Factors Influencing Digital Evidence Transfer Across International Borders: A Case Study

Abstract

Digital Forensics has grown out of the necessity to extract, analyse and present evidence from digital devices in support of an investigation or court case. In its early stages in the 1970' and 80's this would often relate to a computer that was not connected to any networks. The issues were therefore local and dealt with by local law enforcement agencies and prosecuted under local (national) laws. The explosive growth of Internet usage and e-commerce has resulted in a corresponding growth in international e-crime. The perpetrator of this international e-crime can be based in one country with the victim in a second country and the data in a third country. This raises the question regarding in which country the offence has occurred and under which jurisdiction it should be investigated and prosecuted. This new paradigm now means that the digital forensic practitioner may have to deal with the acquisition and presentation of digital evidence in a foreign country. This raises a whole new level of complexity regarding both the integrity of the evidence that has moved between countries and acceptance of the digital forensics practitioner as an expert witness in a foreign court. The differences in the laws of the countries involved in the investigation and prosecution of the offenders can also have a substantial impact on the digital evidence process. The purpose of this research is to identify the main factors that influence the successful presentation of digital evidence across international borders. The test of the success of the presentation of digital evidence is usually considered to be that the evidence and the digital forensic practitioner presenting the evidence are accepted by a court of law. The research commences with a review of the current literature in this area. From the review of the literature a set of 16 hypothesised main factors influencing the transfer of digital evidence across international borders is formulated. In order to test the 16 main hypothesised issues, and investigate if any other main factors exist, a case study approach is used as part of a series of unstructured interviews with digital forensic and legal professionals. A thematic analysis technique is applied to the interview transcripts to extract common themes in the options of the interviewees. The result of the research is the identification of 11 main factors that influence the transfer of digital evidence across international borders. These factors are classified in the four areas of Technical, Transportation, Standards/Qualifications/Certification and Legal. The research postulates the main areas in which the solutions to some of the issues raised by these main factors may be found. The research recognises that the area of digital forensics and the international perspective of the movement of digital evidence across borders is a new and evolving discipline. The thesis concludes with the learnings from the research, the limitations of the research and suggests four areas for future research regarding law enforcement development of digital forensic guidelines, certification of digital forensic practitioners, international standards and harmonisation of international e-crime laws,