When employers worldwide instituted remote-work policies to help reduce the spread of the novel coronavirus COVID-19, the impact to entire criminal justice systems — from law enforcement to evidence processing through the courts — was profound.
Digital evidence examiners in particular questioned how “the new normal” might affect their operations. From delaying search warrants to chain of custody to decontamination, the issues were complex — and the answers not easy. Some labs limited new device intakes, while others put examiners back in uniform and on the street.
Produced in cooperation with the National White Collar Crime Center (NW3C), this update comprises analysis of major legal issues from around the country. The material published here is for general public education. It is not legal advice for any specific situation. If the reader needs specific legal advice, the reader should consult a qualified lawyer.
Digital evidence search & seizure during a pandemic
We start with a white paper produced in partnership with the NW3C, “Coronavirus and Law Enforcement.” While the paper is aimed at all law enforcement officers, a segment focuses on digital forensics examiners who may be involved with seizing evidence in the field, as well as processing evidence back in the lab.
Either way, the risk of exposure to COVID-19 looms large for many, particularly in the field. Here’s what authors J.D. Ronan, Robert Peters, Brandon Epstein, and Jim Emerson had to say:
“COVID-19 represents a unique challenge for law enforcement in a search warrant setting. The danger is not only the potential of a suspect hiding under the bed with a weapon, but also rather the air within the premises that officers breathe, and every surface they touch during the search.”
Their recommendations include:
For everyone
- Sleep. Shift work can compromise the effectiveness of officers’ sleep and strain the responsiveness of their immune system.
- Practice good hygiene by using soap and hot water to wash hands appropriately. If soap is not immediately available, use an antimicrobial hand sanitizer.
- Wear nitrile examination gloves properly, and avoid touching cell phones, pens, and other tools to prevent cross-contamination.
- Use an Environmental Protection Agency (EPA)-recommended cleaner to wipe potentially contaminated surfaces, including phone, pens, steering wheels, etc.
- Use an N95 respirator, filtering face-piece mask (FFP), surgical mask, or even a handmade cloth mask.
For search warrant service
- Consider whether search warrants are necessary and/or can be delayed.
- If a search warrant cannot be delayed, brief the entry team in advance on the items to be seized and protocols for seizing biological evidence before wiping down physical evidence. This includes digital devices.
- Wipe and secure unsoiled physical evidence per standard operating procedure.
- Bag and tag soiled physical evidence per standard operating procedure, and always while wearing gloves.
- If the evidence is a digital device, process it for DNA and serology, wipe it appropriately with an EPA-approved product, and deliver to the digital forensics lab.
- The entry team should launder their clothes in a dedicated washer for biohazard material without shaking out their clothes or otherwise enabling air particulates to be disseminated.
- Agencies that contract with a dry cleaning service should follow existing standard biohazard protocols to minimize risk to dry cleaners.
- Each team member should shower and change into clean clothes prior to leaving the station to avoid bringing any potential contaminant vectors to their homes.
For digital forensics labs
- Before proceeding with normal digital forensic examination:
- Wipe the work area with an appropriate disinfectant while wearing gloves before beginning work.
- Don gloves.
- Wipe the digital device, including the screen, liberally with an EPA approved product.
- Wait for the surface to dry.
- Remove the gloves.
- Don a new set to prevent cross contamination.
- Following the examination:
- Remove gloves.
- Don another pair.
- Wipe the work surface again.
- Proceed to report writing or the next examination.
- Dispose of gloves in a designated garbage can with a bag that can be removed when full.
Find the executive summary and the full white paper at the IACP’s CRI-TAC COVID-19 Library of Resources.
Legal implications of COVID-19
A two-part series by Peters, Ronan and Epstein together with NW3C’s Matthew Osteen examines the many potential legal ramifications, under U.S. Constitutional law, of policies and procedures set up to address operating under the pandemic. These include:
- The timeliness of search warrants and seizures.
- The implications of some labs curtailing operations to the extent where they are not processing even critical evidence such as child sexual abuse material.
- Potential issues with chain of custody, authentication, discovery, and the right to counsel.
- How effective decontamination procedures could affect due process.
Search & seizure timeliness
With investigations curtailed — either because personnel are needed on the front lines, or out of concern for their safety — both field previews and evidence intakes at labs have been likewise. However, can a coronavirus-related lab backlog be enough of a reason to delay a search, even if backlog isn’t normally a valid reason in your jurisdiction? Will the digital evidence go “stale”? And perhaps more importantly, how should labs deal with ongoing severe crimes such as child abuse? (Hint: with lockdown-facilitated child abuse on the rise, these cases should be prioritized.)
Timeliness is also a factor when it comes to a speedy-trial balancing test. Filing preservation orders — and obtaining the preserved evidence — are key here, along with ensuring the evidence doesn’t degrade (especially if it is or could be considered exculpatory).
Chain of custody, authentication, discovery, and the right to counsel
COVID-19 response, particularly operational changes designed to protect employees, has created the potential for changes to a typical chain of custody. Biohazard handling, lab delays — particularly with many examiners working remotely from home — evidence storage and security (including network isolation), and authentication are all covered, especially with regard to documentation of any changes.
Discovery — the defendant’s right to examine the evidence against them — is also potentially affected by these kinds of changes. Virtualized labs can help in this regard, but some contraband evidence, like CSAM, cannot be handled virtually. The authors describe how to manage this with pandemic-oriented precautions and other logistics, stressing that ultimately what examiners will be called on to credibly testify to is whether they knew what to do, and whether they did it.
Due process and decontamination
Decontaminating devices could result in the destruction of physical evidence like fingerprints, DNA, or other physical evidence. The policies around due process involve questions such as whether devices should be decontaminated in the field following seizure, in the lab, or both, as well as what the evidence might have been and what it could have proved (for instance, fingerprints as evidence of ownership).
For in-depth analysis of these issues, find the two-part series at Forensic Horizons, a Medium publication:
Lady Justice… With a Respirator
Not a Get Out of Jail Free Card
Attorneys from different parts of the world who would like to participate in this project are welcome to contact Forensic Focus’ content manager at christa@forensicfocus.com.
