Examination of witnesses

Professor Sarah Morris, Jake Moore and Steve Rick.

Q81 The Chair: We are starting our second session with three witnesses. We have Professor Sarah Morris, a professor of digital forensics at the University of Southampton; Jake Moore, a global cyber security adviser at ESET; and Steve Rick, the CEO of Forensic Analytics. You are all very welcome. As you know, we are looking into forensic science and its importance for the criminal justice system in England and Wales. In this session, we are interested in digital forensics and AI in particular.

By way of introduction, could you each outline your own experience of and role in digital forensics? We would really like to know what you make of the huge increase in demand for digital forensics. Do you think that things have improved since 2019, when we did our last inquiry? At that stage, we were concerned about the rapid rise in digital forensics.

Professor Sarah Morris: Good morning. I am a professor of digital forensics at the University of Southampton; I have been there for three years. Before that, I was at Cranfield University for most of my career. As well as traditional academic work, I also do operational activities with the police and other agencies, both in the UK and across the world. I run a lab called SherFox Labs, which is mostly practitioners, where we do casework research and run CPD for law enforcement.

I have a PhD in digital forensics and an undergraduate degree in AI. I am proud to be a Churchill fellow this year; I am looking at the impact on digital forensic practitioners’ mental health. I will be going over to America next year to explore what it is doing and why its retention is so much better in this space.

On the landscape, I feel that there are a lot of changes—some positive but mostly negative, I am afraid. I feel that accreditation in particular has forced out a lot of the practitioners with whom I worked six years ago, either through not being able to afford it or because it takes too much time. For those who cannot afford it—the sole traders—the fact is that they cannot get insurance cover moving forward. There is a broader range of devices, which I know we will come on to; that is having an impact on where people are going and the amount of work, tools and technical skills required.

There is also a massive mental health problem in digital forensics. We are losing both people who have started and did not realise what they were going to have to see and those who have been doing it a long time and eventually cannot take it any more. Sadly, that sometimes ends with people taking their own lives, hence my decision to apply and receive a Churchill fellowship.

In summary, I would bring out a couple of real positives in the landscape changes since I was here six years ago. The introduction of a chief scientific adviser for policing is one of the most positive changes in terms of really bringing forward the science and technology profession, including how we are considering science and technology in policing and forensics.

The Chair: Thank you. Jake, would you like to introduce yourself?

Jake Moore: I spent 14 years with Dorset Police. I spent 10 of those years in the digital forensics unit; in the last two years in that unit, I led a team of fantastic forensic examiners. I then joined the cyber crime team as it started, where we were learning as we went and incorporating all things to do with forensics and cyber crime in terms of the police and how we could best protect the public.

Echoing what Professor Morris said about people leaving the service, I left the police force and joined an international cyber security company purely because I wanted to best protect the public. I felt that protection and prevention was, unfortunately, better than locating evidence and putting people through court. My time at court then was notably less than when I first started in that department.

I have been involved in high-profile major crime cases. Now, though, I emphasise anything to do with studying what I call future crimes. I spend a lot of my time researching AI, in particular deepfakes, and educating people—in particular, businesses, but the public as well—on my work in terms of their understanding and what to look for in this improving area of technology.

The landscape is underfunded. We have seen this. There is little in terms of resources and money for education, with police forces up and down the country still struggling with that lack of resources and money.

The Chair: Thank you; we will come on to that, I am sure.

Steve Rick: I thank you all for inviting me and giving me an opportunity to contribute. I am conscious that we sit between you and lunch, so we obviously need to be—

The Chair: Do not worry about that.

Steve Rick: Let me talk a bit about Forensic Analytics. We are quite a niche business, but we are at the real epicentre of digital forensics. Forensic Analytics is based in the UK. We were founded in 2013, so we are still quite young. It was three men in a garage, in essence—I am not joking. We are owned by our founders and staff, and we are headquartered in Letchworth in Hertfordshire, although we have an office in Edinburgh, where I am based. We employ 70 people—all data scientists, technologists and other professionals—most of whom have a law enforcement background. The firm specialises in digital forensics—in particular, digital forensics relating to mobile phones and cell site analysis, which are a large part of many cases. We provide digital forensic software, which we create ourselves. It is used by the majority of police forces in the UK. I would challenge what one of the previous witnesses said about it being expensive; it is not. I can say a bit more about that.

We provide forensic radio frequency surveying tools. I was in Australia for the past two weeks. In all the cities I was in, we undertook radio frequency surveys for the police forces there. We also provide professional services. This includes providing expert witnesses; again, that is predominantly for the prosecution, but we do also work on behalf of the defence.

Our services include creating forensic software—most notably, our CSAS software—and we provide City & Guilds-accredited training to more than 2,500 police officers, digital media investigators and analysts every year. We are increasingly providing training in the USA to law enforcement agencies, in particular to district attorneys, and in Australia, where I have been for the past couple of weeks.

Our forensic services are predominantly expert witness testimony in court for complex digital evidence cases and data interpretation from call data records and network logs. One case we looked at when I was in Hobart on Friday morning had a million lines of data in it; I can say a bit more about that, but it gives you an idea of the scale. We also do cell site mapping and geolocation analysis for criminal investigations—again, that is widely used—and independent case reviews, so we provide a lot of reviews of police evidence before it goes to court.

Beyond services, we play a pivotal role in shaping industry standards as a founding member of the Association of Digital Forensic Services Providers, or ADFSP; that is a bit of a mouthful, but it is a collaboration between all the providers of digital evidence in in the United Kingdom. We also collaborate with academia, including University College London. I know that Ruth Morgan presented evidence to this committee quite recently—

The Chair: I am sorry to interrupt you, but can you be a bit more brief? We have a lot of questions for you.

Steve Rick: Probably the most important things for me to talk about—I know that you are going to talk about accreditation and regulation; I can cover those later—are market realities and sustainability, which have been constrained since 2019. Progress on the recommendations that this committee made has been limited, partly due to external factors such as Covid and partly because procurement is painfully slow and disjointed in many cases. I have plenty of examples of that, even from the past couple of weeks.

Our unique situation as a software and service provider makes it possible for us to deliver forensic services at market rates but heavily subsidised by our internal mutually reinforcing model of developing a software, selling the software and providing expert witness services.

The Chair: Thank you very much. I apologise for trying to speed you along there.

Steve Rick: Not at all.

Q82 Baroness Young of Old Scone: I remember the day we went to see the Met Police during our previous inquiry. We saw room after room of blokes staring at screens; that was the digital service. How has that changed? What more needs to be done to ensure that the collection, storage, availability and analysis of data are as modern as possible? From your international experience, which countries do those things well?

Steve Rick: Let me start with the second part of that question. We in the UK have a habit of getting the hair shirt on and having a damn good wriggle around in it. From my experience—particularly in the United States and, most recently, in Australia—I would say that the UK is quite a long way ahead of what is going on in the US and Australia. In Australia, they still predominantly use Excel spreadsheets, Google Maps, highlighter pens and so on.

Let me come back to the Met, which is one of our largest customers. On the first part of your question, I do not think you will see just a lot of blokes there any more; the gender split is probably more equal. The Met is a very advanced user of digital forensic technology. Its recent work with facial recognition cameras is a really good case in point. It is to be commended. It uses our software and has been using our software for a number of years.

We have seen the emergence of two classes of users in large forces. Let me take the Metropolitan Police as one example. You have the digital media investigators, who are the warrant card-carrying officers; Jake was one in a previous life. They triage cases and come to conclusions very quickly. That has allowed the analysts in a unit called MO2, which is staffed by hugely experienced and high-quality analysts, to undertake work on the more complex cases.

I commend to you two well-written and well-presented case studies on the College of Policing’s website. The first is Operation Atlas, which concerns the pursuit of perpetrators of violence against women and girls, in particular stalking and harassment. Previously, the charge rates were running at around 6%; the operation has driven those charge rates up dramatically to beyond 55% or 60% and, in some cases, even higher than that. This has been achieved by relatively young and inexperienced officers having access to digital forensic tools, such as our CSAS, in order to undertake an investigation, put the perpetrator in a custody suite and, within an hour or two, get a charge. Charge rates are going through the roof.

The same is true of Operation Orochi, with which I think all of you will be familiar, about county lines drug gangs. It has a stunning track record, and a number of other police forces are collaborating on this as well.

Baroness Young of Old Scone: Perhaps I could turn to Professor Morris and Jake. Is that your verdict, or do you have a different perspective?

Professor Sarah Morris: The Met is an interesting example of an approach, but there is still a very disjointed ecosystem across the different police forces, particularly in terms of the ability to store both data and hardware—the digital devices. Although mobile phones are quite small to store, when you are talking about big tower PCs, pieces from vehicles or alarm systems, these require physical storage that is suitable for a digital device in that it keeps it both secure and in good condition.

Then you have the actual data. No one is deleting anything any more—we are just keeping more and more—so there is more to go through, and people are bringing more devices to you. Then there is prioritisation, which is creating more of a backlog. The Met is an example but, in some forces, particularly smaller or less well-funded ones, it is a very different story.

Jake Moore: There has been a huge increase in investment in triage, where we would try to get the data off relatively quickly, but we are continually battling with the tech companies—Apple and Android—as the encryption of said phones is increasingly more proactive for the user. Therefore, triaging a device immediately—that is, within 24 hours—can be very challenging, even with the help of GCHQ. Generally, we have to wait until it has in effect been jailbroken, which is when you are able to get through that operating system, but that takes time.

As you have heard, the more data we keep, the more terabytes it generates—so, it takes large amounts of space. We have to store that somewhere, but that is expensive. I do not think that is a cost we should be considering as an option; it should be a given, because we need to store that data. Triage looks at data that effectively has not been deleted yet, so it is a quick process, but storing data and going through deleted data—if it is there—require huge amounts of space.

However, the biggest problem we have seen in the past few years has to be encryption. It has caused huge headaches for police forces—the Met or whoever; it does not matter—all over the world. Encryption is a good thing. We need encryption—without it, we do not have the internet—but, equally, it is about battling those who are not going to give away codes to open those devices because they understand that, by opening those hard drives and other devices, things will be worse for them than just keeping quiet.

The Chair: I think that our witnesses have answered the questions on the storage of data.

Baroness Walmsley: Pretty much, but I have a little question. You talked about encryption. Obviously, that can be a problem when you are going after the bad guys, but there is also a privacy issue for non-criminal members of the public. How do you manage to untangle the two?

Jake Moore: First, that is a brilliant question. This is a balancing act. However, we need to offer such encryption to all devices to keep that privacy first. If anything is spoken about what we would normally call a back door, we break the trust, privacy and security of those channels, whether it be communication or stored data. We cannot allow anyone to have that back door because, if we, as the good guys, can be given that key to open such data, you are putting at risk hugely the criminals who will inevitably abuse that entry point.

Q83 Viscount Stansgate: My question is specifically for Professor Morris. Much of your research has focused on the wide range of devices that need to be analysed. How can digital forensics possibly keep up with the shifting landscape, the development of new devices, the umpteen million software upgrades every day and the world in which we now live?

Professor Sarah Morris: That is a very good question. It is hard. It is one of the reasons why the majority of digital forensics is firefighting things as they come up, because you cannot possibly cover all of the devices, updates and changes. There are too many digital devices everywhere now. I am in a fortunate position: when people come to me to ask me to do a case for them, it is normally the weird or the wonderful. I get the washing machines or the adult devices and things; I do not tend to get run-of-the-mill mobile phones.

However, given the breadth of the landscape, there are a couple of dangers. There is a danger that we are becoming very reliant on tools in some areas. Tools will not cover the breadth of devices—particularly the cheaper ones that you can get, which are less named brands—and will not keep up with the updates.

We also tend to focus on a particular kind of device. Mobile forensics is, as we have heard, incredibly big—as it should be, but not at the expense of other areas. We have started seeing more from Ring doorbells, doorbells in general, alarm systems and home assistants. These all provide valuable evidence, depending on the kind of crime or the investigation that we are doing. I guess what I am saying is that it has to be dependent on the case. You could not cover everything all the time and keep up; there are not enough hours in the day, I am afraid.

Q84 Lord Stern of Brentford: You have already touched on some aspects of this question but what we are trying to understand is how much is done inside, how it is chosen and when the choice is made to go outside. How does the market work for those outside supplies? You heard earlier that, on the physical side, there is the problem of market domination. We were told that, on the digital side, a bigger proportion is done in-house; I hope that that is a reasonable description. Given that, how does the market on the digital side work? It seems that there is a rather larger number of suppliers but a smaller fraction of the demand is sent outside.

Steve Rick: I can tackle that first. From our experience, it is made up of a lot of companies like ours—small to medium-sized enterprises—and it is lots of niche. Within digital forensics, there is not one category. Our original specialisation was in the analysis of data from cellular phones but we then started to bring in things such as vehicle telemetry; every car now has multiple SIM cards and so on. This also included bringing in other data types such as ANPR camera data.

There are other digital forensics businesses out there. You have heard references to the kiosks that are widely used. There are two or three major international providers of those, principally speaking; Magnet, Cellebrite and MSAB are well-known providers. Then there are other providers looking into the work that Sarah and her team research. In our area of expertise, probably only about six companies worldwide are able to provide the software to undertake analysis of the vast volumes of data held on cellular phones. In fact, we are the only ones—

Lord Stern of Brentford: Is it genuinely a world market? Might a police force have a look around, see what is possible and go to the US or wherever?

Steve Rick: Yes. We have had a couple of examples in the UK. The operating model in the United States is very different to that in the UK. We have representation on the two standard bodies. The US does not exactly have standard bodies like we do in the United Kingdom. It does not have a forensics regulator, but it has two specialist groups: the Scientific Working Group on Digital Evidence, which meets two or three times a year and on to which two of our founders have been drafted; and something called the International Association of Chiefs of Police, which, although it has an international front end, is largely American. Again, we have representation on the technical standards group of that body. The American providers tend not to back their product from crime scene to courtroom. They do not have providers in the UK or that forensic evidential capability, so it tends to be incredibly variable.

Lord Stern of Brentford: Professor Morris and Jake Moore, do you think that police forces should be contracting out more on the digital front?

Jake Moore: For me, it is a budgeting issue. It is extremely expensive. When we used to outsource, it was usually to do with capacity surges. Let us say that many people in a gang or a particular group have been arrested and all their devices need imaging—that is, searching through. Each device would come with a cost. There may be some sort of deal with more items but, of course, it is extremely costly. There is also a mix of in-house police units across the UK, so it can be different throughout forces depending on how big each force is. Dorset was a small force, so we had only a small number of examiners. When we had a high-profile murder, say, we would have a lot of support from around the UK but we would rarely go out of the UK for such extra help.

The Chair: Could you hazard a guess as to the extent to which police forces handle digital forensic evidence in-house, as opposed to contracted out? What is it, roughly?

Jake Moore: Ten per cent would be outsourced.

Q85 Lord Burnett of Maldon: You have described a little how the system works but the reality is that, for digital forensics, you need highly-trained, experienced and capable experts—individuals who are well able to learn new things on an almost daily basis. You are not the only part of the digital ecosystem that is trawling the market for people with those skills. My question is on whether digital forensics can attract suitable talent. Are you able to pay well enough, given that there are other—and, I suspect, much richer—organisations looking for comparable talent?

I am interested in what happens not only in the private sector but in the police. Perhaps we could start with Professor Morris, on the academic side, then morph into the private sector perspective.

Professor Sarah Morris: The students I teach who want to go into digital forensics are often not motivated by cost. They are often excited by what they have seen on TV or what they think the investigations are going to involve. Often, the aspiration is to go into policing first. Those who meet the security requirements will do so, even though there is a lower financial reward than they could get elsewhere—in industry, potentially.

The problem is that we then have to put them through a variety of expensive certifications and training, which make them very poachable by industry; it can offer substantially more than policing in terms of pay and other benefits. Often, I see people go in for a few years then move to industry to work in the private sector.

Again, coming back to mental health, although we can attract them, they do not necessarily understand what they are getting into when they go in. There is no amount of preparation for some of the awful things that we have to see. Simply being told that you are going to see bad things or abusive images does not prepare you for the reality. There is also the impact of seeing not just illegal things but a lot of legal material and cases where someone is not wholly a horrible person. You will see good and bad and realise that these people could be normal humans on the street. That impacts on retention, which is as much a problem as attraction.

Jake Moore: To add to what Professor Morris said, I have been in the police force and moved to industry, but for a few reasons. Pay could, of course, be improved. It may sit better at a different scoring system. With the typical police staff system, for example, it is done through letters of the alphabet and does not have much movement. We could move away from that. There is so much competition in the tech industry for those skilled practitioners.

However, as Professor Morris said, there are other reasons and motivating factors for why you would want to join the police. For me, it was exciting. You get a wonderful buzz in the police force, especially when you are part of a high-profile case. That in itself was worth money to the people with whom I was working because the excitement is part of it, although it may not be as fast-paced as what we see in the movies. That can, in effect, allow for some wiggle room in pay.

Baroness Neville-Jones: Job satisfaction is the answer to that, is it not?

Jake Moore: Moving on, there is potentially only a certain length of time during which you can work on, say, front-line digital forensics. When you are viewing extreme material, it is only a certain amount of time before you have to move on. As there is little progression in career and pay in police forensics, it seemingly pushes people into industry, but they are at a time when they want to improve their pay, so it tends to be a young person’s position. Rather than retaining people, because we will be unable to do so past a certain age—and when they want to look for high amounts of money—it is about getting the right people in but continuing with those courses that are on offer, which are fantastic. The courses that I was given for free were excellent, but industry does not always maintain or even offer them. It is about that balance but, given the excitement of forensics, not much else can offer that delivery.

Lord Burnett of Maldon: Mr Rick, briefly, do you have anything to add?

Steve Rick: Yes—two things. Our staff come from two areas. We often get police officers who have done their 30 years of service. They cannot add much more to their pension and are looking for something aligned to policing; we have a number of our staff from that area. We also have a small but important number of younger police officers who found the shift systems and changes of leadership difficult to cope with and—despite my best efforts to persuade them otherwise—come into the private sector. That was challenging and there were high risks, but they have joined us and made a big contribution.

The other thing is that we work closely with Anglia Ruskin University and UCL to provide placements for master’s students; we have hired a few of them as well. That is refreshing the talent pool. On pay, I agree with Jake: we are very much a purpose-driven organisation with a strong ethos of public service. We do not attract people who are motivated purely by cash.

Q86 Lord Burnett of Maldon: That is reassuring to hear. I have a discrete question for you, Mr Rick, which concerns accreditation. We are interested to know how accreditation works, particularly because we understand that your company went through the process relatively recently. Why did you do it and how did you find it? Are other companies doing it? Does it present a barrier to new entrants and smaller companies? Think back to your time when there were three of you in a garage trying to get the accreditation.

Steve Rick: When I made the decision that we would pursue that, I was not the most popular person in the business.

Lord Burnett of Maldon: That is because it is time-consuming and expensive.

Steve Rick: It is time-consuming but absolutely essential. If you ask the 900-odd sub-postmasters who were caught up in the Post Office Horizon scandal, they would probably agree that the quality of the digital evidence that was submitted was fundamentally flawed, as were the investigations. So accreditation is absolutely essential—for heaven’s sake, the legislation was published back in 2021, and we had numerous consultations. Everyone had plenty of time to get their act together but a lot of people stuck their heads in the sand and hoped that it would go away.

Three of our partner organisations specialising in expert witness services and cell site analysis for geolocation were part of the pilot scheme; we worked closely with them. We started to understand some of the challenges. What it forced us to do was write everything down and have standard operating procedures and operating models—that is, test and retest and, for the scientists in the room, achieve test-retest reliability results based on ground truth data, which we shared with a number of police forces. That is absolutely essential. It means that our customers—police forces—can have confidence in the software and tools that we are using, as well as the outputs.

On police forces, the analytics lead for the NPCC is the best person to ask, but, to the best of my knowledge, although wet forensics are generally compliant with the forensic regulator’s code, digital forensics are not. No police force in the United Kingdom—or in England and Wales, which make up the remit of this committee—has pursued accreditation to what is called DIG 200, which is the cell site analysis and geolocation used in 99% of the cases where digital evidence is used in the UK. Among the private sector providers, I know that four of them have secured it and another five are actively pursuing it; that is it.

Q87 Baroness Walmsley: We will now move on to equality of arms. To what extent are digital forensics well understood in the criminal justice system by lawyers, judges, the police and even juries? As you may have heard earlier, we have heard about real issues in physical forensics in terms of a lack of equality of arms between the prosecution and defence. Do you see similar issues in the digital space? Is it possible to say how often digital forensics experts are requested by defence teams?

Steve Rick: I would say that, in the majority of cases, they are. The private sector providers out there work predominantly on defence. One thing that happens, which is encouraging, is that the defence barristers or defence lawyers and the Crown Prosecution Service come together both to evaluate the body of evidence and to agree what is and is not admissible. That helps enormously.

On the balance of power, this year alone, we have probably run—I have lost count—about 20 continuous professional development events in collaboration with various police force customers around the UK. The CPS, other barrister chambers and so on are invited to those. So there is a better understanding of what is happening, but it is constantly evolving.

Baroness Walmsley: What about juries? We heard something rather concerning—that the summary of the evidence, with one or two pages maybe summarising 20 or 30 pages, is written by non-specialists and that that is what the juries get. Is that a problem?

Steve Rick: I can only speak for our niche. I must emphasise that the analysis of call data records and geolocation services is still a niche. Importantly, our software generates what are called fast-time reports, which are put into plain English. A big part of our pursuit is to try to make them understandable for lay people, so you do not have to have a deep technical understanding.

Baroness Walmsley: I see. So it is experts producing the summary and checking this.

Steve Rick: Absolutely. We are working on some very complex cases at the moment. Everything is peer-reviewed internally. Where we have reason for doubt or reason for concern, we will draft in other specialists to review the evidence.

Baroness Walmsley: Do you check it out with ordinary people off-jury, as it were, to see whether they really understand it?

Steve Rick: You had probably better address my wife on this, but we do use friends and family. We ask, “Does this make sense?” The reality of it, though, is that we have enough people in the organisation with different skill sets who may not understand.

Baroness Walmsley: Do the other witnesses want to comment?

Jake Moore: Just to add to that, it is very niche to find digital forensics examiners and specialists who can cut through the noise to explain succinctly, in a short summary, something that is very complex to an audience who may be wide-ranging. As we will come on to later, that is potentially one of the fortes of AI, which can do such processes for individuals who need to divulge such information in that shortened way. That is why you are hearing that non-specialists are doing it; they are the ones who need to be able to explain it in that way.

Professor Sarah Morris: I agree wholeheartedly with what Steve and Jake have said, particularly with regard to the niche environment.

I worry about wider digital forensics—traditional computers and such things. As I said at the beginning in my opening remarks, I have lost many colleagues who are sole traders and who worked predominantly for the defence. They now feel that they cannot stay in the industry because they cannot afford to go for accreditation. They are struggling to get insurance for their business because they are not accredited. Legal aid rates are low. Pay is unpredictable. Obviously, that is a high risk for them as sole traders; it is also lonely, and there is no support for them.

I agree that there is better understanding but, often, when I go and talk to people about computers, they think that, because they use a computer, they understand it more than they actually do. I feel that my colleagues in other forensic disciplines do not have that trouble because people are not doing DNA analysis and such things all the time.

Q88 Lord Berkeley: One of the concerns that led the committee to go for this inquiry is the story that bad forensic science can lead to miscarriages of justice. Do you see a risk in this? What can be done about it? The area is developing so rapidly that this is an important issue to address, I think. Is there any evidence that it has led to miscarriages of justice?

Steve Rick: Could I take that first, Lord Berkeley? A number of years ago, in Denmark, 8,000-odd cases were thrown out—

Lord Berkeley: Eight thousand?

Steve Rick: About that; I cannot remember the exact date off the top of my head, but roughly 8,000 cases were thrown out because of faulty digital evidence derived largely from phones. It was in the news yesterday that the NPCC is undertaking an investigation into the Horizon scandal; it looks like a number of people are, quite rightly, going to be held to account.

Because we have gone through the rigours of accreditation, I think—I would say this, would I not?—that accreditation is the way forward. It gives you an assurance that you have a verifiable process that is repeatable. For me, there is no other option; it is a fool’s errand to think that you wing it or get away with it, or that you can bury your head in the sand and it will go away.

Lord Berkeley: Professor Morris, do you agree?

Professor Sarah Morris: I agree with the purpose of accreditation. Where there is a good, solid process, it can be helpful, but process compliance does not mean that we get the correct interpretation. In fact, in some cases, we are confusing consistency of evidence with quality of evidence. A number of cases have come to me where someone has had accreditation but it has fallen under quality review and they have looked for a different process to go through it. It is about how it is done.

Jake Moore: Rather than a misinterpretation of data to prove that someone did something, we actually have more of a risk of a miscarriage of justice if the data is not even located. This is due to the increase in encryption, which we have mentioned, as well as the dark web. That is a particular browser where users will go and use the internet but not leave any evidence behind them—not even a breadcrumb—other than the fact that they were on the dark web. Without such evidence, you remove digital forensics from the case. We were seeing that we were giving devices back and we could not prove what was on there; that is a miscarriage of justice in itself.

Q89 Baroness Willis of Summertown: That leads on to the next question, which is about training, including training in digital forensics. Are there such programmes for those people who are not experts, such as the police or lawyers? Do you feel that there is a gap here, especially since everything is moving so quickly right now? How do people keep up with the knowledge base. Do they keep up with it?

Jake Moore: From the College of Policing side of things, the answer is yes. Going back to my earlier point, police officers and staff in digital forensics units are offered multiple courses and refreshers, which are invaluable. What we are tending to see now—as opposed to when I started because I went into the police force with a mathematics degree, one module of which was on computing; to paraphrase my chief, I was more qualified than anyone in the force, hence my starting in digital forensics—is many impressive students from specific courses with a lust for helping the public and using their skills for good in the environment in which they are, they hope, destined to be.

Q90 Baroness Willis of Summertown: Professor Morris, you mentioned students coming into this area then being shocked by what they have to deal with. Do you find that the training is on the wrong foot? I mean, we have training in AI and digital, but not training in how to deal with what you are seeing.

Professor Sarah Morris: Yes; I would say that that is accurate. There is a lot of training on the art of investigation—that is, putting the cases together, using the tools and dismantling the technical—but I am not aware of anything in terms of support and dealing with it.

Baroness Willis of Summertown: Is that where you are seeing the biggest drop-off, in terms of people leaving because of that aspect of it?

Professor Sarah Morris: Yes. The majority of people I am aware of who have left are not leaving under retirement.

Q91 Lord Borwick: Is it hopeless to aspire to a magic tool that will tell you whether a piece of evidence, either picture or audio, is deepfaked?

Jake Moore: AI is a necessary evil. It is a wonderful tool, yet it can cause so many issues. To see it as a silver bullet is extremely dangerous. To see it as an extra pair of eyes or hands is fortuitous for the human using it; rather than it taking away that role, it adds to that person, in effect. It does require human validation and oversight, as always. That will be the case going forward; we do not want to release AI tools that are not perfect too quickly.

In so many areas of technology, we see tech coming out just because it is new technology. It is released into the wild without real evaluation. We need good legal frameworks around, and better regulation of, AI. If we can speed that process up in legislation and regulation, it will benefit everyone. If we can use it positively to simplify a complex report, as we said earlier, or for the initial analysis of a triaged phone, it is a great way of giving a flavour of what you are about to see—but then comes the human oversight. That is why it is a brilliant addition to where we are going with the future of technology.

Steve Rick: It is unlikely that it can be treated as a panacea or a silver bullet. Last year, I collaborated with the Police Foundation on writing a paper about the use of AI in policing. It is quite dangerous if it is used in the evidential chain. Some of the points that Jake has made are very good.

We have seen a number of police forces use AI to translate foreign languages, such as Albanian, into English. However, some of the early work has identified that Albanian gangsters do not talk in received Albanian; it is vernacular. AI learns as it goes on. You have to exercise a lot of caution. We are not folding protein here; it took DeepMind something like 12 years to get to a point where it could build the algorithms and models to make that possible.

This is something we have to treat with the utmost caution and a degree of scepticism. I would encourage healthy scepticism and challenge some of the statements that have been made, particularly by the larger tech companies. They say that they have the answer to everyone’s problems, but they do not.

Professor Sarah Morris: Going back to the deepfake issue that you brought up, in terms of identifying them, there are bad actors working—as quickly as we can in finding them—on identifying what we are doing to find them and finding ways around it. It is the same with AI plagiarism at university: students are immediately looking at a tool to find a way round it. Whatever we come up with to find a deepfake, there will be people who find alternatives as soon as it is released. It is cat and mouse; I do not think you will ever be able to do it without a human in the loop.

Q92 Lord Drayson: Building on that point, Professor Morris, what do you see as the most important areas of research to address this growing threat? Do you see any value in the creation of a national institute to co-ordinate that research most effectively?

Professor Sarah Morris: Research depends on case specifics. There is such a wide range of things that come up. Deepfakes are obviously going to be a problem, as is the wide range of evidence.

I would welcome a national institute. I work with a lot of the UK forces, most of which are reinventing the wheel. They will be working on something unaware that another force has already come up with a solution or written its own tool to do that particular thing, so national co-ordination would be useful. When the Forensic Capability Network was introduced in 2000, we had high hopes that that was where it would go, but it has ended up being rather focused on smaller projects that are not reaching those on the ground.

Lord Drayson: Can I ask you a follow-up question to make sure that I understand you fully? Are you saying that the diversity of the challenges facing modern digital forensics means that it is just not practical to say, “These are the three R&D priorities”?

Professor Sarah Morris: Given what I have seen of different forces, I would say that different forces will have different priorities depending on the types of crime and the types of devices that are coming in. In terms of research priorities, a smaller northern force is going to have different requirements to a larger force, such as the Met.

Lord Drayson: Because of the nature of the crime that is taking place.

Professor Sarah Morris: I would say so.

Lord Drayson: That is helpful. Jake Moore, what is your view on this? Is it possible to identify major research priorities, or is it just too diverse?

Jake Moore: We have to continue research—it is one of the biggest tools in our toolkit—but seeing is not believing any more. What we deal with in the security industry is a zero-trust model where, in effect, we teach people not to trust anything until they can verify it in multiple ways—such as multi-factor authentication, for example, where we continually have to verify what something is.

Lord Drayson: That is an established technique. I am trying to push you to identify this: where is the cutting-edge research needed to ensure that justice is done?

Jake Moore: Deepfakes, in particular, are one of the bigger issues that we are facing. We cannot really rely on them. Last year, for example, I was asked to carry out a test. I got hold of CCTV that I was in—I was able to get hold of that footage—and I manipulated someone else’s face on top of my face. I then presented that as a media file to the business owner with no metadata—that is, no other information underneath that video. Fifteen years ago, that would potentially have been used as evidence in a court of law that the other person was there when, actually, it was me. I manipulated it to such a level that, even by zooming in, you could not tell by eye that it was fake. Therefore, we have to have zero trust.

Lord Drayson: What is the state of the art today? Given that you are at the frontier of the state of the art, is it possible to tell whether something has been manipulated?

Jake Moore: Sometimes. The technology is improving weekly at the moment. All of the tech companies are trying to beat each other to show off their range of tools—and we are talking about only off-the-shelf tools, which are the tools that you and I could buy. When it comes to criminals, they do not care about regulation. I have been able to clone people’s voices and video. You used to be able to do it without their consent; now, with off-the-shelf tools, you require their consent to do so.

Lord Drayson: Can I ask you about this national institute? Would that be of value? Should one be created to provide the clear priorities for research—for example, to tackle deepfakes?

Jake Moore: I cannot see how it would benefit that much immediately. You may need to ask the others about that.

The Chair: We need to move on quite quickly, I am afraid.

Jake Moore: Then the short answer is no.

The Chair: Steve, do you have anything to add about research priorities?

Steve Rick: Only that creating a national institute is bound to get bogged down in bureaucracy; having it dispersed is invaluable.

The Chair: We just have a few more minutes left. I turn to Baroness Neville-Jones.

Baroness Neville-Jones: You can move on to the next question.

Q93 The Chair: Okay. In that case, the last question is, I think, a simple one. We will make recommendations to the Government when we report on this inquiry. What would each of you say is the single top-priority recommendation that we should make? Can you give us one each?

Professor Sarah Morris: Better mental health support for practitioners.

Steve Rick: Enable law enforcement to adopt national models, such as Operation Atlas, using digital forensics capability with defined published league tables and KPIs.

Jake Moore: You are probably expecting this. Provide much more investment across all forces. For example, when they require funding for extra storage space, offer that funding immediately.

The Chair: I thank all three of you. You have answered many of our questions. This has been very informative, and we are very grateful. Thank you very much. That concludes today’s public session.