Understanding the Use of Digital Forensics in Policing in England and Wales: An Ethnographic Analysis of Current Practices and Professional Dynamics

Lead Research Organisation: UNIVERSITY OF EXETER
Department Name: Sociology, Philosophy, Anthropology

Abstract

Digital evidence can reveal a suspect's intent to commit an offence and help establish when events occurred, where victims and suspects were and with whom they communicated. It has been increasingly used in examinations of homicides, sex crimes, missing persons, child sexual abuse, drug dealing, fraud and theft of personal information, as well as in civil disputes. As the volume of cases requiring digital forensic analysis and the amount of information to be processed in each case have risen rapidly in recent years, law enforcement agencies are struggling to address this demand. In this context, social science research is needed to illuminate how current practices can be improved and the ways in which the usefulness of digital evidence in crime detection can be maximized while preserving ethical acceptability, civil liberties and protecting both the victims and the wrongly accused. To date however, these critical issues remain under-explored and little is known about the deployment of digital forensic evidence in police inquiries and the organiational, professional and societal issues it raises.

This project aims to offer a theoretically grounded and empirically based ethnographic analysis of the digital forensic resources, practices and expertise mobilised to provide intelligence for on-going investigations and aid the prosecution of suspects. Focusing on areas of improvement prioritised with the input of digital forensics (DF) practitioners working across four police forces as part of a regional forensic collaboration, its main objectives are to examine current provision in the constabularies covered by this organizational arrangement and explore how DF capabilities are used in the production of digital evidence. The project will employ qualitative methodologies to analyse the interactions and exchanges between different occupational groups and render visible this rarely explored socially and politically sensitive domain. A focus on the transformation of digital data into evidence and its trajectory to the final stage before prosecution, will enable the observation of DF knowledge and routines (1) as they unfold and (2) at different points in the investigative process. It will bring into relief operational procedures and dependencies, professional tensions, regulatory dynamics and distinct understandings of DF capabilities. The potential benefits of this project are multi-layered:

Conceptually, the project will contribute to sociological and criminological studies on the seldom explored application of forensic technologies in policing. The analysis will also inform and update wider socio-legal, crime and police studies approaches to assessing the contribution of forensic science to criminal justice outcomes, and social science literature on how various stakeholders understand the role of DF in police investigations.
Methodologically, the project will facilitate practitioners' engagement with and through its design, and provide novel insights on the role of social science research in documenting, establishing and sustaining dialogue between different communities of practice.

At a practical level, the project will provide an in-depth understanding of current DF arrangements. The study will augment initiatives by police forces to improve performance by educating stakeholders about the ways in which DF can contribute to criminal investigations. It will do so in an organizationally reflexive way, with a view to foster cross-sector co-operation and exchange and improvements. The findings will help identify the gaps in DF resources and tensions in its delivery and impact directly on current practices. They will promote dialogue between providers and users, and inform the future training of investigative staff.

At a policy level, the findings will contribute to better informed decision making. With a focus on 'What Works' in DF they will help promote best practices and lead to a more efficient delivery of DF provision.

Planned Impact

The research aims to increase the effectiveness of digital forensics (DF) services and policies, improve how DF provision may be best structured, and enhance stakeholders' understanding of how DF protocols fit into investigative practice. Given the level of change anticipated with the introduction of accreditation processes and streamlining of DF routines regionally, timescales for the full benefits are hard to predict. Its non-academic beneficiaries include:

(A) DF practitioners, High Tech Unit teams and managers of the South West Forensic Collaboration (SWFC) who seek to identify and establish best practice in DF and enable local ownership and accountability. The project will support the development of streamlined DF protocols across the four police forces in the region through a systematic approach to identifying gaps and tensions in DF delivery, providing advice on how these can be overcome.

(B) While immediately relevant to participants and the SWFC, the project will also be of benefit to other DF teams, forensic partnerships and organizations in the UK and internationally. Its findings will help identify best practice in the application of DF in police investigations in a regional setting, demonstrate how this can be achieved and enable further learning about 'What Works' in DF.

(C) The College of Policing, through which the project and its findings will be promoted nationally as a vehicle for the transfer of such learning. Its representation on the Advisory Board will ensure that the research findings will be more widely communicated to police educators, researchers and users to offer guidance for similar organisational initiatives.

(D) Evidence-based agencies such as the Society for Evidence Based Policing (SEBP) and the Centre for the Application of Science and Technology (CAST). Project findings will enable innovation, raise awareness of how DF can be used effectively, appraise a 'What Works' approach in DF and promote the successful delivery of DF services.

(E) Front-line police and Senior Investigative Officers (two of the key DF user groups) and Digital Media Investigators (ranking police officers who serve to translate digital forensic knowledge between DF specialists, police forces and the public). The analysis will involve an investigation of staff processes, and thus enhance users' awareness of what DF can and cannot do. For instance, identifying the utility of DF artefacts is an area with which officers typically struggle but it is critical to effective investigation. Sharing the research findings with these beneficiaries through user engagement activities and outputs is instrumental to facilitate change in current practice.

(F) Prosecutors and legal teams whose awareness and expectations of DF require targeted updating to improve juridical knowledge of DF and prevent miscarriages of justice. Briefings on the research findings will be disseminated to the Crown Prosecution Service, the Law Society and the Criminal Bar Association of England and Wales, to enhance such knowledge.

(G) Forensic Science Regulators, whose mission is to implement forensic standards nationally and assure the integrity of forensic practices. By engaging with these stakeholders as well as fostering connections and dialogue across policing and DF communities, the findings will enhance police understandings of what DF standards involve as well as the regulators' appreciation of operational and organisational issues in DF.

(H) The wider forensic community through its professional associations. Institutional reform is most likely to succeed by nurturing a cross-sector network of experts and practitioners who can together collaborate with police and other key stakeholders to facilitate the effective use of DF in policing. By developing a DF network, this research will create the opportunity for new intellectual and professional links between DF practitioners, police officers, regulators and policy makers.

Publications

10 25 50
 
Description This project examined the application of digital forensics (DF) in police investigations and its operational, organisational and professional tensions. The objectives of the project have been met, by:
1. Appraising DF provision and processes in four DF units that were part of a forensic collaboration
2. Observing how DF processes and practices compare regionally and nationally
3. Understanding how DF contributes to the analysis and interpretation of DF trace
4. Exploring how occupational cultures, organisational arrangements and regulatory requirements impact on inter and intra-professional exchanges and understandings of professionalism and expertise in DF
5. Examining how DF fits in the wider delivery of forensic service support
6. Documenting the concerns and expectations of key stakeholders, informing policy developments and helping to develop local, regional and national approaches to the application of DF in policing.

The most significant achievements are:

a. An analysis of risk management and prioritisation in DF across 33 police forces in England and Wales, which evidences the urgent need for updated tools and centralised arrangements to deal with the increase in the demand for DF analysis. Using a combination of ethnographic observations, survey, qualitative interviews and data obtained through a benchmarking exercise, the findings provide the first systematic understanding of the challenges experienced by forces in handling, interpreting and solving officers' requests for the extraction and analysis of digital trace from the victims and suspects' digital devices.

b. An examination of the emotional burden the analysis of child sexual abuse material has on DF practitioners, the organisational facilities provided to address this problem, and the informal mechanisms DF examiners adopt to carry out their duties seamlessly. The findings resonate with the experiences of the wider DF community, nationally and internationally, illustrate the gaps in counselling provision and call for specifically DF tailored health and well-being provision nationally.

c. The findings evidence the lack of knowledge and training of police workforce and legal teams in DF basic requirements and the implications for both the professionalisation of various occupational groups and the delivery of informed and appropriate criminal justice outcomes. As DF practices spread outside the confines of laboratories, standards and quality must be understood and observed in the practices of all those working with digital trace. Our findings suggest that isolated local initiatives cannot sustain the urgent need for systematic personnel training on increasingly complex forms of digital evidence. Such training must become an integral part of degree programmes and continuing professional development processes.

d. Working closely and collaboratively with the four DF units and other DF teams nationally led to a better understanding of the provision gaps in the regional and national resources allocated to DF, the workforce dynamics, the impact of accreditation on DF units and police forces and the challenges DF raises for different occupational groups and organisations. They also evidence the need for a better understanding of DF cultures and their integration into the integration into the wider forensic scientific community. The findings continue to inform discussions with key stakeholders regionally and nationally.
Exploitation Route The research outcomes offer a snapshot of current provision and challenges in the application of digital forensics in policing and provide a point of reference and comparison for future analyses in this underexplored, yet essential area of criminal investigation.

In terms of non-academic routes, they illustrate the fragmentation of DF provision, and it is hoped that they will also help shape emerging policy (such as that provided by the Forensic Policy Team at the Home Office, and the revised NPCC Digital Forensic Strategy) and the dissemination of good practice (as provided by the Forensic Capabilities Network). They can also help strengthen the voice of DF practitioner communities in lobbying for more comprehensive and better tailored health and well-being provision and appropriate and updated training.

In terms of additional academic routes: the outcomes highlight the need to map DF provision more comprehensively, develop updated tools for risk assessment and prioritisation processes, and to monitor internal demand in policing. Equally, they call for tailored training provisions, within and outside DF laboratories, and a better integration of DF into the wider forensic community, all of which provide fruitful and opportune directions of future academic research.
Sectors Digital/Communication/Information Technologies (including Software)

Education

Government

Democracy and Justice

Security and Diplomacy

URL https://reshare.ukdataservice.ac.uk/855980/
 
Description This project's findings have been used by digital forensic practitioners and digital forensic managers to inform the re-organisation of local and regional work processes. Article outputs have also been used by digital forensic practitioners as far away as Sweden and Argentina to inform how their digital forensic processes are managed. Findings from the project were referenced in the 2020 National Police Chiefs Council (NPCC) Digital Forensic Strategy, a document commissioned by the NPCC to guide practice and process across England and Wales and set the vision for digital forensics in the years to come. Findings of the project have been also discussed with the Forensic Policy Team at the Home Office in August 2022, and with numerous digital forensic practitioners, managers and police personnel locally, regionally, nationally and internationally, on several occasions. New collaborations with practitioners in two police forces are underway (2023).
Sector Digital/Communication/Information Technologies (including Software),Education,Government, Democracy and Justice,Security and Diplomacy,Other
Impact Types Cultural

Policy & public services

 
Description Changing Mobile Phone Examination, risk assessment and workflow practices
Geographic Reach Local/Municipal/Regional 
Policy Influence Type Contribution to new or improved professional practice
Impact Dana Wilson-Kovacs and Jen Wilcox's input contributed to a review of the effectiveness and efficiency in the delivery of digital forensics input in crime investigations. They gave advice on streamlining and restructuring current working arrangements over several meetings with members of senior management, quality and standards teams and digital forensics teams and produced a final report of the research findings for the project's collaborators.
 
Description Citation of research in NPCC Digital Forensics Strategy June 2020
Geographic Reach National 
Policy Influence Type Citation in other policy documents
URL https://www.npcc.police.uk/
 
Description Home Office discussion of project findings
Geographic Reach National 
Policy Influence Type Contribution to new or improved professional practice
 
Description Invited Speaker at Society of Evidence Based Policing Regional Conference October
Geographic Reach Local/Municipal/Regional 
Policy Influence Type Contribution to new or improved professional practice
 
Description Invited member of the Home Office Impact of Forensics project
Geographic Reach National 
Policy Influence Type Contribution to a national consultation/review
 
Description Project Presentation to and Workshop with Digital Forensic Managers as part of the Training Course at the College of Policing, Ryton-on-Dunsmore, Coventry
Geographic Reach National 
Policy Influence Type Influenced training of practitioners or researchers
 
Description The Investigator 2023 CPD training event/conference
Geographic Reach Multiple continents/international 
Policy Influence Type Influenced training of practitioners or researchers
 
Description Transforming Forensics Programme, Digital Forensics Research Working Group
Geographic Reach National 
Policy Influence Type Membership of a guideline committee
 
Description ESRC IAA Knowledge Exchange Fellowship Award application: Digital evidence-based policing: examining the impact of digital evidence strategies in criminal justice outcomes
Amount £31,490 (GBP)
Organisation University of Exeter 
Sector Academic/University
Country United Kingdom
Start 12/2023 
End 11/2024
 
Description Human Factors and Digital Technology in Forensic Science: Decision-Making and Legal Implications
Amount £16,750 (GBP)
Organisation University of Exeter 
Sector Academic/University
Country United Kingdom
Start 01/2022 
End 03/2022
 
Description Outward Mobility Academic Fellowship
Amount £2,060 (GBP)
Organisation University of Exeter 
Sector Academic/University
Country United Kingdom
Start 08/2020 
End 08/2021
 
Description University of Exeter Knowledge Exchange Fellowship Fund
Amount £10,814 (GBP)
Organisation Engineering and Physical Sciences Research Council (EPSRC) 
Sector Public
Country United Kingdom
Start 07/2022 
End 06/2023
 
Description Coverage of latest research findings on the University of Exeter website 
Form Of Engagement Activity A magazine, newsletter or online publication
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Public/other audiences
Results and Impact Presentation of the latest research article (Dirty Work in British Journal of Criminology) , detailing the emotional toll experienced by digital forensic practiotioners.
Year(s) Of Engagement Activity 2021
URL https://socialsciences.exeter.ac.uk/sociology/news/articles/studyshows
 
Description Forensic Newsletter October 2020 
Form Of Engagement Activity A magazine, newsletter or online publication
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Professional Practitioners
Results and Impact Introduction to the research in Forensic Capability Newsletter
Year(s) Of Engagement Activity 2020
URL https://www.fcn.police.uk/latest
 
Description Invited Speaker - The Investigator 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Professional Practitioners
Results and Impact Dana Wilson-Kovacs was an invited speaker at Digital Investigation CPD Workshop on January 27, 2022. The talk was attended by 272 digital practitioners, including examiners, police officers, policy makers and other relevant stakeholders. The talk, topic and content were praised by members of the audience and described by the organisers as - 'a brilliant presentation', with 'so many positive comments and good feedback from the audience', 'Your comments really resonated with the audience and I know that if we had more time we could have generated a lot of debate'.
Year(s) Of Engagement Activity 2022
 
Description Mobile Phones Examination Workshop 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach Regional
Primary Audience Professional Practitioners
Results and Impact Was invited to be part of a review of mobile phone examination practices by the current gatekeepers.
Year(s) Of Engagement Activity 2022
 
Description Participation in Team Meetings as part of the Digital Forensics Laboratories studied 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach Regional
Primary Audience Professional Practitioners
Results and Impact Regular attendance at team meetings with digital forensics practitioners and written reports that have helped inform senior management reviews of current practices.
Year(s) Of Engagement Activity 2018,2019,2020
 
Description Press coverage of how digital evidence is at risk of being missed because of fragmented police training and coordination 
Form Of Engagement Activity A press release, press conference or response to a media enquiry/interview
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Public/other audiences
Results and Impact University of Exeter press coverage of how digital evidence is at risk of being missed because of fragmented police training and coordination. The news item has since appeared on several international sites for digital forensic specialists. (e.g. https://www.labmanager.com/news/ineffective-organization-of-digital-forensics-slowing-down-investigations-29642, https://phys.org/news/2021-09-digital-evidence-fragmented-police.html, https://techxplore.com/news/2023-01-ineffective-police-digital-forensics.html)
Year(s) Of Engagement Activity 2022
URL http://www.exeter.ac.uk/news/research/title_877851_en.html?fbclid=IwAR0CkrLDcOITro8sWQXV3wHmih08GqPe...
 
Description Press coverage: New research helps police meet rising demand for digital forensics services 
Form Of Engagement Activity Engagement focused website, blog or social media channel
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Professional Practitioners
Results and Impact Research and Innovation at University of Exeter Blog presenting the research
Year(s) Of Engagement Activity 2022
URL https://researchandinnovation.co.uk/new-research-helps-police-meet-rising-demand-for-digital-forensi...
 
Description Project presentation at the Home Office April 2019 
Form Of Engagement Activity A talk or presentation
Part Of Official Scheme? No
Geographic Reach National
Primary Audience Policymakers/politicians
Results and Impact The project was introduced to a Home Office team. Preliminary findings of the project were subsequently used by the Home Office team to make policy and investment decisions regarding online child sexual abuse and exploitation offences.
Year(s) Of Engagement Activity 2019
 
Description Project website 
Form Of Engagement Activity Engagement focused website, blog or social media channel
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Professional Practitioners
Results and Impact This refers to the project's own website, publicly available, which is updated regularly with related news and events and where members of the public and those interested in the topic of the research can contact us.
Year(s) Of Engagement Activity 2019,2020
URL https://www.digital-forensics-in-policing.net/
 
Description Research Round-up #2: spot the difference, footwear and church crimes 15th June 2022 
Form Of Engagement Activity A magazine, newsletter or online publication
Part Of Official Scheme? No
Geographic Reach National
Primary Audience Professional Practitioners
Results and Impact Coverage of the project's findings in the Forensic Capability Network Newsletter June 2022 Edition
Year(s) Of Engagement Activity 2022
URL https://www.fcn.police.uk/news/2022-06/research-round-2-spot-difference-footwear-and-church-crimes
 
Description Review of Regional Digital Forensics Practices 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach Regional
Primary Audience Professional Practitioners
Results and Impact Invited to participate in a review of regional digital forensics business plan
Year(s) Of Engagement Activity 2020,2022
 
Description University of Exeter press release June 2020 
Form Of Engagement Activity A press release, press conference or response to a media enquiry/interview
Part Of Official Scheme? No
Geographic Reach International
Primary Audience Public/other audiences
Results and Impact This was a University of Exeter press release of the initial findings of the project.
Year(s) Of Engagement Activity 2020
URL http://www.exeter.ac.uk/news/research/title_798767_en.html