Content warning – this post discusses suicidal feelings.
Si: Welcome everybody to the Forensic Focus Podcast. Today we have back with us, much to our huge pleasure, Professor Sarah Morris from the University of Southampton. Forensics guru, communicator with washing machines, garage-door-opener extraordinaire. And today we’re going to have a conversation with you that she and I have had separately. Jamie, who honestly does exist as the head of Forensic Focus has had with Sarah, has had a conversation with her; Desi and I have talked about it before. And it’s a massively important thing within the world as a whole. I mean, mental health is something that is incredibly important, and we’re taking recognition of far more now with concepts of PTSD for various types of trauma and things like that.
But within digital forensics in particular, although I’m quite sure that there’s a fair few people in CrowdStrike who are suffering from PTSD at the moment as well. A friend of mine who I know listens occasionally did point out that he would rather have gone back and done a tour of Afghanistan again than dealt with the CrowdStrike day once more. So, you know, that puts it into perspective for you.
But we’re going to talk about mental health within digital forensics, where we perceive there to be issues and gaps, what the implications of it are and, you know, basically try and start to tackle a massive problem that’s causing people to leave the industry; far worse, causing people to take their lives. We, both Sarah and I know of people who have unfortunately taken the ultimate irreversible decision that they can’t deal with things anymore. And also, you know, how we deal with it ourselves, you know, how we approach these things.
So, I’ll sort of hand the floor over to Sarah, who’s had the conversation with Jamie a little more recently than I have, and probably has talked about this a little more recently than I have. But, where are we at? What’s the current state? Where are we currently sitting at in this big mess of mental things?
Sarah: That’s a very broad question for a Friday morning, Si.
Si: Don’t break the fourth wall, they don’t know this is a Friday morning.
Sarah: I guess it depends who you talk to. In my job I see a variety of different ranks, everyone from those on the ground all the way up, and everybody seems to have very different views on this problem. And I think that comes back to the central thing that most organisations have around communication and differing priorities at different levels.
But certainly when we look at those on the ground, there are a lot of people suffering and a lot of people afraid to say that they’re suffering until it reaches the point that it’s not hideable, by then it’s too late, and often they make decisions in that state that they may not have made had it been caught or dealt with earlier. And as you said, some of those lead to irreversible consequences.
Si: So, I mean, you and I both see this from a very different perspective from the actual police officers themselves. There’s an implication as far as I can tell that the police provide mental health services to officers. Well, I’m going to say, is that not true? I don’t want to pull you into a slanderous discussion that you may have to refute. Is it perhaps less than adequate or are we perhaps getting the wrong impression? From our side of the table, am I getting the wrong impression? .
Sarah: So there’s definitely support out there. There are some phenomenal organisations and some phenomenal in-service support, but it’s more generic as I understand it across policing. So there are things like Oscar Kilo which is a fantastic source of support. There is the COPS charity for families of people. Police where they have lost their life in the line of duty or through suicide. And then there are other various mental health initiatives and support. Some of those general employee assistance and some more police-specific. I think part of the problem is that there isn’t anything tailored for digital forensic analysts and a lot of the people that I know personally are afraid to reach out and use these resources or don’t know how to use these resources.
Si: I think it’s an interesting one because, I mean, I remember going through my security clearance the first time. Actually, Desi, you’ll have had the same with your security clearance, is that there’s a number of questions sort of relating to, you know, have you suffered from depression? Have you had mental problems? How’s your drinking level? All sorts of things like that. And therefore, there’s, I think, a general fear that if when we are in a position like having clearance, of which the police officers do hold to a certain degree, they’re turning up and going, you know what? I’m depressed, I’m drinking too much, I’m not sleeping, is not going to result in the level of care that they need, but actually is going to mean that they become unemployed. And that, of course, just adds to stress. Is that sort of the impression you get as well?
Sarah: Yep, very much so, both from those that I work with, and you only have to look at social media, like anonymous policing accounts on X, where they talk about the fact that it’s a culture of not reporting, and that’s certainly what I’m seeing on the ground, that they’re afraid to admit there’s a problem and they’re encouraged to hide the problem. Or certainly that’s how they perceive it to be.
Si: I can say certainly in this country we’re suffering from a deficit of police officers anyway. And there’s definitely an issue with that camaraderie whereby you know, you don’t want to leave your friends in the lurch. It’s the same in the military and, you know, it’s that same attitude.
Actually, funnily enough, it’s pretty much the same attitude anywhere where you have a team which works well together and you’re understaffed, whether that’s a university or a, you know, I mean, I, from my own experience, at the university I was at previously, there was a reasonably large exodus of staff, but I was the first one to go, and trust me, I don’t want to call it survivor guilt, but the concern that you’re the first one to go, and you’re leaving others, yes. I mean, I was the first lemming that jumped off the cliff.
But the fact is that there is, and you do feel that there’s this, you know, you’re here to do a job, you’re here to look after, especially in service industries where you’re here to deliver to the public, to students, to your country, that feeling to step away from. It comes with a lot of implications about your self worth, what your values are as well. And therefore the level of support needs to be there in a way that makes it non-judgmental but also that there’s some cap capacity for backfill. Because without backfilling roles, like you said, it just puts more pressure onto other people, so that’s a real issue.
Desi: I think to add into this conversation, coming from the military experience, so there was a royal commission in 2021, I think, into veteran suicide for the ADF, so the Australian Defence Force. And it’s a big problem; statistics are you are more likely to commit suicide within the Defence Force than you are from the general public; because of the kind of work that you do, you’re isolated from family and friends.
And it’s still an ongoing issue these days, and the whole thing of, there’s less and less people, and we’re trying to do more with less people, as well, so you don’t want to step away from work to recover, because you’re feeling that pressure of the camaraderie that you do have in the military.
But it’s kind of like these recommendations, so from the royal commission itself, like. All the higher ups were involved and had to answer to the commission and there are all these support programs in place, like Open Arms, so very similar to what it sounds like with the police force. But it’s a broader issue than just, oh, you need the support to kind of pick up on this or give support when people are upset. Some of the issues are, one, the workforce: you need more, more people to balance out the work, which is hard, but then, you know, I don’t know what the police are like, but are there social groups?
I know in the military, the messes on base used to be a vibrant hub of community for people on base to go and blow off steam after work and catch up with friends and talk about how shit their day is. Whereas now, people finish their job and they just go home because there’s no lifestyle on base. There are no social groups anymore because they cut all those away because the military had a drinking problem. Fair enough. Instead of solving the drinking problem and making it more social and less about alcohol, they just cut away the entire thing. But you’re cutting away your social connection with other people that are doing your job.
So, we already live in an isolated society with social media and how the world’s going. And then you’ve just compounded the issue by removing all your social aspects from work. And then you’re like, oh, I wonder why everyone’s so sad all the time. And you’ve got the telltale signs of the kind of suicide that you do when you do suicide prevention courses.
But a lot of the ones that I know I’ve lived through with people who have taken their own lives that there’s no signs, and everyone’s just like ‘how did this happen?’ Well, we know why it happened because life’s shit and they couldn’t tell us, couldn’t deal with it. And that’s so sad, but it’s not like these prevention courses aren’t going to help, you need prevention before they get to that stage.
Si: Yeah, so having suffered from depression myself, and having been through that previously, I found that, yeah, you cover and the idea that it’s detectable is, I mean, even to your nearest and dearest is somewhat laughable to be honest, especially when everybody’s done the same prevention course and everybody knows what the bloody symptoms are. Of course they’re going to cover them up. If they don’t want people to know what state they’re in, they’re going to be happy, outgoing, all of the things that, yeah.
Desi: I honestly think it’s like when someone goes through a fitness journey and you haven’t seen them in so long and you’re like, ‘Oh wow, you look amazing.’ It’s the same thing, I think, for depression. If you have a close friend, and then they see you three months later, and they’re like, ‘what is wrong?’ You’re a completely different person, because you’re covering like you are, you deteriorate. You would have felt this, Si, you deteriorate over time, but those that are close to you, because you’re covering all the time, they don’t notice those small changes.
But if you had someone that really knew you, and then saw you three months later, and they’re like, ‘What’s wrong?’ But that’s very hard. We don’t often get those opportunities in life because we kind of surround ourselves with the same people day to day.
Si: Yeah.
Desi: And that’s really hard. Yeah.
Si: Yeah, that’s an interesting point. Yeah, because definitely, there are people who, if I had the opportunity to spend sufficient time with, might have picked up on it. But it’s the fact that even if you do see a friend that you’ve not seen for, you know, six months or whatever three months is that you go out, you have an evening, you have a few drinks, you chat shit and then you go home. It’s not that you get to the point of actually necessarily getting through the whole thing.
But that removal of support service, sorry, I mean, the social thing. I mean, you’re right. We are hugely social animals. And actually that is one of the issues with digital forensics is that, first of all, generally speaking, we work alone on everyone.
Desi: We’re not very social people to start with.
Si: We’re not very social people to start with, yeah, there’s that as well. And because of the nature of what we do, we don’t talk about it. It’s, you know, you have a crappy day in the office because something goes wrong and your building falls down. I don’t know, picking up a profession, you’re busy putting up a house and a couple of bricks fall off the top. It’s a bit shit. You can come home and you can say to your other half, you go, ‘Oh, it was terrible. That bricklayer didn’t do a great job. You know, he’s put those things, it fell down and that cost me hours of time.’
To come back and go, ‘Well, you know, today I spent my day looking at child pornography and these things stuck in my head and I can’t get those images out’, you know, it’s not a conversation you bring home. And yeah, I mean, it’s really problematic in that way. And even with fellow examiners, you know, Sarah, I wasn’t actually watching the screen at that moment, but when I said that, I suspect that you kind of nodded. I might be wrong. I didn’t know, I wasn’t watching.
But, you know, there’s stuff there that even we don’t say to each other. I mean, this conversation is more open I think probably than most conversations I’ve had with other examiners. We’ll talk technical stuff left, right and centre quite happily, and we’ll talk generic sort of cases like, oh, you know, I found the evidence for this in this place and it was great.
And yeah, I put this guy away for five years and we had a nice solid case there. And yeah, you’ll say it was murder. Fine, but you won’t talk about the fact that as part of the analysis that you went through, that you went through the entire bundle of evidence and there were pictures of somebody stabbed to death on a bed and, you know, that kind of haunts your dreams and, you know, this sort of thing is not a discussion that we have and, I mean, whilst I’m sure it would be beneficial in some ways, I’m not actually sure how without proper discussion, sort of psychological care applied to it, whether it would necessarily be a good thing or not.
I mean, I’ve never had counselling for work. I had it for, I was working in security at the time and funnily enough for the MOD, but it was a conversation about me and it was a conversation about plenty of other things, but it was never about work. So how one actually goes about addressing this, have you had any actual work-based counselling for stuff?
Sarah: Me? Yeah. So, I’m very lucky at Southampton, so I have a monthly session with a counsellor to talk about casework and all the joys of my world. And that was an agreement to protect my mental health. I guess, partly because it was something that I said would be helpful, but equally it’s new to Southampton. They’re very protective of their staff, they want to make sure that I’m looked after, and we looked at the best of what was happening in industry. And in some corporate environments, they’re very stringent on counselling, and we went for that. It’s helpful, but it is weird talking to someone about the cases, particularly when they’re asking you to describe things and how you feel. It doesn’t feel natural, and I personally feel a lot of guilt for the person I’m then offloading on. And I know they have a counsellor, but like, where does that chain end?
Si: Who guards the guards? Yeah, yeah. I can’t remember the Latin. It says Quis custodiet…anyway. But yeah. no, I mean, ultimately, somebody is at the end of that chain; we have to either have that infinite snake eating its own tail and it goes back round again, or there is somebody at the top. Yeah, I mean that’s really good. Out of curiosity, I mean, are they a specialist therapist in any way for this kind of thing, or are they just a sort of generic trauma counsellor? What is their background that makes them the person that Southampton chose versus, you know, a quick Google?
Sarah: So, they let me choose, and we did some research and we were trying to balance two things because I was moving to a very different environment, so we wanted someone who would be comfortable. So, we were trying to find this nugget of gold of a person who had some forensic experience or some legal practice experience, you know, and could help with that side, but also neurodiverse and we found a counsellor who works with police, military, other people in these fields, but is also a specialist in neurodiversity. And they are wonderful. I don’t imagine they’re cheap, which I think is a big problem, particularly for SMEs and defence people.
Si: Well, yes, I mean, this is sort of the other side of it, which is, you know, police have a budget. Southampton as a university has a budget. Anything I do comes out of, you know, what I loosely like to term ‘profit’, but it isn’t really. Well, my bottom line anyway. So, I assume that they are charging similar rates to other sort of psychological professionals and therefore are considerably more hourly than legal aid pays.
So yes, it is a thing. And to be honest, from a defence perspective, it’s not something that’s even advertised, discussed, certainly, other than the obvious like Samaritans and the helplines that exist for the general public, there’s nothing specific, that I’ve found yet, if anybody knows any different listening to the podcast, please do send us an email as soon as you hear this and we will publicise you till you’re sick of us publicising you because, you know, the more people are able to get help and assistance at the time they need it is hugely important.
But yeah, it’s a real problem. And I think that sort of lack of equity is not beneficial. I mean, I can say the lack of equity and again, we’ve talked about this offline many times, but the lack of equity between prosecution and defence in the British legal system is huge. I’ve recently had to argue several times to be given evidence because there’s a right for the prosecution to decide what’s relevant and what’s not.
And quite often it’s the lawyer making that decision, not an expert, which first of all is the wrong thing, and second of all, you know, and this is not a complaint, we talk about inherent and subconscious bias, you know, if you don’t think that something is relevant because you haven’t used it to build your case, that doesn’t mean that it’s irrelevant for refuting your case. It just means that you haven’t used it and therefore it’s less valuable.
And so the disparity between prosecution and defence is a constant issue. And you see it as well because, you know, legal aid will pay £x per hour and the police will pay a private independent analyst a significant multiple of £x per hour to do a case. I mean, I know this because I’ve done it. I’ve done both sides of that and it certainly pays better to be on the prosecution side. And this, you know, this fundamentally undermines the legal system and we’re diverting massively from mental health.
Although, to be honest, it’s stress, it’s unnecessary pressure and difficulty in order to get a job done. You know, the amount of defence experts is small anyway. We are effectively short-staffed in the same way as the police are, So we’re under a lot of pressure to turn cases around quickly.
Sarah: And you need to find your next case to have more money coming in. It’s not like you have a salary.
Si: Yeah, yeah. And then the timescales are set. So the police will have as long as they want to look at the evidence and then they’ll launch the prosecution and do the charging. And then the court date is set and we have to work to that court date. Now, that could be, you know, three weeks in the future. Well, actually let’s be realistic in this country, it’s about three years in the future.
But, you know, that’s then a finite amount of time. They could have had this evidence for the last four or five years. And then all of a sudden it’s coming to trial in a couple of weeks. As a new solicitor gets instructed, he decides that he wants to get some work done. New barrister decides that there’s an opportunity here to look at something and it comes over the fence and they’re like, ‘yeah, we’re in court in three weeks, could you do these five weeks of work in three weeks, please?’
So, the lack of equity in the system does add to stress and of course stress is part of a mental health conversation, definitely. And, again, you come to the rate. We had the conversation about paying for it, but forensic software is monumentally expensive. To pay for the software that I want, well, I don’t use a lot because I have some good tools and I use a lot of open source tools because I understand how they work. I have decades of experience in Unix and Linux and doing things and developing our own is very much part of the way that I do my job.
But still, in order to maintain a tool set, that’s losing so much of the money that you’re bringing in every year to do that. You know, you phone up a company and they’re like, ‘yeah, we’ll give a law enforcement discount.’ Okay, so the guys who have the massive budget, you’ll give a huge discount to, but the guys who are spending 30% of their annual income through their company to buy your software, you’re going to give no discount to this. This is a bit rich. Can we reconsider that one, please?
So yeah, it’s a real thing. So, how do we tackle this? I mean, where can we take it? What makes it better? I mean, obviously awareness simply on its own is great, but it doesn’t actually do anything. Is there a solution out there? Is there a way we can move things forward?
Desi: I was kind of wondering, similar to when I did engineering, I kind of had a problem with this from my degree is that I don’t think they taught ethics very well. I think it was in one of my mechanical subjects, I did two lessons on ethics. Now, if you do a medical degree, you cover ethics all the time, you essentially do a full subject on ethics, you’ve got the Hippocratic Oath of not causing undue harm to patients kind of thing. Now, you’re a medical professional; if you make a mistake, you kill one person. If you’re an engineer building a bridge, you make a mistake, you kill hundreds.
Now, I would have thought in a degree where you’ve got that potential, that you would do a course on ethics that covers all of that, and that really, really hammers home the impact that you can have on society when you’re building things.
So, I wonder, similar to that vein, and I fully think that it should be in, but taking from the point of the medical degrees, do we need to start educating to kind of create this community and even the open communication between forensic analysts or people who are just in careers that are probably going to be more isolated?
So this is any kind of computer-based degree, and start opening that conversation and be like, you’re all probably going to be depressed at some point in your career and you’re all going to have friends who are going to go through this, and this is the reality. There might not be signs, but try and almost force the communication between people and make people have hard conversations in a safer place, being an educational institution.
Instead of it’s, we have that one day a year, I don’t know whether the UK does it, do you guys do that? R U OK Day? Where it’s like, one day a year you make. So, in Australia, we have R U OK Day, which is essentially one day a year where we make copyrights and we talk about mental health. Which is great and all, like, a really good idea behind it, but it’s almost a joke, in the sense of, we only talk about mental health one day a year, and the rest of it’s like, 364 days a year, don’t worry about it.
And so, yeah, it’s kind of like forcing those, but even then it’s just an, are you okay? It’s not like they try and force other conversations, but it feels really superficial, but it’s superficial because we don’t do it day to day. And in Australia, we have a thing of, when we greet people, we say, ‘how are you?’ And the response is ‘good’, and that’s how we say hello. Which kind of puts Americans off when we talk to Americans, because they’re like, ‘why are you asking me how I am? Just say hello.’ And I don’t know whether that’s the same in British culture.
Si: Yeah, it is to a certain extent. Along with talking about the weather, it’s definitely one of the conversation set pieces of, how are you? I was actually reading a joke about it the other day, and somebody was like, if somebody says they’re fine, basically, the house is burned down but, you know, they’re still alive and the sort of the gradiated scale of, if somebody actually says they’re great, then they’re probably not too bad. And I’m okay and fine doing well, you know, all of these sort of, almost euphemisms that we have for actual, you know, I’m on the verge of throwing myself off a cliff. It’s going no worse than usual.
Desi: So yeah. It’s fine at the moment until gravity impacts me into something.
Si: Yeah. Yeah.
Desi: Yeah.
Si: But I think, you know, it is an interesting one because actually it’s really hard to do. You know, you sit down with someone and you go, ‘How are you doing?’ And they go, ‘I’m fine’. And you go, ‘Cool’. You rarely follow up with ‘No, how are you actually doing? How are things? How is work? How is your home life? How are the kids? How’s your cat?’
Desi: I guess that’s why it’s called a difficult conversation, though. It’s not only difficult for the person, it’s difficult for you. Yes, it’s an uncomfortable thing to have, but the more you do it, the more comfortable you are doing it.
And I think starting in a safe space like an educational institution, particularly a tertiary one, right? Where you’re moulding, you’re kind of in that last phase of personal growth, a big opportunity for personal growth in your life is university. Because once you leave there, you become more static, it becomes more difficult to change as a person. It’s definitely possible, but uni’s kind of like that last bastion of safety and growth, kind of thing. Like, finding your feet. It would take someone to design the course and make sure that you’ve trained instructors and lecturers correctly on how to deliver that type of content. Whether that’s going to be invested in is another thing.
Si: Well, it’s an interesting one, though, because fundamentally it could be a university-wide course. It need not necessarily just apply to…
Desi: Oh yeah, no, I agree.
Si: I mean, whilst we talk about it being particularly important to us because of the material that we deal with, and we certainly do cover ethics, I mean, ethics is a very important aspect of it. And I at least once in any given set of lectures for a class will talk to them about the reality of things very honestly. And I’m going to say, you wouldn’t have seen this the other day, but we were at the Forensic Expo in London.
So Forensic Focus was there, we did a stand, and people came over and asked about, you know, getting into digital forensics. And I said, you know, and I’ve always said, look, you’ve really got to be sure that this is something that you want to do. If you want to play with technology, Sorry, I don’t mean this badly, Desi, I really apologise in advance. If technology is what you’re interested in and you want to do that sort of problem solving thing, incident response is great.
You know, it’s a fascinating area, it’s fast-paced, the stress is there, there’s a whole raft of different mental problems as we’re aware, because you’re under high pressure, you’ve got 24×7 on call, you’ve got very demanding customers, you may well, depending upon where you’re working, have quite high-profile data sets that you’re looking after, whether that’s you know, patient data or banking data or potentially in military data, that kind of stuff. So, you know, it’s not without its problems, but fundamentally, you’re not exposing yourself to traumatic material on a day-to-day basis.
And therefore, you know, if you want to consider this as a career option, you need to realistically know that you are going to come into this and see some things that will pop up in your mind unbidden at a later date when you’re thinking about something entirely different and may well haunt you for a couple of weeks after a case, and you will dream about it.
So, you know, I certainly have a very serious conversation with anybody who comes to me and, you know, I was fortunate when I started this, somebody sat me down and said this to me, and the trouble is that, first of all, I was young and stupid, but it’s very hard to explain to someone what it is without showing it to them. And then it’s too late.
Funnily enough, I had a conversation with a police officer about this and they restructured their training because what they were doing was they were doing all of the digital forensics, technical stuff up front, and then they did categorization of images for IIOC, and what they did was they found that they got to the second lecture in IIOC and 50% of the class had quit and then they’d wasted huge amounts of money and time on training staff up to a certain standard before doing this lecture, so they now do the IIOC categorization lecture at first because, and I don’t mean it badly, but they weed out 50% of the class, the candidates and don’t waste time on them or money on them going forward.
But the thing is that, you know, even if you wanted to go and do corporate forensics or something, it still comes up. It’s not avoidable.
Desi: It still comes up in incident response as well. I’ve been in cases before where you come across child exploitation material. And it’s one of those things that there needs to be more training and protection around it. Because it’s always something that we’ve talked about but never actually acted on in any company that I’ve worked for. And even now, I work in an insider threat company, so the data is closer to people, we do find a lot of stuff, but, and we’re fortunate that our platform, we don’t do inspection, so it’s only metadata. And so if we find something, we pass it off.
So we never actually see the content, which is good, that’s always passed off to policing. But in incident response, you have direct access to endpoints. And if you’re tracking, maybe you’re doing something like corporate fraud or something, and the person that you happen to be investigating, they’re also into child exploitation material. So you’re searching through all their stuff and you just come across it. And it still comes up in instant response. But, to your point, usually when I recommend to people, I always say, you have to be prepared. People use their computers as their deepest inner mind storage, essentially, so you have a potential to come across it.
But when people are like, ‘Oh, I’m so interested in digital forensics’, and they’re thinking about moving into policing, I’m always like, ‘Are you going to be okay viewing material of children, people, animals being abused? Because you’re most likely going to come across it.’ And then they sit on it and they think about it for a while, they’re like, ‘Oh, not really.’ And then I’m like, ‘Well, consider doing instant response because you’ll do some digital forensics, but you’re less likely to get exposed to this stuff.’ But it is still a possibility because I’ve seen it. I’ve been fortunate enough, I haven’t seen the material, but I’ve seen cases where other analysts have come across it.
Si: I mean, before I started out doing forensics myself. because I was doing security work, one of my customers was Revenue & Customs, so, tax people in the UK. And I had a long conversation with the forensics guys there and actually they deal with a huge amount of child exploitation material because it’s profitable to a certain extent and criminals are profiting from it and therefore, you know, people who don’t pay their taxes are often profiting from things that aren’t legal and therefore, you start to get those investigations that are filling it round.
And again, you know, people who are involved in the trafficking of drugs are often involved in the trafficking of people or the exploitation of people. Certainly in the UK there have been a lot of issues with what we call ‘county lines’, which is the exploitation of young people to be drug couriers, sellers, mules to avoid the senior levels of the organisation being picked up by the police so that they’re sort of distancing themselves. And yeah, there’s lots of abuse at various levels. So yeah, even if you think you’ve been assigned to a counter fraud squad as a forensic accountant, there’s a high risk that you will come across it in some way, shape or form.
Sarah: Even when you’re not coming across the illegal material very often, the constant viewing of legal pornography is distorting and has a mental impact. Some of the texts we read, I mean, like Desi said, you’re seeing very intimately into their minds. Some of that can be quite terrifying and build up pictures, you know, just reading text messages and things. And I think all of it adds to it, but this over reliance that now we’ve started using AI to categorise some of the indecent image content that we’re making it better, but it doesn’t remove all the pressure points of some of the other things we’re seeing.
Si: Well, I’m going to say that this is an interesting point, actually. And I’m pretty sure I’ve said this to you, but I’ll say it again, is that actually AI has made the defence work worse, because automatic categorisation is about as accurate as anything else in AI at the moment, which is a 50% hit rate.
The obligation of the defence is to check to make sure that the prosecution has got it right. And that means that we are examining in detail everything that is flagged. Now, I have done this in a case and I have found, well, first of all, in the UK, there is no standard for categorization. It is a subjective process by the person who is doing it, not an objective process for any information that is contained within it. Some of it is immediately obvious, you know, there’s no two ways about it. Where you are looking at the real issues is at the top end of the age range where you’re questioning them all.
And I have quoted this case before, but essentially I ended up doing an indecent images of children case. And I looked at a lot of things but all of them were dubiously young-looking over-18 people and some of the giveaways in it were things like tattoos, wedding rings and all sorts of stuff like this. But because the AI had categorised these things, it meant that I had to then go and analyse it.
Nobody else looked at it, they’d just gone, ‘Oh, here’s the output of the tool, we’re putting this into court, dispute it or refute it’. And of course, you know, somebody who’s like, ‘Well, I’ve only been to legitimate sites, I’ve downloaded things that I thought were people over the age of 18’, blah, blah, blah, you know, has a legitimate defence. If that’s what they honestly believed, fine, you know, questionable taste, but that’s within the realms of the law.
And then, you know, it’s up to the defence to prove that. So we’re picking up the pain point of that process to make that happen. And that’s where I have a huge problem with AI because, first of all, you’re talking about the subjective process of something that has no subjective opinion, and you’re then talking about something that, you know, human beings get wrong frequently enough, you know.
Desi: I’d also throw in here, even if it does get more accurate, right, and it’s sifting through the data, because we’ve had conversations with vendors on this podcast before that have software that go through and categorise this type of data. And I remember them talking about, if it exists in the data set, and if it’s a picture match, or it’s close enough, or whatever, that gives you a fairly high confidence that if it is CSAM, that’s what it hits on. But it doesn’t remove the fact that you’re still generating new content still coming out, because people are still doing this. We haven’t caught all the people making this.
And so, that still needs validation. So while it may alleviate some of the initial groundwork in figuring out what may be CSAM and what’s not, since there’s always going to be new content, it just means analysts are going to be moving through more cases faster. So it’s actually not alleviating how much a particular analyst is seeing, it’s just helping them go through content faster for their cases.
So the analysts themselves still have that same problem of they’re still seeing the same amount of data. It’s just the backlog of cases might be slowly getting shorter and then more and more cases get in the back end. So, yeah, AI is helping in a way, but not in the way I think that we would hope that it’s moving the problem away from someone who may be affected by this.
Si: I think the other issue with the AI categorization is, as you pointed out, a lot of these tools come with a degree of confidence in their answer. I was on an Oxygen training course, which I’ve written up and will appear on the Forensic Focus website shortly as a review of the training course, but one of the things that they had is when you’re doing the picture matching, you set the percentage confidence match that you’re looking for. That’s really important because 100% confidence, yeah, great, you’ve got the same picture twice, you might as well have just checked the hashes. At 10% confidence, you know, you could have a picture of a black and white cat and a picture of a panda and it would still tell you that it’s a panda.
So, you know, this requires quite a deep understanding of the way that AI works and certainly statistical confidence as a general principle. And I’m not entirely sure that that’s being addressed yet. Well, I’m not even sure where you would address it. I mean, in the Oxygen course, it was brought up as part of the training, so that was great. So, you know, it was a specific tool training.
So we had specific training on that aspect. But it’s not going to be part of a digital forensics course because we currently don’t talk about AI because we have no confidence in it, and therefore we don’t really want to encourage its use. It’s a mathematical statistics course, but, you know, that’s not necessarily part of a forensics course. I can’t imagine it’s part of any training that the police would give as part of a forensic analyst’s thing. I may be wrong. So we’re talking about bringing an interesting scientific methodology into court that is not properly understood by the people who are bringing it into court.
And there will be challenges against that in and of its own right in the same way as actually, you know, things like fingerprints and DNA are statistical proper probabilities, not certainties. And the trouble is that digital evidence is often presented as a certainty which, given that I can’t make a computer do the same thing twice in a row, is highly amusing to me.
But this is a misconception is that something there is an absolute certainty and therefore that’s therefore the fait accompli, it’s all done and dusted. And that lack of understanding around the use of AI is to me a bit of a red flag.
Because, I mean, I’ve been anti-push button forensics for a long time. Well, since I started, I’ve been anti-push button forensics. Much as I’m anti-push button security as well. Because, you know, if you don’t understand what a firewall is doing, you really shouldn’t be configuring one. So, there is that. So, yeah, AI, I think, to go back to the topic we’re actually talking about, AI has potential to have a part to play, but it is not a solution in and of itself, I think is where we’re at. Certainly at the levels of AI we’re talking about and the stage we’re at in, in the world today.
Sarah: But doesn’t the fact that there’s this perception that it will solve the issue, like, it will solve all the world’s issues, you know, AI, but it’s that communication that people who aren’t on the ground doing digital forensics, we don’t have that experience are trying to help us and trying to come up with solutions that don’t actually fit the needs of those on the ground and aren’t helping in the way that they need.
Si: I worked for an organisation once and I won’t name it because it would be very embarrassing to them. But they were looking for a particular software security solution at the time. And it turns out that the managing director of one company knew the managing director of another company. And therefore the security solution magically got approved and was installed, or we were told it was going to be installed. We reviewed it as a security team and we went, ‘Yeah, you don’t want to do that. This is shocking. This is absolutely bloody terrible I really, really wouldn’t do that if I were you.’ And they were like, ‘No, the decision’s already been made, we’ve already signed a multi-million pound contract, it’s already going. Just implement it.’
And you’re like, ‘Well, you know what? I’d like to be paid this month, I’ll do that, that’s fine. I told you so, I’ve got it in writing, it’s up to you.’ Several months after I left, it turns out that this security product really wasn’t very good. And there was a global breach of that security product. And yeah, it hit the press left, right, and centre, and they spent millions of pounds cleaning it up. Probably more millions of pounds than they spent on the contracts in the first place.
So, the issue is that the people at the top end are not listening to the people at the bottom end. The people who are making the decisions are not the same people who are actually experienced in what it is that we’re talking about. Whether that’s for AI, or for mental health services, or in fact, even the impacts of mental health. You know, you go to a senior person in an organisation and you say, you know, ‘How’s your mental health in the organisation?’ they go, ‘Well, I’m fine. My yacht is really helping me calm down at weekends and the chauffeur-driven limousine in and out of the office so that I don’t have to deal with the traffic is fine’.
Desi: A yacht would stress me out. There’s so much maintenance. How is any senior exec not stressed? Those things get barnacles all the time. Nightmare
Si: So yeah. But their perception of reality is very different to the person at the bottom. But the person who has to sign the check for what is effectively a non-profit line, to be fair it’s the same for security. I mean, we always came up against this problem when I was still working in security work, is that you go along and you go, right, we need to spend £50,000 to buy a new firewall because this one is old, decrepit, it’s no longer being patched. And, you know, we’re going to be in serious trouble soon. They’re like, ‘What profit? How much are we going to make profit off this? Well, we’re not. We’re just not going to lose. When was the last time we had a compromise? Well, we haven’t had a compromise, but we’re going to have one really soon if you don’t do something about this.’ And it’s like, we’ll worry about that next financial year.
Desi: This actually prompted me just thinking about taking care of our people and stuff, but in either of your roles when you’ve worked for companies, probably not you Si, because you work for yourself, but have you ever come across organisations that, instead of a sick day, you can take a mental health day, and it’s covered as part of your sick leave essentially. You don’t need a doctor’s certificate or anything, you just call in like, ‘Hey, I’m taking a mental health day’ I think that got introduced in Australia, I think it was before COVID,
so it would have been like maybe six, seven years ago and you can just use your sick leave for that which I thought was really good.
Si: I’m going to say I have never seen it personally. I know my daughter, her organisation permits that. And I’ve seen, no actually I take it back, I have sort of seen it. Under certain circumstances some organisations allow what’s called compassionate leave. It’s a fringe example, but if there’s a loss in the family, then they’ll permit that kind of thing.
Desi: So we used to have that in the military, and that was for if your spouse or children was sick, or if you had a death in the family, it was compassionate leave. But then they introduced this new type of leave in Australia. What about yourself, Sarah? Have you come across that at all? Or have you come across other mechanisms that you think work that are in place in organisations?
Sarah: Where I work, they’re incredibly flexible when you’re not teaching, and if you say, I just can’t stay, they have, I guess, respect and trust that you will manage your workload and tell them if there are things you can’t handle, and you will go away and take the time you need to look after you.
I think the School of Electronics & Computer Science is as worried about us as individuals as anyone else. And I certainly see mental health days in some of the newer startup organisations when they get established enough that they’ve got the money coming in. Haven’t seen it in digital forensics, but then everybody’s so worried about backlogs and everything else that there would be a significant amount of pressure if people tried to take leave. Most struggle to take their holiday allowance as it is.
Desi: Yeah, and I guess that’s another thing on mental health. I don’t know whether we’ve done a catch up episode yet. I’ve talked about this, but coming to this new job, I negotiated taking four weeks leave for a holiday that I had planned. But it was actually the first holiday that I’ve taken since getting into cyber security, essentially.
I left the military in September 2020, so, yeah, about four years until I had a holiday. And while I was away, I didn’t realise how much I needed time away from work. Because I’d taken work trips before, but I’d always worked while I was travelling. And I was like, oh, this is great, like I get to travel, but I’m still working, but actually taking time where you’re not talking to anyone at work, you’re not discussing work, you’re actually relaxing and doing something else, was just amazing. And so that’s compounded the issue of you can’t take a mental health day and you can’t even take your actual leave that’s owed to you, how bad is that? You’re never mentally recovering at all.
Si: I’m gonna say, that’s ironically one of the best and one of the worst aspects of being self employed, is that I don’t actually have to go and ask anyone to take leave, but I actually can’t afford to take leave, so it doesn’t really matter.
But, yeah, there have been significant numbers of years where I have not taken holiday and have just worked contract-to-contract or case-to-case to keep stuff going. I’m much better now than I used to be about doing the, I’ll sort it out, I’m going to go and do something else today, than I used to be. So, you know, I will take an afternoon and go somewhere, go and look around the bookshop in Oxford or go out for a walk or whatever just to not go around the bend. But an actual time away holiday is, you know, ironically I’m going away next week, but I feel that it’s probably going to be very little rest for various assorted reasons.
Sarah: So, isn’t your approach of taking an afternoon off, which I’m very glad that you are doing that now, and it’s good to see, but isn’t that the equivalent of mental health firefighting, that you’re dealing with little bits, but you’re not giving yourself sufficient time to rethink that?
Si: Do you know, you are almost certainly right. I mean, yes, I think an honest honest answer to that is, yes, it’s a pressure cooker steam release valve, isn’t it? We’re not quite at the bomb exploding stage, but, you know, it doesn’t actually cool down the rest of the vessel in terms of bringing it back to room temperature. So, in a lot of ways, no, it is a coping mechanism rather than a solution in that regard. But you know, there are plans and there are always plans. There are plans for a proper break sometime later this year, if all things go the way they should. So yeah, we’ll work up to it.
But, you know, going back to the point is that, you know, if the people who are in full-time employment can’t take a break because they’re understaffed and they just can’t get a leave, if people who are self-employed can’t do it because the workload is to a certain amount and also because the rates are not high enough that we actually have to keep working in order to keep the paying the bills, we’re in a scenario whereby nobody’s getting a break and the ultimate problem will be the entire industry folds because if enough people go, you know what, I could be doing something else like being a tree surgeon, you know, could be doing something else that is less stressful and as profitable and gives them the opportunity to go and take time off, then perhaps we’re going to see a mass exodus.
We talked about this back with Christine a couple of years ago now, but it was actually post-COVID. We saw quite a large number of people go, actually, you know what? I don’t really like doing what it was that I was doing. And I think this is a time for me to reassess my life and therefore I’m going to do something else. And we saw the IT industry lose a lot of talented people or at least switch jobs. There was quite an interesting rearrangement of staffing where people were looking for that better work/life balance that they had discovered could exist and can be done remotely and all sorts of things. One of the positive outcomes of COVID is that we discovered that actually, finally, we do have technology that enables us to talk to people in different countries at different times of day, and it doesn’t have to be that we’re all dragging ourselves into an office and sitting behind a desk for nine hours a day.
So yeah, I think we need to be careful to not not push ourselves as an industry beyond the point of no return. Because the trouble is that, as we’ve sort of said, you know, the more people leave, the higher the workload will get, the less people want to join it because it’s not going to be a thing. And, you know, I was talking to someone else about a different industry, but we talk about probation periods when people join an organisation, but what we actually all forget is that a probation period works both ways. You know, the amount of notice you have to give to leave is very small and the amount of notice they have to give you to leave is very small. But people in this particular industry were walking in, looking around at this company and going, ‘Actually, you know what? I don’t like the way this is run. I don’t believe this is being run. Well, thank you very much. Here’s my notice’, and walks out two weeks later.
Desi: I’ve seen that a lot in the digital forensics teams for big consultancy companies. I see that quite a lot with friends who have a lot of experience in DF, and they go to a consulting company and they walk in, they’re like, ‘This is not what I want’, and they leave within a week. So, yeah, it happens all the time.
Si: So I think that’s going to be something if we are really not treading carefully that we run the risk of hitting. And again, you know, within this country, there’s, there’s been the implementation of the ISO, we’ve talked about this again, but the ISO 17025 standards, which are putting a lot of pressure on both commercial labs and independents, for a degree of compliance and stuff, which A: you’re talking about another £6,000-hit to your profit margins, such as they are and; and B: you know, a huge amount of additional paperwork, which you’re not earning money for as well.
But at the end of the day, there will be a point whereby you’re going to end up with three labs that have accreditation. None of the other ones will, all of the work will go to them. They’ll do a shoddy job on it because they don’t have enough staff and the whole system will collapse.
Desi: That’s all right, they’ve got AI.
Si: Yeah, it’s all right, we’ve got AI. And again, but we’re talking about this and we’ve sort of perhaps mooted that this is an issue that is not recognized by the people at the top who think that their, fantastic solutions are all doing amazing things and making the world a much better place because look, you know, this, these people have got their accreditation now. And I had a conversation with those people about their accreditation, and it’s like, yeah, it’s for about one thing that we do and the rest of it’s still unaccredited, so it’s not quite the shiny gold panacea that’s being talked about, but.
Desi: I think it goes back to having those difficult conversations amongst our peers and making sure people are okay, because on the point about the exodus of people moving away from certain jobs because they realise there’s a better work balance elsewhere, that may not happen in today’s current climate. And to your point about paying more for accreditation stuff, cost of living is woeful for everyone across the world at the moment and the option and I guess risk of moving jobs is outweighing potentially the mental health deficit that people are getting in their current job, and so they may decide, because they can’t take that risk, to stay in a role that is potentially not great for their mental health, and we may see a rise of suicides or maybe like an impact of that, because people are stretching themselves too much in one role before actually making that decision to move.
And again, to the people that are making these policies, I don’t know whether the police in, in the UK have done something like this, but the royal commission into looking at veteran suicide over here, the people that are looking at implementing these changes, and they’re making the decisions, they’re affected by their own biases, and even though the evidence is in front of them, they came from where these people are now, the lower ranks, and they’re now in this position, they’re like, ‘Oh when I was a lower rank it this wasn’t an issue.’ But when they went through it, it was a completely different time. They’re not in that position anymore, they’re not earning that small amount of money. They’re social clubs that aren’t non-existent anymore and no longer there. But they had them when they were there and they might have their social clubs now because they have all their friends. They’ve got a different lifestyle than they did then.
And I think for companies, we like to separate definitely corporate world, we like to separate the, ‘this is work and this is personal.’ And it’s almost not that, we work so much overtime these days. I don’t know what their hours are in the UK, but no one works a 38-hour week, 40-hour week anymore. Like, rarely do I work. Just a standard 40-hour week. Not because I have to, I love my job and I do that and that’s fine and even people who are struggling, because we don’t have enough people, we work so much and it bleeds into our personal life.
And so these policies kind of need to reflect your employees and everything that affects them. You can’t just go, ‘Oh it’s just our business.’ It’s everything else encompassed.
Si: And it’s an interesting thing that you said there,actually that we haven’t talked about yet, is the bleeding into your personal life. I mean, obviously, time is a huge thing, whatever role or whatever position you’re in. But actually, it’s an interesting one that I don’t have a distinct and separate lab. Actually, I’m going to say, you work from home as well sometimes. Well, on cases, Sarah, as well, don’t you?
So you know, we occasionally have that material inside our own homes in ways. And it’s setting that distinction between work and life is a very, very important thing. That I am very good at. There’s a distinct and separate room for anything that’s superficially unpleasant versus the usual rafts of paperwork that we have to go through, which I could do on my laptop, sitting in the garden, when it’s not raining.
But, for anything unpleasant, there is a room that has a door that can be shut. At the end of the day, I can walk out, I can turn the lights off, I can shut the door, and it stays in there. And that distinction is a very important one to make. That’s critical. So yeah, just a sort of a sideline on that point is that that’s something that again is an important thing that we need to be able to separate our lives from our work. It’s a very important distinction that has to be made.
Sarah: It is challenging, though. I mean, having moved from a university where, you know, a lot of the material was closed to a more traditional, wonderful university, there are times when we go to social events where I talk with my new friends, my new colleagues, and they find it really difficult to engage at points because I can’t talk about what I’m doing because there are so many aspects to my life that are closed off. And it does make it difficult to build those bridges and to build those, I guess, stronger relationships.
And it did noticeably take time with some people who just weren’t used to having people who couldn’t share every aspect of who they are, what they do. and that makes it hard to get that work life balance and relax.
Desi: Yeah, that’s very true when you have sensitive material or you have a clearance and you don’t relax your mind, because you are conscious of, I know what I can’t say, and you do start to tell stories sometimes, and then you’re like, oh wait, hang on, I actually can’t talk any further, because that’ll bleed into confidentiality or state secrets or that kind of thing. I even found it amongst people, from my experience, when I worked with them, because you weren’t in a secure zone, So, while you could talk about it with some of your work colleagues, you might be at a cafe and then you’re like, ‘Oh, actually I need to go to like a zone three, zone four to even have this conversation’, which is fine in itself, but then it’s mentally taxing because you’re constantly being like, ‘Okay, I need to think about this.’
Si: I found that to be an interesting transition for me because I went from that sort of security protectively marked material environment into forensics. So a lot of the sort of not talking about things kind of transferred over in a way. So I’ve kind of been, I don’t want to say indoctrinated into it because that sounds way worse than I mean, but I’ve had experience of it before it became a problem with the more broader sense of stuff, which actually I think is probably one of the saving graces for me, actually, is that I was already kind of used to that before hitting the point where I couldn’t talk about things that were more difficult to not talk about.
So yes, I think that’s one of the reasons that I’m less insane than I would be otherwise, actually, funnily. But yeah, you’re absolutely right, and yeah, that hilarious thing where you realise that the two of you are now meeting in a pub, and that you were talking about this five minutes ago in the office, and now the conversation has to stop.
Desi: Yeah. Thanks so much for joining us again, Sarah. It’s always a pleasure having you on, and this was, I know, a very interesting topic. Personally, I feel emotionally exhausted from talking about this stuff. So you guys take care today, definitely. And to our listeners as well, for anyone that has been triggered by listening to some of this or has something come up, make sure you reach out to any of your local support lines.
And thanks everyone for coming on and listening to us and talking about this. As you can probably tell, all of us are very passionate about this topic. All of us care about everyone that’s in the industry, and if you are feeling anything, reach out to support lines, reach out to your peers, because everyone feels the same, and everyone wants to help and support everyone.
When we have a loss in the industry, it’s huge. It impacts a broad range of people, and everyone matters in this industry, so definitely reach out if you’re feeling something. But that’s it for this week. We’ll catch you all on our next episode and we really appreciate you joining us. But thanks, everyone.
Si: Thank you, everyone.
If you have been affected by any of the issues raised in this episode, these organisations may be of help:
- Samaritans – https://www.samaritans.org
- Mind – https://www.mind.org.uk
- Oscar Kilo – https://www.oscarkilo.org.uk/
- Occupational health unit (OHU) – all police forces have access to an OHU providing a range of support services
- Employee Assistance Scheme (EAS) – check with your employer to see what specific resources are available to you
- GP – your GP can provide access to various local resources and make referrals to psychological support services
