I was wondering whether any of my peers (this only affects the UK) had any thoughts on the above.
It looks like we're going to have to implement APP and whilst I can see the benefits for witnesses and victims, I'm struggling to understand how it can be implemented when it comes to suspects.
If anyone has already or is trying to implemented it, I'd be interested to hear how you've interpreted it. In particular with regards to the following:
(a) whether it actually applies to arrested suspects - "Throughout this document, in relation to the acquisition of the device, we are clear that we are referring to un-arrested suspects. If a suspect is arrested, there is a well developed legal framework for acquiring evidence." Could that be interpreted as APP not applying when dealing with an arrested suspect? Throughout the document there's reference to PACE so does that 'trump' APP?
(b) taking or not taking a forensic image. See (c) for why I think we should be able to take a forensic image.
(c) returning the device to the victim/witness/suspect. "...inform the device user that it is possible further examination may be required if new lines of enquiry emerge, and advise the device user they should not delete or amend any material that could be relevant to the investigation." In other words, if you get the device back you should not use it at all incase further investigation is required.
If we had an image of the device (see (b)) then (c) would not be an issue.
Website: College of Policing APP Website
Direct link to PDF: APP Extraction of material from digital devices - May 2021
Thanks for your time.
Chris
Digital Forensic Analyst
Kent & Essex Police
I have no direct knowledge of this but, the way the website and documents read, I'm pretty confident this is all related to devices from those that haven't been arrested (victims/witnesses) and that you treat material acquired under PACE in the normal manner (so business as usual).
So I think your real question is how to proceed with non-arrested subjects (i.e. victims and witnesses) in which case it looks like, rather than collecting everything, you'll be going for the categories of data you can justify (i.e. probably ones ones they've said will be of relevance, primarily, unless there's some legitimate doubt/investigative reason why you would want to be looking at other categories of data).
I imagine a conversation might end up being had with the victim/witness as to your point about needing anything later, inadvertent destruction of material by usage, and/or having to request it again later.
Rich
@rich2005 Totally agree. I completely understand the need to protect the information that may be on a witness or victim device, and only extract what is absolutely necessary and proportional. That's exactly what happens now and should and will continue to happen.
But I'm glad you see things regarding an arrested suspect the same way as I (and a lot of my colleagues) do. I was beginning to think I was missing something obvious.
Unfortunately it would appear that those higher up seem to think that APP is saying that we cannot take an image of an arrested suspect's device.
Unfortunately it would appear that those higher up seem to think that APP is saying that we cannot take an image of an arrested suspect's device.
It wouldn't be the first time a "higher up" has skim-read a document...
(gently suggest they CTRL+F for "arrested" and focus on the repeated references to that being a separate case and covered by existing powers 😉 otherwise instead of searching a house for a murder weapon you'll be searching the kitchen drawer only...)
Â
@rich2005 Easier said than done I'm afraid although I do like the analogy!
