Archive for June, 2011

Juries vs. the Internet – time for a change ?

Posted on June 13, 2011. Filed under: forensic | Tags: , , , , , , , |

This story caught my eye this morning : http://www.telegraph.co.uk/technology/facebook/8571855/Juror-in-Facebook-contempt-prosecution-after-contacting-defendant-during-trial.html

It highlights one of the problems we have with jury trials in the age of pervasive technology. It is only natural for someone involved in deciding the fate of another to want to obtain as much information as possible so that they can be sure they’ve made the right decision. No matter how often a judge reminds a jury not to discuss the case and not to attempt to carry out their own research or to make contact with anyone else involved in the case, the temptation to “break the rules” must be almost overwhelming.

This is particularly true when complicated scientific or business evidence is involved. Much of it can be so obscure to the uninitiated that they feel they cannot hope to understand it without help, but that help is not provided to them, so they go off and do their own research – using untested, unapproved and unvalidated sources. Either that, or they believe what they’ve seen in the mass-media and we get the results of the dreaded “CSI effect” creeping in.

Perhaps its time we revised the jury system – not to abolish them, and not to have expert jurors only, but to give them access to court-approved sources of information in the jury room. Independent advisors, completely isolated from the trial materials, who can speak on the underlying principles of the technical evidence, seeking permission from the court before commenting and keeping rigorous notes of everything they discuss so that all parties can be fully aware of the issues being raised by the jury. Of course, jurors might need to be kept in isolation to prevent them seeking the extra information anyway, but perhaps having a source “on tap” in the jury room could help speed up their deliberations by giving them confidence that they know the whole story.

Of course, it might lead to longer trials, but that could be a price worth paying if we  can eliminate uncertainty and reticence to make a decision introduced by jurors who feel they need more information or worse, hurried decisions made by those who already think they know it all.

Read Full Post | Make a Comment ( None so far )

It’s the little things

Posted on June 8, 2011. Filed under: forensic | Tags: , , , |

A while back I was asked to help out with a fraud case. The investigators had done a pretty decent job of extracting relevant information but a critical aspect of the hinged on the dates when a couple of letters were written. We had some issues around the way a disc image had been captured which meant that everything except the “last modified” date was considered unreliable.

These letters had been written in word and the timestamps in the filesystem were about 2 years AFTER the dates in the text in the documents. The meta-data in the documents agreed with the filesystems.

The defence experts, quite rightly, put forward a suggestion that the computer used to create the documents could have had an inaccurate clock, possible even set to a future date. Unlikely, in my opinion, but possible and probably enough to create “reasonable doubt” if the evidence came to court.

However, as we explored the issue further and got further and further into the niceties of Windows XP clock synchronisation using NTP when connected to the Internet something in my subconscious prodded me.

Just out of curiosity, I ran the GNU “strings” program against one of the documents and out popped a couple of JPEG JFIF headers. so – I carved out the two JPEGs and checked the EXIF data. Both contained dates which matched the filesystem – hardly surprising and not much help countering the “clock was wrong” argument – but they also contained a signature from the program used to produce them. It was a version of photoshop which wasn’t produced until at least 18 months after the dates in the letter text.

Either the suspect had been indulging in time travel, or the letters as printed must have been created some time after the date he claimed.

Sometimes, we forget that there’s more to timeline analysis than just the clock data. Knowing when a piece of software or a file first appeared can be very helpful too.

http://www.n-gate.net/

 

Read Full Post | Make a Comment ( 2 so far )

    About

    This is the weblog of Angus M. Marshall, forensic scientist, author of Digital Forensics : digital evidence in criminal investigations and MD at n-gate ltd.

    RSS

    Subscribe Via RSS

    • Subscribe with Bloglines
    • Add your feed to Newsburst from CNET News.com
    • Subscribe in Google Reader
    • Add to My Yahoo!
    • Subscribe in NewsGator Online
    • The latest comments to all posts in RSS

    Meta

Liked it here?
Why not try sites on the blogroll...