Digital Forensic Science – Mobile Devices
In the second of a series of posts around digital technology and its impact on forensic science, we’re going to explore the world of mobile technology, how criminals are using it and how the police and forensic scientists are using mobile devices to catch and prosecute criminals.
Mobile phones and other digital devices have come to play an increasing part of daily life and as a consequence of their prevalence, material from digital devices is increasingly used as evidence in criminal investigations and prosecutions. Police forces must take a consistent approach when examining data from mobile phones and other digital devices to balance the rights of individuals with the need to carry out thorough independent investigations, new national guidance says.
The widespread use of digital devices, mainly mobile phones but also laptops and other computers, mean the materials they contain, including emails, messages, photos and videos, can often provide crucial evidence in criminal investigations and prosecutions.
Crime and Mobile Technology
Aside from the theft of mobile devices themselves, which are the most commonly stolen item totalling over 325,000 in 2019/20, criminals are increasingly using mobile devices to plan, discuss and carry out other criminal activity such as cybercrime.
Cybercrime
Aside from theft of mobile devices to sell on, the number of cyber-attacks on mobile phones has increased year on year. Why are smartphones being targeted for cybercrime?
Smartphones carry significant detailed data about their user, including financial information, confidential images, social media data, location data, and passwords – this makes them an ideal target for cyber criminals.
Mobile applications are an easy route into smartphones, they can be infected with malware and then innocently downloaded by the user. Cyber criminals can infiltrate devices and listen to personal phone conversations to gather confidential data, such as bank account details.
Smartphones also contain powerful processors. If cyber criminals can penetrate your devices, they can use this computing power for mining cryptocurrency, as a result your smartphone will run slowly and inefficiently.
Encryption and Crime
In the last 10 years encrypted mobile devices and applications have been used by criminals to distribute drugs and plan serious crime. Police agencies are turning the tide on these criminals. In 2020, UK law enforcement made a significant breakthrough in the fight against serious and organised crime after the takedown of a bespoke encrypted global communication service used exclusively by criminals. EncroChat was one of the largest providers of encrypted communications with 60,000 users worldwide and around 10,000 users in the UK – the sole use was for coordinating and planning the distribution of illicit commodities, money laundering and plotting to kill rival criminals.
Working with international enforcement agencies since 2016, the National Crime Agency targeted EncroChat and other encrypted criminal communication platforms by sharing technical expertise and intelligence. Operation Venetic in 2020 managed to dismantle entire organised crime groups with 746 arrests, and £54m criminal cash, 77 firearms and over two tonnes of drugs seized.
Using Mobile Technology to Investigate Crime
The proliferation of mobile digital devices has meant that important digital evidence now potentially exists for most criminal cases. Evidence given to the House of Lords Science and Technology Select Committee in 2019 by a senior UK police manager stated that digital evidence now plays a role in 90% of criminal cases.
Such is the volume of potentially relevant digital evidence in criminal cases today, there is a real risk that it could overwhelm Police Forces and the judiciary. To mitigate this risk, many Police Forces have, or are planning to, roll-out digital triage capabilities to front-line officers to help quickly identify those devices that are likely to contain pertinent evidential data and rule out those that do not, reducing the number of devices seized for full forensics examination and the volume of data that must be examined.
The examination of a person’s devices for digital evidence will likely always involve an element of unavoidable collateral intrusion. Law Enforcement will continue to take measures to minimise this with more stringent processes and guidance, but there is also a need for the creators of digital forensic tools to assist by developing tools in direct collaboration with Law Enforcement that can help reduce potential collateral intrusion by allowing focused targeting and extraction of investigation-relative digital evidence only.
Extraction of material from digital devices
The ICO
The Information Commissioner has published 3 reports across 2020 and 2021 regarding the collection of information from mobile devices across England and Wales, Northern Ireland and Scotland.
The reports recommend several measures, aimed at regaining public confidence that may have been lost through previous poor practices. These measures included calling for a new code of practice to be implemented across law enforcement to improve compliance with data protection law.
Recently the Court of Appeal issued a judgment that reinforced the ICO reports’ findings and recommendations. The Attorney General has revised his guidelines on disclosure, stressing the message that it is not always necessary to obtain digital materials. And the College of Policing has issued operational guidance to police in England and Wales, emphasising the need to consider alternatives to the examination of mobile phones and to extract only the minimum amount of data strictly necessary.
The ICO believes that a more strategic, coordinated approach is needed so that police and prosecutors understand and implement the required systemic changes.
The College of Policing
The College of Policing’s Authorised Professional Practice (APP) on the extraction of material from digital devices provides clear guidance for forces in England and Wales to ensure the way police obtain material from digital devices complies with legislation and balances people’s rights to privacy against the absolute right of all individuals to a fair trial.
The guidance is intended to provide a clear summary of the powers and obligations which police have under the Data Protection Act 2018 and how that should be used with other relevant legislation and case law.
It provides police officers and staff with a set of principles to inform how they obtain personal digital devices – most often mobile phones but also laptops and other computers – from victims, witnesses and suspects for the purpose of an investigation and how they then extract the digital material from those devices.
It will also help the public to understand the responsibilities of the police when gathering evidence, obtaining devices and accessing the material held on them.
In the case of victims and witnesses, the guidance aims to ensure that material from mobile phones and other devices is obtained with their informed agreement and with minimal intrusion to their private lives.
How we can help:
NEC Forensics transforms the way officers record and track information. The solution facilitates case management across an end to end process from crime scene investigation and forensics analysis to court.
Make it easier to collect, process and share crime scene evidence and help officers, investigators and laboratory staff to keep a complete chain of custody at all times.
Give users a single, accurate and up to date view of evidence that can be shared across agencies, and make connections to a whole range of national and local systems with open integration.
If you’d like to find out more about how we can help your organisation take advantage of the latest technology, contact us today.
