Christa: Welcome back to the Forensic Focus Podcast. I’m Christa Miller here with my co-host, Si Biles, and this week we’re with Steve Slater, Head of Digital Forensics at Devon and Cornwall Police in the United Kingdom to talk about how his team is implementing the Rape and Serious Sexual Offense, known as RASSO, portion of the National Police Chief’s Council Digital Forensic Science Strategy. Welcome, Steve.
Steve: Thank you for having me.
Christa: It’s a pleasure. So you and I first connected back in March, you tweeted about reviewing the RASSO changes with your team. So before we get into more of the meat of the implementation process, I wanted to talk a little bit about the rationale for these changes.
On the one hand, having the victims themselves who I think almost internationally really have expressed frustration, difficulty trusting law enforcement’s ability to help them, and on the other cases like R v Allen, where exonerating digital evidence wasn’t properly disclosed to defense and nearly sent an innocent man to prison.
So as you’ve been implementing these changes, how do you see them balancing this notion of “trust, but verify”? So assisting the victims at such a difficult time, but also doing the due diligence to verify their claims?
Steve: Yeah. okay. That’s a big old question, so…
Christa: I know.
Steve: It’s quite a big piece from end to end. So, of course the digital forensics only plays a small piece of the jigsaw puzzle.
Christa: Of course.
Steve: No, it was a result of the prosecution rate in the UK dropping, I think below 3% of rape and serious sexual assaults which initiated a joint action plan review, but across the criminal justice system and policing.
And there were multiple things that were affecting the output and the success rate and that ranged from how the police on the frontline deal with victims of these horrific crimes, how the criminal justice system, CPS, as a whole supported victims, and also how we handle their digital devices.
So for us, it was about that evolution from on the back of the ICO report, really that a victim is a victim. We were very traditional in the way we approached digital evidence traditionally with the high-tech crime units. Digital forensics is very set in a process. You know, the old principles and the way we do things.
So all devices, we took a forensic copy, a bit-by-bit copy, we were examining that data, but quite rightly the ICO and the protection groups around victims said, “Well, you know, this isn’t correct. We have no legal right to access a victim or witness’ device and take everything. When you consider GDPR, you know, human rights and people’s privacy rights, we shouldn’t be taking all that data.”
So our part of the journey is really updating our processes and our stops and our accreditation, our standard operating procedures, how we approach the victim. We need to make sure it’s a very focused examination. We’re only taking the data that’s consented to and we want to do that as quickly as possible.
A victim is a victim. They’ve been through a highly horrific dramatic incident. The last thing we should be doing is taking away their digital device for a day, two days, three days or longer to take it into our system, do a full forensic examination and then report on just a fraction of that data and how we retained the data and all the other aspects that come into it.
So our RASSO vans that the national project headed up by the Forensic Capability Network was all around, “Okay, how can we turn this around and flip it on its head?” almost like a blank canvas.
There are several aspects to it such as making sure it’s the right staff at the victim’s location to do the examination first time, every time. So it’s not necessarily a kiosk approach, which is more automated and frontline with frontline officers because kiosks aren’t always successful.
And, you know, a lot of those phones will get submitted to DFU if the kiosk does fail. So of course that adds a delay for a victim. So we wanted to make sure it was highly-trained staff, the right staff with the right equipment and the right tools, the right training and expertise downloading that device straight away, first time, every time.
So, the principle is, we will go to the victim’s location, either home address or a local police station with the data protection notices in place, we’ll have an informed consent from that victim to access the data of relevance.
And that the evolution, the ongoing thing as well is we’ll always make sure we’re keeping our tools up to date, we’re using the right tools, we’re constantly testing the market to make sure that the tools we’re using will do something called ‘data slicing’, which I’m sure you’ve heard of with other tools where we can just access that specific data there and then, and then the victim can have their device back straight away.
Si: I mean, how are you addressing the factor that, you know, A: I mean, technology is moving on in the sense that, you know, there are a million different social networks and a new one will pop up tomorrow.
And also, you know, you’re doing a sort of a triage process on this device and saying, “Well, these are the important things.” How are you managing the risk of actually missing something because of this triage?
I mean, I understand the implications of going to a victim and the reasoning behind it, but obviously there’s a corollary to that, which is that if you’re only looking at part of the data, the exculpatory evidence might be in the other part of the data, or, you know, other victims or anything else.
But, you know, there’s this potential for missing things. How are you managing that within your processes and procedures?
Steve: So, for a victim we don’t really look at it as a triage process. So, because it has to be informed consent, the victim will tell us, “It is a WhatsApp message between myself and the suspect” in the last week, in the last six months.
So it’s a very focused examination. So for a victim or witness, we can only go and access the data that they consent to. So, there is the risk that obviously a victim may delete material or not want us to see all the material, but that is the victim-centric approach. Under the ICO guidelines and GDPR, we can only take the data that the victim consents to. So we won’t take anything else.
With regards to suspects, yeah, we do deploy triage. We don’t use the RASSO vans for triage. We’ve got dedicated triage locations across the forces which frontline officers use. So we use various tools for that with the frontline officers, but predominantly there’s a search pack created.
So if it’s a child abuse investigation, it will have known hash values of the indecent images, it’ll have known keywords, known locations, and also the search packs are very intelligent. So they’ll go on and they’ll look at the most recent files first, they’ll look at the most common user locations or internet locations.
But it has to be, you know, technology is only part of the solution. That has to be coupled with an investigator’s mindset to actually think, “Okay, well, have I got everything I should be getting?” You know, how does that correlate with the intelligence in the case?
‘Cause we certainly do get cases where triage is negative, but the officer just isn’t quite happy. So the case will still be submitted.
And we’ve got very strict protocols in place, as well. So triage could only be used for cases where we could identify the evidence, for example. So we’ve got a quite good gatekeeping process in place to review the jobs and the exhibits and the exhibit type or data types that are being sought for.
A simple example would be if it’s a live abuse case, first-generation images, we wouldn’t put that through a triage process, we would potentially examine all the exhibits in that case, cause we know that the images, movies, or chats wouldn’t be present in our databases.
So I think, yeah, it has to be a very, you know, a team approach. The technology aids, but it’s really down to the OIC and there and the standing and the case and intelligence, what a victim or suspect is telling them and what other intelligence is available to help them make that informed decision.
Si: So is there a feedback loop that you can take from a suspect device that says, “Okay, well actually I found (let’s say) WhatsApp messages that the victim hadn’t disclosed.”
Can you then go back through a feedback loop and go to your victim and say, “You know, you didn’t give us consent to have a look at this. Would you mind?” Does that happen or is that sort of informed consent at the point of reporting or the point of acquisition, the end of the sort of victim side of forensics on those devices?
Steve: So, at the start of the case, it would be informed consent. We would only take the data that the victim consents to. As the case progressed, if more intelligence came to light or more evidence came to light from other devices, that would be obviously something the officer would take back to the victim.
So yes, certainly we could request that that device is examined further. But then of course it’s in the realms of, is it still consent? If it’s a victim, they are still the victim. It’s a very victim-centric approach. But of course it could turn into, the victim becomes a suspect in a different type of scenario. And of course then the exhibit may be seized. But that’s very rare if I’m honest.
Si: No, I mean, I understand that. I mean, the cases that we hear about are people attempting to pervert the course of justice and, you know, hiding other things and therefore, you know, those cases would be the ones where this feedback loop would be valuable. So if it exists, that’s obviously critical.
But no, I mean, the idea that the victim is the one that we are taking care of in a given scenario should absolutely stand. I just want, you know, I’m trying to figure out how by doing this, we create the risk that the victim will be believed regardless of what they say.
And we have to mitigate that by saying, “Well, okay, there will be a feedback if something is found that’s exculpatory on the suspect’s devices that potentially make this a different case.” So, no, that’s brilliant. Thank you.
Steve: And of course it doesn’t replace traditional policing methods at all, does it, the digital evidence. It’s still a lot of, I think, gut instinct with an officer sometimes as to what’s right and wrong and where the investigation needs to go.
Si: Yeah, I mean, I think gut feeling is incredibly important. I mean, even from a digital forensic perspective, you’re looking at the device and you’re like, “This doesn’t feel quite right. I’m going to go a bit further.”
Christa: I think it can backfire too though, you know, that gut instinct, because I mean, you can just as easily have bias. Honestly, that also masquerades as gut instinct, right?
Si: Yeah. And in fact, to a certain extent, that’s what the RASSO changes are. Enforcing is a gut bias towards the victim, which again, I’m not against this. I think that they need to be taken very seriously. And I think that there is a historical aspect of perhaps dismissing these cases a little too quickly in some scenarios, but yeah, we need to put in those checks and balances to make sure that that sort of thing doesn’t happen.
Christa: So, I mean, it sounds like a lot has been involved over the last few months in terms of implementation. What is there? Are you still rolling it out? Is it pretty much a done deal at this point? What kind of feedback are you getting from the team?
Steve: So, from the team, you know, there’s certainly a capacity issue that the staff are highlighting, ‘cause it is a change process for them, as well. And I think you need to look wider at the sort of evolution of high-tech crime.
So in the early days of high-tech crime, we were out and about on a lot of warrants with our child protection teams in early morning and late nights, where sort of nationally as demand has increased ‘cause the plethora of digital devices out there now and 90% of crimes that involve a digital footprint has just overwhelmed us, really.
So with the creation of cyber and digital teams we’ve sort of dropped away from the frontline examination of devices and attending warrants and providing assistance.
So at the moment we’re focusing certainly on the CPD of our staff. You know, we’ve got a lot of new staff in our units who’ve never been out on warrants. So of course we’ve got to make sure that they’re supported and there’s CPD around them actually going out.
You know, it’s not a warrant, it’s not a risky situation we’re talking about here. This is a compliant victim we’re going to support. But it’s also interesting how the CPD is unfolding with the teams to understand the victim-centered approach. Everything we do in the police world and well, any world really is all about the victim and how we’re supporting a victim.
But of course it’s that traditional digital forensics approach. I need to take a full forensic copy just in case there’s other evidence needed or the defense need to see something, you know, it’s a very thorough process.
So we’re doing a lot of work around our CPD of what the new legislation and the, you know, College of Policing APP guidance and everything is actually pointing that it is a selective ICO-type examination.
But no, we haven’t deployed them as yet. We’ve got one that is due to deploy potentially next week now, because the vans only arrived, well, we got all four by June, so in the last month.
So of course there’s a bit of work that our workshop teams do with just checking the vans, you know, making them safe and all the kit for the local force.
We’ve then got to test and validate all our equipment, so all the kit that came from the FCN as well, ‘cause these are mobile labs, they’re not just for RASSO. We can examine, triage, acquire any digital device at a scene. So even though they’re primarily focused at RASSO victims, they do cover any digital device, which is phenomenal, it’s great to have that asset with the teams.
But of course behind the scenes, then we’ve got to validate the kit; make sure we’re happy with it within our processes; make sure all our SOPS are up to date, our standard operating procedures with accreditation; and just, you know, the whole process and tool development is in place, as well.
So the team’s eager to go, it’s a great process. And also, the way I look at it as well is this is a great welfare opportunity for our teams, because we’re certainly evolved in the DFU world to be a really sat behind the scenes, you know, staff doing invaluable work day in, day out, just potentially looking at some of the most horrific stuff continually, as well.
So to build in a sort of shift rota where for a week, couple weeks, or however the teams want to run it, but they can be out on the road, they can come in in the morning, pick up the van, make sure the kit’s ready and then they’re out and about driving around. It takes them away from being sat there at a screen for eight hours a day looking at horrific stuff, but to actually get out and, you know, network with the officers obviously supporting victims and taking that expertise to the frontline, as well.
So yeah, we’re still in the process of rolling out. And I’m sure there are going to be lots of changes we’re going to have to make. It’s going to be an evolution. We’re critically aware of that. So we’re keeping an eye on all the tools that are out there, as well. Have we got the right tools? What’s coming on the market?
We’ve got a lot of projects running with different organizations to just sort of look at, “Okay, how can we evolve? What pilots can we run?” Even to the extent of getting better tools on the frontline for victims and witnesses. Do we need a DFU specialist in every single case?
It could be that there’s a tool out there where a frontline officer, as soon as they have that interaction with the victim or a witness, they can take that data straight away cause it’s an informed consensual process of live data. If it’s anything more complex, you know, location system data or deleted data, that’s when it would then need to come back to us in the DFU.
Si: Have you found that, you know, you were saying that this is you going back out into the field again and, you know, I think that’s fantastic, but have you found that with withdrawal into the DFU that the officers on the frontline, the OIC, so I’ve actually lost touch with what DFU are capable of?
Either in the sense that they’ve watched too many episodes of Midsomer Murders and think we can solve everything, or in the sense that they actually have no idea what we are capable of doing now. I mean, you were saying that you want the guys to get to go out and interact again, and that seems like an opportunity to bring that knowledge back, but have you actually noticed it slide over time?
Steve: Yeah, that’s an interesting one. So, we certainly still keep CPD in place with the officers. So we’ll attend training days, team events in CID, PPU world. So that’s still in place, but I don’t think we’ll ever get away from that sort of officer who wants to do the right thing for the right reasons without actually understanding what they’re doing.
We’ve always had it where, you know, everybody’s got a mobile phone in their pocket, so of course everybody’s an expert in how a mobile phone works. And I hear that so many times across so many police forces all suffering from the same issue.
So yeah, I think we will always have those situations where we need to step in and support an officer more in certain cases. There’s always key officers, officers who are regularly involved in digital evidence from the PPU world who really get it, really understand it.
And we were talking about earlier, you know, you get those barristers as well, who really get it, the ones who do the same types of cases over and over again, and really understand that specialism.
So, to be frank, I think, yeah, there isn’t enough CPD for officers out there. And I was really reassured to see how the FCN and the College of Policing were addressing that to put better CPD out to officers and they’ve completely shaken up the induction process of new officers into policing, as well.
And there are elements of digital training in there as well now. Cyber teams and DMIs are out there on the front line. They’re very well placed with the links into the specialist teams, not just DFU, it could be SPOCK or AMPR teams behind the scenes and providing that specialism into an SIO and providing that single point of contact themselves between specialist teams and an investigation team.
So, I certainly think it’s better than it’s ever been before, but is it ever going to be good enough? And that’s the challenge, isn’t it, with technology. I mean, something’s always changing, you know, we’ve got Ring doorbells now, the Internet of Things vehicles, which of course 10 years ago we didn’t, and then in another 10 years there’ll be something else that we’re having to just make sure that we’re keeping officers up to date with and our knowledge with up to date with.
But of course, we’re always one step behind because that’s the nature of the beast. We don’t go and develop our skills into something that isn’t being used illegally. So yeah, it’s always an evolution. It is an interesting question, definitely.
Christa: I had wondered myself about how the new procedures, everything you’re describing had been received actually by the victims, but it sounds like it’s still kind of too early to tell.
Steve: Yeah, it is at the moment. And certainly some of the reports suggest that, you know, victims don’t want to engage with the police in a lot of cases anyway, but not through the fact that their phone’s going to be taken away. It could be a third party report or, you know, just the victim feels it’s the right thing to do to report to the police, but they don’t want to get involved in a criminal investigation.
So it is a very complex crime to investigate anyway. But I’m sure, you know, with the hundreds of devices we get through the doors already that come into the DFU and we already offer an immediate turnaround service on all our DFUs anyway, but this process will just take away the travel time of an officer having to take the phone to a DFU, wait for it to be examined and take it back.
We’re going to obviously shave hours off of that, if not a couple of days in some cases. So in all those cases, I’m sure the victim would feel more reassured because, you know, using our own empathy and looking at it ourselves, how would we feel if somebody said I’m taking away your mobile phone for the day or a couple of days?
Christa: Well, your one lifeline maybe to your support network, right?
Steve: Absolutely. That’s exactly the thing, isn’t it? It’s your support network, your family, your friends, it could be the social networks, you know, dating apps, all those things that, you know, in the old days we used to say if somebody was being bullied online, don’t go on that website.
You know, and of course it’s how we evolve and understand technology. You can’t tell somebody to stay away from it because, you know, it’s that thing that follows you, isn’t it? And there’s a lot more psychological understanding nowadays. So just being able to ensure that the victim isn’t left without their device is a massive step forward in my mind.
Christa: Yeah, yeah, yeah.
Si: I think, you know, just a curiosity question that again, feel free to answer this one. But, you know, the willingness to go and report something like this to the police is that there is a historic issue with regard to things like representation.
So, you know, there are a lot of male police officers and a female going into a station and attempting to report something like this is an issue. And also, you know, representation of ethnic diversity or perceived gender or any of the other things where people feel unrepresented.
In your own sort of the staff that you’re sending out, what’s your ratio representation like? Is it a good mix or are, my experience of the forensics industry unfortunately is about 90% male.
Steve: I’d say we’re running at about 70 to 80% male. And you are right, you know, high-tech crime was always a male-dominated environment historically. And it was only men who used to apply for the DFU role.
But, you know, I’m really pleased to see that that’s changed massively in the last 10 years. We’ve got, well, I’ve got about three or four DFU managers who are female, for example. And we’ve got a lot of, actually, and there’s quite a chunk of our female officers are the mobile phone examiners coming through the door.
So I think just, you know, society’s changed, isn’t it? Technology was always, you know, the nerdy, geeky thing, was always a boys thing, wasn’t it? Whereas nowadays, you know, women are getting more interested in those careers, in that type of environment as well, which is really good to see.
Steve: And also, as the type of material we found, I do recall back in that it was probably about 2008, 2009, we did have a female applicant into the high-tech crime unit.
And as soon as we started talking, you know, and she was successful through the process, she was our preferred candidate, as soon as we then started going into more detail about the work and what it involves, she withdrew her application because she didn’t want to sit there and look at that type of material.
So I think society as a whole has changed, hasn’t it, in just how we look at it and how we understand it. And certainly our support processes are better. You know, with the mandatory counseling we have in place for our staff every six months dealing with this type of material.
But we’ve also got buddy systems in place, peer reviews in place, manager 1-1s, so we’ve completely encapsulated these environments now with an understanding that it’s okay to talk about this stuff and it’s okay to have times when you don’t feel okay or you’re upset by a job.
And it’s almost that permission from, you know, the managers and the structure and the policing to say to the staff that if one of your colleagues is upset, stop work, and go and have a coffee and have a break.
So yeah, we’re getting better at being okay to not be okay. I still think we haven’t got it completely by and, you know, it’s sometimes a balance with demands and pressures where everybody’s feeling it, but it’s certainly a better place today than it’s ever been..
Si: Wonderful. I’m really pleased to hear that. How did you find it over the pandemic in that regard? Were you able to still work together as a team and get that level of support or did it become lots of this, excuse me, but the Zoom stuff where, you know, we’re trying to read micro gestures across, you know, well probably to be fair only a couple of streets away, but, you know, still not face to face.
Steve: Yeah, it was an interesting time for us because we just had a small uplift of 22 staff. It sounds large, but across four forces, obviously 22 doesn’t go that far. But it was still a significant uplift and a really positive step forward for DFUs in combating increasing backlogs and the demands.
So we were recruiting right at the start of the pandemic. So we managed to continue, which was really positive. You know, a lot of hard work in the teams with the managers, the staff, doing the recruitment and the testing of candidates coming through the door.
But we still managed to recruit 22 staff throughout the pandemic. Our lab stayed open. It was a tricky one because certainly with several meetings with information assurance, for example, our rules and our procedures hadn’t changed and still haven’t changed and won’t change around security of evidence and exhibits and the data and GDPR. How we control data hasn’t changed.
So certainly we’ve seen, you know, it’s been a massive advancement for technology, the pandemic, because of course, all of sudden teams were switched on and, you know, all these enabling tools became available for our systems.
But of course, how we approach data and security hasn’t changed. So unfortunately we can’t take exhibits home, we can’t vet family members and friends coming in and out of an address, we can’t put staff at risk by, you know, potentially making their home a fortress or putting sensitive data at their home address.
So of course our teams had to stay in the lab areas. We’re still getting exhibits through the door and still sensitive data, it’s still distressing data still producing exhibits.
So we had a lot of furniture moving around, we had a lot of screens going up and of course, you know, for people like me, where I spent most of my time at home, I hated it. I hated not being in the team environment and around my colleagues and supporting them. And I wanted to get back in the office and back into the labs as soon as I could.
But then for our staff, you know, they didn’t want us there. You didn’t want somebody else coming into your bubble where you’re trying to stay safe. And of course they worked for outer putting, you know, not putting their own safety at risk because we had lots of safety controls in place and sanitizer and one way systems and we followed all the guidelines.
But of course it’s still a worrying time, isn’t it? You’re still getting an exhibit through the door that’s just been taken from a victim or a suspect, it needs examining immediately.
So we had to adopt our different processes where we would either treat that exhibit as almost like a contamination thing where, you know, you’re having to glove up and clean the exhibit, examine the exhibit, clean the equipment; or we’d leave the exhibit for 48 hours if we could because the study showed that the virus would die on a plastic surface within 48 hours and things like that.
So yeah, it was a difficult time. I certainly wouldn’t want to go back to it, as I don’t think anybody else would. And of course, I think we’re now suffering from the outcome of the pandemic. It’s trying to get back to normal and trying to reassure colleagues that we’ll still keep things safe, but we’re trying to move back into a normal way of life again.
Christa: So one thing I was kind of curious about with regards to the pandemic, cause I was re-reviewing R v Allen again before the podcast and, you know, it struck me that there were multiple failure points along that line.
And I, you know, I mean that was in 2017 before the pandemic and it made me wonder how that case might have been handled either during the pandemic, if there would be additional failure points introduced, or if the RASSO changes and other changes that we’ve been talking about that have been going on in the UK would help to mitigate even what you’re describing in terms of pandemic-related challenges.
Steve: Yeah, that’s an interesting one. Because certainly R v Allen, we’ve learned from that and I think officers from that where, you know, digital evidence is only part of the investigations we were talking about earlier.
And certainly, kiosk is only a part, I think R v Allen was all about the kiosk examination of the victim’s device, wasn’t it? So, you know, certainly from the cases we involved in, an officer is more focused on the holistic view of the case. So we will see the victim device as well as suspect devices coming through the door.
Christa: Well, I think we’re going to wrap it there, Steve, thank you again for joining us on the Forensic Focus Podcast today.
Steve: Thank you very much for having me.
Christa: Yeah. Thanks also to our listeners. You’ll be able to find this recording and transcript along with more articles, information and forums at www.forensicfocus.com. Stay safe and well.
