Digital forensics in the United Kingdom is still in a sad state. That is one of the outcomes of a recent report by the House of Lords Science and Technology Select Committee: Rebuilding forensic science for criminal justice: an urgent need: (https://publications.parliament.uk/pa/ld5901/ldselect/ldsctech/256/256.pdf)
The report was a follow up to an earlier one in which I was extensively quoted back in 2019. Very little progress across the whole landscape of forensic science has happened since then, much to the annoyance and despair of the Select Committee. Matters have got worse.
But the committee’s report even though highly critical underestimates the problem of dealing with digital forensics in the criminal justice system. There is a system for forensic science regulation headed by a Forensic Science Regulator who has had statutory powers since 2021 and has a published Code of Practice since 2023. Those powers include digital forensics but compliance with the code issued by the regulator has been sparse not the least because of the cost of being assessed.
There is however a rather greater weakness. Overall forensic science regulation in the UK is about regulating forensic science laboratories, typically those dealing in “wet” subjects like DNA traces. Trace evidence – “is there a match?” – lends itself very well to lab process which can then be assessed for following standard tested procedures. But this is only one aspect of digital forensics. The earlier scheme – the Council for the Regulation of Forensic Practitioners – focussed on individuals, not laboratories. It is individuals who give evidence in court, not laboratories.
The early stages of digital forensics, acquisition of devices and subsequent preservation, do lend themselves to standardised processes but after that nearly all of the effort involves event reconstruction, not simply the identification of a trace. It is only in strict liability offences such as possession of child sexual material that an offence is immediately made out. In almost all other circumstances an investigator has to look at several different places on a computer device in order to prove that an offence has been committed. In distribution of child sexual material one must not only identify an offending file but also programs, log files and other artefacts which show that distribution must have taken place.
Part of the role of the expert is to explain how all these separate individual elements can be put together to tell a specific story. Similar arguments apply in Computer Misuse offences when there will be the need to bring together several different elements to explain to a jury that the criteria for an offence under s1 CMA 1990 has been made out – that there was a computer, that it was accessed, that the access was unauthorised and that it was carried out by and accused. Matthew Tart in his submission to the Select Committee highlights the problems of cellsite evidence.
This indicates a particular problem for policing as well as forensic science regulation. In many non digital investigations what is being asked of a forensic scientist is the establishment of a trace and perhaps some very limited conclusion arising from it. The bulk of the investigation falls firmly on the law enforcement investigator. But with digital crimes the work of the law enforcement officer and the digital forensic specialist need to be much more closely co-ordinated. They have to inform each other about what is being sought and what is available. UK policing does not seem to have a scheme in place which recognises that.
The Report, good though it is, has very little to say about expert evidence and its role in the Criminal Procedure Rules. It might for example have looked at the role of meetings between experts under CrimPR 19.6 which could alleviate some of the problems at trial. But then this is science and technology select committee, not one with remits to Justice.
It is a pity that the Report does not specifically cover the very helpful submissions of Angus Marshall and Matthew Tart. Marshall explains, among other things, why he has had to stop expert work because of the cost and complexity of FSR/UKAS accreditation compared with his actual earnings. I am rather sorry that I didn’t find time to make a submission of my own.