DIGITAL FORENSICS SPECIALIST GROUP

Transcription

1 DFSG230914/Notes vfinal DIGITAL FORENSICS SPECIALIST GROUP Notes of the fourteenth meeting, held at 11:00am on Tuesday 23 September 2014 at the Home Office, London 1.0: Introduction 1.1 The Chair welcomed all to the fourteenth meeting of the group. 1.2 See Annex A for full list of attendees and apologies. 2.0: Minutes of the last meeting 2.1 The minutes of the last meeting were agreed. 3.0: Matters arising 3.1 Para 5.3: This action was ongoing as the new Regulator was yet to take up the role. Simon will recommend to the new Regulator a joint letter on achieving digital accreditation with the National Policing Lead for standards and performance in forensics, and the Chair and Simon will draft the letter. Action 1: Simon to recommend to the Regulator the joint letter approach, and the Chair and Simon to draft letter as required 3.2 Para 7.1: The consultation on the digital validation guidance will run until the end of October. The intention was to have this document ready when the new FSR arrived. Members were asked to provide Simon with relevant contacts for circulation of it. John Beckwith offered to add it to his letter to Chief Constables. Simon would post it on POLKA. Peter Sommer suggested linking it on the F3 and Digital Detective websites. It could be circulated to Scientific Support managers and and sent to the College of Policing High Tech Crime Managers workshop, 3.3 Para 11.1: Dave Compton stated that he had some comments on the speech and audio appendices and validation guidance for speech and audio to Peter French. Action 2: Dave Compton to send comments on speech and audio appendices and validation guidance for forensic speech and audio to Peter French 3.4 The Chair agreed to find out who chairs the audio subgroup for the European Network of Forensic Science Institutes (ENFSI). Simon would ask Peter French about adding more on Critical Findings Checks to the document. It could be circulated to both ENFSI and ZENO.

2 Action 3:The Chair to find who chairs the audio subgroup for ENFSI 3.5 Para 12.2: The DFSG discussed possible methods for circulating the UKAS need for technical assessors. It was agreed that Simon should check with the Interim/new Regulator whether UKAS s need for assessors could be mentioned in the Regulator s newsletter planned to mark the new Regulator being in post in mid November. John Beckwith would also recommend the DCC Nick Baker that the call for assessors could be included in a planned communication of forces on digital forensics. Action 4a: Simon to check with Interim Regulator if UKAS s need for technical assessors could be circulated via the Regulator s newsletter Action4b: John Beckwith to recommend to DCC Nick Baker that the call for assessors could be included in his letter 3.6 The other actions were either cleared or are agenda items. 4.0: Streamlined Forensic Reporting (SFR) presentation 4.1 The DFSG was given a presentation on SFR which covered: National governance and resources An overview of SFR and implementation Justice and case management view Digital approach 4.2 SFR aimed to produce proportional forensic evidence in accordance with the needs of each case. It was agreed that electronic copies of the presentation will be circulated with the notes of this meeting. In response to a query from Peter Sommer, John Beckwith said that the defence community were not represented in the SFR governance, but their feedback would be welcome. Defence organisations had had problems in dealing with these documents electronically. It was the intention of SFR that forensics issues would be dealt with earlier, to avoid delay to cases. Action 5: Secretariat to circulate SFR presentation slides with the minutes. 5.0: CCTV CPS work 5.1 The DFSG was informed that the CPS was (with MPS and FS) looking at specific guidance around the use of video comparison evidence in the criminal justice system. Legal guidance on experts for prosecutors was due for publication on 4 October The video comparison guidance could sit with this guidance and was complementary to the FSR s video evidence appendix. A longer paper on the subject would be completed later.

3 5.2 Facial mapping evidence was relatively new, without any acceptable standards. Standards were necessary to ensure that where enhancement had taken place, it was done properly. Also prosecutors needed to consider carefully whether CCTV comparisons, or CCTV evidence from experts, added value to a particular case. It was accepted that convictions were unlikely to rely solely on CCTV evidence. As courts had shown a willingness to reject poor CCTV evidence, very few cases had been appealed, and there was little authority on appeal. The DFSG agreed that the guidance needed to be circulated widely when it was published on 4 October, and it was also agreed that the DFSG should be given an opportunity to comment. Action 6: Ian Elkins to circulate the CPS guidance on CCTV to the DFSG Audio Appendix 6.1 The draft audio guidance from Peter French s subgroup had been presented in the appendix format to fit with the rest of the Regulator s Code of Practice. There were some sections that still required strengthening. It might need additional material on critical findings checks, and accreditation. However, the expectation was to publish the appendix for consultation by December. It was agreed that the appendix needed technical review and this could be done by an ENFSI group. It would also be useful to approach one of the working groups in the US, Europe and Australia. Simon agreed to establish who in Australia s national lab, which had been accredited, could help with the technical review. Action 7: Simon to find out who in Australia s national lab could help with a technical review of the audio appendix 6.2 The DFSG discussed concerns that the Regulator s Code of Practice needed to be a bit more prescriptive about processes and procedures. It was recognised that the digital arena had been practised outside the sphere of forensic science in many forces. Therefore to introduce forensic science disciplines in the digital arena required a bit more focus in the direction colleagues were going. Different practitioners from various backgrounds were involved in digital forensics, and several practices had been left unchecked with the danger of practitioners not knowing that they were in an arena of science. Also the G19 ILAC guidelines for Forensic Laboratories had recently been revised. Cell Site Analysis 7.1 Cell Site analysis required accreditation by What this meant for practitioners required discussion. It was suggested that the draft guidance should first identify high-level principles in terms of what the assessor was looking at, and then more prescriptive guidance about how to achieve those principles. Matt Tart agreed to pull out the high-level principles from the guidance document and include how those principles could be achieved, and discuss the draft with Simon and Dave Compton before putting it before the

4 wider DFSG. The high-level principles were expected to stay unchanged, while the processes might frequently change. The high-level principles would have a wider readership. An explanation of the scope and remit of the paper might be added, specifying in particular which areas it did not aim to cover. Action 8: Matt Tart, Simon and Dave Compton to redraft the guidance with high-level principles and how to achieve those principles. 7.2 It was suggested that the cell site guidance could fit into the Regulator s Codes. It would benefit from an introduction that explained the context, stating that the document would set out the principles, provide an explanation of the hierarchy in terms of where it fitted with the other documents on standards and how they apply. The key principles could be one page. Action 9: Matt Tart agreed to make changes to the Cell Site analysis guidance as suggested. Statement of accreditation requirements 8.1 What needed to be accredited included capture, recovery, analysis and interpretation of digital data. It was agreed that there needed to be some clarity on the scope of digital forensics. CAST had started to draft what should be in the scope and the different stages from acquisition to the evidence presented in court. Neil Cohen agreed to circulate the first draft. Action 10: Neil Cohen to circulate first draft of CAST document on what digital forensics should cover. 8.2 The DFSG noted that it was important for digital forensics to become embedded into the quality management culture of forces. Simon had added a catch-all section, so that any novel digital techniques would be covered, despite not appearing on the list of standard techniques. AOB 9.1 It was agreed that John Beckwith should join the DFSG. 9.2 Matt Tart asked to discuss interpretive methods offline. 9.3 The DFSG discussed a gatekeeper function for small providers seeking accreditation. It was clarified that the Regulator s Code of Practice applied to anyone acting on forensic data and did not exclude single entities grouping together, and the Codes took peer review into account fully. It was suggested that the Forensic and Policing Services Association (FAPSA) were trying to address the challenges for small providers in gaining accreditation. The Code of Practice also had a section that dealt with processes for novel practices that came up through case work. Simon agreed to report the concerns of small providers to the Regulator.

5 Action 11: Simon agreed to feedback to the Regulator the concerns of small providers about achieving accreditation. Date of next meeting 10.1 The next meeting will be held at 11:00 am on 16 December 2014 in Conference Room 7, Home Office 2 Marsham Street London SW1P 4DF

6 Annex A Present: Mark Stokes Neil Cohen Dave Compton Ian Elkins Rupert Evernden Angus Marshall Peter Sommer Kenny Chigbo In attendance John Beckwith Simon Iveson Matt Tart Mike Taylor Apologies Peter French Brian Jenkinson Nigel Jones Andy Letherby Miranda Moore Zoe Scott Chris Simpson Craig Wilson Met Police (Chair) Centre for Applied Science and Technology UKAS CPS College of Policing (for Chris Simpson) Forensic Science Society LSE Home Office (Secretary) Staffordshire Police Forensic Science Regulation Unit CCL Forensics Home Office Peter French and Associates First Forensic Forum (F3) Technology Risk HMRC 5pb Chambers Skills for Justice College of Policing Digital Detective

7

8 Actions from Sept 2014 Action No. Action Owner Deadline Progress Status 1 Simon to recommend to the Regulator the SI/MS In Progress joint letter approach, and the Chair and Completed Superseded Simon to draft letter as required 2 Dave Compton to send comments on speech and audio appendices and validation guidance for forensic speech and audio to Peter French DC Completed 3 The Chair to find out who chairs the audio subgroup for ENSFI 4 a) Simon to check with Interim Regulator if UKAS s need for technical assessors could be circulated via the Regulator s newsletter MS SI b) John Beckwith to recommend to DCC Nick Baker that the call for assessors could be included in his letter JB

9 Action No. Action Owner Deadline Progress Status 5 Secretariat to circulate SFR presentation slides with the minutes. KC. 6 Ian Elkins to circulate the CPS guidance on CCTV to the DFSG 7 Simon to find out who in Australia s national lab could help with a technical review of the audio appendix IE SI 8 Matt Tart, Simon and Dave Compton to redraft the guidance with high level principles, and how to achieve those principles. MT/SI/ DC 9 Matt Tart agreed to make changes to the Cell Site analysis guidance as suggested. MT 10 Neil Cohen to circulate first draft of CAST document on what digital forensics should cover. NC

10 Action No. Action Owner Deadline Progress Status 11 Simon agreed to feedback to the Regulator the concerns of small providers about achieving accreditation. SI