Last month’s column made a case, in a post-Riley world, for a three-pronged approach to mobile device searches incident to arrest: policy, technology, and training.
Arguably, neither policy nor technology would be as effective without the proper training to support them. In other words, training ensures that officers appropriately use technology, and provides the right measuring stick with which to apply policy.
A recent case, Rhode Island v. Patino (2012), demonstrates how important at least a basic level of training is for first responders and investigators alike. In that case, mobile device evidence was suppressed because officers failed to properly preserve evidence—either at the scene or back at the station—and failed also to document their actions. They used what they illegally obtained to coax a confession from their suspect.
Good digital evidence handling training isn’t just a checklist of best practices. It trains the professional, not just the tools that s/he uses. The Riley decision made clear that officers need the knowledge to make quick decisions on how to handle a search incident to arrest. What kinds of decisions?
Methods of preserving mobile device evidence
Scenario-based training has proven useful in helping officers learn how to think critically in a variety of situations. Good training incorporates scenarios, helping you to understand and use your judgment to determine:
- How to prioritize digital evidence among a wider array of evidence at physical crime scenes.
- The many differences in mobile device platforms, operating systems, chipsets, security, and other issues that might affect how you protect devices from being remotely wiped or otherwise altered.
- The different methods you can use to preserve evidence, from Faraday containers or bags to seizing data via forensic extraction without searching it.
How to effectively document your actions
Training should help you understand how to document each action you take, including (but not necessarily limited to):
- Different types of documentation—written descriptions, photo, and/or video—about the device’s physical characteristics, which could include its physical position relative to other evidence at a crime scene, the condition it’s in, and the existence of any potential evidence on—not just in—the device.
- Many investigations nowadays involve more than one device, and training should detail how to identify, bag, and tag them, as well as documentation related to chain of custody of each device you find and/or seize.
- Documentation might also include passwords for the device(s) and any apps, including encryption if applicable.
- What you do to preserve evidence on one or more of the devices, and why you chose that particular method.
Also important is training on the best way to obtain and document legal authority. Whether you seek consent or a warrant, or some exception to the search warrant requirement applies, you need to be able to articulate why the device is a nexus to a crime, and why you believe evidence of that crime exists on that device.
Training is also valuable when it helps you take the right approach to secure a subject’s written consent, including the appropriate use of forms.
Some training can help you understand how to customize an otherwise boilerplate search warrant and affidavit. Static boilerplates that you never change are unwise to use. The data you collect is too dependent on the case you’re investigating, and you’d want neither to miss evidence nor to collect too much. Knowing how to customize for the situation is key to success.
Developing in-service or roll-call training on mobile evidence issues
Localized training is important for those situations that outside vendors cannot cover in depth, including:
- Procedures in your jurisdiction for obtaining search warrants, including the use of electronic or telephonic warrant systems, if applicable.
- Process for relying upon your forensic lab, either when escalating evidence to the next level or submitting everything to specialists.
Field training officers, too, should be prepared to help new officers understand how to make decisions regarding digital evidence, backing up—and not undermining—what new officers learn in academies or from vendors.
Work with prosecutors, supervisory and command staff to identify the vendor training that will work for your agency and the tools you have, as well as to develop in-service training on what to do and when to do it.
As columnist Kevin Davis pointed out a few weeks ago, minimum training doesn’t create competence. This is just as true for digital evidence handling – whether you are a first responder or a forensic examiner – as it is for other tools and tactics. Regardless of your level of responsibility for digital evidence, training needs to prepare you to make defensible decisions about that evidence.
Remember, mobile device searches can get you valuable “low hanging fruit” evidence for most, if not all, offenses. That’s why it’s worth taking the time to become properly trained and practiced in all the different facets of seizing and searching mobile device evidence.
Davis wrote that competence breeds confidence. An officer who lacks it risks either making the wrong decisions, as in the Patino case, or ignoring the evidence altogether. The stakes for the officer may not be as high as in the lethal force situations Davis focused on, but the stakes for the victim and suspect(s) are—and that raises the stakes for you and your agency.
