proceedings. It is argued that the principle implicitly enshrines a framework for the development of universal evidence rules . Derived are two-groups of evidence rules: equality of arms based and presumption of innocence based. For each group specific challenges in the digital investigation are outlined and discussed in the context of a new governance model for digital evidence.     

Quantitative evaluation of the results of digital forensic investigations: a review of progress

Unlike conventional forensics, digital forensics does not at present generally quantify the results of its investigations. It is suggested that digital forensics should aim to catch up with other forensic disciplines by using Bayesian and other numerical methodologies to quantify its investigations’ results. Assessing the plausibility of alternative hypotheses (or propositions, or claims) which explain how recovered digital evidence came to exist on a device could assist both the prosecution and the defence sides in criminal proceedings: helping the prosecution to decide whether to proceed to trial and helping defence lawyers to advise a defendant how to plead. This paper reviews some numerical approaches to the goal of quantifying the relative weights of individual items of digital evidence and the plausibility of hypotheses based on that evidence. The potential advantages enabling the construction of cost-effective digital forensic triage schemas are also outlined.

Key points

• The absence of quantified results from digital forensic investigations, unlike those of conventional forensics, is highlighted.
• A number of approaches towards quantitative evaluation of the results of digital forensic investigations are reviewed.
• The significant potential benefits accruing from such approaches are discussed.

     

An efficient technique for enhancing forensic capabilities of Ext2 file system

As electronic documents become more important and valuable in the modern era, attempts are invariably made to take undue-advantage by tampering with them. Tampering with the modification, access and creation date and time stamps (MAC DTS) of digital documents pose a great threat and proves to be a major handicap in digital forensic investigation. Authentic date and time stamps (ADTS) can provide crucial evidence in linking crime to criminal in cases of Computer Fraud and Cyber Crimes (CFCC) through reliable time lining of digital evidence. But the ease with which the MAC DTS of stored digital documents can be changed raises some serious questions about the integrity and admissibility of digital evidence, potentially leading to rejection of acquired digital evidence in the court of Law. MAC DTS procedures of popular operating systems are inherently flawed and were created only for the sake of convenience and not necessarily keeping in mind the security and digital forensic aspects. This paper explores these issues in the context of the Ext2 file system and also proposes one solution to tackle such issues for the scenario where systems have preinstalled plug-ins in the form of Loadable Kernel Modules, which provide the capability to preserve ADTS.     

The Internet, Technology, and Organized Crime

Digital technology has transformed organizational life. Developments in communications, and in information storage and retrieval, to name just two areas, have greatly enhanced the efficiency with which legitimate organizations operate. Unfortunately, the benefits of digital technology are not lost on criminal organizations, which exploit digital technology to enhance the efficiency and effectiveness of their own operations. This paper will discuss the organized criminal exploitation of digital technology, by looking at a number of illustrative cases from Asia and around the world. It will discuss the various types of “conventional” organized crime that can be facilitated by digital technology, as well as terrorism, which itself can be regarded as a special kind of organized criminal activity. One fundamental question that the paper will seek to address is whether the activities of Asian organized crime have become substantively different as a result of technology, or whether traditional organized criminal activities in Asia are merely being conducted on a more efficient and effective basis. The paper will note the transnational nature of much organized criminal activity, and will discuss mechanisms for the control of organized crime in the digital age.     

When finding nothing may be evidence of something: Anti-forensics and digital tool marks

There are an abundance of measures available to the standard digital device users which provide the opportunity to act in an anti-forensic manner and conceal any potential digital evidence denoting a criminal act. Whilst there is a lack of empirical evidence which evaluates the scale of this threat to digital forensic investigations leaving the true extent of engagement with such tools unknown, arguably the field should take proactive steps to examine and record the capabilities of these measures. Whilst forensic science has long accepted the concept of toolmark analysis as part of criminal investigations, ‘digital tool marks’ (DTMs) are a notion rarely acknowledged and considered in digital investigations. DTMs are the traces left behind by a tool or process on a suspect system which can help to determine what malicious behaviour has occurred on a device. This article discusses and champions the need for DTM research in digital forensics highlighting the benefits of doing so.     

Situational prevention of terrorism. Remarks from the field of counterterrorism in the Netherlands on Newman and Clarke’s Policing Terrorism

In this paper I shall discuss how criminal investigation might contribute to a situational approach to terrorism. Therefore I discuss Policing Terrorism by Newman and Clarke, and confront it with experiences from work in the field of counterterrorism: criminal investigations at the Dutch National Police Agency (NPA). I demonstrate that Newman and Clarke have too narrow a scope on policing terrorism, in particular when it comes to the role of criminal investigation. They restrict their focus to local police work in the phases immediately before and after a terrorist attack. This is unfortunate because case files show that criminal investigators play a central role in the prevention of terrorism. They intervene in earlier phases of terrorist preparation, target a wider range of terrorist offences than terrorist attacks, and prosecute radicals for their non-terrorist offences. Furthermore, criminal investigations offer insights that might be of help in developing an SCP approach to terrorism.     

Triaging digital device content at-scene:- Formalising the decision-making process

The prominence of technology usage in society has inevitably led to increasing numbers of digital devices being seized, where digital evidence often features in criminal investigations. Such demand has led to well documented backlogs placing pressure on digital forensic labs, where in an effort to combat this issue, the ‘at-scene triage’ of devices has been touted as a solution. Yet such triage approaches are not straightforward to implement with multiple technical and procedural issues existing, including determining when it is actually appropriate to triage the contents of a device at-scene. This work remains focused on this point due to the complexities associated with it, and to support first responders a nine-stage triage decision model is offered which is designed to promote consistent and transparent practice when determining if a device should be triaged.     

Ambiguity and Conflict in the Implementation of Evidence Law in Criminal Matters: a Study of the United Arab Emirates Jurisprudence

Due the lack of the law of evidence in criminal matters in the United Arab Emirates (UAE), it is important to address the issue of the rules of evidence in the UAE where Sharia criminal law is applied along with enacted law of Criminal Procedural Law. The courts’ decisions contradicted each other because of the differences of opinions among the law schools exist in Islamic law in one hand and between the Sharia criminal law and enacted law in the other hand. Further, the Criminal Procedural Law does not state the rules of evidence in clear manner to judges and individuals. The lack of stated rules and procedures and what evidence could be accepted and what cannot are not definite in the UAE legal system. The article will argue that because of the differences in the opinions related to the admission and acceptance of the evidences exist among the Islamic law schools and between the Sharia law and enacted law, the court decisions have contradicted each other and create ambiguities in the field of the evidence in criminal law. The Islamic jurists have different opinions about evidence in fornication crimes, Qasama evidence in qisas, and women and non-Muslim testimonies. Such differences affect the Union Supreme Court decisions. Therefore, the UAE legislator must enact the law of evidence in criminal matters in order to reduce the contradiction between judges’ opinions, clear ambiguities, and protect individual rights as it did with civil and commercial matter.     

False positive and false negative rates in self-reported intentions to offend: A replication and extension

Purpose

Studies of criminal decision making commonly rely on college students’ self-reported intentions to commit a hypothetical offense. The current study evaluates the predictive validity of these intentions to offend.

Methods

Undergraduate students (n = 726) read a fictitious but seemingly realistic newspaper article describing an illegal opportunity for acquiring digital music files, and then reported their intentions to act upon the opportunity. Afterward, participants’ real world attempts to follow-through on the opportunity were monitored covertly.

Results

Findings reveal that participants who reported weak intentions to offend typically refrained from the act, resulting in a low false negative rate. However, those who reported strong intentions to offend also typically refrained from the act, thereby resulting in a high false positive rate.

Conclusions

These findings suggest that while participants’ predictions of criminal abstention are generally accurate, their predictions of criminal involvement are more problematic. Such faulty intentions have important implications for research on criminal decision making.     

Law versus technology: Blockchain,GDPR, and tough tradeoffs

Inconsistency between the way in which the law is structured, and the way in which technologies actually operate is always an interesting and useful topic to explore. When a law conflicts with a business model, the solution will often be changing the business model. However, when the law comes into conflict with the architecture of hardware and software, it is less clear how the problem will be managed.In this paper, we analyze the contradiction of blockchain technology and the requirements of GDPR. The three contradictions we examine are (i) right to be forgotten versus irreversibility/immutability of records, (ii) data protection by design versus tamper-proofness and transparency of blockchain, and (iii) data controller versus decentralized nodes. We highlight that the conflicts can be handled through focusing on commonalities of GDPR and the blockchain, developing new approaches and interpretations, and tailoring the blockchain technology according to the needs of data protection law.     

Digital evidence and the crime scene

Many criminal investigations maintain an element of digital evidence, where it is the role of the first responder in many cases to both identify its presence at any crime scene, and assess its worth. Whilst in some instances the existence and role of a digital device at-scene may be obvious, in others, the first responder will be required to evaluate whether any ‘digital opportunities’ exist which could support their inquiry, and if so, where these are. This work discusses the potential presence of digital evidence at crime scenes, approaches to identifying it and the contexts in which it may exist, focusing on the investigative opportunities that devices may offer. The concept of digital devices acting as ‘digital witnesses’ is proposed, followed by an examination of potential ‘digital crime scene’ scenarios and strategies for processing them.     

On the database lookup problem of approximate matching

Investigating seized devices within digital forensics gets more and more difficult due to the increasing amount of data. Hence, a common procedure uses automated file identification which reduces the amount of data an investigator has to look at by hand. Besides identifying exact duplicates, which is mostly solved using cryptographic hash functions, it is also helpful to detect similar data by applying approximate matching.Let x denote the number of digests in a database, then the lookup for a single similarity digest has the complexity of O(x). In other words, the digest has to be compared against all digests in the database. In contrast, cryptographic hash values are stored within binary trees or hash tables and hence the lookup complexity of a single digest is O(log₂(x)) or O(1), respectively.In this paper we present and evaluate a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(x) to O(1). Therefore, instead of using multiple small Bloom filters (which is the common procedure), we demonstrate that a single, huge Bloom filter has a far better performance. Our evaluation demonstrates that current approximate matching algorithms are too slow (e.g., over 21 min to compare 4457 digests of a common file corpus against each other) while the improved version solves this challenge within seconds. Studying the precision and recall rates shows that our approach works as reliably as the original implementations. We obtain this benefit by accuracy–the comparison is now a file-against-set comparison and thus it is not possible to see which file in the database is matched.     

Automatic forensic face recognition from digital images.

Digital image evidence is now widely available from criminal investigations and surveillance operations, often captured by security and surveillance CCTV. This has resulted in a growing demand from law enforcement agencies for automatic person-recognition based on image data. In forensic science, a fundamental requirement for such automatic face recognition is to evaluate the weight that can justifiably be attached to this recognition evidence in a scientific framework. This paper describes a pilot study carried out by the Forensic Science Service (UK) which explores the use of digital facial images in forensic investigation. For the purpose of the experiment a specific software package was chosen (Image Metrics Optasia). The paper does not describe the techniques used by the software to reach its decision of probabilistic matches to facial images, but accepts the output of the software as though it were a 'black box'. In this way, the paper lays a foundation for how face recognition systems can be compared in a forensic framework. The aim of the paper is to explore how reliably and under what conditions digital facial images can be presented in evidence.     

Organised crime groups in cyberspace: a typology

Three categories of organised groups that exploit advances in information and communications technologies (ICT) to infringe legal and regulatory controls: (1) traditional organised criminal groups which make use of ICT to enhance their terrestrial criminal activities; (2) organised cybercriminal groups which operate exclusively online; and (3) organised groups of ideologically and politically motivated individuals who make use of ICT to facilitate their criminal conduct are described in this article. The need for law enforcement to have in-depth knowledge of computer forensic principles, guidelines, procedures, tools, and techniques, as well as anti-forensic tools and techniques will become more pronounced with the increased likelihood of digital content being a source of disputes or forming part of underlying evidence to support or refute a dispute in judicial proceedings. There is also a need for new strategies of response and further research on analysing organised criminal activities in cyberspace.

Covert communication by means of email spam: A challenge for digital investigation

In digital investigations the investigator typically has to deal with thousands of digital artifacts. Among them, email has long been one of the many focuses that potentially can generate useful information. However, in our training we notice a tendency to overlook or downplay the importance of analyzing spam emails as they are generally assumed to be irrelevant junk emails. In this article we thus illustrate how these seemingly irrelevant messages might play a crucial role in digital investigations. Five scenarios are introduced in which the investigator tends to overlook crucial incriminating information that has been disguised as spam. The methods used by criminals in these cases are discussed. In light of these covert criminal communications, we call for more attention from the digital forensics community to realize how email spam may assist in criminal activities.     

A comparison of hair colour measurement by digital image analysis with reflective spectrophotometry

While reflective spectrophotometry is an established method for measuring macroscopic hair colour, it can be cumbersome to use on a large number of individuals and not all reflective spectrophotometry instruments are easily portable. This study investigates the use of digital photographs to measure hair colour and compares its use to reflective spectrophotometry. An understanding of the accuracy of colour determination by these methods is of relevance when undertaking specific investigations, such as those on the genetics of hair colour. Measurements of hair colour may also be of assistance in cases where a photograph is the only evidence of hair colour available (e.g. surveillance). Using the CIE L^*a^*b^* colour space, the hair colour of 134 individuals of European ancestry was measured by both reflective spectrophotometry and by digital image analysis (in V++). A moderate correlation was found along all three colour axes, with Pearson correlation coefficients of 0.625, 0.593 and 0.513 for L^*, a^* and b^* respectively (p-values = 0.000), with means being significantly overestimated by digital image analysis for all three colour components (by an average of 33.42, 3.38 and 8.00 for L^*, a^* and b^* respectively). When using digital image data to group individuals into clusters previously determined by reflective spectrophotometric analysis using a discriminant analysis, individuals were classified into the correct clusters 85.8% of the time when there were two clusters. The percentage of cases correctly classified decreases as the number of clusters increases. It is concluded that, although more convenient, hair colour measurement from digital images has limited use in situations requiring accurate and consistent measurements.     

Multi-resolution similarity hashing

Large-scale digital forensic investigations present at least two fundamental challenges. The first one is accommodating the computational needs of a large amount of data to be processed. The second one is extracting useful information from the raw data in an automated fashion. Both of these problems could result in long processing times that can seriously hamper an investigation.In this paper, we discuss a new approach to one of the basic operations that is invariably applied to raw data – hashing. The essential idea is to produce an efficient and scalable hashing scheme that can be used to supplement the traditional cryptographic hashing during the initial pass over the raw evidence. The goal is to retain enough information to allow binary data to be queried for similarity at various levels of granularity without any further pre-processing/indexing.The specific solution we propose, called a multi-resolution similarity hash (or MRS hash), is a generalization of recent work in the area. Its main advantages are robust performance – raw speed comparable to a high-grade block-level crypto hash, scalability – ability to compare targets that vary in size by orders of magnitude, and space efficiency – typically below 0.5% of the size of the target.     

THE GENESIS OF CARTEL INVESTIGATIONS: SOME INSIGHTS FROM EXAMINING THE DYNAMIC INTERRELATIONSHIPS BETWEEN U.S. CIVIL AND CRIMINAL ANTITRUST INVESTIGATIONS

The U.S. Department of Justice has prosecuted over 1600 criminalantitrust (price-fixing and related) cases since 1970. Yet weknow precious little about the true genesis of these investigations.This paper uses the vector-autoregression methodology to examinethe dynamic interrelationships between the various criminaland civil antitrust enforcement variables. A key result is thatthe number of criminal prosecutions increases in the years immediatelyfollowing an increase in the number of civil cases, suggestingthat merger reviews and other civil investigations may alertthe antitrust authorities to criminal antitrust activities.To the best of my knowledge, this is the first econometric analysisthat demonstrates the quantitative size of this effect and thetime lags in the relationship. Other findings include importantdynamic interrelationships between grand jury investigations,the number of individuals and corporations prosecuted, and criminalcases, indicating that information unearthed during a givencriminal investigation and prosecution often reveals informationabout other conspiracies leading to future investigations andprosecutions. Finally, the number of criminal cases prosecutedincreases following an economic downturn. We relate this increaseto the literature, which points to cartel instability duringeconomic downturns.