Legal Issues for Research and Practice in Computational Forensics

Introduction

These special issues of reliability require that the principles, method, application and expert using a CF system be validated as accurate, relevant, competent and appropriate for use by a finder-of-fact to an identified level of confidence. This testing for appropriate forensic use is especially important as conclusions from the results of these systems may have serious impact on the life and liberty of individuals.

Researchers in computational forensics may be challenged as to

• i)

  the evaluation of their system against the general legal framework for evidence,

• ii)

  measurement of computationally-based conclusions against one or more tests for reliability and

• iii)

  the weight of their conclusions in a judicial determination.

Early and ongoing assessments by computational forensic researchers can guide the process, protocol and evaluation of their work to assure appropriate use in forensic environments.

“Evidence” is a flexible term with flexible application. CF evidence, as with evidence in general, may fall along a spectrum of reliability. It may be appropriate for one type of use in the administration of justice but not another. Even if it has no use in a judicial forum, such as with lie-detector testing in U.S. courts, it may have private application to guide decision-making in private settings. Assessing, quantifying and establishing the reliability of a computational forensic system is essential for its forensic use and credibility.

Background

Computational Forensics (CF) has been described as

Franke and Srihari (2007) assert that computational systems enhance forensic systems in several ways. These include production of objective, reproducible analytical conclusions, quality analysis of examination methods, examination of large data sets, visualization and pattern recognition. But they note significant concern about proper validation of computational forensic techniques to assure their reliability and the importance of a systematic approach to computational forensics, cooperation between forensic and computational scientists and continued peer -review and testing of computational forensic techniques.

Saks and Koehler(2005) note the lack of rigor in many forensic techniques, list the large error rates in some, as high as 60%-100% and advocate application of the basic research model of validation to all such techniques. Their model for proper forensic validation is that used for the validation of DNA match systems. Murphy (2007) details similar problems with adequate validation of forensic techniques, particularly with the expansion of supposedly science based methods. She notes the additional problem of proprietary forensic systems where external, third party of validation and peer review is difficult, if not impossible. (Murphy 2007)

Yet the potential for computational forensic techniques is tremendous, if not absolutely necessary for the investigation of distributed misconduct involving computing systems. The sheer scale of digital crime may necessitate the expansion of computational forensic systems for digital crime investigation. For example, Wong, Kirovski, and Potkonjak (2004) posit that computational forensic engineering of an analytical engine using statistical information can be effective in recognizing intellectual property infringement; such a computational forensic engine could overcome scale problems inherent in the enforcement of distributed infringement. Ripeanu, Foster and Iamnitchi (2002) designed and used an automated processing of the Gnutella membership protocol to map the topology of a 30,000 node peer-to-peer network in a few hours, overcoming the issue of scale. Nasraoui, et al (2008) propose a computational forensic solution to criminal contraband exchanges over peer-to-peer networks where a large number (K) of under-cover nodes serve three purposes: