ACPO Guidelines for Digital Based Evidence

 

Introduction

As the digital landscape continues to evolve, the need for effective handling of computer-based electronic evidence is more critical than ever. The Association of Chief Police Officers (ACPO) in the United Kingdom has established principles to guide investigators in the proper collection, preservation, and presentation of electronic evidence. In this article, we'll delve into the key ACPO principles and provide real-world examples to illustrate their application.

Principle 1: No action taken by law enforcement agencies or their agents should change data held on a computer or storage media, which may subsequently be relied upon in court.

This principle emphasizes the importance of maintaining the integrity of electronic evidence. Any actions taken during an investigation should not alter the original data. For instance, when seizing a computer, investigators should create a forensically sound copy of the hard drive to preserve the original state. Altering the data could jeopardize its admissibility in court.

Example: During a fraud investigation, law enforcement seizes a suspect's computer. Instead of directly accessing the files on the computer, they create a bit-for-bit forensic image of the hard drive using specialized tools. This image becomes the basis for analysis, ensuring the original evidence remains intact.

Principle 2: In circumstances where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions.

Competence is crucial when dealing with electronic evidence. Those handling the data must have the necessary skills and knowledge to do so without compromising its integrity. Moreover, they should be able to explain their actions and the significance of the evidence in a court setting.

Example: A digital forensics expert is called to analyze a computer recovered from a crime scene. The expert possesses the skills to navigate through the computer's file system, extract relevant data, and explain the significance of the discovered evidence in the context of the investigation.

Principle 3: An audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result.

Creating a comprehensive audit trail is essential for transparency and accountability. This ensures that all actions taken during the investigation are documented, allowing an independent third party to review and validate the processes.

Example: During the analysis of a suspect's computer, a digital investigator documents every step taken, from the initial acquisition of the evidence to the extraction and analysis of specific files. This audit trail provides a transparent record that can be reviewed by another expert or presented in court.

Principle 4: The person in charge of the investigation has overall responsibility for ensuring that the law and these principles are adhered to.

The principle underscores the accountability of the person leading the investigation. It is their responsibility to ensure that all actions align with the law and the established principles for handling electronic evidence.

Example: A senior investigator is overseeing a cybercrime case involving the theft of sensitive data. The investigator ensures that the team follows proper procedures, from evidence collection to analysis, and that all actions are in accordance with the law and ACPO principles.

Conclusion

In an era dominated by digital information, adherence to established principles is crucial for the effective handling of computer-based electronic evidence. The ACPO principles provide a solid framework for law enforcement agencies, ensuring that investigations maintain the integrity of electronic evidence from seizure to presentation in court. By following these principles, investigators can bolster the reliability and admissibility of digital evidence, contributing to the successful resolution of cases in the digital age.