Investigators still struggling to keep pace with digital evidence

The annual Digital Intelligence Benchmark Report for 2021 found investigators also lack the additional training needed to effectively use tools such as analytics.

The report, published by digital intelligence specialists Cellebrite, is based on responses from 2,000 managers, investigators, analysts and forensic examiners working in law enforcement agencies across 117 different countries.

Despite sharp falls in most crime types across some of the world’s biggest economies as a result of Covid-19 lockdowns, it found law enforcement agencies were still “struggling to keep pace, process and analyse digital evidence quickly and effectively”.

Cellebrite says the implications of not speeding up the digital investigation process for solving crimes “are significant” because, according to the study, digital evidence plays a role in almost two thirds (63 per cent) of all investigations.

Of those, smartphones were an evidence source in 96 per cent, followed by Windows computers (52 per cent), feature phones (45 per cent), tablets (39 per cent) and even emerging technologies such as wearables and cryptocurrencies (both eight per cent).

Mark Gambill, executive vice-president at Cellebrite, said: “We could see there was no improvement against many key performance indicators our industry tracks despite the dips in crime we’ve seen throughout 2020. Law enforcement’s ability to lawfully access locked devices continues to slow down investigations.

“And we were not at all surprised to see the importance of digital evidence to solving crimes clearly reflected in the data, as well as new technologies such as crypto and wearables playing a role in advancing investigations.

“Agency managers, investigators, analysts and forensic examiners didn’t have any respite last year and the situation is about to worsen as crime rates, particularly violent crime, are rising quickly across major metropolitan areas across the world.”

Investigators are spending an average of 48 hours a week reviewing photographs, recorded videos and text messages from devices, along with CCTV and security videos, and creating reports. Furthermore, they reported a five to seven-day average turnaround time to receive data and an initial report from examiners in the lab.

Ninety-seven per cent of investigators feel key evidence is missing or lost when reviewing digital data and almost half feel they miss significant amount of data from device examinations. They agreed that with so much time and energy spent on reviewing digital data, more effective tools were needed to accelerate time to evidence.

Skills shortages are also placing an additional burden on agencies that are at or above their existing investigative capacity. This “resource crunch” must be addressed by creating career pathways in policing that are attractive for “tech-minded talent” says Cellebrite.

It adds that “information silos” between different departments and IT systems, as well as with other agencies, are also slowing down the processing of digital evidence.