The Transformation of Digital Forensics in UK Policing

Police forces across the world are grappling with technology changes that have transformed society, and as a consequence, crime, over the past 15 to 20 years. In the early 21st century, the demand for digital forensics expertise was limited to exceptional cases; today, almost every crime has a digital footprint owing to the ubiquity of smartphones, tablets, and wearable devices, as well as computers. Consequently, every law enforcement agency has to have a means of preserving, accessing, and analysing the evidence held on digital devices.

As recognised by the National Police Chiefs’ Council (NPCC) and Association of Police and Crime Commissioners (APCC) in 2020’s Digital Forensic Science Strategy, law enforcement’s response to the increasing sophistication of criminals has been “slow, fractured, and piecemeal.” Many police agencies have lacked the capacity to process digital devices efficiently, creating substantial backlogs of data delaying the criminal justice process. Law enforcement investigators may lack visibility into processes and technology their peers are using in other parts of the country. This report attempts to rectify that lack of insight.

Download the Exterro Survey Report on Digital Forensics in UK Law Enforcement here!

Over the past several months, Exterro has reached out to the 43 police forces across the United Kingdom to ask a series of questions around their digital forensics units’ (DFUs) workloads, budgets, workflows, and cultures. Thirty-eight agencies responded with information shedding light on these topics of critical importance to digital forensic investigators and law enforcement professionals in general. While backlogs still exist and some digital forensic investigators perform their tasks without the benefits of collaboration, there are signs of progress. 

With over a decade of experience in digital forensics, Jonathan Shorter, Exterro Vice President of International Technical Engineering, calls out some of these changes:

Starting work in Digital Forensics back in 2011, I have seen Digital Forensics Units move from Forensic Examiners investigating siloed devices and cases (with backlogs of years of computers and phones to be analysed and reviewed), to some Digital Forensics Units now having just a few days or (at most) weeks of backlogs to deal with. The change has not been through the luxury of greater staffing budgets. In fact, if anything, these have tightened, with more DFUs needing to rely on more reviewers and fewer forensic examiners. Reviewers are staff trained in combing through messages or pictures, grading them for severity
of indecency, and looking for key pieces of evidence. Forensic Examiners, on the other hand, command a higher salary and are more scarce, with qualifications and experience to be able to perform 'deep-dive' forensic examinations where it is necessary to dig right down into binary values to prove, for example, who had hands on a keyboard at a time an alleged crime took place involving a specific electronic device.

The industry has instead adapted by using:

Innovative and smarter tools: Reviewers can, with the help of AI and other assistive technology, remove the need to look through previously classed-as-indecent images, use powerful AI to identify objects or faces in photos or videos, auto-translate between all primary languages, analyse social connections and build up entities of people with all of their associated devices and handles, and display everything in easy to follow timelines, focusing in on just the relevant data which pertains to just the relevant parties in a case - perhaps highlighting a totally novel lines of intelligence for officers to follow

Collaboration: Swarms of reviewers or front-line officers who know subjective information about cases working on labeling or 'Bookmarking' items of interest to a case, whilst forensic examiners are freed up to work on the same cases, but in the areas where they can add highest technical value for their salaries, means people's skills, time and ultimately departments' budgets are all utilised in the most efficient of manners.

More efficient hardware models and advanced highly complex distributed lab processing engines can power through an ever increasing mass of data collected from crime scenes more quickly than ever, taking advantage of new cost saving and flexible technologies such as virtualisation and cloud technologies, whilst also making Digital Forensic tool interfaces available through a simple browser for local or cross-border officer access. Even the defence can review subsets of data with minimal training on the tool in front of them. The training can be video-led, on demand, with a short exam ensuring that investigators are qualified to an acceptable standard before using the tool on live cases.

Streamlined processes can see case reports being sent straight to the CPS/Departments of Justice electronically. Evidence that needs to be kept for a specific retention period can then automatically be moved to cheaper storage or brought back for further investigation at the click of a button, rather than shipping old tapes of evidence to off-site storage facilities. We've seen a number of forces be able to reach incriminating material so quickly that criminals often admit guilt as soon as the evidence is presented to them, saving time for cases to work their way through an already clogged justice system.

So, whilst I've seen DFUs remain similar in terms of size, everyone is more connected. Cases contain evidence from not just single computer hard drives or disparate mobile phones. Data from these devices, plus IoT devices, car infotainment systems, fitness trackers, you name it - anything that can hold data - is now collated into one case, building up intelligence in a way we would never had dreamed possible before, presented with such ease for reviewers and jury alike to make sense from. With the bottlenecks of acquisition, processing and intelligent review all straightened out, the change in the efficiency from a dozen years is mind-blowing. We can achieve reductions in case backlogs from years, to months, to days to hours, improving the speed to justice. This gets criminals off the streets, but also it is just as important for those who may have been falsely accused and can be vindicated of heinous crimes with equal efficiency.

Now, with the infancy and explosion of AI capabilities, we are preparing for a new round of even smarter investigations to improve how we tackle the existing traditional crime types, with the added challenge of a world where the power of AI is inevitably falling into the hands of miscreants too, eager to utilise it to expand their own criminal enterprises in traditional areas, but also into areas we may not even have conceived yet. The race continues, and I raise my hat to all of those who continue devoting their lives to running it.