Hi guys,
New here.
This is really long, sorry.
I have looked at the processes used in the UK to investigate the so-called "making" of indecent images.
The law
The "making" law in the UK makes it a criminal offence to make indecent images. The law predates the internet but judges have ruled and our Crown Prosecution Service is "satisfied" that it is the intention of parliment that "making", which was previously only possible with lithograph machines, contact printing, photogrpahic enlargement etc should apply to the modern era. "Making" has therefore been radically expanded to include actions that most of us do every day; opening an email attachment is "making", opening a word document recieved on a USB drive is making, merely causing to be on your monitor screen an image from an internet site is "making", pop-ups are "making", even merely seeing thumbnail is enough to prosecute the making law. The maing law can be, and is, prosecuted even when the image(s) is deleted. The issues that prevent every act of making as desxribed above being illegal are only two; was the image indecent? and was it "made" intentionally? Observe, the law is applied with zero tolerance. It mean even a single image will be prosecuted.
The Detection
UK law enforcement protects the methods by which the crime is detected, but I will say that I am fairly confident that the movement of files with incriminating titles and hashes are detected by a super computer and then fed to police forces. On the basis of information of this kind a search warrant is obtained.
The Search
The police will search the premises that houses the system that has been detected as probably having downloaded the files. There is nothing that requires the police to be exhaustive in this search. Also, police forces frequently refrain from asking questions relative to the suspected crime during these searches as to do so without the regulatory safeguards may make the evidence inadmissable.
The order on the digital forensic unit
The devices seized will be presented to the digital forensic unit (dfu) along with an instruction. That instruction will typically be simply the suspected (set of) crime(s). Observe, the police cannot inform the lab of more than this; they have asked no questions and they do not yet know what will be on the devices.
The work of the DFU
The unit will seek first the artefacts they expect to find i.e. indecent images and then seek evidence that these were deliberately made and by whom. It will be well known to this group that the work is constructive - a story is built. In most cases that story will be easy to build; the user was in chat rooms asking how to get such images, there are browser searches using incriminating keywords etc. The CPS have a standing insturction that the work of both the police and the DFU should be "streamlined". This menas, as soon as enough inculpatory evidence is found to convict with the highest penalties, the analysis should be stopped.
The interview
On the basis of the wotrk of the DFU an interview under caution will be performed.
What's wrong with this process?
1. The law is draconian and is applied with zero tolerance. This is surely not wrong, but we will all surely agree tgat such laws should be associated with the very highest standards of investigation - but they are not...
2. The search can be partial and can miss exculpatory evidence.
3. The DFU works on the theory that a crime has been commited. The lab is under pressure to move on to reduce what are typically massive backlogs. The lab is encouraged to "get the goods" and then stop by a standing instruction form the Crown Prosecution Service request to to "streamline" the work. The lab is not paid more to investigate alternative theories such as that the images were "made" by accident and that therefore no crime has been committed. The lab "wastes" the investigative work done so far if it finds exclupatory evidence. Exculpatory evidnce is, by its very nature harderd to get than inculpatory evidence. The forensic software is designed around the easy detection of inculpatory, not exclupatory evidence ("Find evidence" button). The bottom line is that even where the evidence is slim and alternative theories are viable they will not be tested. I want to say that, in my experience, Codes of Ethics make zero difference to this. Neither does it make any difference if the lab is qualified to ISO 17025.
4. The interview is absurdly assymetrical. In the case where there is only one deleted image with no searches and no metadata etc. a typical opening question to the accused will be of the form "we have found a single indecent image in unallocated space. How did it get there?" This almost certainly presents the innocent accused with an impossible problem, he simply does not know. The remainder of the interview will then typically be given over to trying to obtain a confession and thereby shorten the process of justice. The interview (i) does not aspire to be a dettached exploration of the evidence and (ii) it cannot do so becuase the evidence made available to law enforcement by the DFU will very possibly be partial and only inculpatory in nature.
5. Juries (and judges!) are bad at understanding forensic evidence. About half the jury won't be able to make an attachment to an email! The logic often reduces to "there is this horrible image and it was on his computer and he can't explain it!"...
FYI, conviction rates by police forces in the UK for this crime are normally above 95%. This massively outstrips almost every other kind of crime...
My questions to the group are
AAA Are my assertions *substantially* correct? Those orf you who know the UK system please correct me if I am wrong.
BBB How can things be improved in the DFU? I have ideas, but this post is about a mile too long as it is.
Best Regards
Adrian
AAA - no.
For those of you who are not familiar with the UK system, please don't be miseld by the answer Rich has just given. I either know direct from law enforcement here, or I know from government produced documents that pretty much everything I wrote in the original post is correct, and if anyone wants to enage with this thread in a constructive way and wants me to do it, I will provide the background for my statements.
Bearing this in mind, if anyone would like to offer a constructive response, even if the system in your country differs from that of the UK, I would still be very interested in what you have to say.
Best
Adrian
Having worked in law enforcement for over 13 years, I can state that pretty much all of what has been written above is incorrect or incomplete. Unfortunately I have neither the time or the inclination to go through and point out all the errors, as it would be larger than the original post, this message is for those reading this thread who may question the validity of the OP.
It is very disspointing to find that the only two people who have responded make blanket assertions and simply expect readers to believe them. Is this a discussion group or is it a place where people simply assert things and that's it?
In order that people can continue to take the original post seriously after these two bald responses I substatiate and expand the first paragraph.
The law
The "making" law in the UK makes it a criminal offence to make indecent images. The law predates the internet
[Adrian - There are two laws used to prosecute in relation to indecent images in the UK; the Criminal Justice Act 1988, often referred to as the "possession" law and the Protection of Children Act 1978, often referred to as the "making law". The world wide web became available to the public in 1991...
but judges have ruled and our Crown Prosecution Service is "satisfied" that it is the intention of parliment that "making", which was previously only possible with lithograph machines, contact printing, photogrpahic enlargement etc should apply to the modern era.
[Adrian - It is not really a matter for debate that prior to the internet the means to make images were those I mention and others like them. What makes these means very different than those available to make images in the era of the internet is that it was almost impossible to make an image then without intending to do so. Now of course, it is extremely easy...
Readers please note the "possession" law is rarely prosecuted in the UK, here is a quote from the Crown Prosecution Guidelines that explains why
"The use of...the CJA 1988 is becoming increasingly rare. It is better reserved to cases where the evidence is unambiguous in showing genuine possession, for example, where a suspect has the images in printed form or has saved them into a clearly labelled file within the hard drive of the device."
"Making" has therefore been radically expanded to include actions that most of us do every day; opening an email attachment is "making", opening a word document recieved on a USB drive is making, merely causing to be on your monitor screen an image from an internet site is "making", pop-ups are "making", even merely seeing thumbnail is enough to prosecute the making law.
[Adrian - Here is a further quote from the CPS prosecution Guidlines
"The charge of 'making' also has the advantage of being widely interpreted to cover such activities as opening attachments to emails and downloading or simply viewing images on the internet."]
The maing law can be, and is, prosecuted even when the image(s) is deleted.
[Adrian - Again, from the CPS prosecution guidlines
"Even if an image is located in ‘unallocated clusters’ and cannot be retrieved, provided it can be proved that the image was downloaded or in some way transferred onto the device, a charge of ‘making’ an indecent image can follow."
Iissues that prevent every act of making as described above being illegal are only two; was the image indecent? and was it "made" intentionally?
[Adrian - The word "making" as it used in the PCA 1978 means "to cause to exist, to produce by action, to bring about" from R v Bowden 2000.
To emphasise the point about the width of the term making the CPS Guidelines state
“To make” has been widely interpreted by the courts and can include the following:Opening an attachment to an email containing an image (R v Smith [2003] 1 Cr. App. R. 13) Downloading an image from a website onto a computer screen (R v Jayson [2002] 1 Cr. App. R. 13) Storing an image in a directory on a computer (although depending on where that image is stored, this could also be a possession charge under s. 160 CJA 1988) (Atkins v DPP; Goodland v DPP [2000] 2 Cr. App. R. 248) Accessing a pornographic website in which indecent images appeared by way of automatic “pop-up” mechanism (R v Harrison [2008] 1 Cr. App. R. 29)]
Observe, the law is applied with zero tolerance. It means even a single image will be prosecuted.
[Adrian - There are numerous cases involving just one image. I cnnot give you statistics but here is a case to illustrate the point.
https://www.thescottishsun.co.uk/news/5782716/eric-joyce-labour-mp-indecent-photo-child/
Theoretically, the police still have right to determine whewther rcase goes forward to the CPS, but interviews I have performed with a police officert on a team doing this kind of work said "we have almost no leeway now".
I will add that for reasons I hope will be self-evident to readers the police feel an extreme need not to be the part of the justice sysyem who decided not go forward with any case.]
Guys, here's the thing, I came to this group, hoping to discuss with thinking and open-minded people issues I have spent a long time researching, and what I have is two replies, one of them monosyllabic and both completely negative and unconstructive. I don't mind, but these responses seem to be frankly worthless and written from piq.
My post was cut off. Not sure why. Maybe it was too long?🤔
Anyway, what I had left to say is that I am hoping that people will see that the first paragraph has substance and you will be correct to deduce the rest has too.
I have read back in this group and I know there are people who do not think it right to simply assert bald contradictions, but prefer when they respond to say something constructive. If you are one such I am still very interested to hear what you can tell me. This *absolutely includes* any corrections you might be able to make.
Moderator, please keep an eye on this thread.
My post was cut off. Not sure why. Maybe it was too long?🤔
Anyway, what I had left to say is that I am hoping that people will see that the first paragraph has substance and you will be correct to deduce the rest has too.
I have read back in this group and I know there are people who do not think it right to simply assert bald contradictions, but prefer when they respond to say something constructive. If you are one such I am still very interested to hear what you can tell me. This *absolutely includes* any corrections you might be able to make.
Moderator, please keep an eye on this thread.
"The lab is encouraged to "get the goods" and then stop by a standing instruction form the Crown Prosecution Service request to to "streamline" the work. The lab is not paid more to investigate alternative theories such as that the images were "made" by accident and that therefore no crime has been committed."
I have been dealing with the CPS since it was formed in the mid-80's. I don't recall any occasion where there was any form of request/instruction to "streamline" the work. Where I have encountered such instructions, they were quite the opposite. The only context I can think that phrase is used is in relation to 'Streamlined Forensic Reporting'. That is not specific to digital forensics. This takes an incremental approach, with the intention of attempting to engage with the Defence at an early stage to identify what issues are taken, if any, with the forensic evidence. There is probably some scope to evaluate how successful this approach is or has been.
It might also be borne in mind that the majority of work is carried out by law enforcement bodies, in their own labs, without any direct payment issues. Although there are of course occasions where out-sourcing companies are used. In those cases the instructions are from the CPS to the Police, not to the company.
"I want to say that, in my experience, Codes of Ethics make zero difference to this. Neither does it make any difference if the lab is qualified to ISO 17025".
I am not sufficiently well-informed to know whether this is factually correct, but interesting, if not disappointing, given your profile details.
Occupation UKAS Assessor
[Adrian - There are numerous cases involving just one image. I cnnot give you statistics but here is a case to illustrate the point.]
I have no personal knowledge of this case, but basic research indicates the subject admitted searching for such images; admitted knowledge of the presence of the image and consequently pleaded guilty to the offence.
HI Jerry,
Thank you so much for making a differetiated answer instead of sweeping away the original post as if it were made by an idiot.
See my interspersions.
QQQQQQQQQQQQQQ
I have been dealing with the CPS since it was formed in the mid-80's. I don't recall any occasion where there was any form of request/instruction to "streamline" the work.
[ Adrian - The streamlined approach should be used under specific circumstances for low risk offenders. There is a whole slew of requirements, far too many to list here, but the objective is to reduce the time spent investigating.
I quote the CPS Guidlines
"It is hoped that the timescales for technical examinations will be considerably reduced allowing a greater number of offenders to be investigated".]
Where I have encountered such instructions, they were quite the opposite.
[Adrian - This is very interesting to me. Can you illustrate the general idea with a case?]
The only context I can think that phrase is used is in relation to 'Streamlined Forensic Reporting'. That is not specific to digital forensics. This takes an incremental approach, with the intention of attempting to engage with the Defence at an early stage to identify what issues are taken, if any, with the forensic evidence. There is probably some scope to evaluate how successful this approach is or has been.
[Adrian - This is not what I was talking about but it is very interesting. Changing the line only a little bit, you are most likely familiar with part 19 of the Criminal Procedures Rules. Have you ever been called to a meeting of experts prior to a case? This practice seems to me to be of great value and could massively improve the quality and shorten the process of justice in these cases, but I cannot find anybody who has attended one yet. And I am not sure they are happening.]
It might also be borne in mind that the majority of work is carried out by law enforcement bodies, in their own labs, without any direct payment issues. Although there are of course occasions where out-sourcing companies are used. In those cases the instructions are from the CPS to the Police, not to the company.
[Adrian - Yes. The concern I have is that these labs are under huge pressure. There are lots of reasons for this the fundametal one being that government won't fund the police properly. If it is OK with you I will start anothr thread sometime to talk about the experience of police labs.]
I am not sufficiently well-informed to know whether this is factually correct, but interesting, if not disappointing, given your profile details.
Occupation UKAS Assessor
[Adrian - The reason 17025 is not working for justice in the UK are many, but I list out just a few.
The vast majority of police units simply do not have it...
Of the few units that have it, their scope does not include compliance with the Forensic Science Regulators Code of Practice, without which 17025 becomes assymetrical, being positive only in relation to conviction.
Most labs doing this work are very small being just one or two people and, whilst 17025 is capable of being used in relation to labs of any size at all, the fact is that where the lab is small the effectivenss is weakened because there cannot be a proper separation of activities.]
I have no personal knowledge of this case, but basic research indicates the subject admitted searching for such images; admitted knowledge of the presence of the image and consequently pleaded guilty to the offence.
[Adrian - When I used the term "zero tolerance" I meant that single images will be prosecuted. The point I want to get over is that the lattitude that the police have to issue cautions etc. is now only theoretical and is no longer used in relation to this crime. The police always prosecute. And I am certainly not saying they should not. But, when they operate this way in relation to this "hair-trigger" law it is essential that the quality of the investigative work is *uniformly* top notch and, whilst it makes me as popular as anthrax to say so, it isn't.
Here is a case where a bit of lattitude might well have been granted but wasn't.
If I remember rightly, the police woman was such a good officer and so effective that she was taken back into the force. This underlines that the police apply no leeway in relation to this crime. And I repeat, that may well be the right thing to do, but if it is done, the forensic work must invariably be top notch. When I get past the trial I am having in this group about my credibility, I hope to discuss ways it can be improved, costs reduced and justice better served.
Best Regards A]
I hope to discuss ways it can be improved, costs reduced and justice better served.
The primary purpose of these forums is to allow the exchange of technical information between DFIR professionals. My understanding is that you are not a DFIR professional but if you have suggestions which would allow other members to improve their procedures and working practices please outline them now in this forum topic.