Ethical Issues Of Digital Forensics

In today’s world, technology is perpetually growing at a rapid pace and, while its advancements often improve the lives we are living and are becoming more useful, often times they are advancing faster than we can be prepared for. In fact, a lot of people don’t realise just how quickly it’s developing, so how can one be ready? A key example of this problem is in the field of Digital Forensics. Digital Forensics is “the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law”. While Digital Forensics has proved itself to be not only beneficial, but in some cases vital, to a lot of modern investigations, we don’t yet have the necessary laws and standards of practice to ensure it is used ethically and reliably. Two of the main problems we face in relation to Digital Forensics are improper use of technology and handling of evidence, and the ethical dilemmas faced in carrying out procedures. To date, there is no code of ethics regarding Digital Forensics. As Digital Forensics is still a relatively new concept, it is mostly up to the practitioners to decide on the ethical and reliable actions. However, sometimes these people are not capable and therefore should not be trusted with making these judgements. Ethics is subjective, so many different people will have completely differing opinions about what is the ethical course of action in a situation.

I am of the opinion that set of guidelines or laws to be followed is necessary and overdue. Digital forensics now plays a major role in the justice and legal system as the evidence obtained can have a great influence on court cases and therefore affect their outcome in many ways. In the investigation of the death of Caylee Anthony in Florida, to give one real life example, Digital Forensic software by John Dennis Bradley was used in the investigation and showed that the murder suspect had web searched ‘chloroform’ eighty four times on her computer. This “evidence” was potentially incriminating and, had it been used to prove the suspect guilty, could have resulted in the death penalty. However, Bradley later discovered a flaw in his software which proved the initial finding untrue as the suspect had only web searched chloroform once and the website consulted offered information on the use of the compound in the 1800s. He immediately made this flaw clear to prosecutors and police. The suspect was later acquitted of the crime, however, the evidence obtained from Digital forensics could have resulted in a completely different outcome. It is vital that the software used is verified and a standardised protocol is put in place to avoid mistakes like this.

The lack of a code or law in regard to the ethical side of Digital forensics can, and has, led to some unfortunate situations wherein an individual has used their knowledge and ability to hack a website or computer for good reasons, but their actions were technically illegal. Oftentimes these situations lead to unnecessary and frustrating altercations. For example, if someone were to hack a computer that has unauthorised control over other computers via a virus with the intention to release this control, while their intent is morally in the right place, it is still illegal, and they could be held accountable in court. A notable instance of this dilemma is the security breach of ‘First State Super’, an Australian financial service website. When logging into his own account with the website, Patrick Webster discovered that he could easily access the accounts of others by simply changing the unique ID number in his own URL. This lack of security could enable one to access another person’s confidential details including full names, addresses, email addresses, membership number, age, insurance information, superannuation amount, fund allocations, beneficiaries and employer information. With this information an individual could quite easily commit identity theft. To obtain evidence of this security breach to present to the company, Webster wrote a script to go through the ID numbers in the URL and download relevant information to his computer. Upon initially informing the company of the problem with the information he accessed, he was thanked by several staff members. However, less than a month later he was contacted by police and the company’s law firm who both told him that his actions constituted a breach of the Crimes Act and Criminal Code Act and that he may be held responsible for relevant costs. Fortunately, since then the company have reviewed their security systems and no action has been taken against Webster. This shows that the current laws don’t protect those carrying out ethical yet illegal actions.

In 2016, Seigfried-Spellar and Gilliland hosted a workshop at the American Academy of Forensic Sciences annual conference. To the workshop they invited professionals of digital forensics with the intent of sitting down and discussing the need for a professional code of ethics in digital forensics. The end result was members of the community agreeing there was a lack of a universal, professional code of ethics in digital forensic which is needed in today’s world. Despite this, there are still substantial obstacles in the way of creating one. For instance, what exactly would it cover, who would be expected to enforce it, would the code apply to all practitioners or just those officially processing it and who would be tasked with writing it? All these queries would need to be addressed to even begin the process of creating a code. While an early attempt was presented at the development of a code of ethics for digital forensics, it must be accepted that this is only the beginning and there is a long way to go yet.

In my personal opinion, despite the difficulties that will be faced in the attempt to write a code of ethics for digital forensics, it is highly possible as fields such as law and medicine have universal, effective codes of ethics backed by the government. However, both of these fields have organisations by which they are governed and back their code of ethics. This is what the field of digital forensics is missing and requires in order to make the necessary changes.

To sum it up, digital forensics is one of many fields that requires a code of ethics because of how influential it can be on the lives of others, such as defendants of court cases. While in an ideal world, the practitioner would be trusted to make ethical decisions and would always make the morally right decision. However, this is not the ideal world and practitioners can easily take advantage of their power and may sometimes carry out morally corrupt actions. It is about time a universal association is set up to govern this field and to ensure a code of ethics and standards of practice are finally decided on and followed. The code should attempt to cover a number of possible situations and protect those whose intentions are ethical. Digital forensics is no longer a new field so there are very few excuses for the lack of a set code and standards of practice.