Mobile forensics have the potential to transform traditional methods of profiling offenders and build a comprehensive picture of suspects. Yuval Ben-Moshe outlines the importance of social data and why the evidence it can provide deserves greater traction among the legal system it ably serves
Upon extracting evidence from mobile devices, the police service is now using traditional investigative methods to analyse the data. Data which can place people at the scene of a crime and provide – or indeed even break down – an alibi.
Some commentators argue that mobile phones have become such personal tools that they can offer more detail to investigators than fingerprint evidence.
DNA was accepted as a formal method of evidence in the late 1980s and, in 2014, mobile forensics must now be accepted in the same way. The legal system simply must embrace the evidence that can be provided by such methods of forensic detection.
Ian Huntley’s conviction in 2002 for the murder of Holly Wells and Jessica Chapman was the first high profile case to be based partly on mobile phone evidence. Now, over a decade on, it’s not just calls and text messages that can link a suspect to a range of different crimes.
GPS tracking, social media applications like Facebook, Twitter and Instagram, e-mails, online transactions and even mobile banking can offer forensic investigators critical evidence that may well help determine the route a criminal case takes whether it involves petty crime, such as minor thefts, or more serious instances – even terrorist threats.
Social data retrieved from mobile apps is fast becoming a major source of evidence in not only building profiles of suspects but also establishing or demolishing a witness’ credibility. Recent research conducted by Cellebrite revealed that 77% of its customers believe mobile applications are a crucial data source in criminal investigations.
The value to both prosecuting and defence counsels in a Court of Law renders the neglect of such data a potentially severe barrier to case solving. Social data can provide highly important evidence for terrorist investigations.
Criminals plotting potential attacks are continuing to use sophisticated digital methods and it’s essential that investigators as well as the criminal courts are one step ahead.
If plots are not thwarted, courts should have the tools at their disposal to fully embrace the evidence built up through detailed investigations. This evidence may come not only directly from suspects’ activities but also from witnesses to criminality.
The investigation of the 2013 Boston Marathon bombing episode – in which three people were killed and an estimated 264 left injured – made use of crowdsourcing to collect photos and video from mobile phones. The data was made public within 72 hours and arrests implemented less than 30 hours later thanks to the evidence shared widely by onlookers.
Grasping the implications
In today’s world, the technology to extract valuable and accurate evidence from specific devices has evolved but legal systems are only now starting to grasp the full extent and implications of that fact.
Around 85% of people in Britain own at least one mobile phone and, because those phones readily fit into a pocket or bag, they’re carried by users for the majority of their day. Even if the device isn’t used or no direct contact is made with it when committing or planning a crime it still has the potential to offer vital evidence.
Location data via GPS tracking can identify abnormal travel patterns of a suspect, for example, which may provide important insights. It’s now time that such information is widely used as vital case evidence. Digital data that shows a defendant or victim was in a certain place at a specific time is harder evidence than having to take a witness’ word for it. Both prosecution and defence counsels should be using this in a similar fashion to that evidence obtained from CCTV systems.
It’s not just the complex nature of mobile devices that’s giving the criminal courts a more pessimistic view of digital evidence. Concerns over privacy are heightened by the personal nature of mobile devices.
Data ownership is also a regular barrier. Take data on a Facebook application, for example. There are always problems over the physical ownership of potential evidence and who must be approached to obtain that evidence. Most legal systems are yet to be provided with solid answers or case law to answer these vitally important questions.
Therefore, investigators are having to opt for a traditional approach which is based on the physical location and then serve a court order or warrant to Facebook for the data. As you might well imagine this can be a very drawn out process. Traditional systems are connecting the physical location of the data with its ownership and control while in the all-connected world servers may reside anywhere in the world and serve any point on Earth. This is an adjustment legal systems absolutely need to make.
Determining Best Practice
If well thought out and prepared for in advance, forensic evidence from mobile devices can make all the difference to cases tried in criminal courts. The technology exists for investigators to be partnering with forensic examiners and prosecutors who, to save time and improve the cases they build, should be working together on determining standard operating procedures and Best Practice around obtaining the evidence.
It’s quite alarming that, at a point in time where there are 6.8 million mobile phones worldwide, only in the last few years have some legal systems started to adapt and place themselves in a position to accept digital evidence. When it can build profiles and support or refute alibis, it’s imperative that this form of evidence is taken seriously.
Hopefully, as courts across the world become more aware of the latest mobile phone technology and its capabilities, advances in social media and privacy issues, they will then be better equipped to make decisions about the legal ramifications of search and seizure, acquisition and analysis.
Legal systems need to accept mobile forensics and embrace and alter their approach to accommodate the technology that will ultimately prove a major benefit to criminal cases.
Social media as recruiter
Earlier this year, a young British man was arrested in Bangladesh on suspicion of recruiting potential Jihadists to fight for ISIS in Syria. According to police in Bangladesh, the suspect is reported to have used social media sites such as Facebook to recruit combatants wishing to fight for ISIS in the Middle East.
Although the suspect has not been charged, this episode showcases the value and importance of social media data when it comes to investigating, profiling groups and individuals and breaking down suspected terrorist activities.
Social media data offers a different yet complementary sort of analysis than the more traditional forms of forensic evidence. In a case of suspected terrorism, social media platforms and applications may be used for mass communication. This point highlights and embellishes the importance of digital forensics when considering social media data as an evidence source. Again, this truism demands to be recognised. It’s not just about a potential conviction. Rather, it’s about preventing and neutralising any threats to either national or international security.
For more than a decade now, mobile phone records and messages have been central to unlocking evidence in many investigations. They still are to this day, but there has to be greater recognition of that social media data and what it can be used to achieve in law.
Yuval Ben-Moshe is Senior Director of Forensic Technologies at Cellebrite