Law and Justice

Posts Tagged ‘Police’

Product Description
The upper strata of society are harvesting large sums of cash from a crooked parole board! Parole, Inc. is a tale of dirty money and downtrodden convicts, where no one is above a payoff. As rumors of corruption swirl, g-… More >>

Copyright (c) 2008 Steve Burgess

Computer forensics practices and procedures can diverge significantly depending upon whether the investigation is criminal or civil litigation. Standards for data collection evidence can be different, as can the process of data collection and imaging. Furthermore, the consequences of the case may have dramatically different impacts.

A couple of quick definitions may be in order. Criminal law deals with offenses against the state – the prosecution of a person accused of breaking a law. These offenses may include crimes perpetrated against an individual. “The People”, in the form of a state representative (for instance, the District Attorney) makes formal charges and the accused must then face the government’s full resources. Guilty outcomes can result in fines, probation, incarceration, or even death.

Civil law covers everything else, such as violations of contracts and lawsuits between two or more parties. The prevailing party often is entitled to payment, property or services from the loser. Imprisonment is not at issue in civil cases. As a result, the standard for evidence is not as high in civil cases as in criminal cases.

For the law enforcement computer forensics specialist, a certain amount of extra care should be taken in collecting data and producing results, for the standard of proof is higher. There are advantages on the data collection end, however. For once a court has authorized a search warrant, an officer (and possibly several) with badge and gun can go seize the defendant’s computer by surprise and by force. Once the computer has been seized and imaged, all data is accessible and may result in additional charges being brought against the defendant.

By contrast, in a civil case, there tends to be a lot of negotiation over what computers and what data can be inspected, as well as where and when. There is not likely to be any seizing of computers, and quite a long time may take place between the time the request to inspect a computer is made and the time the computer is made available to be inspected. It is common for one party to have access to a very limited area of data from the other party’s computer. During this time, a defendant may take the opportunity to attempt to hide or destroy data. The author has had several cases wherein the computer needed for analysis was destroyed before the plaintiff had the opportunity to inspect. Such attempts at hiding data are often discovered by the digital forensic sleuth, who may in turn present evidence of such further wrongdoing in expert witness testimony.

Opportunities for learning techniques and interacting with other professionals may differ as well. While some computer forensic software suites and training, such as Access FTK, EnCase, or SMART Forensics are available to most who can pay, others, such as iLook are available only to law enforcement and military personnel. While many support and professional organizations and groups are available to all, some, such as the High Technology Crime Investigation Association (HTCIA) are not open to professionals who provide for criminal defense (with a few minor exceptions).

Police, Homeland Security, and other law enforcement personnel’s goal is to generate a body of evidence significant enough (presuming such evidence exists) to find the criminal defendant guilty. The standard for information presented to the court and jury in such a case is fairly high. From the time digital data or hardware is seized and acquired, Rules of Evidence must be kept in mind (Cornell University has the complete and voluminous code on its website). Law enforcement personnel must follow accepted procedures or evidence could be thrown out. Acquisition of data and discovery in criminal cases often must follow sometimes strict and differing procedures depending upon whether the jurisdiction is federal, state, or municipality and at times depending upon a judge’s preferences.

The expert in a civil case may not analyze all of the data on a computer at a very deep level Initial efforts may rather be a kind of fact-finding mission, intended to determine the value of digging deeper and at greater expense. As such, the initial presentation of data may be fairly informal, and be just enough to induce the parties to settle the case. On the other hand, the data found may be so minimal the line of inquiry into electronic evidence is dropped.

Although we use many of the same tools, computer forensic professionals in private practice and those in law enforcement are held to different standards, have access to different resources, and their work results in substantially different outcomes between the criminal and civil cases to which they contribute.

Incoming search terms:

The dogs have been let loose recently. Numerous people have been charged generally involving small amounts of cannabis and MDMA (ecstasy) as a result of over active Labradors at pubs, parties and big days out. A client who recently contacted me was apprehended walking to a dance party in the Botanical Gardens. She had in her possession, 1 joint and 1 pill. The dogs detected her and she foolishly threw away a cigarette pack containing the joint in sight of the police. As the detective was taking her 1 pill and issuing her with a court attendance notice, he blithely noted that he hoped a friend could give her a pill inside the party. Such is the hypocritical operation of drug laws in New South Wales.

What are your rights when a member of the canine constabulary shows you particular attention? The police have no power at common law to search someone prior to arrest. If you are arrested, the police can and will search you and ask you to empty your pockets and go through your clothing. Most minor drug offences are not situations where arrest would normally be appropriate.

Legislation gives the police power to ‘stop search and detain’ if they form a reasonable suspicion that you have committed a drug possession offence. A ‘reasonable suspicion’ involves less than a belief but more than a possibility. There must be some factual basis for the suspicion; reasonable suspicion is not arbitrary.

For minor drug offences the issue is what is a reasonable suspicion and how do the police get their hands lawfully into your pockets. Drug detector dogs are a relatively recent phenomenon on the streets of Sydney and for the police a very useful investigatory tool. A recent Supreme Court decision noted Rocky’s (the drug detector dog) ‘nostrils will flare and he will start to sniff rapidly and he will follow the source of the scent until he has found it.’

To what extent can the police rely on an agitated Labrador trained in drug detection to justify a search? The matter was considered by the supreme Court of NSW in 2004 in Darby’s case. The Supreme Court cast doubt on the legitimacy of the use of police dogs to routinely justify searches. The court also pointed out that having an agitated Labrador jump all over you could constitute an assault and an illegal search. The court nevertheless did not state that drug dogs cannot assist a police officer in forming a reasonable belief that an offence has been committed.

On 22 February 2002, the NSW Parliament enacted the Police Power (Drug Detection Dogs) Act (The Drug Dog Act). The Drug Dog Act continues to allow police to use drug dogs to search an individual once they have formed a reasonable suspicion that an offence has been committed. The Act also gives police wide powers to enter venues and screen persons for drugs with the aid of drug dogs.

The Act provides the police with the power to enter premises and undertake ‘general drug detection’. The police may enter without a warrant any licensed premises, a sporting event, concert or artistic performance, dance part, parade and public transport facilities with a drug detector dog. The definition includes persons seeking to enter or leave any of the above. Accordingly on the train, at the pub and at the footy, the police can put the dogs over you while you are entering and leaving. Any drug detection work conducted by the police outside of this very wide definition requires a warrant.

The issue of what will form a reasonable suspicion is still left to the courts and the Drug Dog Act does not empower the police to arbitrarily search persons. The Act gets the police into venues and gives them the opportunity to screen people. The reaction of a drug dog alone likely does not amount to a reasonable suspicion. The police are told not to rely solely on the reaction of the drug detection dog and observe very closely the reaction of the person subject to screening. If a person bolts, starts walking the other way or discards a cigarette package when detection dog’s nostrils flare in their direction this can empower a police officer to search and detain the individual.

A word of warning! You have rights and the law does provide you with some protection but you should not argue with police. It is an offence to tell a police officer to get f…ked, hinder a police officer and assault a police officer. Police routinely arrest persons for these offences. Be cooperative, do not say anything other than your name and your address and get legal advice if you are charged. There is a time and a place to challenge the police and this is at court with your lawyer. The courts will exclude evidence illegally obtained and the prosecution will fail as a result.

Most importantly stay calm. What will give you away is your behaviour. It is likely that you are not the only person at the big day out who has the smell of cannabis on their clothing. The police will generally not search and detain someone unless they give them some real reason to do so. Do not make it hard on yourself, so stay calm if and when approached and ask are you being arrested; if yes call us!