Commentary and information about public safety and security, intelligence and counterintelligence, open government and secrecy, and other issues in northern Idaho and eastern Washington.

Location: Coeur d'Alene, Idaho, United States

Raised in Palouse, WA. Graduated from Washington State University. US Army (Counterintelligence). US Secret Service (Technical Security Division) in Fantasyland-on-the-Potomac and Los Angeles. Now living in north Idaho.

Sunday, February 04, 2007

Digital Evidence: Before the Investigators Get There

This Whitecaps post could be sub-titled "What to do before the investigators arrive." It illustrates the need for private industry to be able to recognize and preserve digital media that may contain evidence of criminal or civil misconduct.

On Friday, February 2, 2007, The Spokesman Review staff writer John Craig wrote an article headlined "S-R worker may have downloaded child porn". The subhed was, "Web employee fired after images found on two company computers". Craig's article briefly describes how the newspaper's staff discovered and then preserved the evidentiary value and admissibility of the digital evidence. A more complete discussion of the newspaper's procedures is available in the paper's "The Transparent Newsroom" blog under the headline Mud bath anyone?. Scroll down in that piece to the hyperlink "the video" and watch it. Make sure your sound is on.

The newspaper's experience shows that private sector businesses would benefit from talking with their attorney about their duties and responsibilities to preserve digital material. They should have a simple but effective process in place that prepares key employees (including all supervisors) to recognize obvious evidence and preserve it properly when necessary. In most instances, doing little is far better than trying to do too much. It is not the employee's responsibility to become crime scene investigators. It should be their responsibility to preserve, not process, digital evidence. The staff at The Spokesman-Review did it correctly.

In preparing employees to recognize and preserve digital evidence, employer training officers may wish to consult the guides prepared by the National Institute of Justice. These guides are intended for investigators and prosecutors, but the material would help a corporate training officer better understand what the company's employees should do and what they must never be expected to do. Here are links to the four existing guides: