Friday, February 20, 2015

Digital Forensics & Mental Health



February 20, 2015

Digital Forensics & Mental Health

As a former law enforcement officer, tactical team member and child exploitation investigator, I’ve certainly seen my fair share of gruesome car accidents, injuries, violence and child victimization.  And while the police generally get quite a bit of attention with regard to the concerns of Post-Traumatic Stress Disorder, seldom (if ever) are the civilian counterparts in digital forensics afforded the same considerations.  I’d like to user this forum to start changing that mindset, if even a just a little.

Background

Soldiers, medics and front-line combat personnel certainly see some of the worst man has to offer.  From wounded comrades to children being used as homicide bombers, the horrors of combat have been well documented throughout history.  One of my personal role-models is Lt. Col. Dave Grossman, whose written works “On Killing” and “On Combat” break down the stigma typically associated with the “John Wayne” and Hollywood imagery of combat and tell the truth about how traumatic combat really is.  From men displaying acts of pure cowardess to defecating themselves, these actions are real, physiological symptoms of operating in a high-stress environment, such as combat.  In civilian law enforcement, it’s often reported that a very high percentage of officers involved in combat situations in which they had to kill or seriously wound another person don’t work in the field much more than a couple of years after the incident.  The very fact that police officers, firefighters & combat soldiers receive hazardous duty benefits means society has deemed their positions not only of higher value than other public servants, but that they also have a high propensity for danger.  This is why I would cringe whenever another police officer would tell me to “stay safe.”  There’s nothing safe about these positions.  If you want safe, go work in a library.

The almost inevitable fallout from working these positions is some sort of psychological damage, most commonly referred to as Post-Traumatic Stress Disorder or PTSD.  While it’s often the butt of jokes from people who have never worked in dangerous situations, it’s also a real phenomenon.  For example, I have two friends & former co-workers who responded to a domestic dispute that turned violent.  The aggressor in the situation grabbed his pistol and began shooting his family members, then at my friends as they arrived at the house in response to frantic 911 calls from the shooter’s family.  One of my friends had to shoot and kill the man who was about to shoot and kill him.  The other friend shot at the man from a distance, but they both delivered deadly force.  This incident occurred over 4 years ago.  One of my friends is still in law enforcement, the other is not, but they bond over the incident and speak to each other yearly as a reminder of how fortunate they are to be alive after that day.

The stress of combat isn’t the only environment where a public safety practitioner can fall victim to the psychological effects of trauma.  As a child sexual exploitation investigator, I would routinely work in an undercover capacity chatting online with grotesque, sick men (yes, they were all men) who consistently talked about doing horrible, vile things to a person they thought was a young girl (age 13) - from rape to incest & marriage to pregnancy.  In addition to those cases, I would routinely attempt to identify and arrest people involved in the trading of child pornography images on the internet.  These images are not of 17 year-old girls, they are of small children, sometimes infants, being bound, drugged, raped, molested and violated in acts you can’t even imagine.  These acts are recorded then traded and shared amongst people with similar interests.  Initially, I would investigate these cases, view only what I had to in order to make the case, then submit the evidence to someone else for digital forensic examination.  As time went on, I became responsible for not only the investigation, but the computer forensics portion of the cases as well.  This meant my exposure increased from a moderate percentage to almost 100% in every case.

Forensic Examiners in the Weeds

In many ways, the forensic examiner has it worse than the investigator.  In order to get a complete picture of the evidence for court, it must ALL be examined, not just the parts that are good enough to make a case.  I recall one case (referenced here: http://prodigital4n6.blogspot.com/2015/01/case-study-commonwealth-v-emanuele.html) where there were not only mountains of child pornography images, but terabytes of adult pornography and bestiality images too.  As the forensic examiner in these cases, once the images are viewed, you can’t un-see them.  Some of them are so vile and disgusting, they make you gag.  These images get emblazoned in your memory for a time and the best thing you can do is take a break from the work and try to let the memory fade.  The repeated exposure to these types of images had an effect on my marriage, my relationships with co-workers, my overall attitude and my desire to keep working.  The argument could be made, much like officers involved in deadly force incidents, that the PTSD effect from repeated exposure to images like this led to my eventual departure from law enforcement.  If that isn’t textbook PTSD, I don’t know what is.  Over the years, I attempted to talk about my haunts with a couple of different counselors, but it’s hard to relay the horror of things to people who don’t even want to know these evils exist.

If you are a digital forensic practitioner and you’re reading this, you may be thinking, that’s what we have hash sets of known child pornography for – so we don’t have to view all of the images.  While this point is very well taken, many cases still require those involved in the process to view and verify the images, regardless if they belong to hash sets of known child victims.  This is also why we show images to judges & juries at trial.  An alpha-numeric string doesn’t adequately relay what the image contains.  Not even close.

Agencies like the FBI do have measures in place to ensure the mental well-being of their agents, especially those involved in child exploitation investigations.  I do not know, however, if the same considerations are offered for civilian forensic examiners employed by the FBI who are unquestionably exposed to more of these images than the agents themselves.  Examiners have to look at it all, that’s the only way we can know what really happened.  I worked at a smaller rural agency who not only didn’t give any consideration to the stress the repeated exposure had on mental health, but denied several attempts for us to join forces with the FBI task force, which would have offered us the opportunity for yearly psychological evaluations and access to counseling.  I’m forced to wonder if this phenomenon is present for other child exploitation task force officers employed by smaller, local and/or rural agencies.  With all the political and monetary capital being fed into national child exploitation investigations and state task forces, how much is being set-aside to ensure appropriate mental health of the investigators AND the forensic examiners, whether they be civilian or sworn?

Conclusion

There is a trend afoot in the world of digital forensics in law enforcement.  The movement is progressing in many areas to transition the role of a digital forensic examiner away from sworn law enforcement officers and move toward an all-civilian digital forensic work force.  Why, you may ask?  To save money.  But what is the cost in terms of human capital when examiners get burned-out, stressed-out, over-worked and perhaps even sloppy because they are exposed to things that most people should never see?  It can be very hard for some people to remain consistently objective under those circumstances.
Perhaps it’s time to consider adding civilian digital forensic examiners to the statutory list of public servants who are afforded certain considerations because of the hazards their job exposes them to.  Do civilian examiners have to kick open doors and handcuff people? No.  But their job on the back-end of an investigation is just as important as the investigator and they are often exposed to much more psychological trauma than investigators.  

The job of a digital forensic examiner isn’t glamorous (despite the new CSI: Cyber series).  It is interesting, challenging, ever-evolving, fascinating and valuable.  I love it no matter who my “client” may be because I get to pursue the truth in every case.  But maybe it’s time for administrators to stop counting beans and start caring about the people doing the work. 

As a close friend of mine who is a retired Trooper once wisely said, the command simply doesn’t exist without the rank-and-file.

Author:
Patrick J. Siewert, SCERS, BCERT, LCE
Principal Consultant
Professional Digital Forensic Consulting, LLC
Based in Richmond, Virginia
Available Globally
Web: www.ProDigital4n6.com
Twitter: @ProDigital4n6