December 9, 2019
Digital Forensics in Sexual Assault Cases
Any practicing litigators and digital
forensic analysts (as well as our regular readers) appreciate the value that
digital evidence can add to their cases. Civil, criminal and administrative matters can
all have a data component to them, for which forensic data acquisition, analysis
& reporting may be necessary and valuable.
The challenge when putting together a case strategy is whether or not
the cost of digital forensic analysis is worthwhile to the overall
case. This particular approach in the
case strategy should always meet with a resounding “YES!” when working sexual
assault cases. It is reported that false
claims of sexual assault are
five times as common as other types of crime, and the incidents at the
heart of the claim are very often precipitated by text and/or picture messaging,
often to a high degree, which can serve to help reveal the truth of the claim.
From One Side: The Accused
When an accusation of sexual assault
is made, there is frequently a “he said, she said” factor. But before the alleged assault took place,
there is often a build-up of text and/or picture messages in some form. In 2018 alone, Uber
reported over 3,000 sexual assaults.
All activity on Uber is facilitated via the app, including a messaging
component. Uber also frequently logs GPS
coordinate location while using the app.
All of this is extremely valuable data when attempting to prove or
disprove if the alleged perpetrator was at or near the incident location and in
contact with the complaining witness and if any pre or post-assault messaging
took place. But Uber is just one example…
Dating apps are another frequent data
medium where activity precipitating a claim of sexual assault can take
place. Apps like Tinder, Bumble, Hinge,
Match, etc. all serve to match potential dates and facilitate communication prior
to meeting and/or exchanging phone numbers.
Several of these apps also have the ability to send picture
messages. In the events where messages
have been deleted in between the time of the contact and the alleged assault, a
forensic data acquisition is critical to any recovery of those messages and
should be performed as soon as possible after the report is made and legal
authority is obtained. Additionally,
these apps are all location-based, so there may be data within the app that is
not accessible to the user that may help prove or disprove the claim of sexual
assault.
While app data is certainly valuable,
the data stored within the standard text or iMessage databases should not be
overlooked. Even in cases where
communication may have started on an application, very often users will
transition to standard text messaging once there is a certain level of comfort. In the past several years, we have worked
multiple sexual assault cases where the deleted and recovered text messaging data
led to the acquittal of criminal defendants.
In every case, this was because a false claim was made and ultimately
proven to be false through acquisition, analysis and presentation of text
message data from one location or another on the device.
As a brief note, certain app data may
not be available through the forensic process and depending on the application,
the recoverable artifacts can be more circumstantial than substantive (i.e.,
contact entries). Snapchat, WhatsApp
& Signal are all very challenging, depending on the device hardware and software
(iPhone vs. Android). Fortunately,
mobile forensic developers are constantly working on these issues, so data that
may not be available today could be available in the future.
From The Other Side: The Complaining Witness
Despite there being five times as
many false claims of sexual assault as other types of crime, there still
seems to be a mental block with regard to obtaining a forensic data extraction
of the device(s) belonging to the complaining witness. As alluded to in our May
2016 article, obtaining the data from the complaining witness’ device as
soon as possible after the incident is reported should be part of standard
practice in any sexual assault claim. Why? Simply put, there are two sides to every story
and as trained investigators will undoubtedly agree, the truth usually lies
somewhere in the middle.
Aside from being able to confirm or
refute the veracity of the claim, one party or the other may have deleted some of
the pertinent data, which could prove invaluable in piecing the facts together. No matter which party’s device is analyzed, it
is absolutely vital to look in all potential areas for messages. As previously stated, the accused and the
complaining witness may have started communication on one medium and
transitioned to another, so cross-referencing phone numbers, user ID’s/monikers
and other personally identifiable information is crucial to finding and
reporting all of the relevant data.
It bears noting that obtaining the data
from the complaining witness’ device has not been the normal practice in cases
we’ve seen. The rationale given for this
is that the investigating entity doesn’t want to “re-victimize” the complaining
witness. The job of an investigator and
a digital forensic examiner is to ultimately find the truth, no matter
where that leads. With only half of the
potential data and a claim of assault, we potentially only have half of the
story. This “digital PERK kit”
can and will add value to the overall investigation when so much is at stake
for both parties, so obtaining the data from the complaining witness’
device in the interest of truth and justice.
This should also be done with a high level of discretion and with either
consent or search warrant to obtain the data.
The Civil Side
The numbers of reported sexual
assaults from Uber alone make it worth mentioning how vital this evidence can
be from both sides, even in civil matters.
If a criminal claim of sexual assault is made involving a company or app-based
service provider, that claim will many times lead to a civil suit being filed
alongside or subsequent to the criminal investigation. While the freedom of the accused may not be
at stake in a civil claim, there may be millions of dollars involved in the claim
arising from alleged sexual assault. For
all of the reasons cited here, the forensic data should be acquired from both plaintiff
and defendant. If data has previously
been acquired by law enforcement in an accompanying criminal investigation, the
same data should be requested through discovery.
Wrapping It Up
In the era of the #metoo movement and
high-profile attention on sexual assaults in America, the value of forensic
data as it relates to these claims cannot be overstated. Proper collection, analysis, reporting and
effective testimony about the findings can often make or break a case. Ultimately, the truth is at the heart of the
matter. With a universal approach to
every sexual assault investigation – criminal or civil – the digital evidence
can help lead the finder of fact to the truth, which means justice will have
been served.
Author:
Patrick J. Siewert
Principal Consultant
Professional Digital Forensic
Consulting, LLC
Virginia DCJS #11-14869
Based in Richmond, Virginia
Available Wherever You Need Us!
We Find the Truth for a
Living!
Computer Forensics -- Mobile
Forensics -- Specialized Investigation
About
the Author:
Patrick
Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based
in Richmond, Virginia. In 15 years of
law enforcement, he investigated hundreds of high-tech crimes, incorporating
digital forensics into the investigations, and was responsible for
investigating some of the highest jury and plea bargain child exploitation
investigations in Virginia court history. Patrick is a graduate of SCERS, BCERT, the
Reid School of Interview & Interrogation and multiple online investigation
schools (among others). He is a
Cellebrite Certified Operator and Physical Analyst as well as certified in
cellular call detail analysis and mapping. He continues to hone his digital forensic
expertise in the private sector while growing his consulting &
investigation business marketed toward litigators, professional investigators
and corporations, while keeping in touch with the public safety community as a
Law Enforcement Instructor.
Email: Inquiries@ProDigital4n6.com
