I recently posted the following question at LinkedIn
"How should organisations deal with employees exposed to disturbing material during computer forensics investigations?
I'm interested in all facets of this topic. What support structure (if any) do you think is appropriate for computer forensics examiners? Is there a distinction to be made between law enforcement and private practice? Are you aware of relevant research in this area?"
If I've copied it correctly, you should be able to see the replies so far
I could probably have phrased the main question better to avoid any confusion. Primarily I'm interested in what actions should be taken or procedures put in place to protect examiners from the harrowing nature of their work when they encounter material of a disturbing nature (I'm purposefully not defining "disturbing" in any detail, the emphasis being on the effect it has on the viewer rather than the material itself).
Above all else I'm interested in any research which has been carried out in this field which might help answer the questions 1) What are the potential consequences of exposure to disturbing material, and 2) What measures are recommended to minimise these (presumably negative) consequences?
Thoughts and comments most welcome.
BearShare (a file sharing network) took a precautionary approach to this. As part of their contract, employees had to sign the following
17. SPECIAL CONSENT
Employees of Bearshare understand and acknowledges that the employer, employee, and/or other employees may produce, transmit, distribute, utilize, analyze, inspect, examine, and/or download various text, pictures, video, sounds, data, web sites, and other content (collectively referred to as "materials") that could be considered inappropriate, offensive and/or a violation of certain community standards.
Employee understands that this content and such materials may even be obscene, either to employee or others and/or as a matter of law, and that the content and materials could relate to violence, hate/discrimination, drugs, profanity, alcohol, nudity, soft-core pornography, hard-core pornography, genitals, graphic sex acts, deviant activities, bestiality, torture, incest, excretory functions, illegal activities and/or any other topic that could be considered offensive or obscene.
Employee understands, acknowledges and agrees that Employer is not responsible for the legality, decency or for any other aspect of any content or materials described in this document.
It seems that some of the people getting into the field often have no idea what they are getting themselves into. Bearshare's disclaimer would at least give them a bit of an idea.
In "Investigating Child Exploitation and Pornography The Internet, Law and Forensic Science" by Ferraro and Casey, they state in Chapter 16, "Some child exploitation units contract with a therapist to provide ongoing support and evaluation of unit personnel. Confidential sessions with the therapist on a regular basis, such as monthly or quarterly, serve several purposes. First, providing such services sends a message to personnel that the administration is concerned about their welfare and mental health. If the opposite sentiment is perceived, resentment will build, and the effectiveness of the unit will diminish. Second, it conveys to team members that their work is recognized as important and that it is expected to be stressful. Such reassurances encourage the team to pull together during difficult periods rather than to neglect members who are having difficulty. Third, ongoing sessions provide a benchmark to compare an individual's functioning and mental health so that if the work environment takes a toll, such changes can be readily identified and intervention may be swift. A prompt response to such problems can minimize the resulting damage to the individual and the cases s/he is working on. Finally, unit personnel reap the benefits of an ongoing supportive relationship with someone who understands their work and can talk about it with them."
I would also think that looking into PTSD would yield some more information as well.
Maybe the folks at SurfRecon have some insight. I was a beta tester for their product which was designed to help employees that work with disturbing images.
Jamie,
I teach a session on this very topic "Living With The Images" (DOD Cybercimre Conference 2008, various HTCIA conferences 2004-2007, forthcoming Crimes Against Women Conference in Dallas, Feb 2009).
Examining PTSD yields some information, but the recurring nature of exposure to images makes it different for examiners. Critical Incident Debriefing doesn't really help much either - same reason.
In short (and I mean REALLY short), the issue that is most helpful to the examiner is to understand what they are saying to themselves about the images/material. Most of the secondary trauma that derives from the material is directly related to the self-statements the examiner makes. There are extremely effective steps one can take to identify, evaluate, and change these self statements. Fortunately, these steps are easy to understand, easy to learn, and amazingly efficient.
A rough summary of the steps can be found in an old cog session I developed in 1995 titled "Thinking Traps" which is found at
Your question, however, has encouraged me to write a white paper and post it (as I have on other topics found on my "resources" page). I'll try to do that in the next few months as I find some extra time…. whatever that is -)
Jim Tanner, Ph.D., GSLC
I attended this class at DC3-2008 and it was very good.