Understanding the Use of Digital Forensics in Policing in England and Wales: An Ethnographic Analysis of Current Practices and Professional Dynamics
Lead Research Organisation:
UNIVERSITY OF EXETER
Department Name: Sociology, Philosophy, Anthropology
Abstract
Digital evidence can reveal a suspect's intent to commit an offence and help establish when events occurred, where victims and suspects were and with whom they communicated. It has been increasingly used in examinations of homicides, sex crimes, missing persons, child sexual abuse, drug dealing, fraud and theft of personal information, as well as in civil disputes. As the volume of cases requiring digital forensic analysis and the amount of information to be processed in each case have risen rapidly in recent years, law enforcement agencies are struggling to address this demand. In this context, social science research is needed to illuminate how current practices can be improved and the ways in which the usefulness of digital evidence in crime detection can be maximized while preserving ethical acceptability, civil liberties and protecting both the victims and the wrongly accused. To date however, these critical issues remain under-explored and little is known about the deployment of digital forensic evidence in police inquiries and the organiational, professional and societal issues it raises.
This project aims to offer a theoretically grounded and empirically based ethnographic analysis of the digital forensic resources, practices and expertise mobilised to provide intelligence for on-going investigations and aid the prosecution of suspects. Focusing on areas of improvement prioritised with the input of digital forensics (DF) practitioners working across four police forces as part of a regional forensic collaboration, its main objectives are to examine current provision in the constabularies covered by this organizational arrangement and explore how DF capabilities are used in the production of digital evidence. The project will employ qualitative methodologies to analyse the interactions and exchanges between different occupational groups and render visible this rarely explored socially and politically sensitive domain. A focus on the transformation of digital data into evidence and its trajectory to the final stage before prosecution, will enable the observation of DF knowledge and routines (1) as they unfold and (2) at different points in the investigative process. It will bring into relief operational procedures and dependencies, professional tensions, regulatory dynamics and distinct understandings of DF capabilities. The potential benefits of this project are multi-layered:
Conceptually, the project will contribute to sociological and criminological studies on the seldom explored application of forensic technologies in policing. The analysis will also inform and update wider socio-legal, crime and police studies approaches to assessing the contribution of forensic science to criminal justice outcomes, and social science literature on how various stakeholders understand the role of DF in police investigations.
Methodologically, the project will facilitate practitioners' engagement with and through its design, and provide novel insights on the role of social science research in documenting, establishing and sustaining dialogue between different communities of practice.
At a practical level, the project will provide an in-depth understanding of current DF arrangements. The study will augment initiatives by police forces to improve performance by educating stakeholders about the ways in which DF can contribute to criminal investigations. It will do so in an organizationally reflexive way, with a view to foster cross-sector co-operation and exchange and improvements. The findings will help identify the gaps in DF resources and tensions in its delivery and impact directly on current practices. They will promote dialogue between providers and users, and inform the future training of investigative staff.
At a policy level, the findings will contribute to better informed decision making. With a focus on 'What Works' in DF they will help promote best practices and lead to a more efficient delivery of DF provision.
This project aims to offer a theoretically grounded and empirically based ethnographic analysis of the digital forensic resources, practices and expertise mobilised to provide intelligence for on-going investigations and aid the prosecution of suspects. Focusing on areas of improvement prioritised with the input of digital forensics (DF) practitioners working across four police forces as part of a regional forensic collaboration, its main objectives are to examine current provision in the constabularies covered by this organizational arrangement and explore how DF capabilities are used in the production of digital evidence. The project will employ qualitative methodologies to analyse the interactions and exchanges between different occupational groups and render visible this rarely explored socially and politically sensitive domain. A focus on the transformation of digital data into evidence and its trajectory to the final stage before prosecution, will enable the observation of DF knowledge and routines (1) as they unfold and (2) at different points in the investigative process. It will bring into relief operational procedures and dependencies, professional tensions, regulatory dynamics and distinct understandings of DF capabilities. The potential benefits of this project are multi-layered:
Conceptually, the project will contribute to sociological and criminological studies on the seldom explored application of forensic technologies in policing. The analysis will also inform and update wider socio-legal, crime and police studies approaches to assessing the contribution of forensic science to criminal justice outcomes, and social science literature on how various stakeholders understand the role of DF in police investigations.
Methodologically, the project will facilitate practitioners' engagement with and through its design, and provide novel insights on the role of social science research in documenting, establishing and sustaining dialogue between different communities of practice.
At a practical level, the project will provide an in-depth understanding of current DF arrangements. The study will augment initiatives by police forces to improve performance by educating stakeholders about the ways in which DF can contribute to criminal investigations. It will do so in an organizationally reflexive way, with a view to foster cross-sector co-operation and exchange and improvements. The findings will help identify the gaps in DF resources and tensions in its delivery and impact directly on current practices. They will promote dialogue between providers and users, and inform the future training of investigative staff.
At a policy level, the findings will contribute to better informed decision making. With a focus on 'What Works' in DF they will help promote best practices and lead to a more efficient delivery of DF provision.
Planned Impact
The research aims to increase the effectiveness of digital forensics (DF) services and policies, improve how DF provision may be best structured, and enhance stakeholders' understanding of how DF protocols fit into investigative practice. Given the level of change anticipated with the introduction of accreditation processes and streamlining of DF routines regionally, timescales for the full benefits are hard to predict. Its non-academic beneficiaries include:
(A) DF practitioners, High Tech Unit teams and managers of the South West Forensic Collaboration (SWFC) who seek to identify and establish best practice in DF and enable local ownership and accountability. The project will support the development of streamlined DF protocols across the four police forces in the region through a systematic approach to identifying gaps and tensions in DF delivery, providing advice on how these can be overcome.
(B) While immediately relevant to participants and the SWFC, the project will also be of benefit to other DF teams, forensic partnerships and organizations in the UK and internationally. Its findings will help identify best practice in the application of DF in police investigations in a regional setting, demonstrate how this can be achieved and enable further learning about 'What Works' in DF.
(C) The College of Policing, through which the project and its findings will be promoted nationally as a vehicle for the transfer of such learning. Its representation on the Advisory Board will ensure that the research findings will be more widely communicated to police educators, researchers and users to offer guidance for similar organisational initiatives.
(D) Evidence-based agencies such as the Society for Evidence Based Policing (SEBP) and the Centre for the Application of Science and Technology (CAST). Project findings will enable innovation, raise awareness of how DF can be used effectively, appraise a 'What Works' approach in DF and promote the successful delivery of DF services.
(E) Front-line police and Senior Investigative Officers (two of the key DF user groups) and Digital Media Investigators (ranking police officers who serve to translate digital forensic knowledge between DF specialists, police forces and the public). The analysis will involve an investigation of staff processes, and thus enhance users' awareness of what DF can and cannot do. For instance, identifying the utility of DF artefacts is an area with which officers typically struggle but it is critical to effective investigation. Sharing the research findings with these beneficiaries through user engagement activities and outputs is instrumental to facilitate change in current practice.
(F) Prosecutors and legal teams whose awareness and expectations of DF require targeted updating to improve juridical knowledge of DF and prevent miscarriages of justice. Briefings on the research findings will be disseminated to the Crown Prosecution Service, the Law Society and the Criminal Bar Association of England and Wales, to enhance such knowledge.
(G) Forensic Science Regulators, whose mission is to implement forensic standards nationally and assure the integrity of forensic practices. By engaging with these stakeholders as well as fostering connections and dialogue across policing and DF communities, the findings will enhance police understandings of what DF standards involve as well as the regulators' appreciation of operational and organisational issues in DF.
(H) The wider forensic community through its professional associations. Institutional reform is most likely to succeed by nurturing a cross-sector network of experts and practitioners who can together collaborate with police and other key stakeholders to facilitate the effective use of DF in policing. By developing a DF network, this research will create the opportunity for new intellectual and professional links between DF practitioners, police officers, regulators and policy makers.
(A) DF practitioners, High Tech Unit teams and managers of the South West Forensic Collaboration (SWFC) who seek to identify and establish best practice in DF and enable local ownership and accountability. The project will support the development of streamlined DF protocols across the four police forces in the region through a systematic approach to identifying gaps and tensions in DF delivery, providing advice on how these can be overcome.
(B) While immediately relevant to participants and the SWFC, the project will also be of benefit to other DF teams, forensic partnerships and organizations in the UK and internationally. Its findings will help identify best practice in the application of DF in police investigations in a regional setting, demonstrate how this can be achieved and enable further learning about 'What Works' in DF.
(C) The College of Policing, through which the project and its findings will be promoted nationally as a vehicle for the transfer of such learning. Its representation on the Advisory Board will ensure that the research findings will be more widely communicated to police educators, researchers and users to offer guidance for similar organisational initiatives.
(D) Evidence-based agencies such as the Society for Evidence Based Policing (SEBP) and the Centre for the Application of Science and Technology (CAST). Project findings will enable innovation, raise awareness of how DF can be used effectively, appraise a 'What Works' approach in DF and promote the successful delivery of DF services.
(E) Front-line police and Senior Investigative Officers (two of the key DF user groups) and Digital Media Investigators (ranking police officers who serve to translate digital forensic knowledge between DF specialists, police forces and the public). The analysis will involve an investigation of staff processes, and thus enhance users' awareness of what DF can and cannot do. For instance, identifying the utility of DF artefacts is an area with which officers typically struggle but it is critical to effective investigation. Sharing the research findings with these beneficiaries through user engagement activities and outputs is instrumental to facilitate change in current practice.
(F) Prosecutors and legal teams whose awareness and expectations of DF require targeted updating to improve juridical knowledge of DF and prevent miscarriages of justice. Briefings on the research findings will be disseminated to the Crown Prosecution Service, the Law Society and the Criminal Bar Association of England and Wales, to enhance such knowledge.
(G) Forensic Science Regulators, whose mission is to implement forensic standards nationally and assure the integrity of forensic practices. By engaging with these stakeholders as well as fostering connections and dialogue across policing and DF communities, the findings will enhance police understandings of what DF standards involve as well as the regulators' appreciation of operational and organisational issues in DF.
(H) The wider forensic community through its professional associations. Institutional reform is most likely to succeed by nurturing a cross-sector network of experts and practitioners who can together collaborate with police and other key stakeholders to facilitate the effective use of DF in policing. By developing a DF network, this research will create the opportunity for new intellectual and professional links between DF practitioners, police officers, regulators and policy makers.
Organisations
Publications
Wilson-Kovacs D
(2023)
The Routledge International Handbook of Homicide Investigation
Wilson-Kovacs D
(2023)
The long journey of resistance toward acceptance: Understanding digital forensic accreditation in England and Wales from a social science perspective
in WIREs Forensic Science
Wyatt D
(2019)
Understanding crime scene examination through an ethnographic lens
in WIREs Forensic Science
Wilson-Kovacs D
(2023)
Digital evidence in defence practice: Prevalence, challenges and expertise
in The International Journal of Evidence & Proof
Wilson-Kovacs D
(2022)
Dirty Work? Policing Online Indecency in Digital Forensics
in The British Journal of Criminology
Wilson-Kovacs D
(2019)
Effective resource management in digital forensics An exploratory analysis of triage practices in four English constabularies
in Policing: An International Journal
Wilson-Kovacs D
(2021)
Digital media investigators: challenges and opportunities in the use of digital forensics in police investigations in England and Wales
in Policing: An International Journal
Wilson-Kovacs D
(2023)
Managing Policing Demand for Digital Forensics through Risk Assessment and Prioritization in England and Wales
in Policing: A Journal of Policy and Practice
Rappert B
(2020)
Rationing bytes: managing demand for digital forensic examinations
in Policing and Society
Rappert B
(2022)
Evincing Offence: How Digital Forensics Turns Big Data into Evidence for Policing Sexual Abuse
in Engaging Science, Technology, and Society
Description | This project examined the application of digital forensics (DF) in police investigations and its operational, organisational and professional tensions. The objectives of the project have been met, by: 1. Appraising DF provision and processes in four DF units that were part of a forensic collaboration 2. Observing how DF processes and practices compare regionally and nationally 3. Understanding how DF contributes to the analysis and interpretation of DF trace 4. Exploring how occupational cultures, organisational arrangements and regulatory requirements impact on inter and intra-professional exchanges and understandings of professionalism and expertise in DF 5. Examining how DF fits in the wider delivery of forensic service support 6. Documenting the concerns and expectations of key stakeholders, informing policy developments and helping to develop local, regional and national approaches to the application of DF in policing. The most significant achievements are: a. An analysis of risk management and prioritisation in DF across 33 police forces in England and Wales, which evidences the urgent need for updated tools and centralised arrangements to deal with the increase in the demand for DF analysis. Using a combination of ethnographic observations, survey, qualitative interviews and data obtained through a benchmarking exercise, the findings provide the first systematic understanding of the challenges experienced by forces in handling, interpreting and solving officers' requests for the extraction and analysis of digital trace from the victims and suspects' digital devices. b. An examination of the emotional burden the analysis of child sexual abuse material has on DF practitioners, the organisational facilities provided to address this problem, and the informal mechanisms DF examiners adopt to carry out their duties seamlessly. The findings resonate with the experiences of the wider DF community, nationally and internationally, illustrate the gaps in counselling provision and call for specifically DF tailored health and well-being provision nationally. c. The findings evidence the lack of knowledge and training of police workforce and legal teams in DF basic requirements and the implications for both the professionalisation of various occupational groups and the delivery of informed and appropriate criminal justice outcomes. As DF practices spread outside the confines of laboratories, standards and quality must be understood and observed in the practices of all those working with digital trace. Our findings suggest that isolated local initiatives cannot sustain the urgent need for systematic personnel training on increasingly complex forms of digital evidence. Such training must become an integral part of degree programmes and continuing professional development processes. d. Working closely and collaboratively with the four DF units and other DF teams nationally led to a better understanding of the provision gaps in the regional and national resources allocated to DF, the workforce dynamics, the impact of accreditation on DF units and police forces and the challenges DF raises for different occupational groups and organisations. They also evidence the need for a better understanding of DF cultures and their integration into the integration into the wider forensic scientific community. The findings continue to inform discussions with key stakeholders regionally and nationally. |
Exploitation Route | The research outcomes offer a snapshot of current provision and challenges in the application of digital forensics in policing and provide a point of reference and comparison for future analyses in this underexplored, yet essential area of criminal investigation. In terms of non-academic routes, they illustrate the fragmentation of DF provision, and it is hoped that they will also help shape emerging policy (such as that provided by the Forensic Policy Team at the Home Office, and the revised NPCC Digital Forensic Strategy) and the dissemination of good practice (as provided by the Forensic Capabilities Network). They can also help strengthen the voice of DF practitioner communities in lobbying for more comprehensive and better tailored health and well-being provision and appropriate and updated training. In terms of additional academic routes: the outcomes highlight the need to map DF provision more comprehensively, develop updated tools for risk assessment and prioritisation processes, and to monitor internal demand in policing. Equally, they call for tailored training provisions, within and outside DF laboratories, and a better integration of DF into the wider forensic community, all of which provide fruitful and opportune directions of future academic research. |
Sectors | Digital/Communication/Information Technologies (including Software) Education Government Democracy and Justice Security and Diplomacy |
URL | https://reshare.ukdataservice.ac.uk/855980/ |
Description | This project's findings have been used by digital forensic practitioners and digital forensic managers to inform the re-organisation of local and regional work processes. Article outputs have also been used by digital forensic practitioners as far away as Sweden and Argentina to inform how their digital forensic processes are managed. Findings from the project were referenced in the 2020 National Police Chiefs Council (NPCC) Digital Forensic Strategy, a document commissioned by the NPCC to guide practice and process across England and Wales and set the vision for digital forensics in the years to come. Findings of the project have been also discussed with the Forensic Policy Team at the Home Office in August 2022, and with numerous digital forensic practitioners, managers and police personnel locally, regionally, nationally and internationally, on several occasions. New collaborations with practitioners in two police forces are underway (2023). |
Sector | Digital/Communication/Information Technologies (including Software),Education,Government, Democracy and Justice,Security and Diplomacy,Other |
Impact Types | Cultural Policy & public services |
Description | Changing Mobile Phone Examination, risk assessment and workflow practices |
Geographic Reach | Local/Municipal/Regional |
Policy Influence Type | Contribution to new or improved professional practice |
Impact | Dana Wilson-Kovacs and Jen Wilcox's input contributed to a review of the effectiveness and efficiency in the delivery of digital forensics input in crime investigations. They gave advice on streamlining and restructuring current working arrangements over several meetings with members of senior management, quality and standards teams and digital forensics teams and produced a final report of the research findings for the project's collaborators. |
Description | Citation of research in NPCC Digital Forensics Strategy June 2020 |
Geographic Reach | National |
Policy Influence Type | Citation in other policy documents |
URL | https://www.npcc.police.uk/ |
Description | Home Office discussion of project findings |
Geographic Reach | National |
Policy Influence Type | Contribution to new or improved professional practice |
Description | Invited Speaker at Society of Evidence Based Policing Regional Conference October |
Geographic Reach | Local/Municipal/Regional |
Policy Influence Type | Contribution to new or improved professional practice |
Description | Invited member of the Home Office Impact of Forensics project |
Geographic Reach | National |
Policy Influence Type | Contribution to a national consultation/review |
Description | Project Presentation to and Workshop with Digital Forensic Managers as part of the Training Course at the College of Policing, Ryton-on-Dunsmore, Coventry |
Geographic Reach | National |
Policy Influence Type | Influenced training of practitioners or researchers |
Description | The Investigator 2023 CPD training event/conference |
Geographic Reach | Multiple continents/international |
Policy Influence Type | Influenced training of practitioners or researchers |
Description | Transforming Forensics Programme, Digital Forensics Research Working Group |
Geographic Reach | National |
Policy Influence Type | Membership of a guideline committee |
Description | ESRC IAA Knowledge Exchange Fellowship Award application: Digital evidence-based policing: examining the impact of digital evidence strategies in criminal justice outcomes |
Amount | £31,490 (GBP) |
Organisation | University of Exeter |
Sector | Academic/University |
Country | United Kingdom |
Start | 12/2023 |
End | 11/2024 |
Description | Human Factors and Digital Technology in Forensic Science: Decision-Making and Legal Implications |
Amount | £16,750 (GBP) |
Organisation | University of Exeter |
Sector | Academic/University |
Country | United Kingdom |
Start | 01/2022 |
End | 03/2022 |
Description | Outward Mobility Academic Fellowship |
Amount | £2,060 (GBP) |
Organisation | University of Exeter |
Sector | Academic/University |
Country | United Kingdom |
Start | 08/2020 |
End | 08/2021 |
Description | University of Exeter Knowledge Exchange Fellowship Fund |
Amount | £10,814 (GBP) |
Organisation | Engineering and Physical Sciences Research Council (EPSRC) |
Sector | Public |
Country | United Kingdom |
Start | 07/2022 |
End | 06/2023 |
Description | Coverage of latest research findings on the University of Exeter website |
Form Of Engagement Activity | A magazine, newsletter or online publication |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Public/other audiences |
Results and Impact | Presentation of the latest research article (Dirty Work in British Journal of Criminology) , detailing the emotional toll experienced by digital forensic practiotioners. |
Year(s) Of Engagement Activity | 2021 |
URL | https://socialsciences.exeter.ac.uk/sociology/news/articles/studyshows |
Description | Forensic Newsletter October 2020 |
Form Of Engagement Activity | A magazine, newsletter or online publication |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Professional Practitioners |
Results and Impact | Introduction to the research in Forensic Capability Newsletter |
Year(s) Of Engagement Activity | 2020 |
URL | https://www.fcn.police.uk/latest |
Description | Invited Speaker - The Investigator |
Form Of Engagement Activity | Participation in an activity, workshop or similar |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Professional Practitioners |
Results and Impact | Dana Wilson-Kovacs was an invited speaker at Digital Investigation CPD Workshop on January 27, 2022. The talk was attended by 272 digital practitioners, including examiners, police officers, policy makers and other relevant stakeholders. The talk, topic and content were praised by members of the audience and described by the organisers as - 'a brilliant presentation', with 'so many positive comments and good feedback from the audience', 'Your comments really resonated with the audience and I know that if we had more time we could have generated a lot of debate'. |
Year(s) Of Engagement Activity | 2022 |
Description | Mobile Phones Examination Workshop |
Form Of Engagement Activity | Participation in an activity, workshop or similar |
Part Of Official Scheme? | No |
Geographic Reach | Regional |
Primary Audience | Professional Practitioners |
Results and Impact | Was invited to be part of a review of mobile phone examination practices by the current gatekeepers. |
Year(s) Of Engagement Activity | 2022 |
Description | Participation in Team Meetings as part of the Digital Forensics Laboratories studied |
Form Of Engagement Activity | Participation in an activity, workshop or similar |
Part Of Official Scheme? | No |
Geographic Reach | Regional |
Primary Audience | Professional Practitioners |
Results and Impact | Regular attendance at team meetings with digital forensics practitioners and written reports that have helped inform senior management reviews of current practices. |
Year(s) Of Engagement Activity | 2018,2019,2020 |
Description | Press coverage of how digital evidence is at risk of being missed because of fragmented police training and coordination |
Form Of Engagement Activity | A press release, press conference or response to a media enquiry/interview |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Public/other audiences |
Results and Impact | University of Exeter press coverage of how digital evidence is at risk of being missed because of fragmented police training and coordination. The news item has since appeared on several international sites for digital forensic specialists. (e.g. https://www.labmanager.com/news/ineffective-organization-of-digital-forensics-slowing-down-investigations-29642, https://phys.org/news/2021-09-digital-evidence-fragmented-police.html, https://techxplore.com/news/2023-01-ineffective-police-digital-forensics.html) |
Year(s) Of Engagement Activity | 2022 |
URL | http://www.exeter.ac.uk/news/research/title_877851_en.html?fbclid=IwAR0CkrLDcOITro8sWQXV3wHmih08GqPe... |
Description | Press coverage: New research helps police meet rising demand for digital forensics services |
Form Of Engagement Activity | Engagement focused website, blog or social media channel |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Professional Practitioners |
Results and Impact | Research and Innovation at University of Exeter Blog presenting the research |
Year(s) Of Engagement Activity | 2022 |
URL | https://researchandinnovation.co.uk/new-research-helps-police-meet-rising-demand-for-digital-forensi... |
Description | Project presentation at the Home Office April 2019 |
Form Of Engagement Activity | A talk or presentation |
Part Of Official Scheme? | No |
Geographic Reach | National |
Primary Audience | Policymakers/politicians |
Results and Impact | The project was introduced to a Home Office team. Preliminary findings of the project were subsequently used by the Home Office team to make policy and investment decisions regarding online child sexual abuse and exploitation offences. |
Year(s) Of Engagement Activity | 2019 |
Description | Project website |
Form Of Engagement Activity | Engagement focused website, blog or social media channel |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Professional Practitioners |
Results and Impact | This refers to the project's own website, publicly available, which is updated regularly with related news and events and where members of the public and those interested in the topic of the research can contact us. |
Year(s) Of Engagement Activity | 2019,2020 |
URL | https://www.digital-forensics-in-policing.net/ |
Description | Research Round-up #2: spot the difference, footwear and church crimes 15th June 2022 |
Form Of Engagement Activity | A magazine, newsletter or online publication |
Part Of Official Scheme? | No |
Geographic Reach | National |
Primary Audience | Professional Practitioners |
Results and Impact | Coverage of the project's findings in the Forensic Capability Network Newsletter June 2022 Edition |
Year(s) Of Engagement Activity | 2022 |
URL | https://www.fcn.police.uk/news/2022-06/research-round-2-spot-difference-footwear-and-church-crimes |
Description | Review of Regional Digital Forensics Practices |
Form Of Engagement Activity | Participation in an activity, workshop or similar |
Part Of Official Scheme? | No |
Geographic Reach | Regional |
Primary Audience | Professional Practitioners |
Results and Impact | Invited to participate in a review of regional digital forensics business plan |
Year(s) Of Engagement Activity | 2020,2022 |
Description | University of Exeter press release June 2020 |
Form Of Engagement Activity | A press release, press conference or response to a media enquiry/interview |
Part Of Official Scheme? | No |
Geographic Reach | International |
Primary Audience | Public/other audiences |
Results and Impact | This was a University of Exeter press release of the initial findings of the project. |
Year(s) Of Engagement Activity | 2020 |
URL | http://www.exeter.ac.uk/news/research/title_798767_en.html |