Position paper on the forensic examination of child pornography

Position paper on the forensic examination of child pornography

Directrices de ACPO sobre reglas de evidencia del crimen computarizado en pornografía infantil (Ingles)

We gratefully acknowledge the assistance of Edward Wilding of Data Genetics International Ltd in the preparation of this paper.

The British Computer Society welcomes the release of the new ACPO Guidelines on Rules of Evidence for Computer Based Crime, but has concern about one particular aspect of the document which relates to the rules of evidence in child pornography cases.

This stems in part from recent legislative changes which would suggest that this type of material is so damaging that it has been made illegal to copy or to possess such material for any purpose.

This is inhibiting police forces from copying material in their possession which is alleged to contain such images or material, even for what would normally be viewed as legitimate defence purposes.

Police forces in England and Wales are currently resisting solicitors' requests to release computer evidence seized in child pornography prosecutions to appointed defence expert witnesses for independent inspection.

Various police forces have stipulated that the defence investigation of any alleged offence must be conducted in a police station, and that the computer evidence in such cases will not be released for examination outside of police premises or facilities.

The examination of a computer, computers or data storage systems allegedly used to access or view child pornography at a police inspection facility is not conducive to providing a solicitor with a fair appraisal of the evidence ranged against his or her client. The reasons for this are as follows:

The data to be inspected has been prepared by the police and has not been independently verified. Its veracity needs to be established by independent access to the original computer(s) or data storage devices and by independent forensic processing of these systems.

The entirety of the computer data pertaining to the offence must be made available for examination, not just incriminating portions of it. Without independent access to the entirety of the data there is a risk that the prosecution will engage in selective 'cherry picking' of evidence that is supportive of the allegation, whilst ignoring evidence that may be prejudicial to its case. The fact that illegal material may be found on a computer or data storage device does not in itself prove guilt unless it can be seen in the context of all the other material on the disk, its provenance and the circumstances by which it got there.

The evidence supplied by the police may be provided using software processes that are unavailable to the independent expert, rendering the evidence, effectively, inaccessible. Many police forces use specialist evidence processing suites that are not generally available or familiar to independent examiners, or which would not be their preferred processing option.

Under the current system, the independent examiner is under constant police supervision and may feel under pressure to complete his or her examination. There is an implied time restraint. Computer forensic examination, by nature, is a time consuming process. An examination of a computer seized in a child pornography case will typically take many days.

The examiner has to use his investigative tools in an alien environment at a pace dictated by the clock, using unfamiliar equipment and without immediate recourse to his or her systems, software or processes other than that equipment which is immediately available. This is wholly unfair, and has already caused expert witnesses to decline cases on the basis that the strictures placed on them effectively render a forensic examination of seized computer evidence impracticable and non-viable. The current strictures imposed by some police forces does not benefit the criminal justice system, and undermines and potentially subverts the individual's right to a fair trial.

We are of the opinion that any expert appointed by a defence solicitor on a child pornography case should be vetted by the police through the Police National Computer and by whichever other database checks or enquiries the police deem necessary and appropriate.

Having established the good character of the examiner, the police should make available image copies of all of the material pertaining to the case for genuinely independent examination.

The expert and the expert's instructing solicitor undertake before the Court to destroy this material upon the conclusion of the trial. This undertaking should be a formal Court order.

The defence expert would similarly undertake to keep the material in secure storage facilities under his or her exclusive control and that the said storage facility and overall security of the workplace would be available for inspection and assessment by the police.

Prepared by Noel Bonczoszek,
Chairman BCS-ISSG and member of the BCS Security Expert Panel

Fuente: http://www.bcs.org/server.php?show=conWebDoc.1166

Fuente de imagen: http://www.flickr.com/photos/cherly__df/2878920760/