Rationing bytes: managing demand for digital forensic examinations

Abstract

With the growing sophistication and prevalence of digital devices such as mobile phones, computers, tablets, sat-navs, and domestic appliances, the extraction, analysis and interpretation of digital data has become increasingly central to intelligence gathering and criminal proceedings. However, the very extent of data available today challenges the ability of police agencies to turn seized devices into useful evidence. To date, most social science scholarship about forensics has concentrated on DNA profiling and its societal and ethical issues. In contrast, other forensic fields, including digital forensics, have had little analytical scrutiny. Based on unprecedented access to a forensic collaboration in England, this study addresses the question: In conditions of constrained resources, how do police agencies manage the insatiable demand for digital examinations? In doing so, we bring rationing classification schemes from healthcare studies into the field of criminology in order to characterise the techniques for reconciling demand with capacity. As detailed, formal attempts to ration demand are confounded by informal practices and procedures that can impact on the capacity of the workforce and the speed with which cases are processed. In addition, the rationing of digital devices has significant consequences for the definition and distribution of skills and expertise across criminal justice agencies.

Evincing Offence: How Digital Forensics Turns Big Data into Evidence for Policing Sexual Abuse

“…At the time of the fieldwork, demand for DF routinely outstripped capabilities (Tully 2020), leading to backlogs. Against the substantial demand for DF and limited capacity, DFUs effectively ration their service provision (Rappert et al 2020).…”

“…Both the seizure and analysis of digital devices in the four forces studied are governed by formalized protocols that standardize the ways in which organizational resources are focused, and thereby embody assumptions about the relative significance of data (Rappert et al 2020). Among the significant protocols in place relevant (but not specific) to IIOC are:…”

Police preparedness to respond to cybercrime in Australia: An analysis of individual and organizational capabilities

“…Karampidis et al, 2018), which is beyond the reasonable capabilities of most general duties officers. Although agencies have established specialist units to address these issues, the limited time and resources available require specialists to triage their work according to the investigative priorities of their organization (Rappert et al, 2021). As such, the decentralized and anonymous characteristics of cybercrimes create technical hurdles for law enforcement.…”

Policing the smart home: The internet of things as ‘invisible witnesses’1

“…This creates challenges such as increasing time to sift, analyse and interpret data within investigations (Rogers, 2015). The increase in data volume may impact effective use in investigations due to limitations in technical capabilities to handle IoT traces (Rappert et al, 2020). The result-oriented and time-sensitive nature of forensic investigations generates demand for new tools to enhance efficiency, such as automating certain phases (Casey et al, 2013).…”