Monday, December 9, 2019
December 9, 2019
Digital Forensics in Sexual Assault Cases
Any practicing litigators and digital forensic analysts (as well as our regular readers) appreciate the value that digital evidence can add to their cases. Civil, criminal and administrative matters can all have a data component to them, for which forensic data acquisition, analysis & reporting may be necessary and valuable. The challenge when putting together a case strategy is whether or not the cost of digital forensic analysis is worthwhile to the overall case. This particular approach in the case strategy should always meet with a resounding “YES!” when working sexual assault cases. It is reported that false claims of sexual assault are five times as common as other types of crime, and the incidents at the heart of the claim are very often precipitated by text and/or picture messaging, often to a high degree, which can serve to help reveal the truth of the claim.
From One Side: The Accused
When an accusation of sexual assault is made, there is frequently a “he said, she said” factor. But before the alleged assault took place, there is often a build-up of text and/or picture messages in some form. In 2018 alone, Uber reported over 3,000 sexual assaults. All activity on Uber is facilitated via the app, including a messaging component. Uber also frequently logs GPS coordinate location while using the app. All of this is extremely valuable data when attempting to prove or disprove if the alleged perpetrator was at or near the incident location and in contact with the complaining witness and if any pre or post-assault messaging took place. But Uber is just one example…
Dating apps are another frequent data medium where activity precipitating a claim of sexual assault can take place. Apps like Tinder, Bumble, Hinge, Match, etc. all serve to match potential dates and facilitate communication prior to meeting and/or exchanging phone numbers. Several of these apps also have the ability to send picture messages. In the events where messages have been deleted in between the time of the contact and the alleged assault, a forensic data acquisition is critical to any recovery of those messages and should be performed as soon as possible after the report is made and legal authority is obtained. Additionally, these apps are all location-based, so there may be data within the app that is not accessible to the user that may help prove or disprove the claim of sexual assault.
While app data is certainly valuable, the data stored within the standard text or iMessage databases should not be overlooked. Even in cases where communication may have started on an application, very often users will transition to standard text messaging once there is a certain level of comfort. In the past several years, we have worked multiple sexual assault cases where the deleted and recovered text messaging data led to the acquittal of criminal defendants. In every case, this was because a false claim was made and ultimately proven to be false through acquisition, analysis and presentation of text message data from one location or another on the device.
As a brief note, certain app data may not be available through the forensic process and depending on the application, the recoverable artifacts can be more circumstantial than substantive (i.e., contact entries). Snapchat, WhatsApp & Signal are all very challenging, depending on the device hardware and software (iPhone vs. Android). Fortunately, mobile forensic developers are constantly working on these issues, so data that may not be available today could be available in the future.
From The Other Side: The Complaining Witness
Despite there being five times as many false claims of sexual assault as other types of crime, there still seems to be a mental block with regard to obtaining a forensic data extraction of the device(s) belonging to the complaining witness. As alluded to in our May 2016 article, obtaining the data from the complaining witness’ device as soon as possible after the incident is reported should be part of standard practice in any sexual assault claim. Why? Simply put, there are two sides to every story and as trained investigators will undoubtedly agree, the truth usually lies somewhere in the middle.
Aside from being able to confirm or refute the veracity of the claim, one party or the other may have deleted some of the pertinent data, which could prove invaluable in piecing the facts together. No matter which party’s device is analyzed, it is absolutely vital to look in all potential areas for messages. As previously stated, the accused and the complaining witness may have started communication on one medium and transitioned to another, so cross-referencing phone numbers, user ID’s/monikers and other personally identifiable information is crucial to finding and reporting all of the relevant data.
It bears noting that obtaining the data from the complaining witness’ device has not been the normal practice in cases we’ve seen. The rationale given for this is that the investigating entity doesn’t want to “re-victimize” the complaining witness. The job of an investigator and a digital forensic examiner is to ultimately find the truth, no matter where that leads. With only half of the potential data and a claim of assault, we potentially only have half of the story. This “digital PERK kit” can and will add value to the overall investigation when so much is at stake for both parties, so obtaining the data from the complaining witness’ device in the interest of truth and justice. This should also be done with a high level of discretion and with either consent or search warrant to obtain the data.
The Civil Side
The numbers of reported sexual assaults from Uber alone make it worth mentioning how vital this evidence can be from both sides, even in civil matters. If a criminal claim of sexual assault is made involving a company or app-based service provider, that claim will many times lead to a civil suit being filed alongside or subsequent to the criminal investigation. While the freedom of the accused may not be at stake in a civil claim, there may be millions of dollars involved in the claim arising from alleged sexual assault. For all of the reasons cited here, the forensic data should be acquired from both plaintiff and defendant. If data has previously been acquired by law enforcement in an accompanying criminal investigation, the same data should be requested through discovery.
Wrapping It Up
In the era of the #metoo movement and high-profile attention on sexual assaults in America, the value of forensic data as it relates to these claims cannot be overstated. Proper collection, analysis, reporting and effective testimony about the findings can often make or break a case. Ultimately, the truth is at the heart of the matter. With a universal approach to every sexual assault investigation – criminal or civil – the digital evidence can help lead the finder of fact to the truth, which means justice will have been served.
Patrick J. Siewert
Professional Digital Forensic Consulting, LLC
Virginia DCJS #11-14869
Based in Richmond, Virginia
Available Wherever You Need Us!
We Find the Truth for a Living!