Monday, July 05, 2010

How long will Computer Forensic Standards Last?

How long will Computer Forensic Standards Last?

A police officer switching ON a device that is already switched OFF at a potental crime scene should be an absolute no-no, according to Forensic bibles, case law etc. Indeed, even the Police's official release version of ACPO Guidelines categorically states for Crime Scenes Page 8/66:

"• Do not, in any circumstances, switch the computer on."

Why does this matter? It is a flagrant breach of that principle when we see on "Cops on Camera" ITV 3 Saturday 8pm 4th July 2010 patrol car police stopping a car in Lewisham, questioning the driver about drug related matters (ok, to this point) and then the officer opens the boot of the car and in it he sees a laptop. Did the officer put the laptop in an evidence bag? Oh no, he switches ON the laptop.

The programme clearly demonstrated a major pyschological flaw in the thinking of those who are generating evidential rules vis-a-vis evidential standards. The actions of the Police officer, who I do not think is to blame, actually, because you see the way he went about the task displaying little regard for the rules - which probably means he doesn't know them or they are not enforced properly.

Moreover, it certainly highlights the redundancy of ACPO Guidelines, because what is the point of promoting good practice principles and expect them to be followed in the Lab and at Scene of Crime, yet when it comes to devices in cars or people walking along the street with devices then a wild-west approach of anything goes to deal with the evidence occurs.

Furthermore, it undermines s129 Criminal Justice Act 2003 reliability to seek overt declarations of change to data by ignoring the use of this wild-west approach and reduces the reliability of evidence to nothing more that speculative assumptions. This certainly reveals the slippery slope Lord Steyn raised when as Steyn HHJ R v Minors [1989] 1 WLR 441 he said “if computer evidence cannot be used, much crime would be immune to prosecution also”? For computer evidence to be used it has to be as reliable as possible, at first instance, and reflect the behaviour of the defendant, not the world and his wife who have also had a go at the computer.

No comments: