Jusletter IT

Digital devices in relation to criminal investigation can provide valuable evidence, but likewise pose a risk to the integrity of such evidence where data could be tampered with, altered or manipulated, while inexperience and ignorance of standard guidelines may result in data loss. This, and the divergent legal frameworks on handling digital evidence, pose a challenge to its admissibility and weight in court. To address the issue, both legal and forensic standards within each step of the evidence life cycle need to provide quality assurance, while requiring a holistic international approach of the framework governing criminal investigations. According to a United Nations' report, a «number of countries recommended that international standards should be developed on law enforcement investigations concerning extraterritorial data, including with a view to clarifying the relationship of such investigations with national sovereignty principles.»¹ Therefore, it is important to examine the benefits and drawbacks of such standardization process.

Because digital evidence is not bound to territory and is always an abstraction of the computer intermediary², there are multiple specifics in its nature, types, life cycle and chain of custody. That is why it may be preferable to see it as a process – its probative value may depend not only on the evidence itself, but also on the associated metadata (say time and date stamps), the computer system’s integrity and security (as source of the evidence), the consistency of the Digital Forensics (DF) methods (scientific evidence) and the preservation time (storage, technical obsolescence). Twenty years ago, the first model law initiatives³ for international regulation of evidence were focused on adapting rules for «traditional» physical evidence to electronic evidence, but possibly with incomplete understanding of key concepts. Compared to more recent initiatives⁴, it is notable, that the growing amount of digital evidence in criminal proceedings and evidence from foreign jurisdiction, shifted the focus to the specifics electronic data, requirements for admissibility, integrity through the whole chain of custody and evidence exchange models. In addition, jurisdictions are facing some similar issues in regards to digital data, which opens a dialog for a global standard governing digital evidence. Mason discusses possible models for a Convention based on private initiatives or non-binding initiatives by way of regional fora or international agencies⁵. The objective in this paper is to better understand possible implications of standardization, without proposing a legal model, but searching interlinks or gaps of law and forensics emergence in the evidence domain.

Digital forensics⁶ is the bridging discipline, which aligns technical capabilities with legal requirements in order to turn data into evidence. While the need of a standard scientific framework is widely recognized among digital forensic experts⁷, its implementation in the legal and law-making process is still underdeveloped. Moreover, the cooperation between police authorities and American internet service providers (ISPs) is on a voluntary basis and there are no specific legal requirements on what kind of data (i.e. subscription, transaction or content data), time limits and in which format will be provided⁸. In addition, judges understanding of the digital forensic methods and their quality is of great importance⁹ in order to avoid either blindly accepting the digital forensic results, or on the contrary, disregard or lower the digital evidence’s value.¹⁰ The validation of the evidence, largely depends on the skill and knowledge of the investigators. However, judges or lawyers must evaluate their findings of how the evidence supports the truth. Conceivably, in the evidence domain purely legal approach will be insufficient, since legal, technical and scientific principles must complement and also constrain each other.

Back in 2011, the Council of the EU established the European forensic science area (EFSA) and European Network of Forensic Science Institutes (ENFSI), and pointed to the lack of «any [internationally] recognised quality standards» for digital forensic processes and systems, and the lack of transparency¹¹ as a major problem. The potential of developing new standardization or mapping the existing one to the digital evidence specifics – not only scientifically or technically but also legally, in order to improve these processes, requires examination from a theoretical and practical point of view.

For this purpose, standards are understood as quality policies linking forensic science and evidence-related laws in approach to international harmonization, since such standards could establish sets of solutions and models to potentially matching problems. Or in the words of the European Council «minimum forensic science standards» must be complemented with a «common approach to implementation of these standards that fosters closer cooperation between them and the criminal justice systems»¹². A standardization process within the evidence domain, its benefits and drawbacks, are outlined in a legal, forensic (scientific) and technical context.

When considering multiple types of evidence, the volume of data and fast changes in technologies with relevant effects on practitioners (i.e. digital forensic experts) – extended standardization may lead to information loss. Some insights regarding the negative impact of over-standardisation could be derived by analogy for certain aspects of cloud-computing¹³ and the related proliferation of standards. Distorted import of international standards may have negative impact on national criminal laws as examined in relation to international criminal procedures¹⁴. In addition, the studies on the use of comparative reasoning in court as a way to align procedures and create global common standards for criminal adjudication vary strongly –conclusions, that judges are insusceptible to external influences¹⁵ contradict to arguments that foreign and international law is an effective instrument for empowering the domestic democratic processes¹⁶. Other limitations are related to the fact, that «formal consensus in standardization is often very slow».¹⁷ Moreover, insufficient oversight and auditing may result in inconsistency and redundancy. The issue with proliferation of standards might be addressed with policies for standardization development, quality testing of quality procedures and methodology to avoid duplication or contradiction in existing standards. However, every standardization process must rely on or with time emerge in mandatory legislation, which encourages policies and best practices for cooperation in evidence exchange while sufficiently insuring sovereignty of all countries, enforcement and judicial supervision. In achieving this, a precondition will be «standards that are not prescriptive with respect to methodology, but recognise existing accepted practice and form an achievable, cohesive and consolidated quality and risk management benchmark for laboratory managers and accrediting bodies»¹⁸.

Some argue, that there is no possibility to map minimum standards for evidence, since «evidence» is a legal construct, not a «real thing» and depends on courts (legal doctrine) understanding of it and on mutual trust».¹⁹

On the contrary, in a cross disciplinary hypothesis digital evidence is not a purely legal construct, but interlinks the forensic science (DF specific solutions, methods and tools), technology (platforms and system to facilitate the chain of custody) and law (legal requirements for criminal evidence). The extraterritorial and crossdisciplinarity nature of digital evidence needs a specific approach, which can overcome jurisdiction obstacles while respect legal tradition, to increase the general admissibility of digital data as evidence.

Moreover, this regulative impact must be achieved in an emerging environment within the young discipline of digital forensics. Abbott and Snidal, who build upon Koremenos’s work, argue that soft law realm opens when «legal arrangements are weakened along one or more of the dimensions of obligation, precision, and delegation», and in international context «facilitates compromise between weak and powerful states», considering that «nonstate actors […] press for different forms of legalization»²⁰. Considering the power nonstate actors like ISPs have over data, even with legal framework on evidence, there will be still the need of synchronizing their cooperation with state authorities. Particularly, in new legal environments, standards, unlike hard law, can «deal with uncertainty, especially when it initiates processes that allow actors to learn about the impact of agreements over time».

Consequently, standards are more flexible than legal rules, because they are based on multi-stakeholder consensus and can act globally. They contain best practices and policies, which can be used as supplements or substitutes to legal rules, have an important ex ante function, while criminal laws generally act ex post and could pave the way for more comprehensive, legislative initiatives. In addition, standards have a distinct enforcement impact through auditing and certification and indirect impact on the process of implementing legal rules in/to future technology. Moreover, standardized processes in the chain of custody will ensure more trust among LEAs and judicial authorities from different countries, when exchanging evidence cross jurisdictions and cooperation, instead of competing investigations in trans-border crime.

In this sense, any practical solution must meet certain scientific, legal and technical standards, which should be soundly interlinked and internationally valid. Controversially, firstly large effort is put into scientific and technical solutions, while judicial cooperation and understanding as to how digital evidence support the truth and how to be challenged on solid grounds in court is insufficient. Secondly, the loose interlinking of the three factors is at the expense of its admissibility and probative value.

Developing minimum standards for digital evidence and systems to facilitate their secure exchange was laid down in the Stockholm Programme back in 2009²¹. Earlier this year, EUROPOL identified as a pressing open issue the «establishment of a consolidated cooperation framework for the collection and exchange of evidence […which] should include relevant national and international stakeholders such as private industry, and to the extent possible follow a standardised approach»²².

Two recent legal initiatives, the European Commission`s communication on EU level²³ and the proposition for second additional protocol to the Budapest convention on CoE level²⁴, based on the Recommendations of the Cloud evidence group²⁵, are dedicated to enable and improve the cross-border exchange of digital evidence. Proposed are three evidences exchange models: 1. improving of mutual legal assistance regime, 2. direct cooperation with ISPs through production orders/ requests and 3. direct access from seized computers, or remotely from investigators’ machines.

Notably, these initiatives focus on some purely legal shortcomings in the evidence process – like defining types of digital evidence, and of safeguards and rules to be followed in the different regimes, as well as tackling the «loss of location» issue by addressing the legal fragmentation and the conflicts of law, or enabling searches for evidence the location of which is unknown or volatile. A significant effect on forensic cooperation between LEAs from different MS will have the definition of «connecting factors», which is based on the type of data and regulates potential effects of online investigation measure on another country’s territory.

Along with the addressed legal challenges, a strong call for practical solutions and standardized approaches is mapped. Particularly, efforts are focused in two directions: firstly, the legislative standardization – aligning the forms of requests, accelerating procedures, improving safeguards, authentication and enforcement mechanisms. Secondly, technical facilitation of evidence exchange by developing new platforms and connecting/improving existing ones. Based on the legal documents, further some practical implications are discussed, bearing in mind that for now these are only propositions for legislation.

Considered are improved and faster mutual legal assistance (MLA) mechanisms to provide legal ground for remote and cloud forensics. Further measure is the facilitation of evidence exchange platform with robust security. Legal standards for ISPs forensic readiness complemented by standard channels and procedures for data exchange with LEAs, will also reduce the different approaches to evidence among private companies offering the same services. Another proposition for effective case management and workflow are dedicated SPOCs²⁶ (single point of contacts for cross-border law enforcement information exchange) and entry points on the ISPs side. However, most countries have SPOCs in compliance with Art. 35 Budapest convention requirement for 24/7 network. In addition, new regulation²⁷ require eu-LISA to develop a central monitoring capacity for data quality of large databases (e.g. SIS II, VIS, EURODAC, ESS²⁸) and development of anonymised data warehouse with LEAs access to it on the principle hit-no-hit identification. The new ENISA regulation²⁹ provides for establishing a harmonised framework for security certification of IT products and service, and underlines the importance of consistency with certification mechanisms for data protection seals and marks for the purpose of demonstrating compliance with GDPR³⁰. The non-exhaustive examples prove ongoing standardization approach with direct impact on digital evidence process.

Moreover, cross border exchange of evidence based on the European investigation order³¹, which entered into force this year, challenges MS to find suitable solutions to approximate their laws and policies³². Particularly, standardization could be applied in regards to resolving issues in combining lex loci and lex fori to provide maximum flexibility for evidence exchange, time limits compliance and prioritisation of cases, criteria for refusal, practical measures for evidence gathering in real time. A comprehensive study on international evidence exchange concludes that certification can «indicate that the taking of the investigative measure is possible in a similar national case»³³. These legal standardization efforts have dualistic impact – they will change administration and facilitation of digital evidence and forensics, but at the same time provide a chance for forensic specialist to map insights in international dialog for evidence exchange. For example, time limits and prioritization of cases could compliment efforts in law enforcement laboratories for case management, resource allocation and efficiency within organization as well as international cooperation. However, the ongoing initiatives are focused on effectiveness and more security in the evidence process, but give no answers how the legislator will achieve its goal for stronger cooperation between digital forensic specialists and criminal justice systems³⁴.

Scientific standardization processes in digital forensics were acknowledged 10 years ago³⁵, and nowadays the forensic science principles³⁶ and methodology are applied to digital forensics in order to develop this new branch and ensure research and education corpora³⁷. This impacts the efforts for creating a comprehensive international legal Framework for evidence at least in three important aspects. Firstly, digital forensic corpora with methodologies for tool verification, reproducibility of results and accuracy improve mutual legal assistance, admissibility and standardised probative value, but raise questions about the balance between practical and efficient technical solutions on one hand and human rights and civil liberties on the other. Secondly, the scientific approach of the pre-trial investigation gains more importance, while court proceedings are formal and inefficient, which reflects on the issue that experts are dominating the dispute resolution in court. Finally, the scientific standardization of digital forensics can ensure predictability and certainty in the analysis, but also to provide exact knowledge where a regulatory approach is needed.

Cohen argued that «scientific consensus in the area of digital forensic evidence examination is lacking in the broad sense, but that different groups within that overall community may have limited consensus around areas in which they have special expertise.»³⁸ In terms of the legal developments in cross-border exchange of evidence, the mutual recognition principle in EU introduced with the EIO and the international movement towards system interoperability «the community needs to adopt standardized, modular approaches for data representation and forensic processing»³⁹ to move forward.

The legal initiatives for evidence cross-border exchange show that the scientific standardization will no longer be left at the discretion of forensic specialists, but will be enshrined in a larger and global legal standardization process. This follows from the EU Commission statement when referring to collection of evidence in cross-border cases, that there is a need of «minimum principles to facilitate the mutual admissibility of evidence between Member States, including scientific evidence.»⁴⁰. In US the Daubert's principle⁴¹ is also questioned for its practical use in the absence of «standard […] established and certified by the justice system» on the possible legal evaluation and challenging of forensic findings in court⁴². In UK the criticism on the presumption of reliability of computer systems, expose missing standards on quality, reliability and integrity of evidence, covered by incomplete understanding and application of the presumption⁴³. In civil law systems either the same presumption exists⁴⁴ or specific rules on how in practice the probative value of digital evidence is evaluated are lacking⁴⁵. However, the following comparison of legal and forensic analysis on reliability and authenticity of evidence, shows that all jurisdictions face some similar issues.

Scientific evidence always has a degree of uncertainty⁴⁶, caused by either potential human error or data corruption. Casey, while examining the possible errors in digital evidence, concludes that «we should evaluate computer-generated records based on the reliability of the system and process that generated the records» and refers to Strong, who suggests that digital evidence must not be presented in court as expert testimony, but «admissibility should be determined on the basis of the reliability and accuracy of the process involved»⁴⁷. Further Teppler argues to be handled as hearsay⁴⁸. However, in court often computer system integrity is not even questioned⁴⁹ or challenged on «slender grounds»⁵⁰, or courts from both common and civil law systems relay on presumption of «reliability» of computer systems⁵¹.

In US, the Daubert's rule for expert scientific testimony requires validation of the method, error rate, scientific acknowledgment and independence, which is broadly recognized in academia and among practitioners from both the legal and the digital forensics domain. NIST contributed to standardization of the process for Computer Forensics Tool Testing (CFTT)⁵², which consist of a specific methodology to demonstrate the reliability of forensic results, to identify potential errors, and at the same time to support admissibility of evidence. However, a new issue emerged, when the need for sharing tool testing results and for cross-verifying them could not be fulfilled, since different labs used different formats for the reports. Alignment of the practices in standard reports allow this to be overcome⁵³. Also in relation to data protection requirements, «data controllers holding information in a non-standard format to convert it into a standard one» was proposed as a solution for ensuring data subject rights⁵⁴. It seems that legal requirements for evidence foster more scientific standardization, without however, considering if this will positively impact the traditional trial. More importantly, truth and accurate evidence is only one part of the judicial evaluation of a case, but other aspects like civil liberties, human rights (right to access to justice, right to fair trial, data protection) remain remote to the evidence process. Notably, scientific standardization can improve a lot the evidence chain of custody, but per se is insufficient, if not practically implementing also legal requirements.

Another example can illustrate the exponential complexity of scientific digital evidence, which call for more scientific knowledge by legal practitioners and forensic experts. Likelihood ratio (LR) gains importance when DF specialists present their findings in court, since there is a practical need of quantitative methods for presenting digital evidence analysis and related levels of certainty. In addition, knowing possible error rates in the methods of software, judges can estimate to what extend the scientific evidence is trustworthy. However, Lund and Iyer «find this likelihood ratio paradigm to be unsupported by arguments of Bayesian decision theory, which applies only to personal decision making and not to the transfer of information from an expert to a separate decision maker» (judge), because «computing an LR is generally not free from prior probability assignment at the level of specific scenarios»⁵⁵. Others, refer to the danger of machine bias, discrimination algorithms and the lack of policy, endangering the very basis of society⁵⁶ – an issue well-known also in the data protection domain when it comes to automated decision-making. ENFSI in its action plan relates to «creating standards for interpretation of scientific evidence»⁵⁷. Initiatives to promote reliability in the submission and handling of expert evidence, resulted in a Guide in statistical evidence for legal professionals⁵⁸.

Often both legal and forensic evaluation of the digital evidence depend on cross-verification of the accuracy of forensic results, tool testing, reproducing the results by other DF specialists and with other methods. However, the criteria and approach how to do this vary and depend on the way an evidence will be challenged in court, if at all challenged. Mason refers to Reed and Angel's two hypotheses⁵⁹ – either the computer system or software was not functioning properly and created evidence, that does not support the truth or although the system was functioning properly at the given time, the evidence record was tampered, altered or manipulated by third person, which can include also contamination by the forensic examiner. Cross-verification and reproducibility of forensic results is also particularly important for the defence.

One approach is the access to the software source code, in order judges and forensic specialist to evaluate possible errors or modifications. Therefore, Mason calls for disclosure and discovery of source code under confidentiality agreements⁶⁰, but finds negative unwillingness of judges and lawyers to request cross-testing of system audits and critical updates⁶¹. A federal judge recently unsealed the source code for a software program developed by New York City’s crime lab, exposing to public scrutiny a disputed technique for analysing complex DNA evidence⁶². In this respect standards for open source software increase the verifiability.

While both Mason and Casey agree on the danger of applying presumption of reliability to computer systems, considering the numerous existing hardware and software errors, Casey argues that «it is more effective to focus on the evidence itself rather than the reliability of the process that created it» as well as searching for «further corroborating information» from other sources⁶³. He also discusses the importance of peer review of the forensic results by other DF specialist and with different methodologies and refers to Sommer on prehearing of experts, when there are disagreements on the results. However, the challenges outlined by both authors, as legal and digital forensics ones are related to what constitutes an adequate test for different types of digital data, which are the right mechanisms to determine error rates, how to incorporate probative value, quality, integrity and reliability in the evidence itself and how adequate interpretation and challenging of forensic findings are⁶⁴. According to these results, global standardization of evidence is narrowly understood as setting this type of data under specific regime in order to improve the quality of its assessment, which consequently may open the dialog for some harmonization of legal systems and comparative reasoning by lawyers and judges.

Walden reminds that «although European data protection laws apply only to personal data, their practical impact may be broader […] because it may be difficult to delineate personal data (for example where they are co-mingled with non-personal data or where they are encrypted).» Here, we examine two issues in the data protection regime, which are considered the most challenging for compliance in digital forensics, but with a very significant impact on the admissibility of digital evidence: namely, the vague regulation of external digital forensic services in data protection law and the gaps by estimating the intrusiveness of the investigation measure. In both cases, a standardization approach may provide practical solutions.

Svantesson argues that in an investigation context the «recognised, distinction between (a) subscriber data, (b) traffic data and (c) content data, does not match data privacy law’s distinction between (a) non-personal data, (b) personal data and (c) sensitive personal data»⁶⁵. The Commission recently replied, «Subscriber information, traffic data, metadata, and content data are personal data, and are thus covered by the safeguards under the EU data protection acquis»⁶⁶. Nonetheless, the CoE cloud evidence group reports that in the majority of criminal cases (60%) only traffic and subscriber information need to be collected, which is a lesser interference with data subject rights⁶⁷.

The Directive 2016/680/EU⁶⁸ has a wider scope and includes any processing of personal data, nationally or internationally. It introduces sector specific rules – distinguishes different data subject categories⁶⁹ and requires separation of hard (based on facts) and soft (based on assumption) data and independent oversight as well (Art. 6 and Art. 7). In addition, the separation of certain categories of personal data under different protection regimes is established in Convention 108 and in R (87) 15 as well⁷⁰. In compliance with Convention 108 most police and law enforcement authorities have already developed data protection regimes; so – depending on the congruence with legacy systems – it may be challenging to harmonize and adapt the existing police systems to the new requirements. Moreover, external digital forensic services, which only assist with forensic analysis to the investigation, must also apply such data protection rules. Sadly, it is not clear in the Directive which rules apply for cases in which personal data is being transferred to private parties for law enforcement purposes in and outside EU, or when police authorities are using data for a law enforcement purpose, but incompatible with the one for its prior collection (Rec. (11) and Art. 9). However, both are of importance in terms of cross-border exchange of evidence. For both LEAs and digital forensic services, it is important to understand under which conditions data must be communicated to data subjects with respect to data subject’s rights, fair trial and defendant`s rights.

The intrusiveness of a certain law enforcement measure is evaluated by data protection principles (Art. 8 (2) ECHR and ECrtHR standard test⁷¹), namely it must be first provided for by law, second serve a legitimate aim and thirdly be necessary and proportionate in a democratic society. CJEU in the Schwartz case provides also a method to apply the necessity and proportionality test⁷². In addition, the WP29 has published practical recommendations, where the evaluation depends on the social need, the safeguards applied, preventing excessiveness, limits of the retention, but also on abstract concepts like purpose limitation, margin of appreciation and culture in MS⁷³. In the latest communication the Commission points out, that the necessity and proportionality test depend on the type and volume of evidence, the type of investigation measure, its intrusiveness and safeguards to human rights⁷⁴. It is not realistic, though, to assume that forensic experts can limit their collection methods only to relevant data from the beginning, or that all experts, which are often not lawyers, can successfully conduct a complex legal test. Simultaneously, cases where judges will need to refuse to accept important evidence due to the warrant’s limits being exceeded, will need to be avoided. A clearer standard needs to be developed to overcome this legal gap. As argued by Hong and Yu a «model needs to be established that can assess and regulate excessive search and seizure of digital evidence in accordance with a reasonable standard that considers practical limitations.»⁷⁵ Compliance with thepurpose limitation principle is very challenging, considering that forensic experts may follow only traces online until they find concrete evidence; and not always it is possible to ex ante define precisely the needed information type or content, or the forensic method appropriate. In addition, the principle is set under pressure by the examined above EU data bases (SIS II, VIS, EURODAC, ESS)⁷⁶, which are created for other purpose but will be used also for law enforcement activities, which is direct violation.

The need of data retention for investigation purposes is well recognized by law enforcement authorities, but fundamentally questioned and criticised within the data protection community; and data retention also affects the cooperation with private sector. The controversial nature of the data retention laws is partially rooted in the apparent inability of the legislator to guarantee sufficient safeguards, and maintain an appropriate necessity and proportionality test for data retention, which was also received emphasis by CJEU when invalidating the Data Retention Directive⁷⁷. However, the UN report concluded that «National legal obligations and private sector data retention and disclosure polices vary widely by country, industry and type of data. Some countries report challenges in obtaining data from service providers»⁷⁸.

The paper examines the emergence of legal, scientific and technical standards in the digital evidence domain and its impact as quality assurance in law-making, court proceedings and digital forensics. New regulation on evidence exchange in Europe, improving MLA regimes and EIO implementation will greatly depend on the ongoing standardization initiatives for better facilitation and security in the evidence chain of custody and their national implementation. As main standardization topics are outlined legal evaluation and challenging forensic findings in court, adequate tests for different types of digital data, mechanisms to determine error rates, embedding evidence probative value in forensic process, integrity, reliability and storage of digital evidence, as well as data protection and onsite forensics combined with beck office analytic tools and platforms. Global standardization of evidence is narrowly understood as setting this type of data under specific regime in order to improve the quality of its assessment, which consequently may open the dialog for harmonization of legal systems and comparative reasoning by lawyers and judges. Moreover, both legal and forensic systems require some basic agreements on terminology and taxonomy, interoperable formats, tools and procedures, which also has to facilitate the communication of evidential material with ISPs. In addition, this process will be indirectly influenced by the standards chosen in EU for facilitating exchange through e-Codex and the EU databases.