Non-technical Sources of Errors When Handling Digital Evidence within a Criminal Investigation

Digital evidence is relevant to almost every criminal case. Like other lines of evidence, they serve the purpose of establishing the indisputable facts, and they also shed light on the suspects motivation and purpose of committing the crime under investigation. The spectrum of technical errors and uncertainties with digital evidence is thoroughly covered in literature. This study aims at the non-technical sources of errors that might impact the potential digital evidence in the investigation of a criminal case. In the thesis the research problem addressed is: When handling digital evidence in a criminal investigation, do the non-technical sources of errors pose a threat towards the required quality, and eventually the rule of law? The Digital Forensics Process and The Investigative Cycle is the fundament for the analysis in this study, and is discussed in relation to relevant theory and methodologies from a criminal investigation point of view. Theory from law, criminal investigative methodology, forensic psychology and digital forensics is used to solve the research problem. This study employed a qualitative methodological approach, and built on a hermeneutic phenomenological theoretical framework. 6 detectives from the Oslo Police District were interviewed in semi-structured interviews. The analysis was performed with The Step-by-step Deductive Inductive approach (SDI-model). The data analysis showed that criminal investigation was conducted within the phases of the Digital Forensics Process. Investigative competence was needed in the identification-, analysis-, and presentation phases. The investigation of digital evidence was carried out by digital forensic detectives with police or civil background. The participants without police background had only a one-day course in subjects relevant to criminal investigation. The cooperation when investigating digital evidence was regarded most successful when the digital forensic detective was involved in the investigation at an early stage, or fully included in the investigation team. The examples from the participants showed that other important 2 factors for good cooperation in investigation of digital evidence were clear leadership and adequate allocation of resources. The literature review and the interviews led to identification of several non-technical sources of errors in relation to investigation of digital evidence, and they were divided into four main themes: The individual detective does not possess the sufficient competence, absence of the right type of competence at the right time during the investigation, bias and heuristics and organisational challenges, such as missing competency requirements and large backlogs. This resulted in the development of a concept where the necessary technological and investigative competence in relation to the Digital Forensics Process was described. Errors may cause poor quality and efficiency of the investigation, which again may lead to insufficient protection of the rule of law in the form of inadequate penalties, wrongful convictions or acquittals. Countermeasures towards the sources of errors on an individual level, a cooperation level or an organisational level are suggested. Keywords Digital forensics, Digital Forensics Process, The Investigative Cycle, analysis sub-phases, criminal investigation, digital evidence, errors, sources of errors, technological competence, investigative competence, bias, heuristics.